5491
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
5492
Introducing the USB Stick of Death
Several months back we have been playing with different file systems on various system platforms, examining the security posture and robustness of numerous device drivers’ implementations. One of the configurations we spent some time on was the commonly used NTFS on Microsoft Windows – as the file system is rather…
5493
5494
Repairing Corrupted ZIP Files by Brute Force Scanning in C
My brother is a wonderful photographer , and took 14 gigabytes of photos at my recent graduation from Columbia, some of which I hope to post on PhotoFloat -- my web 2.0 photo gallery done right via static JSON & dynamic javascript .
5495
5496
"Unstripping" binaries: Restoring debugging information in GDB with Pwndbg
GDB loses significant functionality when debugging binaries that lack debugging symbols (also known as “stripped binaries”). Function and variable names become meaningless addresses; setting breakpoints requires tracking down relevant function addresses from an external source; and printing out structured values…
5497
Stealing everything you've ever typed on your Windows Recall PC is now possible
Recall is a new feature in Windows 11 which takes a screenshot every few seconds, runs local device OCR on it and stores the resulting text in a SQLite database. …
5498
Formal verification of the WireGuard protocol
WireGuard has undergone all sorts of formal verification, covering aspects of the cryptography, protocol, and implementation. Below details the various efforts.
5499
Jailed Just-in-Time Compilation on iOS
Saagar Jha's website.
5500
Why the CrowdStrike bug hit banks hard
Regulation-induced monocultures meet unfortunate but explicable engineering decisions.
5501
5502
5503
A Year-End Letter from our Executive Director
This letter was originally published in our 2022 annual report. The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before with excellent…
5504
Android libstagefright still exploitable
Update (2015-08-13 1:16pm CST): We’ve been in contact with Zimperium and are working with them to provide coverage for detection of this flaw through their Stagefright Detector app. They have been very responsive (more so than the affected vendor) and we plan to alert them of similar flaws we’ve recently discovered…
5505
'Impossible-to-hack' security turns out to be no security
Teammate App had a publicly exposed database and told me to stop harassing them after I emailed them about it.
5506
5507
5508
Virtual Machine Detection in the Browser (2019)
Virtual Machine (VM) detection is nothing new. Malware has been doing it for over a decade now. Over time the techniques have advanced as defenders learned new ways of avoiding VM detection. A while back a friend and I were working on a project related to exploit delivery via a web application for redteaming purposes…
5509
NY Payroll Company Vanishes with $35M
MyPayrollHR , a now defunct cloud-based payroll processing firm based in upstate New York, abruptly ceased operations this past week after stiffing employees at thousands of companies. The ongoing debacle, which allegedly involves malfeasance on the part of the payroll company’s CEO, resulted in countless people…
5510
Developing provably correct Rust code with Verus
How the Verus "program verifier", which automatically checks code against a mathematical specification of its functionality, helps increase security assurance in software projects.
5511
5512
United Airlines Bug Bounty: An experience in reporting a serious vulnerability
About six months ago, United Airlines announced their Bug Bounty program and, almost immediately, it received a ton of press. Though I initially wasn’t interested in pursuing the program (mainly due to its popularity), I decided to take a look a week or two after its launch despite being late to the party. Shortly…
5513
The sad state of SMTP encryption
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
5514
France's Government Aims to Give Itself Carte Blanche to Spy on the World
The United States makes an improper division between surveillance conducted on residents of the United States and the surveillance that is conducted with almost no restraint upon the rest of the world. This double standard has proved poisonous to the rights of Americans and non-Americans alike. In...
5515
64 bits ought to be enough for anybody
How quickly can we use brute force to guess a 64-bit number? The short answer is, it all depends on what resources are available. So we’re going to examine this problem starting with the most naive approach and then expand to other techniques involving parallelization. We’ll discuss parallelization at the CPU level…
5516
Here come the encryption apps
It seems like these days I can’t eat breakfast without reading about some new encryption app that will (supposedly) revolutionize our communications — while making tyrannical regimes fa…
5517
E-Mail Leaves an Evidence Trail
If you’re going to commit an illegal act, it’s best not to discuss it in e-mail. It’s also best to Google tech instructions rather than asking someone else to do it: One new detail from the indictment, however, points to just how unsophisticated Manafort seems to have been. Here’s the relevant passage from the…
5518
Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx
Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.
5519
Fixing a Buffer Overflow in Unix v4 Like It's 1973
This blog post shows how to fix a buffer overflow in the su progam of UNIX v4
5520
