121
Preliminary Post Incident Review
Read the preliminary post incident report regarding the CrowdStrike Falcon content update affecting Windows hosts.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 257 posts.
122
The golden age of scammers: AI-powered phishing
AI phishing is all over the headlines and that’s not going to change. Learn about the capabilities of the dark side of gen ai, and how to defend against it.
123
124
How to delete your data from data brokers
Digital safety is public safety. We're building the knowledge, standards, and tools people need to face online harm — together.
125
Microsoft's Xandr grants GDPR rights at a rate of 0%
noyb has filed a GDPR complaint regarding transparency issues, the right of access and the use of inaccurate information about users
126
Google Distributed Cloud air-gapped appliance
The Google Distributed Cloud air-gapped appliance is an integrated hardware and software solution that lets you run workloads at the tactical edge.
127
128
Proton announces release of a new VPN protocol, "Stealth"
Stealth is a new VPN protocol from Proton VPN that overcomes censorship in restrictive countries.
129
Private Browsing 2.0
When we invented Private Browsing back in 2005, our aim was to provide users with an easy way to keep their browsing private from anyone who shared the same device.
130
131
Abusing Ubuntu 24.04 features for root privilege escalation
With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privilege escalation vulnerabilities.
132
A cryptographically secure bootloader for RISC-V in Rust
A summary of a Codethink sponsored project which implements a cryptographically secure bootloader, written in Rust, for RISC-V.
133
Listen to the whispers: web timing attacks that work
Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets
134
Network Tunneling with QEMU
While investigating an incident, we detected uncommon malicious activity inside one of the systems. We ran an analysis on the artifacts, only to find that the adversary had deployed and launched the QEMU hardware emulator.
135
136
Give Me the Green Light Part 1: Hacking Traffic Control Systems
Adventures in Responsible Disclosure
137
Passkey Implementation: Misconceptions, pitfalls and unknown unknowns
Read about the challenges, pitfalls and misconceptions we faced while developing our passkey-first authentication solution and passkey intelligence.
138
GCC's new fortification level: The gains and costs (2022)
Discover the gains and costs of GCC’s enhanced runtime buffer overflow protection. Level 3 _FORTIFY_SOURCE preprocessor macro may detect more buffer overflows, but there’s a cost.
139
The AWS S3 Denial of Wallet Amplification Attack
If you publicly host large data files on AWS S3 & pay for transfer costs, you may be vulnerable to a “Denial of Wallet” amplification…
140
Bootkitty: Analyzing the first UEFI bootkit for Linux
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.
141
The Beginner's Guide to Visual Prompt Injections (2023)
Learn about visual prompt injections, their appearance, and top defense strategies against these attacks.
142
The epidemic of fraudulent DMCA takedowns
There’s an enormous and largely invisible campaign to use fraudulent notices under the US Digital Millennium Copyright Act to remove critical articles from the internet. We don’t know who is running…
143
Advancing Our Bet on Asymmetric Cryptography
Google and many other organizations, such as NIST, IETF, and NSA, believe that migrating to post-quantum cryptography is important due to the large risk posed by a crypt…
144
145
How deceptive design is used to compromise your privacy and how to fight back
Today, we’re releasing a new guide explaining how to compel companies employing deceptive design to dodge data protection requests—like those for data deletion or access—to comply. It encapsulates five years...
146
Fuzzing between the lines in popular barcode software
Fuzzing—one of the most successful techniques for finding security bugs, consistently featured in articles and industry conferences—has become so popular that you may think most important software has already been extensively fuzzed. But that’s not always the case. In this blog post, we show how we fuzzed the ZBar…
147
From object transition to RCE in the Chrome renderer
In this post, I'll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
148
The /unblock API from Browserless: dodging bot detection as a service
The /unblock API clears away bot fingerprints at the CDP level, to truly humanize your Puppeteer automations.
149
Using Large Language Models to Catch Vulnerabilities
Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offe...
150
An unexpected journey into Microsoft Defender's signature World
Microsoft Defender is the endpoint security solution preinstalled on every Windows machine since Windows 7. It's a fairly complex piece of software, addressing both EDR and EPP use cases. As such, Microsoft markets two different products. Microsoft Defender for Endpoint is a cloud based endpoint security solution that…