4681
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
4682
Are Your Devices Hardwired for Betrayal?
It's an interesting time to be a computer security researcher. Last week, Kaspersky Lab released a report about a new family of malware from an entity they called "The Equation Group". The report demonstrated for the first time that firmware-based attacks, previously only demonstrated in lab...
4683
Who wants to be tracked?
“We value your privacy…”, the clichéd beginning of many a privacy notice. I legitimately do value my own online privacy, and whenever I read that phrase as part of a website consent banner it sounds like lip service at best. Consent banners ostensibly exist to give users control over their data & personal privacy. Far…
4684
Windows will improve user privacy with DNS over HTTPS
Announcing and explaining our intention to support DNS over HTTPS in future versions of Windows
4685
SSH has no Host header
A dive into how we share IPs between VMs while making SSH work.
4686
Freeing My Phone from Google
Phones are so full of ads that you don’t even notice them anymore. Suggestions and notifications you didn’t ask for, tracking mechanisms you don’t even know are there, services over which you have no control. It’s absurd how much smartphones, a large extension of our private and social lives, are controlled and…
4687
VPN by Google One security assessment
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
4688
TPM GPIO fail: How bad OEM firmware ruins Intel TPM security
In this article I demonstrate a software only attack that allows an operating system to set the PCRs of a discrete TPM device to arbitrary values and unseal any secret that uses a PCR based sealing policy (such as disk encryption keys used by unattended unlock TPM FDE schemes).
4689
4690
4691
Linux kernel security work
Lots of the CVE world seems to focus on “security bugs” but I’ve found that it is not all that well known exactly how the Linux kernel security process works. I gave a talk about this back in 2023 and at other conferences since then, attempting to explain how it works, but I also thought it would be good to explain…
4692
KeePassXC 2.3.0 released
KeePassXC Password Manager
4693
Dystopian Surveillance Is Becoming a Reality
Apple recently announced an upcoming feature for their new Apple Watches called “Audio Intelligence,” which will always be listening to a...
4694
How I protect my Forgejo instance from AI web crawlers
This article describes my nginx configuration and strategy on how to prevent web crawlers from putting down my instance while still serving most people with minimal amount of friction.
4695
4696
4697
Firewall rules: not as secure as you think
A post outlining tricks for firewall privilege escalation
4698
Noyb.eu files 422 formal GDPR complaints on nerve-wrecking “Cookie Banners”
Today we filed 422 + 36 complaints on "cookie banners" with ten European Data Protection Authorities.
4699
Abusing Ubuntu 24.04 features for root privilege escalation
With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privilege escalation vulnerabilities.
4700
A cryptographically secure bootloader for RISC-V in Rust
A summary of a Codethink sponsored project which implements a cryptographically secure bootloader, written in Rust, for RISC-V.
4701
4702
4703
Faking Twitter unfurling to phish you
Do you trust links? Well, you shouldn’t. Do you trust this link: Twitter says this link should take you to Uniswap, nobody would be none-the-wiser because we…
4704
EFF’s “Spying on Students” Report Highlights Tech Companies’ Data Collection
San Francisco—School children are being spied on by tech companies through devices and software used in classrooms that often collect and store kids’ names, birth dates, browsing histories, location data, and much more—often without adequate privacy protections or the awareness and consent of...
4705
Class Breaks
There’s a concept from computer security known as a class break. It’s a particular security vulnerability that breaks not just one system, but an entire class of systems. Examples might be a vulnerability in a particular operating system that allows an attacker to take remote control of every computer that runs on…
4706
4707
The Critical Security Flaws that Resulted in Last Friday's Hack
A core value CloudFlare is that security information should be shared between organizations to make the entire Internet safer. That is how CloudFlare's systems work: if one site is attacked, data about that attack is immediately shared with the rest of the network so other sites can be safe.
4708
Hacking a Virtual Power Plant
I recently had solar panels and a battery storage system from GivEnergy installed at my house. A major selling point for me was that they have a local network API which can be used to monitor and…
4709
AlgorithmWatch shuts down Instagram monitoring after threats from Facebook
Digital platforms play an ever-increasing role in structuring and influencing public debate. Civil society watchdogs, researchers and journalists need to be able to hold them to account. But Facebook is increasingly fighting those who try. It shut down New York University’s Ad Observatory last week, and went after…
4710