2401
Exploiting the Wi-Fi Stack on Apple Devices
Posted by Gal Beniamini, Project ZeroEarlier this year we performed research into Broadcom’...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
2402
Cloudflare blocks an almost 2 Tbps multi-vector DDoS attack
Earlier this week, Cloudflare automatically detected and mitigated a DDoS attack that peaked just below 2 Tbps — the largest we’ve seen to date.
2403
Microsoft has detected nation-state activity associated with NOBELIUM
The Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity associated with the threat actor tracked as NOBELIUM, attempting to gain access to downstream customers of multiple cloud service providers (CSP), managed service providers (MSP), and other IT services organizations.
2404
Hardening the Firefox Front End with Content Security Policies
Most of the Firefox User Interface (UI), including the address bar and the tab strip, are implemented using standard web technologies like HTML, CSS and JavaScript plus some additional custom components like XUL. One of the advantages of using web technologies for the front end is that it allows rendering the frontend…
2405
2406
How Referral Spam Like lifehacker.com Gets into Google Analytics
Find out how referral spam in Google Analytics can be produced, why anybody would take time to do that and personality behind the latest spam wave.
2407
Urgent and Important – Rotate Your Amazon RDS, Aurora, and DocumentDB Certs
Feb 5th, 2020: We’ve made an edit to this post. Previously, we had communicated that between February 5 and March 5, 2020, RDS would automatically stage the new certificates on RDS database instances without a restart. Based on customer feedback and to give customers as much time as possible to complete updates, RDS…
2408
A hands-on introduction to static code analysis
An example-rich description of the architecture of static code analysis systems along with a hands-on tutorial on how to implement it.
2409
Passkey Implementation: Misconceptions, pitfalls and unknown unknowns
Read about the challenges, pitfalls and misconceptions we faced while developing our passkey-first authentication solution and passkey intelligence.
2410
What happens when your phone is spying on you
Smartphone spyware apps that allow people to spy on each other are not only hard to notice and detect, they also will easily leak the sensitive personal information they collect, says a team of computer scientists from New York and San Diego.
2411
Certificate Transparency in Firefox
Certificate Transparency (CT) has been one of the biggest advancements in web security, keeping users safe from threats such as certificate fraud and…
2412
Bypassing Antivirus with Ten Lines of Code
I had originally set out to write a long winded blog post on different antivirus bypass techniques. I went through what was supposed to be s...
2413
2414
2415
Designing a COM Library for Rust
I interned with Microsoft as a Software Engineering Intern in the MSRC UK team in Cheltenham this past summer. I worked in the Safe Systems Programming Language (SSPL) group, which explores safe programming languages as a proactive measure against memory-safety related vulnerabilities.
2416
Access Control for GitHub Pages
GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page. With access control, you…
2417
Tor Messenger Beta: Chat Over Tor, Easily
WARNING STARTS As of March 2018, Tor Messenger is no longer maintained and you should NOT use...
2418
How we reduced the impact of zombie clients
Every night, right around midnight (mainly UTC), a horde of zombies wakes up and clamors for … digital certificates! The zombies in question are abandoned or misconfigured Internet servers and ACME clients that have been set to request certificates from Let’s Encrypt. As our certificates last for at most 90 days…
2419
2420
2421
Google Cloud Platform Security Best Practices
A walkthrough of a couple of Google Cloud Platform (GCP) features with security recommendations and advice on how to configure your GCP environments.
2422
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.
2423
Are popular toxicity models simply profanity detectors?
Are popular toxicity models simply profanity detectors? We show how toxicity models overweight profanity, and make mistakes when profanity is used in a positive way.
2424
GCC's new fortification level: The gains and costs (2022)
Discover the gains and costs of GCC’s enhanced runtime buffer overflow protection. Level 3 _FORTIFY_SOURCE preprocessor macro may detect more buffer overflows, but there’s a cost.
2425
Proposed illegal image detectors on devices are ‘easily fooled’
Proposed algorithms that detect illegal images on devices can be easily fooled with imperceptible changes to images, Imperial research has found.
2426
An attacker’s blunder gave us a look into their operations
An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.
2427
2428
The AWS S3 Denial of Wallet Amplification Attack
If you publicly host large data files on AWS S3 & pay for transfer costs, you may be vulnerable to a “Denial of Wallet” amplification…
2429
Google uncovers major account-hijacking campaign targeting senior US officials
Insights from Googlers into our products, technology, and the Google culture
2430
Bootkitty: Analyzing the first UEFI bootkit for Linux
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.