421
SQLite does not do checksums
SQLite does not do checksums by default. Disk corruptions go silently unnoticed.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 536 posts.
422
The browser's biggest TLS mistake
Much like a previous talk of mine at Chaos Computer Congress this blog post is a direct write-up of a talk, if you prefer to consume this kind of content in video form you can watch the video here:
423
Progressive Web Apps (PWAs) Phishing
Providing security research and red team techniques
424
YARA is dead, long live YARA-X
For over 15 years, YARA has been growing and evolving until it became an indispensable tool in every malware researcher’s toolbox.
425
Security Is a Useless Controls Problem
We're all a bunch of chimps in a cage
426
Security and privacy risks of public JavaScript CDNs
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
427
Mintlify GitHub read/write token leak
Edit March 18, 2024 10:20 AM
428
Preventing app removal on iOS
These days, I am developing an alarm app called ‘SuperAlarm’. To ensure a user is awake, SuperAlarm can be turned off only after a user completes a mission(e.g., taking a picture...
429
430
Anti-Cheat Expert: all your pixels are belong to us
a blog about exploring reverse engineering, hypervisor development and software programming.
431
U.S. border surveillance towers have always been broken
A new bombshell scoop from NBC News revealed an internal U.S. Border Patrol memo claiming that 30 percent of camera towers that compose the agency's "Remote Video Surveillance System" (RVSS) program are broken. Except, this isn't a bombshell. What should actually be shocking is that Congressional leaders are acting…
432
Hacking eInk Price Tags (2021)
Dmitry.GR: Wireless picture frames that run for years on batteries
433
Simple ways to find exposed sensitive information
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
434
435
Hacking cars in JavaScript (Replay attacks in the browser with the HackRF)
Collection of side projects, conference talks and blog posts experimenting with frontend technologies and human-computer interaction
436
Privacy focused platform Skiff is joining Notion, Skiff to be sunset
Our co-founder Akshay talks to Skiff co-founders Andrew Milich and Jason Ginsberg about their startup's vision and journey to Notion.
437
Technical Details on Today's Outage
Learn more about the technical details around the Falcon update for Windows hosts.
438
Nobody Cares About Security
Nobody cares about security. There. I said it. I said the thing everyone feels, some people think, but very few have the temerity to say out loud. But before you call me...
439
Personal Mail Server on OpenBSD (2019)
I will use this place to relate my geeky adventures in the world of gnu/linux, bsd, the internets, and other important things like windows managers and pretty colors. Basically, it's a place to expose and share with the world things I do on my computer.
440
Firewalling your code
When writing code, you can call any function as long as it’s public, and similarly, you can access any object’s public properties or methods. Usually, access to code is all or none – a piece of code can be either public or private. Lately, I’ve been thinking about ways to implement more fine-grained access controls…
441
442
Reversing for dummies – x86 assembly and C code (Beginner/ADHD friendly)
Before I got into reverse engineering, executables always seemed like black magic to me. I always wondered how stuff worked under the hood, and how binary code is represented inside .exe files, and how hard it is to modify this ‘compiled code’ without access to the original source code.
443
Is regulated BGP security coming?
What impact would regulating BGP routing security have on the global Internet?
444
Anatomy of a cryptocurrency scam
You receive a message. Now either you will be victim or not. Your knowledge, attention and moral compass will decide where you will end up.
445
Deluge of Fake Mac App Store Reviews
Yesterday I discovered a deluge of recent fake customer reviews for a number of top paid apps in the United States Mac App Store. (Each country has its own version of the App Store with separate reviews.) I've now checked the reviews for all of the current top 40 paid apps in the Mac App Store, and 8 of those apps…
446
Security flaws in an SSO plugin for Caddy (2023)
We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources. During our evaluation, Caddy was deployed as a…
447
BIMI and DMARC Can't Save You: The Overlooked DKIM Exploit
Analysts at Zone.eu, one the leading domain registrars and web hosting providers in Europe, have observed a vulnerability affecting the global e-mail ecosystem, stemming from unaddressed warnings in the DomainKeys Identified Mail (DKIM) standard that puts billions of users in risk. This is not an issue in a particular…
448
Someone was breaking into Orange Spain RIPE account (and break their /12)
Ah. Orange Spain has had their /12 (and likely others) broken by (what appears to be) someone breaking into their RIPE account and making RPKI ROA's to somewher...
449
GhostRace: Exploiting and mitigating speculative race conditions
Exploiting and Mitigating Speculative Race Conditions GhostRace: CVE-2024-2193 Race conditions arise when multiple threads attempt to access a shared resource without proper synchronization, often leading to vulnerabilities such as concurrent use-after-free. To mitigate their occurrence, operating systems rely on…
450
Early Cascade Injection: From Windows process creation to stealthy injection
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.