181
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 257 posts.
182
Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself
A USPS smishing attempt prompts the Akamai SIG to unearth shocking statistics: Illegitimate USPS domains see as much traffic as the legitimate USPS domain.
183
AWS Nitro Enclaves: Attack Surface
In the race to secure cloud applications, AWS Nitro Enclaves have emerged as a powerful tool for isolating sensitive workloads. But with great power comes great responsibility-and potential security pitfalls. As pioneers in confidential computing security, we at Trail of Bits have scrutinized the attack surface of AWS…
184
Xz sshd backdoor collecting usernames from logs
The amazingly scary xz sshd backdoor, Author: Bojan Zdrnja
185
DigiCert Revocation Incident (CNAME Domain Validation)
DigiCert will be revoking certificates that did not have proper Domain Control Verification (DCV). Before issuing a certificate to a customer, DigiCert validates the customer’s control or ownership over the domain name for which they are requesting a certificate using one of several methods approved by the CA/Browser…
186
“YOLO” is not a valid hash construction
Among the cryptographic missteps we see at Trail of Bits, “let’s build our own tool out of a hash function” is one of the most common. Clients have a problem along the lines of “we need to hash a bunch of different values together” or “we need a MAC” or “we need […]
187
OWASP Data Breach Notification
OWASP Data Leak Notification on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
188
Breaking SecuROM 7 – A Dissection
This is an archive of an old whitepaper made by three reverse engineering experts on breaking down SecuROM and its multiple layers of protection. Archive Opening NotesAs mentioned, this is a whitepa
189
CFPB finalizes personal financial data rights rule
The Consumer Finance Protection Bureau (CFPB) has just finalized a rule that makes it easy and safe for you to figure out which bank will give you the best deal and switch to that bank, with just a couple of clicks. We love this kind of thing: the coolest thing about a digital world is how easy it...
190
Building a Faraday cage with data passthrough for ESP32 reverse engineering
Instructions for building an affordable Faraday cage
191
LeftoverLocals: Listening to LLM responses through leaked GPU local memory
We are disclosing LeftoverLocals: a vulnerability that allows recovery of data from GPU local memory created by another process on Apple, Qualcomm, AMD, and Imagination GPUs. LeftoverLocals impacts the security posture of GPU applications as a whole, with particular significance to LLMs and ML models run on impacted…
192
Security researchers identify new malware targeting Linux
ESET researchers analyzed previously unknown Linux backdoors that are connected to known Windows malware used by the China-aligned Gelsemium group, as well as to Project Wood.
193
How to use the Bitwarden forwarded email alias generator
Bitwarden includes a very handy integration called forwarded email aliases. Learn how to use the feature in this blog!
194
Lawsuit challenges Virginia City's use of cameras for warrantless surveillance
NORFOLK, Va.—Today, two Norfolk-area residents teamed up with the Institute for Justice (IJ) to file a federal lawsuit against the city, challenging the constitutionality of […]
195
Equinix: Major Accounting Manipulation, Core Business Decay
Initial Disclosure: After extensive research, we have taken a short position in shares of Equinix, Inc. (NASDAQ:EQIX). This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
196
The Backbone of Cybersecurity: Hardware Security Modules
Discover how Hardware Security Modules (HSMs) provide robust security solutions for managing cryptographic keys and protecting sensitive data in various industries.
197
198
Clio: A system for privacy-preserving insights into real-world AI use
Anthropic's new system, Clio, analyzes how people use AI while maintaining their privacy.
199
YARA is dead, long live YARA-X
For over 15 years, YARA has been growing and evolving until it became an indispensable tool in every malware researcher’s toolbox.
200
Security and privacy risks of public JavaScript CDNs
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
201
Mintlify GitHub read/write token leak
Edit March 18, 2024 10:20 AM
202
203
U.S. border surveillance towers have always been broken
A new bombshell scoop from NBC News revealed an internal U.S. Border Patrol memo claiming that 30 percent of camera towers that compose the agency's "Remote Video Surveillance System" (RVSS) program are broken. Except, this isn't a bombshell. What should actually be shocking is that Congressional leaders are acting…
204
205
Privacy focused platform Skiff is joining Notion, Skiff to be sunset
Our co-founder Akshay talks to Skiff co-founders Andrew Milich and Jason Ginsberg about their startup's vision and journey to Notion.
206
Technical Details on Today's Outage
Learn more about the technical details around the Falcon update for Windows hosts.
207
Nobody Cares About Security
Nobody cares about security. There. I said it. I said the thing everyone feels, some people think, but very few have the temerity to say out loud. But before you call me...
208
Is regulated BGP security coming?
What impact would regulating BGP routing security have on the global Internet?
209
Security flaws in an SSO plugin for Caddy (2023)
We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources. During our evaluation, Caddy was deployed as a…
210
BIMI and DMARC Can't Save You: The Overlooked DKIM Exploit
Analysts at Zone.eu, one the leading domain registrars and web hosting providers in Europe, have observed a vulnerability affecting the global e-mail ecosystem, stemming from unaddressed warnings in the DomainKeys Identified Mail (DKIM) standard that puts billions of users in risk. This is not an issue in a particular…