Topics /
The most popular blog posts about security & privacy on Hacker News. 317 posts.
Since the events of the search warrant by the Swedish police at Mullvad’s office in Gothenburg, we have tried to get hold of documents and protocols tied to the operation. This is what the authorities came back with.
13 vulnerabilities in GarminOS and the MonkeyC VM, 9 with CVEs, that let Connect IQ apps escape the VM and bypass permissions on 100+ Garmin watches.
You are seeing this because the administrator of this website has set up Anubis to protect the server against the scourge of AI companies aggressively scraping websites . This can and does cause downtime for the websites, which makes their resources inaccessible for everyone.
A photo in a Los Alamos National Laboratory (LANL) student briefing from 2022 shows four people inspecting what appears to be a damaged B61 nuclear bomb.
(Note: This is the companion post to my article at Public Books about evading data detection at Disneyland. For the…
After nearly a full year of non-stop development since the initial announcement of The Big Refactor , 4153 commits made, 700 issues closed , and a month of beta testing, Ronin 2.0.0 has finally been released!
Experts warn that ISPs would use black-box AI to comply Like our piece on Canada's Cyber-Security Bill earlier this year, this item was flagged in my work for the Internet Society, Canada Chapter, but this post does not necessarily reflect the opinion of the ISCC. It concerns a legal opinion…
OpenSSL 1.1.1 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
Protect sensitive data from phishing and social engineering with Varonis Interceptor, AI-native email security with 99.9% detection and real-time response.
Michael Allen // A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new […]
Earlier this week a letter from an activist imprisoned in France was posted to the internet. Contained within Ivan Alococo’s dispatch from the Villepinte prison
HAProxy products are unaffected by CVE-2023-44487, which could allow a DoS attack against web servers, reverse proxies, and more. Stay tuned for updates.
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
As one of the creators of bcrypt back in 1997, I find it somewhat surprising that, 25 years later, we still rely heavily on passwords. My initial encounter with password security took place in 1993 at the University of Hamburg. Having just discovered Unix, I was fascinated by a service called Yellow Pages that allowed…
"Infosec Twitter," a vibrant community of security practitioners, known for its insight, inspiration, and entertainment, is coming to an end.
Understanding the OpenSSH CVE-2023-25136 high vulnerability. Read our analysis with Proof-of-Concept, learn what's vulnerable, and discover remediations.
Despite dealing with issues like depression, suicide, domestic violence, and PTSD, these apps share data freely and raise many security concerns
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually do, allowing us to take a nonstandard approach to the […]
Finding vulnerabilities in global domain infrastructure to take control of ccTLD zones. Vulnerabilities in EPP
Cascade is a RISC-V CPU fuzzer that generates valid , long and complex programs, and relies on a termination cascade-effect for bug detection. It detected 37 new bugs (29 new CVEs) in 5 RISC-V CPUs, which is more than all the existing fuzzers, combined. You can read a paper we wrote on Cascade here and try it out here…
Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds. Fortunately, the Ledger Donjon discovered the vulnerability very quickly and likely avoided one of the biggest hack in the crypto ecosystem.
Posted by Seth Jenkins, Project Zero For a fair amount of time, null-deref bugs were a highly e...
CT scans of counterfeit AirPods Pro and MagSafe chargers reveal pouch cell batteries in circular cavities, internal weights, and a fake ground pin.
This guide shows you how to set up session recordings for Tailscale SSH. Learn how to record the terminal output whenever someone on your tailnet initiates a Tailscale SSH connection. Use these recordings to detect threats, investigate security incidents, and remain compliant with your network security policies.
Discovery and walkthrough of CVE-2023-38633 in librsvg, when two URL parser implementations (Rust and Glib) disagree on file scheme parsing leading to path traversal.
Kaspersky researchers analyzed a Linux backdoor disguised as Free Download Manager software that remained under the radar for at least three years.
