7891
ACLU: ICE and CBP Are Secretly Tracking Us Using Stingrays. We’re Suing
The public has a right to know if and how often ICE and CBP are using Stingrays.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,773 posts.
7892
7893
Rackspace passwords are visible to customer service
I just had a very disturbing conversation with a Rackspace Cloud CSR. It went something like this: CSR: Can I have your account user name a...
7894
7895
7896
Do Evil with ESP8266: Slow Down the WiFi
While hackers do good most of the time, we occasionally do evil and play a prank. The ESP8266, unlike JSON , allows me to do evil. Thus, I programmed the microcontroller for an evil purpose: slow down the WiFi.
7897
Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE
It was yet another day at the office. Our team was internally discussing moving to a different platform analytics solution. Our team was really leaning more towards Posthog. It’s one of the brilliant -I personally believe it’s the best- products on the market. And that’s where the story has begun… We have a somewhat…
7898
7899
ComputerCOP: Dubious 'Internet Safety Software' Police Distributed to Families
[caption]ComputerCOP in Maricopa County, Arizona[/caption] For years, local law enforcement agencies around the country have told parents that installing ComputerCOP software is the “first step” in protecting their children online. Police chiefs, sheriffs, and district attorneys have handed out...
7900
“Stylish” is back, and you still shouldn't use it
2 days after I published ‘“Stylish” browser extension steals all your internet history’, Stylish was pulled from the Chrome and Firefox stores. The story echoed around parts of the internet for a few days, my name was misspelled on several right-wing British news websites, and I felt that I’d helped make the world a…
7901
PSA: Internet Archive "glitch" deletes years of user data and accounts
Recently at Internet Archive a “glitch” (their choice of word) deleted a great many accounts, including my account that had been at archive.org/details/@ging...
7902
Affiliates flock to scam gambling machine
Last month, KrebsOnSecurity tracked the sudden emergence of hundreds of polished online gaming and wagering websites that lure people with free credits and eventually abscond with any cryptocurrency funds deposited by players. We’ve since learned that these scam gambling sites have proliferated thanks to a new Russian…
7903
How Cybercriminals Profit by Tapping Your Email
A few days ago I came across the CBC story on how a Canadian man had been defrauded out of $800,000 when cybercriminals inserted themselves into a real estate deal and had the funds diverted to themselves: Here is the "Whois" record for the fake domain used to send the…
7904
Design Patterns for Securing LLM Agents Against Prompt Injections
This new paper by 11 authors from organizations including IBM, Invariant Labs, ETH Zurich, Google and Microsoft is an excellent addition to the literature on prompt injection and LLM security. …
7905
Fingerprinting Firefox users with cached intermediate CA certificates
Fingerprinting Firefox users with cached intermediate CA certificates (#fiprinca) ...
7906
Faking Bluetooth LE
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
7907
OSX.Pirrit Mac Adware Part III: The DaVinci Code
Discover expert insights on the latest cybersecurity trends, challenges, and best practices shaping the industry today.
7908
7909
Reverse-Engineering Claude Web's MicroVM: Uncovering Anthropic's Hidden Antspace
Full stack developer, open sourceror, serial entrepreneur.
7910
macOS code injection for fun and no profit (2024)
Fun little vacation project for fun and zero profit.
7911
A new Cloudflare Web Application Firewall
Today we are announcing a new Cloudflare Web Application Firewall for all Cloudflare paid zone customers.
7912
Break a dozen secret keys, get a million more for free
[An in-depth blog post by Daniel J. Bernstein, crossposted between the ECRYPT blog and the cr.yp.to blog .]
7913
TLS Symmetric Crypto
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
7914
Front-End Performance: The Dark Side
The latest news about Opera web browsers, tech trends, internet tips.
7915
7916
XSS in Gmail through Rapportive
A blog on security, malware, cryptography, pentesting, javascript, php and whatnots
7917
LTrack: Stealthy Tracking of Mobile Phones in LTE
Martin Kotuliak, Simon Erni, Patrick Leu, Marc Röschlin, and Srdjan Čapkun, ETH Zurich
7918
The search for a perfect access control system
Making sense of authorization, policy and access management systems.
7919
Uncovering 2017’s Largest Malvertising Operation
The Zirconium group successfully created and operated 28 fake ad agencies to distribute malvertising campaigns through 2017, buying an estimate of 1 billion ad views throughout the year, and reaching
7920
Automating cookie consent and GDPR violation detection
The European Union's General Data Protection Regulation (GDPR) requires websites to inform users about personal data collection and request consent for cookies. Yet the majority of websites do not give users any choices, and others attempt to deceive them into accepting all cookies. We document the severity of this…