3451
“Disregard That” Attacks
Why you shouldn't share your context window with others
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3452
The OpenSSH Bug That Wasn't
Much has been written about a purported OpenSSH vulnerability. On closer inspection, the reports actually got most of their facts wrong. Rea...
3453
3454
A bit more on Twitter/X's new encrypted messaging
Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about T…
3455
A dead man's switch for your computer?
In the last few weeks, a lot of details have been disclosed around Ross Ulbricht’s arrest. For those not familiar with the matter, Ulbricht was arrested at …
3456
Preventing app removal on iOS
These days, I am developing an alarm app called ‘SuperAlarm’. To ensure a user is awake, SuperAlarm can be turned off only after a user completes a mission(e.g., taking a picture...
3457
Recovering a password-protected ThinkPad T60
An illustrated overview about the process of clearing the supervisor password from a ThinkPad T60, based on guides that some smart and persistent people have written.
3458
3459
Would You Have Fallen for This Phone Scam?
You may have heard that today’s phone fraudsters like to use caller ID spoofing services to make their scam calls seem more believable. But you probably didn’t know that these fraudsters also can use caller ID spoofing to trick your bank into giving up information about recent transactions on your account — data that…
3460
If You Can Read This, You're SNIing
When TLS was defined, it didn’t allow more than one hostname to be available on a single IP address / port pair, leading to “virtual hosting” issues; each Web site (for example) now requires a dedicated IP address.
3461
3462
Typed Programs Don't Leak Data
Mistral Contrastin's thought bubble, blog, and personal revelations.
3463
3464
The Great $50M African IP Address Heist
A top executive at the nonprofit entity responsible for doling out chunks of Internet addresses to businesses and other organizations in Africa has resigned his post following accusations that he secretly operated several companies which sold tens of millions of dollars worth of the increasingly scarce resource to…
3465
3466
3467
Understanding how AES encryption works
Deepen your understanding of AES implementation using golang.
3468
Taking another shot at the cheap IP camera, part 2
Eric Park's website
3469
Testing “Exotic” P2P VPN
My standard "everyday" solution when it comes to connecting computers into a single network is Wireguard. Wireguard is good, supports p2p, and generally has no downsides.
3470
No U PNP
Previously on Deep Space Nine, we discussed (read: I complained about) the short life and quick death of DLNA. On the way, I mentioned DLNA's dependence on UPnP as an underlying autoconfiguration protocol. Let's talk a bit more about UPnP, because it's 1) an interesting protocol, 2) widely misunderstood, and 3)…
3471
Building a PGP web of trust that people will actually use
Back in the early 1990s, PGP introduced the concept of web of trust (WoT)- a means by which users of personal encryption can know whether or...
3472
Set up a malware analysis lab with VirtualBox, INetSim and Burp
In this post we will set up a virtual lab for malware analysis. We’ll create an isolated virtual network separated from the host OS and from the Internet, in which we’ll setup two victim virtual machines (Ubuntu and Windows 7) as well as an analysis server to mimic common Internet services like HTTP or DNS. Then…
3473
Linux Internals: How /proc/self/mem writes to unwritable memory (2021)
Introduction An obscure quirk of the /proc/*/mem pseudofile is its “punch through” semantics. Writes performed through this file will succeed even if the destination virtual memory is marked unwritable. In fact, this behavior is intentional and actively used by projects such as the Julia JIT compiler and rr debugger…
3474
A Hardware Privacy Monitor for iPhones
Andrew “bunnie” Huang and Edward Snowden have designed a hardware device that attaches to an iPhone and monitors it for malicious surveillance activities, even in instances where the phone’s operating system has been compromised. They call it an Introspection Engine, and their use model is a journalist who is…
3475
Phishing with Unicode Domains
Vulnerability in Chrome, Firefox, and Opera makes users susceptible to phishing with Unicode domains
3476
High frequency security bug hunting: 120 days, 120 bugs
1) Intro & Motivations At the start of of this year, I set myself a personal goal of finding 365 bugs in 365 days. This was entirely motivated by wanting to challenge myself to find more security issues as I felt I'd been slacking off. I thought back to things
3477
Exploiting the Superfish certificate
As discussed in my previous blogpost, it took about 3 hours to reverse engineer the Lenovo/Superfish certificate and crack the password. In...
3478
Hardware trojans under a microscope (2022)
Table of Contents
3479
Serial swatter who caused death gets five years in prison
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.
3480
No Instagram, no privacy
This means that I am oblivious to all of my friends’ fun broadcasted on Instagram. I don’t feel pressured either to update the abstract audience of everyone I ever connected with online, on where I am, what I am doing or who I am hanging out with.