271
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 292 posts.
272
How to earn money by hacking a “walking for money” app
Or how to reverse engineer React Native apps, and abuse API.
273
Block web scanners with ipset and iptables
Anybody who runs an internet-facing webserver has seen their fair share of spammy scanners in the logs. It varies server to server, but some of mine get up to 15,000 scans per day. Almost all of these are harmless network mappers, but they still annoy me. Many are compromised hosts or belong to hackers & organized…
274
275
Locking down your GitHub-hosted Domains
The other day someone claimed a hostname on a domain I own and it took me a while to track down how. Turns out it was via GitHub pages.
276
Finding an authorization bypass on my own website
The mysqljs parameterized query parser handles objects as column name and key, leading to alterations of the query.
277
Building Password Purgatory with Cloudflare Pages and Workers
I have lots of little ideas for various pet projects, most of which go nowhere ( Have I Been Pwned [https://haveibeenpwned.com/] being the exception), so I'm always looking for the fastest, cheapest way to get up and running. Last month as part of my blog post on How
278
The Plausibly Deniable DataBase (PDDB)
The problem with building a device that is good at keeping secrets is that it turns users into the weakest link.
279
Security through obscurity is underrated (2020)
Some thoughts about cyber security, technology and life - https://utkusen.com/. Click to read Utku Sen’s Substack, a Substack publication with hundreds of subscribers.
280
281
JavaScript Obfuscation Techniques by Example
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
282
Malicious update/malware by a semi-advanced adversary
What do wedding venues and malware have in common? I got to spend my weekend investigating them. A short post about interesting malware, and lessons learned.
283
Stealing checks worth millions and pwning a bank
Another long (hacker) story of mine! Once upon a time contracted to do a penetration test on a bank… I spent the better part of a week assessing every nook and cranny of the main web application. I mapped every function, and every web path, but the main website was very hardened. After spending a lot of time…
284
Adding code to an existing ELF file
Recently I was reverse-engineering an Android app [ a ] . The relevant details are as follows:
285
If AI can read, then plain text can be weaponized (2019)
Advances in AI have helped automate many tasks that involve processing text. However, text-processing AI algorithms have their own unique vulnerabilities, researchers at IBM, Amazon and University of Texas have found.
286
Arris / Arris-variant DSL/Fiber router critical vulnerability exposure
Cybersecurity researcher, entrepreneur, and engineer.
287
288
What is: Linux keyring, gnome-keyring, Secret Service, and D-Bus (2019)
What are Linux keyring, gnome-keyring, Secret Service, and D-Bus - a brief overview and usage examples
289
Passkeys
This is an opinionated, “quick-start” guide to using passkeys as a web developer. It’s hopefully broadly applicable, but one size will never fit all authentication needs and this guide ignores everything that’s optional. So take it as a worked example, but not as gospel.
290
Beginners Guide to 0day/CVE AppSec Research
A while ago I took up the challenge to get Offensive Security Web Expert (OSWE) certified. During this journey I learned many awesome things. The most important lesson learned was that with source code and a debugger, I could find vulnerabilities exponentially faster than by using traditional Blackbox/Bug-Bounty…
291
292
Europe: The end of the privacy of digital correspondence
The End of the Privacy of Digital Correspondence The EU wants to oblige providers to search all private chats, messages, and emails automatically for suspicious content - generally and indiscriminately. The stated aim: To prosecute child pornography. The result: Mass surveillance by means of full