2761
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
Learn how XBOW achieved #1 performance in autonomous penetration testing by validating real exploits and outperforming human pentesters in speed and accuracy.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
2762
Modernizing C arrays for greater memory safety: a case study in the Linux kernel
How to modernize C arrays for greater memory safety: a case-study in refactoring the Linux kernel and a look to the future Kees Cook C i...
2763
SSH: Best practices
The comments around the last OpenSSH issue ( CVE 2016-0777 , you must read excellent Qualys’ analysis if you’re interested with the details), I noticed that many people were not aware of some basic features of OpenSSH. I will attempt to give a few advises, prioritized in feasibility order, and with graphical…
2764
2765
Canadian man stuck in triangle of e-commerce fraud
A Canadian man who says he’s been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve “triangulation fraud,” which occurs when a consumer purchases something online — from a seller on Amazon or eBay , for example — but the seller doesn’t actually own…
2766
Password Requirements: Myths and Madness
Password requirements are weird. It seems impossible to set a new password in many websites. Why?
2767
Hyundai Head Unit Hacking
Standard-class Gen5 navigation
2768
An Update on the Lock Icon
Editor’s note: based on industry research (from Chrome and others), and the ubiquity of HTTPS, we will be replacing the lock icon in Chrome’...
2769
Firefox’s Test Pilot Program Returns
Like a cat, the Test Pilot program has had many lives. It originally started as an Add-on before we relaunched it three years ago. Then in January, we anno
2770
AMP for email is bad
The US antitrust complaint against Google shows that the claim 'to improve speed with AMP' was false from the start. It is simply a measure to increase ad revenue.
2771
Tor Browser: a legacy of advancing private browsing innovation
In this post, we want to share a little bit of Tor Browser history with you, the origins of our features and designs, and how many of our innovative privacy and security features have been adopted by other browsers.
2772
2773
2774
Evidence that the NSA Is Storing Voice Content, Not Just Metadata
Interesting speculation that the NSA is storing everyone’s phone calls, and not just metadata. Definitely worth reading. I expressed skepticism about this just a month ago. My assumption had always been that everyone’s compressed voice calls is just too much data to move around and store. Now, I don’t know. There’s a…
2775
USB Reverse Engineering: Down the Rabbit Hole
Thanks for the featured writeup Hackaday! Make sure to check out the comments over there as well. Looks like Hackernoon picked it up as well, make sure to check in with the comments there too. It would be great if you could also head over to Hacker News, give an upvote, and join in the comments there. Let's get this…
2776
Curl Security Audit
"the overall impression of the state of security and robustness of the cURL library was positive." I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago. This was done by Mozilla getting a 3rd party company involved to do the job and footing … Continue…
2777
Site requests bank logins for online purchases
I’ve spent a lot of time trying to educate people on being careful with credentials. It really doesn’t help when I try to place a purchase with a “legitimate” supplier, and, after handing over valid credit card details, I get this:
2778
The MongoDB hack and the importance of secure defaults
There’s a widespread attack on insecure MongoDB installs that has resulted in over 28,000 databases being held ransom. This post explains the hack, how to protect yourself and what can we learn from it.
2779
Mysterious Planes Over Baltimore Spark Surveillance Suspicions
It all started with a simple Twitter query from a Baltimore man: “Anyone know who has been flying the light plane in circles above the city for the last few nights?” This was several days after the death of Freddie Gray in police custody, and the subsequent riots and protests. Pete Cimbolic, an aviation buff and…
2780
How I Could Have Hacked Any Instagram Account
This article is about how I found a vulnerability on Instagram that allowed me to hack any Instagram account without consent permission. Facebook and Instagram security team fixed the issue and rewarded me $30000 as a part of their bounty program. Facebook is working constantly to improve its security controls on all…
2781
2782
Announcing the Windows Bounty Program
Windows 10 represents the best and newest in our strong commitment to security with world-class mitigations. One of Microsoft’s longstanding strategies toward improving software security involves investing in defensive technologies that make it difficult and costly for attackers to find, exploit and leverage…
2783
2784
2785
2786
Python malware on the rise
The vast majority of serious malware over the past 30 years has been written in Assembly or compiled languages such as C, C++, and Delphi. However,…
2787
2788
Put an io_uring on it: Exploiting the Linux kernel
How much do you know about system calls and how they introduce security risks? We shed light on these interactions and how security teams monitor them.
2789
Breaking homegrown crypto
Anubis could not load its JavaScript. The server may be overloaded. Please reload the page to try again.
2790
Popular GitHub Action tj-actions/changed-files is compromised
Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.