3571
Anticheat Update Tracking
A few years ago when I was into reverse engineering and binary analysis (and game modding), I did a lot of research into anticheats work. I was curious about tracking their updates, since that would allow me to:
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3572
3573
Hey Paypal, why do you need access to my microphone, camera and photos?
Who actually checks the permissions of applications they’re installing? A little while ago a Paypal update stalled because it required extra permissions. This is what happens if an app you have already installed wants more power. I was more than a little surprised with what I found.
3574
A possible flaw in open-source bcrypt implementations
[NOTE: See updates below and here .] I'm working on an application that requires a secure password hash. The state of the art is Colin Perc...
3575
Bash bug: apply the unofficial patch now (CVE-2014-6277)
OK, rebuild bash and deploy Florian's unofficial patch or its now-upstream version now. If you're a distro maintainer, please consider doi...
3576
3577
Dear Mozilla community: I screwed up. Big time.
I screwed up. Big time. Not just with Adblock Plus users but with the Mozilla community at large.
3578
Reversing for dummies – x86 assembly and C code (Beginner/ADHD friendly)
Before I got into reverse engineering, executables always seemed like black magic to me. I always wondered how stuff worked under the hood, and how binary code is represented inside .exe files, and how hard it is to modify this ‘compiled code’ without access to the original source code.
3579
Reverse Engineer Amazon's Whispersync
I am a big fan of my Kindle. This is the device I’d bring over to a desert island. I am also a fairly frequent user of the highlight feature where you can select a bit of text you like and save it. One thing is bothering me though: the lack of open API on the Kindle to retrieve the data about me. Amazon provides the…
3580
The FBI can almost certainly crack the San Bernardino iPhone without Apple
The title kind of says it all. How do I know? Because of this photo : That's a picture of the logic board of an iPhone 5C, the same mod...
3581
Apple Reneged on OCSP Privacy
In the current version of macOS, Monterey, on every system update on a system containing an M1 chip, such as all the new shiny/fast ARM (“Apple Silicon”) macs, the update process phones home to Apple to obtain a special boot signature, known in Apple jargon as a “ticket”.
3582
How Rainbow Tables Work
I found the creator of Rainbow Table's paper, aimed at cryptanalysts, was pretty inaccessible considering the simplicity and elegance of Rainbow Tables, so this is an overview of it for a layman.
3583
Audio Adversarial Examples
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.
3584
Compiler fuzzing, part 1
Much has been written about fuzzing compilers already, but there is not a lot that I could find about fuzzing compilers using more modern ...
3585
OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
Usual Mandatory Disclaimer: IANAC (I am not a cryptographer) so I might likely end up writing a bunch of mistakes in this blog post... ...
3586
Tactics, Techniques, and Procedures of the Yahoo Hack
(.. Tactics, Techniques, and Procedures)
3587
The beauty and terror of modding Windows
Let's talk about the "Windows Baseline Security Mode," too.
3588
3589
3590
Netmask NPM package, used by 270k+ projects, vulnerable to octal input data
The following research outlines a vulnerability discovered in netmask npm package that is currently used by 278,722+ other projects. The vulnerability has been present for 9 years. Since this package is so incredibly widespread, I would suggest every nodejs developer to check their package.jsons to see if they use…
3591
Anatomy of a cryptocurrency scam
You receive a message. Now either you will be victim or not. Your knowledge, attention and moral compass will decide where you will end up.
3592
The scrypt parameters
The recommended scrypt parameters in the Go docs were recently brought up for discussion given they haven’t changed since 2009.
3593
Insecurities in the Linux /dev/random
New paper: “Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust, by Yevgeniy Dodis, David Pointcheval, Sylvain Ruhault, Damien Vergnaud, and Daniel Wichs. Abstract: A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is…
3594
Supply chain nightmare: How Rust will be attacked and what we can do to mitigate
An essential part of being able to say "I told you so" is in fact having told you so. Well, here we are. For those living under a rock (lucky
3595
“Downthem” DDoS-for-hire boss gets 2 years in prison
A 33-year-old Illinois man was sentenced to two years in prison today following his conviction last year for operating services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against hundreds of thousands of Internet users and websites.
3596
Nym Wars (Google+ "real name" rules)
I hadn't been paying much attention to the Google "Real Names" clusterfuck, because it was so obvious to me that they were going to lose this one in the press that it would all be over soon. But it's still not over, and the Google brass appear to be digging in their heels, despite the universally bad press they're…
3597
The i.MX8 cannot be deblobbed
Devices based on the i.MX8 or i.MX8M (such as the Librem phone or MNT Reform) have received popular coverage recently. The number of firmware blobs involved in the bringup of these devices is often a point of discussion. At times, people have considered whether some of these blobs could be replaced with libre…
3598
NSPM-7 labels common beliefs as terrorism 'indicators'
New directive targets “anti-Christian,” “anti-American,” and “anti-capitalism” opinions
3599
Exploring Google Hangouts' easter eggs
Web developer and cybersecurity researcher
3600
Microsoft Issues Emergency Patch for Windows Flaw
Microsoft on Tuesday issued an emergency software update to quash a security bug that’s been dubbed “ PrintNightmare ,” a critical vulnerability in all supported versions of Windows that is actively being exploited. The fix comes a week ahead of Microsoft’s normal monthly Patch Tuesday release, and follows the…