2971
The case of the 9 bit AES key
Several PDF implementations advertise AES-256, but generate the 256-bit key from either a very small state space, or from insecure random sources.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
2972
2973
How the United Arab Emirates Intelligence Tried to Hire Me to Spy on Its People
Recently, we’ve been overwhelmed with news of horrors, attacks, monsters who murder the innocent in the name of a faith they don’t truly know. I’m publishing t…
2974
2975
The Untouchables – Apple’s new OS “activation” for Touch Bar MacBook Pros
Last week Joe Chilcote discovered an interesting message when imaging a Late 2016 MacBook Pro TouchBar (from here on out referred to as TBP): A critical software update is required for your Mac. To…
2976
Penetration testing and low-cost freelancing
Penetration testing is complex. For it to be successful, the tester needs to possess a variety of different abilities and skills. Some testers rely only on automated tools, while others focus more on manual analysis. While a creative and unconventional way of thinking is necessary, it is also important for the tester…
2977
The Origin of ‘Script Kiddie’
The term script kiddie probably originated around 1994, but the first public record is from 1996.
2978
Coreboot Blocked from Recent Thinkpads by Intel Boot Guard
So some innocent post on the coreboot mailing list managed to make some waves. The problem Intel tries to solve… Intel Boot Guard is the latest effort in a long series by Intel and others to allow computers to provide some reliable information about the state a computer is in. They’re working on it since at least…
2979
Twitter accounts are being hijacked for spam
It seems that Twitter has lost control of its advertising system. This blog post will show you why it is dangerous to click on any Twitter advertising. Twitter ads have always been a bit crap, but I've seen a recent influx in outright scams. Let me step you through a couple of examples. A typical click-bait headline…
2980
Hacking industrial vehicles from the internet
It is possible to monitor and control float trucks, public bus or delivery vans from the internet , obtaining their speed, position, and a lot other parameters. You can even control some parameters of the vehicle or hack into the canbus of the vehicle remotely.
2981
Bruce Schneier: Refuse to be terrorized
On Aug. 16, two men were escorted off a plane headed for Manchester, England, because some passengers thought they looked either Asian or Middle Eastern, might have been talking Arabic, wore leather jackets, and looked at their watches—and the passengers refused to fly with them on board. The men were questioned for…
2982
Half of curl’s vulnerabilities are C mistakes
I spent a lot of time and effort digging up the numbers and facts for this post! Lots of people keep referring to the awesome summary put together by a friendly pseudonymous "Tim" which says that "53 out of 95" (55.7%) security flaws in curl could've been prevented if curl had been written in Rust. … Continue reading…
2983
A Call of Duty exploit
A few years ago, I became aware of a security issue in most Call of Duty games. Although I did not discover it myself, I thought it might be interesting to see what it could be used for. Without going into detail, this security issue allows users playing a Call of Duty match to cause a buffer overflow on the host’s…
2984
Bash bug: the other two RCEs, or how we chipped away at the original fix
The patch that implements a prefix-based way to mitigate vulnerabilities in bash function exports has been out since last week and has been...
2985
“Privacy”.com–Yeah Right
At the behest of a friend of mine, I decided to get myself a Privacy.com account. I filled it out with my personal information, activated the account, and...
2986
Please Stop Writing Secure Messaging Tools (2015)
This is my first Patreon-supported essay, which went out a week early to my $10 and up subscribers. This was written in part in response to issues with the IWMF check-in tool, but it's something I've been concerned about for some time.
2987
Bug in Notepad Involving Asterisk in Title Bar
Back in May 27, 2020 Microsoft published a blog post describing a new feature in Notepad:
2988
Why the KeePass format should be based on SQLite
Mohammed Ketab
2989
2990
How to build an NPM worm
npm is a registry and package manager for JavaScript that ships as part of Node.js . It's used by tens of millions of people to install hundreds of thousands of packages billions of times every week.
2991
Target Hackers Broke in via HVAC Company
Last week, Target told reporters at The Wall Street Journal and Reuters that the initial intrusion into its systems was traced back to network credentials that were stolen from a third party vendor. Sources now tell KrebsOnSecurity that the vendor in question was a refrigeration, heating and air conditioning…
2992
Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003 , citing the discovery of a “wormable” flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of…
2993
2994
Testing FIDO U2F security keys
Last time I reviewed various security keys at a fairly superficial level: basic function, physical characteristics etc. This post considers lower-level behaviour.
2995
What’s in a Boarding Pass Barcode?
The next time you’re thinking of throwing away a used boarding pass with a barcode on it, consider tossing the boarding pass into a document shredder instead. Two-dimensional barcodes and QR codes can hold a great deal of information, and the codes printed on airline boarding passes may allow someone to discover more…
2996
CloudFlair: Bypassing CloudFlare using Internet-wide scan data
Cloudflare is a service that acts as a middleman between a website and its end users, protecting it from various attacks. Unfortunately, those websites are often poorly configured, allowing an attacker to entirely bypass Cloudflare and run DDoS attacks or exploit web-based vulnerabilities that would otherwise be…
2997
The ICANN Public Comments on WHOIS Privacy
ICANN is currently considering a proposal that “domains used for online financial transactions for commercial purpose should be ineligible for [WHOIS] privacy and proxy registrations” [ PDF ]. Given the vagueness around what would count as “commercial purpose” (tip jars? advertising? promoting your Kickstarter?) and…
2998
Adventures in WhatsApp DB – extracting messages from backups, with code examples
Getting your messages without giving a third party your credentials and data
2999
Anthropic installed a spyware bridge on my machine?
Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.
3000