2521
Credit card fraud warning signs
Avoid accepting fraudulent credit card orders by paying attention to these warning signs.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
2522
Comments on the Sony Hack
I don’t have a lot to say about the Sony hack, which seems to still be ongoing. I want to highlight a few points, though. At this point, the attacks seem to be a few hackers and not the North Korean government. (My guess is that it’s not an insider, either.) That we live in the world where we aren’t sure if any given…
2523
2524
I will not log in to your website
Two or three times a day, I get an email whose basic structure is as follows: Prof. Aaronson, given your expertise, we’d be incredibly grateful for your feedback on a paper / report / gr…
2525
1k Data Breaches Later, the Disclosure Lag Is Worse
Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed? Especially considering the emergence of privacy regulations
2526
Security research on Private Cloud Compute
Private Cloud Compute (PCC) fulfills computationally intensive requests for Apple Intelligence while providing groundbreaking privacy and security protections — by bringing our industry-leading device security model into the cloud. To build public trust in our system, we’re making it possible for researchers to…
2527
I accidentally turned LLM memory into program analysis
Why I stopped trying to give LLM agents a better memory and instead built Lemmalog, a Datalog engine that maintains an agent's knowledge as analysis state, with provenance, retractions and incremental evaluation, plus what happened when I benchmarked it on LongMemEval and LoCoMo.
2528
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
2529
Obscurity Is a Valid Security Layer
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
2530
Pwn2Own Vancouver 2019: Tesla, VMWare, Microsoft, and more
Starting in 2007, Pwn2Own has evolved from a small demonstration with prizes averaging around $10,000 per exploit, to one of the most well-known security contests in the industry, with millions of dollars of cash and prizes made available to contestants over the years. The contest serves as more tha
2531
CamScanner, a malicious Android app with more than 100M downloads in Google Play
Kaspersky researchers found malware in CamScanner, a text recognition app that was downloaded more than 100 million times from Google Play.
2532
2533
2534
Hacking Github with Webkit
Previously on Github: XSS , CSRF ( My github followers are real , I gained followers using CSRF on bitbucket ), access bypass, mass assignm...
2535
Indian Government Breached, Massive Amount of Critical Vulnerabilities
A writeup detailing the vulnerability reporting process that took place after Sakura Samurai had breached the Indian Government
2536
Trackers and bank accounts
A Finnish online bank leaked out user data by using a third-party tracker script.
2537
Apple and a hacker's future
I was happy for years in Apple’s walled garden; with AI, however, their protections feel like limitations.
2538
SAML Is Insecure by Design
What is SAML? Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. Source: Wikipedia SAML is often used for single-sign on (“Sign in with Google”, “Sign in with Twitter” etc.). It means when you want to log in to example.com, example.com…
2539
Repositories held for ransom by using valid credentials
We’ve learned of suspicious Git activity on GitLab. Affected users have been notified.
2540
How Adversarial Attacks Work
Emil Mikhailov is the founder of XIX.ai [http://XIX.ai] (YC W17). Roman Trusov is a researcher at XIX.ai. Recent studies by Google Brain have shown that any machine learning classifier can be tricked to give incorrect predictions, and with a little bit of skill, you can get them to give pretty much any result you…
2541
Scream cipher
You've probably heard of stream ciphers, but what about a scream cipher 😱? Today I learned there are more “Latin capital letter A” Unicode characters than there are letters in the English alphabet....
2542
We tried to book a train ticket and ended up with a 245k records data breach
Dieser Artikel ist auch auf deutsch erschienen To celebrate Franco-German friendship, German Transport Minister Wissing and his French counterpart Beaune came up with something special: 30,000 free Interrail tickets per country for travel in Germany and France for young adults between 18 and 27. Codename: “Passe…
2543
Passkeys are now enabled by default for Google users
Google is making it even easier to get started with passkeys by offering the ability to set them up for all users — by default.
2544
Grindr to be fined almost €10M over GDPR complaint
The Norwegian Data Protection Authority confirmed that Grindr did not receive valid consent from users and announces a fine of 100 Mio NOK (€ 9.63 Mio) on Grindr.
2545
2546
Privacy is at a crossroads. Choose wisely
We already put legal limits on financial, medical, military, transportation, and agriculture technology. Why not online tracking?
2547
Can I drop a pacemaker 0day?
Can I drop a pacemaker 0day at DefCon that is capable of killing people? Computers now run our cars. It's now possible for a hacker to i...
2548
Apple Explains Mysterious iPhone 11 Location Requests
KrebsOnSecurity ran a story this week that puzzled over Apple ‘s response to inquiries about a potential privacy leak in its new iPhone 11 line, in which the devices appear to intermittently seek the user’s location even when all applications and system services are individually set never to request this data. Today…
2549
Detailed Financial Histories Exposed for Thousands
111 GB of internal customer information from National Credit Federation was left exposed in a publicly downloadable data repository. This is its story.
2550