7021
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
7022
Unsolicited messages on Keybase
What is Keybase? Keybase ( keybase.io ) is a platform designed to help users send and receive encrypted communications as well as secu...
7023
Very Good Security
“Never answer an anonymous letter” —Yogi Berra Did you ever wonder why doctor offices ask for your social security number? They don’t want to keep your SSN, but it’s the primary “key” that identifies you to an insurance company. In computer science/math terms, they need to call a function. Let’s call it: int…
7024
7025
Stealing Facebook access_tokens using CSRF in device login flow
I enjoy breaking websites.
7026
7027
7028
Multiple vulnerabilities in WP Fastest Cache plugin
We uncovered multiple vulnerabilities in WP Fastest Cache plugin that could grant attackers access to your privileged information. We strongly recommend that you update to the latest version of the plugin and have an established security solution on your site, such as Jetpack Security.
7029
Why SSD Drives Destroy Court Evidence, and What Can Be Done About It (2012)
Why SSD Drives Destroy Court Evidence, and What Can Be Done About It: Explore the challenges posed by SSD drives in preserving court evidence and discover strategies to mitigate data loss risks.
7030
I'm giving up on HPKP
HTTP Public Key Pinning is a very powerful standard that allows a host to instruct a browser to only accept certain public keys when communicating with it for a given period of time. Whilst HPKP can offer a lot of protection, it can also cause a lot of harm too.
7031
“Why do you work in security instead of something more lasting?”
This post grew out of a friend on Facebook asking (I paraphrase) "why do you spend your time on security instead of using your brainpower f...
7032
7033
Malware in the browser: how you might get hacked by a Chrome extension
A case study of a Chrome extension that turned out to be some nasty botnet malware.
7034
VPN services blocked in Sri Lanka as information controls tighten
Internet providers in Sri Lanka are in the vanguard of blocking access to digital security tools that allow users to work around censorship, according to new NetBlocks network measurement data. ...
7035
UEFI Secure Boot on the Raspberry Pi
UPDATE: this post unexpectedly ended up on Hacker News and I received a lot of comments. The two most important points being made are (1) that Secure Boot on the RPi as …
7036
Fighting cryptojacking and doing good things with content security policies
If you've landed on this page because you saw a strange message on a completely different website then followed a link to here, drop a note to the site owner and let them know what happened. If, on the other hand, you're on this page because you're
7037
The NSA is not made of magic (2014)
I am regularly asked what is the most surprising thing about the Snowden NSA documents. It’s this: the NSA is not made of magic. Its tools are no different from what we have in our world, it’s just better-funded. X-KEYSCORE is Bro plus memory. FOXACID is Metasploit with a budget. QUANTUM is AirPwn with a seriously…
7038
How CDNs Generate Certificates
Say Hi to Thomas. Thomas's first weeks at Fly have been hectic, but he's been taking notes, copious notes that can teach you all about the wild world of certificate infrastructure. Read on to discover more...
7039
Where the term "Zero Day" comes from
After seeing a FOIA request earlier today that someone created asking for FBI training documents that teach staff how to understand/communicate using hacker leet-speak, I was reminded about something I’ve wanted to put in virtual ink for a while.
7040
Remote Code Execution as a Service
Learn how Earthly Compute, a remote code execution as a service, was built to handle bursty workloads and provide secure and fast remote execution ...
7041
“No-fly” trial: Closing arguments
Judge William Alsup convened day five of the trial in Ibrahim v. DHS — the first lawsuit challenging a U.S. government “no-fly” order to make it to trial — on Friday morning with the announcement that, “I received this additional material about the [plaintiff’s] daughter and her attempts to come here.”
7042
Breaking the Zyzzyva encryption
The article here sums up pretty well the debacle that North American tournament Scrabble players have been faced with since the…
7043
Reverse Engineering the Comtech AHA363 PCIe Gzip Accelerator Board
All this work was done in November last year. I haven’t worked on it since, but others have shown interest in picking this up, so it’s about time this gets thrown out in the open.
7044
Implant.ARM.iLOBleed.a
HP servers provide a management module called iLO (a.k.a. Integrated Lights-Out), which turns on as soon as the power cable is connected, loading a full-blown proprietary operating system. This module has full access to all the firmware, hardware, software, and operating system installed on the server. In addition to…
7045
How 4chan hacked ReCAPTCHA to win the TIME 100 Poll
This morning Time.com published the final result for their annual TIME 100 Poll. Time reports that the new owner of the title ‘Worlds’s most influential person, is moot’. What T…
7046
Sinkholed: A DNS Horror Story (2019)
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
7047
7048
Chromecast: Exploiting the Newest Device By Google
On Wednesday, July 24th Google launched the Chromecast. As soon as the source code hit we began our audit. Within a short period of time we had multiple items to look at for when our devices arrived. Then we received our Chromecasts the following day and were able to confirm that one of the bugs existed in the build…
7049
7050
