3931
Comcast uses MITM JavaScript injection to serve account related information
For years, Comcast and other large telecommunication companies around the world have injected javascript into your web browsing experience to serve
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
3932
Facebook exploit – Confirm website visitor identities
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
3933
The CIA's “Development Tradecraft Do's and Dont's”
Useful best practices for malware writers, courtesy of the CIA. Seems like a lot of good advice. General: DO obfuscate or encrypt all strings and configuration data that directly relate to tool functionality. Consideration should be made to also only de-obfuscating strings in-memory at the moment the data is needed…
3934
3935
PyPI now supports digital attestations
Announcing support for PEP 740 on the Python Package Index
3936
3937
3938
Security Keys
Security Keys are (generally) USB-connected hardware fobs that are capable of key generation and oracle signing. Websites can “enroll” a security key by asking it to generate a public key bound to an “appId” (which is limited by the browser based on the site's origin). Later, when a user wants to log in, the website…
3939
3940
3941
Firefox 143 for Android to introduce DoH
All web browsing starts with a DNS query to find the IP address for the desired service or website. For much of the internet’s history, this query is sen
3942
3943
Most laser printer printed pages have tracking watermark
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><a href="http://brahmsyellowdots.blogspot.com/2008/10/it-begins.html">About This Blog</a>
3944
3945
Better-performing “25519” elliptic-curve cryptography
Automated reasoning and optimizations specific to CPU microarchitectures improve both performance and assurance of correct implementation.
3946
Tor's Fall Harvest: The Next Generation of Onion Services
We are hyped to present the next generation of onion services! We've been working on this project non-stop for the past 4 years and we officially launched it two weeks ago by publishing our first alpha releases. All in all, the new system is a well needed improvement that fixes many shortcomings of the old design, and…
3947
We want Texans to know their rights
Last May, EFF reported that a sheriff’s office in Texas searched data from more than 83,000 automated license plate reader (ALPR) cameras to track down a woman suspected of self-managing an abortion. ALPRs are promoted as tools for keeping communities safe by finding missing persons and locating...
3948
3949
How to harden GitHub Actions
Build resilient GitHub Actions workflows with insights from real attacks, missteps to avoid, and security tips GitHub’s docs don’t fully cover.
3950
When coding style survives compilation: De-anonymizing programmers from binaries
In a recent paper, we showed that coding style is present in source code and can be used to de-anonymize programmers. But what if only compiled binaries are available, rather than source code? Today we are releasing a new paper showing that coding style can survive compilation. Consequently, we can utilize these…
3951
Analysis and Exploitation of a Linux Kernel Vulnerability
FortiMail Workspace Security secures user-facing apps from advanced threats that target Email, Browsers, Collaboration Tools and Cloud Storage Apps.
3952
Cyberespionage Using SS7 via Circles
Circles is a surveillance firm that reportedly exploits weaknesses in the global mobile phone system to snoop on calls, texts, and the location of phones around the globe, and is affiliated with NSO Group, which develops the oft-abused Pegasus spyware. Using Internet scanning, we found a unique signature associated…
3953
How to request removal of your contact info from Google search results
A new tool in Google Search can help you easily control whether your personally-identifiable information can be found in Search results.
3954
Shutting Down the BGP Hijack Factory
Oracle Blog
3955
Total security in a PostgreSQL database
The technologies used to build or run their apps
3956
Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
3957
Hacking the Nintendo DSi Browser
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
3958
Attacking Merkle Trees with a second preimage attack
Hacking, hardware, software, and general curiosities of computing machinery! Docendo discumus.
3959
PiFex: JTAG Hacking with a Raspberry Pi
With this blog post, we'll introduce the PiFex, a basic companion board for the Raspberry Pi designed to teach users the basics of hardware hacking and embedded protocols. We will then demonstrate how to use the PiFex to access a JTAG tap on an undocumented SSD, allowing memory reads and GDB access to the SSD CPU.
3960
Passwordless: a different kind of hell?
It's no secret that authenticating into services is an unresolved topic. With time, we have managed