1021
Surveilance bill rushed through Australian parliament in 24 hours
New Australian surveillance bill enables police to hack your device, collect or delete your data, and take over your social media accounts.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
1022
I got my money back from a scammer by contacting his mom on Facebook (2016)
Personal Blog of Christian Haschek
1023
GitHub MCP exploited: Accessing private repositories via MCP
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security analyzer for detecting toxic agent flows.
1024
CircleCI trusts 8 analytics companies with your source code and API tokens
When you navigate to your project in CircleCI's UI, Javascript from eight different analytics companies gets loaded and executed in your browser.
1025
Prompt injection explained, with video, slides, and a transcript
I participated in a webinar this morning about prompt injection, organized by LangChain and hosted by Harrison Chase, with Willem Pienaar, Kojin Oshiba (Robust Intelligence), and Jonathan Cohen and Christopher …
1026
Investigating an “evil” RJ45 dongle
Reverse-engineering hardware can be difficult -- but sometimes, all you need is a comfy armchair and some Google Translate.
1027
Chat control: EU Commission presents mass surveillance plan on May 11
Next week on Wednesday (May 11), the EU Commission will present an EU draft law on mandatory chat control to the public for the first time. Similar to Apple's highly controversial "SpyPhone" plans, the Commission wants to oblige all providers of email, chat and messaging services to search for susp
1028
Apple AirTags draining battery of devices close by
If you have AirTags in the vicinity of your iPad it drains its battery for no reason. The past months I’ve been wondering why my iPad Pro always needed to be recharged when I used to use it without charging for weeks. I’m not the only one…
1029
1030
1031
6-Day and IP Address Certificates Are Generally Available
Update: March 11, 2026 If you use Certbot, see Six-Day and IP Address Certificates Available in Certbot for details on requesting these certificates. Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a…
1032
How we hacked McKinsey's AI platform
An autonomous AI agent found a SQL injection in McKinsey's Lilli AI platform. What it extracted was worse than we expected.
1033
Tech companies shouldn't be bullied into doing surveillance
The Secretary of Defense has given an ultimatum to the artificial intelligence company Anthropic in an attempt to bully them into making their technology available to the U.S. military without any restrictions for their use. Anthropic should stick by their principles and refuse to allow their...
1034
Open Whisper Systems partners with WhatsApp to provide end-to-end encryption
At Open Whisper Systems, our goal is to make private communication simple. For the past three years, we’ve been developing a modern, open source, strong encryption protocol for asynchronous messaging systems, designed to make seamless end-to-end encrypted messaging possible. Today we’re excited ...
1035
Deleting any Facebook album
What if your photos get deleted without your knowledge? That would be pretty upsetting, wouldn’t it? This post is about a vulnerability I found that allowed malicious users to delete any photo album on Facebook. Any photo album owned by a user, a page, or a group could be deleted. Graph API is the primary […]
1036
Pressing YubiKeys
If you work in tech, you probably have a YubiKey. I have this one, the YubiKey 5C Nano:
1037
How Verizon and Turn Defeat Browser Privacy Protections
Update 2014-01-16: Turn announced today they will suspend their zombie cookie program by early February, but left open the possibility to resume in the future. We ask that they end the program permanently.Verizon advertising partner Turn has been caught using Verizon Wireless's UIDH tracking header...
1038
Critical Bluetooth vulnerability in Android
On November 3rd, 2019, we have reported a critical vulnerability affecting the Android Bluetooth subsystem. This vulnerability has been assigned CVE-2020-0022 and was now patched in the latest security patch from February 2020. The security impact is as follows:
1039
What went wrong inside recalled Anker PowerCore 10000 power banks?
Investigate Anker’s recalled power banks. See how CT scanning uncovers battery defects and improves safety in lithium-ion designs.
1040
1041
Adobe Spyware Reveals Again the Price of DRM: Your Privacy and Security
The publishing world may finally be facing its “rootkit scandal.” Two independent reports claim that Adobe’s e-book software, “Digital Editions,” logs every document readers add to their local “library,” tracks what happens with those files, and then sends those logs back to the mother-ship, over...
1042
Writing Safe Shell Scripts (2019)
This page was migrated from the old website and has not been manually reviewed, or is here for historical purposes. We make no guarantees that the content is up-to-date or reflects SIPB's current views. Contact sipb-www@mit.edu if anything is broken or you have other questions or feedback.
1043
GoodWill ransomware forces victims to donate to the poor
Goodwill ransomware group propagates very unusual demands in exchange for the decryption key. The Robin Hood-like group is forcing its Victims to donate to the poor and provides financial assistance to the patients in need.
1044
Google’s OAuth login doesn’t protect against purchasing a failed startup domain
Millions of Americans can have their data stolen right now because of a deficiency in Google’s “Sign in with Google” authentication flow. If you’ve worked for a startup in the past - especially one that has since shut down - you might be vulnerable.
1045
How did Facebook intercept their competitor's encrypted mobile app traffic?
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
1046
Let's Encrypt now fully supports IPv6
Let’s Encrypt is happy to announce full support for IPv6. As IPv4 address space is exhausted, more and more people are deploying services that are only reachable via IPv6. Adding full support for IPv6 allows us to serve more people and organizations, which is important if we’re going to encrypt the entire Web. IPv6 is…
1047
Glibc getaddrinfo stack-based buffer overflow
Posted by Fermin J. Serna, Staff Security Engineer and Kevin Stadmeyer, Technical Program Manager Have you ever been deep in the mines of ...
1048
Intel Issues Updates to Protect Systems from Security Exploits
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
1049
1050
The Original Cookie specification from 1997 was GDPR compliant (2019)
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month