3301
Code execution through email: How I used Claude to hack itself
This is the story of how I used a Gmail message to trigger code execution through Claude Desktop, and how Claude itself (!) helped me plan the attack.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
3302
TPP Threatens Security and Safety by Locking Down US Policy on Source Code Audit
Multiple recent reports on serious security vulnerabilities in cable modems and routers paint a dire picture of the state of security of the devices that millions of users depend upon to connect to the Internet. Such vulnerabilities can be exploited to disable our access, snoop on our personal...
3303
PHP Core Security Audit Results
The PHP Foundation — Supporting, Advancing, and Developing the PHP Language
3304
3305
Azure's Weakest Link? How API Connections Spill Secrets
Binary Security found the undocumented APIs for Azure API Connections. In this post we examine the inner workings of the Connections allowing us to escalate privileges and read secrets in backend resources for services ranging from Key Vaults, Storage Blobs, Defender ATP, to Enterprise Jira and SalesForce servers.
3306
Monzo: How our security team handle secrets
We recently designed a new system to manage secret information safely – from the keys that we use to sign your Mastercard transactions, to credentials for external services.
3307
Google, the Wassenaar arrangement, and vulnerability research
Posted by Neil Martin, Export Compliance Counsel, Google Legal Tim Willis, Hacker Philanthropist, Chrome Security Team Cross-posted on...
3308
Restrict Access to your internal websites on AWS with BeyondCorp
Discover how BeyondCorp assists in securely restricting access to internal websites, ensuring organizational data remains protected.
3309
Get Ready for New SameSite=None; Secure Cookie Settings
UPDATE (10/28/2019): We've revised the 2nd and 3rd bullet points in the section "How to Prepare; Known Complexities" below. In May, Chrome ...
3310
H.R.1981, the end of online privacy as we know it.
Space Cybersecurity has become a prominent topic in the news, particularly when it comes to protecting space-related assets and technologies.
3311
3312
Reversing Go Binaries Like a Pro
GO binaries are weird, or at least, that is where this all started out. While delving into some Linux malware named Rex, I came to the realization that I might need to understand more than I wanted to
3313
Exploiting a heap overflow in the FreeBSD wi-fi stack
In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. This bug was originally reported to the ZDI program by a researcher known as m00nbsd and patched in
3314
3315
PyPI has completed its first security audit
We are proud to announce PyPI's first external security audit.
3316
An Open Letter From Internet Engineers to the Senate Judiciary Committee
(Update: we've added a few engineers who asked to sign on right as the letter was going out; the final count is 96 signatures) Today, 87 prominent Internet engineers sent a joint letter the US Senate Judiciary Committee, declaring their opposition to the "Combating Online Infringement and...
3317
Introducing FuzzDB
FuzzDB is an open source database of attack patterns, predictable resource names, regex patterns for identifying interesting server responses, and documentation resources. It's most often used testing the security of ...
3318
3319
Disinformation-for-hire in Kenya
Mozilla Fellows Odanga Madung and Brian Obilo reveal that Kenyan journalists, judges, and other members of civil society are facing coordinated disinformation campaigns on Twitter — and the site is doing very little to stop it.
3320
9M Australians affected by Optus data breach
Optus notifies customers of a cyberattack that has allowed unauthorised access to customers personal information.
3321
3322
Dangerous bug in Chrome’s ‘New Tab’ page bypassed security features
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
3323
3324
Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet
Exploiting the Tesla Wall Connector from its charge port connector -
3325
Improved Authentication for Email Encryption and Security
Today, we are happy to become the first and only secure email service to support Secure Remote Password (SRP), a much more secure authentication method.
3326
Dear Search Guard Users
We’ve filed a lawsuit against the makers of Search Guard. Here is what we know, the actions we’re taking, and potential impact to Search Guard users.
3327
FIDO2 security key company publishes results of internal security audit
This blogpost summarizes the result of a cooperation between SoloKeys and Doyensec, and was originally published on SoloKeys blog by Emanuele Cesena. You can...
3328
3329
Security flaws caused by compiler optimizations
Learn how to optimize compilers for enterprise-wide automation, avoiding pitfalls with examples and solutions.
3330
