7471
Analyzing and breaking an externally encrypted HDD
Analyzing and breaking external encrypted HDD has been a “hobby” of mine for quite some time. With my colleagues Joffrey Czarny and Julien Lenoir we looked at several models in the past :
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
7472
Releasing jsfunfuzz and DOMFuzz
Today I'm releasing two fuzzers: jsfunfuzz , which tests JavaScript engines, and DOMFuzz , which tests layout and DOM APIs.
7473
0x01 – Killing Windows Kernel Mitigations
This post was made possible through hard work and determination. Do not feel frustrated if this stuff does not click immediately and remember, the source of truth will always be the source code. For us, our source code is raw assembly. That said it’s important you understand these techniques in detail because when…
7474
How to write a rootkit without really trying
We open-sourced a fault injection tool, KRF, that uses kernel-space syscall interception. You can use it today to find faulty assumptions (and resultant bugs) in your programs. Check it out! This post covers intercepting system calls from within the Linux kernel, via a plain old kernel module. We’ll go through a quick…
7475
Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43
The Sophos Blog
7476
The Resolv hack: How one compromised key printed $23M
Web3 security lessons from the Resolv hack: how a compromised key enabled a $23M exploit, what went wrong, and how DeFi protocols can prevent similar attacks.
7477
Never talk to the police
Always talk to a criminal defense attorney before you tell the police anything or consent to a search without a warrant. When I was a prosecutor, the first think I would ask when given a case was, "did he say anything?"
7478
7479
Facebook paid $4.5K for disclosure of my user account exploit
Back in 2009 I found a major security exploit on both Facebook and the than popular MySpace which exposed access to a user's personal data. I reported both data leaks to the social networks, and…
7480
I fear for the unauthenticated web
LLM and AI companies seem to all be in a race to breathe the last breath of air in every room they stumble into. This practice started with larger websites, ones that already had protection from ma...
7481
Another Conflict Between Privacy Laws and Age Authentication–Murphy v Confirm ID
This opinion is a routine ruling over TOS formation and whether disputes must go to arbitration. However, before I dig into that question, I need to note the case’s chilling implications. * * * This case involves the Adult Friend...
7482
Every Model Cheats
This post presents a controlled prompt-ablation study: 23 tasks, three prompt conditions, 1,518 individually audited traces, and a simple question: can you prompt away cheating?
7483
7484
Time-lock encryption
How do you encrypt a file such that it can be decrypted after a date, but not before? Use serial computations for proof-of-work using successive squaring, chained hashes, or witness encryption on blockchains.
7485
7486
Chrome client “variations” can be used to identify you (2020)
Until now I used Chrome with a few settings tweak like disabling sending usage statistics, uBlock origin, no crash reports and so on.
7487
Google Docs Users Targeted by Phishing Scam
Broadcom Community - VMTN, Mainframe, Symantec, Carbon Black
7488
What's the risk from fake Yubikeys?
I found this on a security-related Slack (shared with permission). It launched an entertaining discussion about the risks of taking a potentially fake FIDO token. We all know the risks of taking a free USB drive and shoving it in our computer, right? USB sticks can install software, act as a keylogger, transmit data…
7489
Body found in Canada identified as neo-nazi spam king
The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of Davis Wolfgang Hawke , a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports.
7490
7491
Google Calendar Event Injection with MailSniper (2017)
Beau Bullock & Michael Felch // Source: https://chrome.google.com/webstore/detail/google-calendar-by-google/gmbgaklkmjakoegficnlkhebmhkjfich Overview Google Calendar is one of the many features provided to those who sign up for a Google account along with other popular […]
7492
Oracle deprecating Java applets in Java 9
The Java programming language is one of the most popular languages today. Stay up to date with news, certifications, free learning resources, Java Magazine, events and much more
7493
Who Does Skype Let Spy?
Lately I’ve been thinking a lot about power and the Internet, and what I call the feudal model of IT security that is becoming more and more pervasive. Basically, between cloud services and locked-down end-user devices, we have less control and visibility over our security—and have no point but to trust those in power…
7494
The Federal HTTPS-Only Standard: Necessary and Overdue
The White House Office of Management and Budget has published a new standard recommending full HTTPS on all federal web sites and web services. They are accepting public comments until April 14; if you care about privacy and security, you should weigh in.This post is our public comment: we whole-...
7495
Containers and Docker: how secure are they?
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
7496
Tarsnap exploit bounty
Most bugs are straightforward, but occasionally one comes up which is not so clear in its impact. Such is the case with a bug which is fixed in tarsnap 1.0.36 . This bug causes the NUL string termination byte to overflow the heap-allocated buffer used for paths of objects examined as tarsnap traverses a directory…
7497
Anti-Interdiction on the Librem 5 USA
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
7498
7499
Poor man's VPN via ssh socks proxy
Redpill Linpro Tech Blog
7500
Breaking 256-Bit Elliptic Curve Encryption with a Quantum Computer
Researchers have calculated the quantum computer size necessary to break 256-bit elliptic curve public-key cryptography: Finally, we calculate the number of physical qubits required to break the 256-bit elliptic curve encryption of keys in the Bitcoin network within the small available time frame in which it would…