6871
Further hardening glibc malloc() against single byte overflows
Introduction Back in 2014, while at Project Zero, I exploited a buffer overflow of a single NUL byte in glibc . Tavis Ormandy had found th...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
6872
6873
Security and privacy risks of public JavaScript CDNs
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
6874
6875
Blueborne – A new attack vector endangering major operating systems
Following the disclosure of the BlueBorne attack vector this past September, Armis discovered that critical Bluetooth vulnerabilities impact the Amazon Echo and Google Home.
6876
Attunity Data Leak: Vendor for half the Fortune 100 exposed terabyte of backups
Backups ensure data continuity, but they're also a surface of risk. See how Fortune 100 vendor Attunity exposed nearly a terabyte of internal backups.
6877
Siri, Privacy, and Trust
We should expect Apple to lead the industry on this front, but in fact, they’re far behind.
6878
Inverting PhotoDNA
Ribosome inverts Microsoft PhotoDNA hashes using machine learning.
6879
Constructing the Word's First JPEG XL MD5 Hash Quine
A walk through of building an image that displays its own MD5 Hash
6880
6881
Chat Control 2.0: EU set to approve end of private messaging, secure encryption
By making a minor concession EU governments hope to find a majority next week to approve the controversial „chat control“ bill. According to the proposed child sexual abuse regulation (CSAR), providers of messengers, e-mail and chat services would be forced to automatically search all private messag
6882
Mastercard Internet Gateway Service: Hashing Design Flaw
Last year I found a design error in the MD5 version of the hashing method used by Mastercard Internet Gateway Service. The flaw allows modification of transaction amount. They have awarded me with a bounty for reporting it. This year, they have switched to HMAC-SHA256, but this one also has a flaw
6883
Social engineering dos and don'ts
Another day, another success at sneaking into a building and pretending to be staff. I do so love drinking other people’s expensive office coffee. No fruit bowls though. Close, but no banana. It got me thinking, again, about what makes for good social engineering (SE), and what advice would I give my younger self…
6884
Cryptic Crossword: Amateur Crypto and Reverse Engineering
Reverse engineering is a special subgenre of computer programming. It's about the closest that I as a programmer get to being a scientist. Gather data, formulate a hypothesis, test, refine, repeat: reverse engineering is basically applying the scientific method to a very, very small knowledge domain. If you've never…
6885
Fuzzing Like It’s 1989
With 2019 a day away, let’s reflect on the past to see how we can improve. Yes, let’s take a long look back 30 years and reflect on the original fuzzing paper, An Empirical Study of the Reliability of UNIX Utilities, and its 1995 follow-up, Fuzz Revisited, by Barton P. Miller. In this blog post, […]
6886
The target=“_blank” vulnerability by example
Instagram leaves its users open to a simple phishing attack
6887
Testing Firefox Monitor, a New Security Tool
From shopping to social media, the average online user will have hundreds of accounts requiring passwords. At the same time, the number of user data breaches occurring each year continues ...
6888
Who Is Planting Backdoors in Ledger Crypto Wallets?
The theft last week of an estimated $100 million in crypto using a hardware backdoor planted in Ledger wallets points to a sophisticated and systematic attack aimed at subverting crypto wallets sold by legitimate resellers in Asia and Europe
6889
86% of CrashCrate subscribers used passwords already leaked in other breaches
A couple of months ago, I launched version 2 of Pwned Passwords [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/]. This is a collection of over half a billion passwords which have previously appeared in data breaches and the intention is that they're used as a
6890
Intel deprecates SGX on Core series processors
A newer version of this document is available. Customers should click here to go to the newest version.
6891
The browsers are probably running the TLS show now
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
6892
Updated Proton, Unified Protection
ProtonMail is now Proton! We’re more than just encrypted email — we now offer an entire privacy-focused ecosystem of services.
6893
A 96 Bitcoin ransom payment ends up on Bitfinex
"Hello, to get your data back you have to pay for the decryption tool, the price is $1,200,000... You have to make the payment in Bitcoin...
6894
6895
Every C99.php shell is backdoored
A Hacker's Blog of Unintended Use and Insomnia.
6896
6897
6898
Getting a biometric security key right
"Discover the upcoming YubiKey Bio with biometric capabilities. Enhance your security with our cutting-edge, FIDO-enabled device. Sign up for updates!
6899
Parse, Don’t Validate – Some C Safety Tips
“A good programmer is someone who looks both ways before crossing a one-way street.” – Doug Linder
6900
The mechanics of a sophisticated phishing scam and how we stopped it
Yesterday, August 8, 2022, Twilio shared that they’d been compromised by a targeted phishing attack. Around the same time as Twilio was attacked, we saw an attack with very similar characteristics also targeting Cloudflare’s employees