2401
How Go mitigates supply chain attacks
Go tooling and design help mitigate supply chain attacks at various stages.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
2402
2403
Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it
This week we released our authorisation flow making it possible for you to go from building apps that talk to your bank account, to building apps that can talk to any bank account. This is huge. Check out this SMS bot (how on trend) I hacked up yesterday morning. (and don’t forget to join the beta wait list ).
2404
Fake recruiter lured aerospace employee with trojanized coding challenge
ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.
2405
2406
The State of Software Security in 2019
My goal in this post is to skim my observations on the state of software design and development over the past year, and to try to find a meaningful way forward for myself for 2019. My perspective is limited by the fact that I have worked exclusively in client-side software security for the past 7.5 years. Still, I…
2407
Belarus finally bans Tor
Country: Belarus Probed ISPs: Beltelecom (AS 6697) Censorship method: TCP injections We have recently heard of network anomalies in Belarus. Tor has been finally blocked in December 2016, although it had been explicitly declared that Tor should be blocked since February 2015. An anonymous cypherpunk has helped to…
2408
Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall
Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.
2409
How an empty S3 bucket can make your AWS bill explode
Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?
2410
2411
Hacking the largest airline and hotel rewards platform (2023)
Between March 2023 and May 2023, we identified multiple security vulnerabilities within points.com, the backend provider for a significant portion of airline and hotel rewards programs. These vulnerabilities would have enabled an attacker to access sensitive customer account information, including names, billing…
2412
Discord Desktop App RCE
A few months ago, I discovered a remote code execution issue in the Discord desktop application and I reported it via their Bug Bounty Prog...
2413
2414
2415
Instagram's URL Blackhole
While exploring the file system on a jailbroken iPhone 6s, I stumbled upon an interesting folder:
2416
Hackers Steal Phone, SMS Records for Nearly All AT&T Customers
AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people — nearly all of its customers. AT&T said it delayed disclosing the incident in response to “national security and public safety concerns,” noting that some of the records included data that…
2417
Cryptocurrency scams cost owners $7.7B in 2021, driven by DeFi-based “rug pulls”
Crypto scams were once again the largest form of crypto crime, with over $7.7 billion worth of cryptocurrency taken from victims worldwide.
2418
Users are losing out against Big Sur’s sealed System
macOS 11.2, 11.2.1 and 11.2.2 have come in quick succession. What do they tell us about how difficult it is to update Big Sur’s sealed System volume? Is this the way to go?
2419
Cloudflare loses 22% of its domains in Freenom .tk shutdown
A staggering 12.6 million domains on TLDs controlled by Freenom (.tk, .cf and .gq) have been shut down and no longer resolve, leading to a significant reduc ...
2420
2421
A Tor of the Dark Web
Tell me if you’ve been in this situation: you’re chatting about online anonymity with your wife and the other Knight-Mozilla Fellows over a pizza in Florence. A quiet-spoken stranger who had been sitting across the room walks up to your table and says “are you all here for the Tor hackathon?” You respond “why yes, yes…
2422
Dumping Memory to Bypass BitLocker on Windows 11
Memory-Dump-UEFI is a UEFI application for dumping the contents of RAM.
2423
2424
Apple’s device surveillance plan is a threat to user privacy – and press freedom
The backlash from privacy and human rights advocates to Apple's new plan this month for scanning photos on user devices to detect known child sexual abuse images has been loud and nearly unanimous. The tech raises press freedom problems, too.
2425
Google Home (in)Security
TL;DR: An undocumented API in Google home devices is easily exploitable. This command will reboot any on your local network: nmap –open -p 8008 192.168.1.0/24 | awk ‘/is up/ {print up};…
2426
2427
GrayKey iPhone unlocker poses serious security concerns
Ever since the case of the San Bernadino shooter pitted Apple against the FBI over the unlocking of an iPhone, opinions...
2428
Duplicate SSH Keys Everywhere
Back in December when I revamped the SSH banner and started collecting the fingerprint I noticed an odd behavior. It turns out that a few SSH keys are used a lot more than once. For example, the following SSH fingerprint can be found on more than 250,000 devices! dc:
2429
Blocking Visual Studio Code embedded reverse shell before it's too late
Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …
2430
Experian Sold Consumer Data to ID Theft Service
An identity theft service that sold Social Security and drivers license numbers — as well as bank account and credit card data on millions of Americans — purchased much of its data from Experian , one of the three major credit bureaus, according to a lengthy investigation by KrebsOnSecurity.