3541
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3542
3543
Usenet Tradecraft: Survival in an Extremely Adversarial Environment (2013)
Survival in an Extremely Adversarial Environment If your secure communications platform isn’t being used by terrorists and pedophiles, you&# …
3544
A New Development for Coverity and Heartbleed
Byte swapping does not necessarily imply the data comes from an external source. For example, when writing graphics code, you sometimes need to do byte swapping if you’re converting between 24-bit RGB and BGR image formats (Windows’ GDI famously uses BGR so this is one place where you need to do such conversions)…
3545
X-Clacks-Overhead
A small HTTP-header tribute to Sir Terry Pratchett
3546
Stealing Chrome cookies without a password
Stealing Chrome Cookies without root or password on OSX, Linux, and Windows via Remote Debugging Protocol.
3547
One Line of Code That Compromises Your Server
Demonstrating how a weak session secret can allow an attacker to take control of a server
3548
3549
Mountain Lion quietly includes app blacklist and security restrictions
Today I went to launch VMware 4.1.0 on my OS X 10.8.1 Mac and was met with this surprising refusal to open:
3550
Infosec Core Competencies
An incomplete list of (technical) things just about anybody working in Information Security would benefit from knowing.
3551
Twitter Bots Use Likes, RTs for Intimidation
I awoke this morning to find my account on Twitter ( @briankrebs ) had attracted almost 12,000 new followers overnight. Then I noticed I’d gained almost as many followers as the number of re-tweets (RTs) earned for a tweet I published on Tuesday . The tweet stated how every time I tweet something related to Russian…
3552
3553
White hat social engineering: How to become an admin of a system
Warning: Half-satire, half-truth
3554
No, RSA Is Not Broken
I have been seeing this paper by cryptographer Peter Schnorr making the rounds: “Fast Factoring Integers by SVP Algorithms.” It describes a new factoring method, and its abstract ends with the provocative sentence: “This destroys the RSA cryptosystem.” It does not. At best, it’s an improvement in factoring—and I’m not…
3555
Linux Foundation Secure Boot System Released
As promised, here is the Linux Foundation UEFI secure boot system. This was actually released to us by Microsoft on Wednesday 6 February, but with travel, conferences and meetings I didn’t really get time to validate it all until today. The files are here
3556
CVE 2025 31200
Background On April 16, 2025, Apple released a patch for a bug in CoreAudio which they said was “Actively exploited in the wild.” This flew under the radar a bit. Epsilon’s blog has a great writeup of the other bug that was presumably exploited in this chain: a bug in RPAC. The only thing out there that I am aware of…
3557
Lamphone: Real-Time Passive Sound Recovery from Light Bulb Vibrations
Recent studies have suggested various side-channel attacks for eavesdropping sound by analyzing the side effects of sound waves on nearby objects (e.g., a bag of chips and window) and devices (e.g., motion sensors). These methods pose a great threat to privacy, however they are limited in one of the
3558
The 'Fly' Has Been Swatted
A Ukrainian man who claimed responsibility for organizing a campaign to send heroin to my home last summer has been arrested in Italy on suspicion of trafficking in stolen credit card accounts, among other things, KrebsOnSecurity.com has learned.
3559
Hacking cars in JavaScript (Replay attacks in the browser with the HackRF)
Collection of side projects, conference talks and blog posts experimenting with frontend technologies and human-computer interaction
3560
Reverse engineering GoDaddy's tracking script
An article by Igor Kromin has provided an insight into a practice by GoDaddy involving injecting Javascript into customer sites. Several people expressed interest in a breakdown of the script - so here it is. Please review Igor’s original blog for further background
3561
High-Throughput, Formal-Methods-Assisted Fuzzing for LLVM
Mutation-based fuzzing is based on the idea that new, bug-triggering inputs can often be created by randomly modifying existing, non-bug-triggering inputs. For example, if we wanted to find bugs in a PDF reader, we could grab a bunch of PDF files off the web, mutate them by flipping a few bits or something, and feed…
3562
Apple software update “bug” enables Apple Intelligence
Some people who had previously disabled Apple Intelligence in macOS 15.3 and iOS 18.3 saw it re-enabled after updating to macOS 15.3.1 and iOS 18.3.1 today. In fact I personally have two different Apple silicon Macs running macOS Sequoia, and after I updated both Macs to 15.3.1, Apple Intelligence was re-enabled on my…
3563
Don't Talk to the Cops
Don't talk to the cops about any significant crime ...ESPECIALLY if you're innocent. Here's why.
3564
3565
Anyone on the Internet Can Ring Your Doorbell
Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device's persistent password and lets anyone on the Internet hijack the next live call.
3566
Hacker Who Sent Me Heroin Faces Charges in U.S
A Ukrainian hacker who once hatched a plot to have heroin sent to my Virginia home and then alert police when the drugs arrived had his first appearance in a U.S. court today, after being extradited to the United States to face multiple cybercrime charges.
3567
Personal Mail Server on OpenBSD (2019)
I will use this place to relate my geeky adventures in the world of gnu/linux, bsd, the internets, and other important things like windows managers and pretty colors. Basically, it's a place to expose and share with the world things I do on my computer.
3568
Firewalling your code
When writing code, you can call any function as long as it’s public, and similarly, you can access any object’s public properties or methods. Usually, access to code is all or none – a piece of code can be either public or private. Lately, I’ve been thinking about ways to implement more fine-grained access controls…
3569
What are malicious USB keys and how to create a realistic one?
This blog post shows how to create a reliable and realistic-looking malicious USB key that can be used in a drop attack.
3570
Mozilla says it's finally done with Onerep
In March 2024, Mozilla said it was winding down its collaboration with Onerep — an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites — after KrebsOnSecurity revealed Onerep’s founder had created dozens of people-search services and was…