3601
A Blackstone real estate company exposed SSN digits, DOBs, addresses and more
Update: This post received some attention on Hacker News — see the discussion thread.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3602
Deluge of Fake Mac App Store Reviews
Yesterday I discovered a deluge of recent fake customer reviews for a number of top paid apps in the United States Mac App Store. (Each country has its own version of the App Store with separate reviews.) I've now checked the reviews for all of the current top 40 paid apps in the Mac App Store, and 8 of those apps…
3603
3604
root with a single command: sudo logrotate
Starting from the constraint that only sudo logrotate * may be run, and ending at root: abusing the log file flag to overwrite root owned scripts and ride cron to privilege escalation.
3605
Someone was breaking into Orange Spain RIPE account (and break their /12)
Ah. Orange Spain has had their /12 (and likely others) broken by (what appears to be) someone breaking into their RIPE account and making RPKI ROA's to somewher...
3606
3607
Rooting, firmware analysis and persistent credentials of TP-Link TL-841N
round 2: rooting & analysing firmware of the TP-Link TL-WR841N
3608
3609
3610
A Guide to Synthesizing Adversarial Examples
Synthesizing adversarial examples for neural networks is surprisingly easy.
3611
Web-based cryptography is always snake oil
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your…
3612
Stopping bad guys from using my open source project (feedback wanted)
I maintain a sorta-popular open source package, and I want to prevent big corporations and "bad guys" from using it. I want feedback on how to do this.
3613
Can you use GDPR to circumvent BlueSky's adult content blocks?
In the battle between the Online Safety Act and GDPR, who will win? FIGHT! I'll start by saying that I'm moderately positive on Online Safety. If services don't want to provide moderation then they shouldn't let their younger users be exposed to harm. The social network BlueSky has taken a pragmatic approach to this…
3614
3615
Privatizing our digital identities
Trying to make the case for permanent irrevocable digital identities, which unfortunately today, by de-facto, are email addresses.
3616
“Guccifer2”'s second release from DNC hack
This’s time to keep my word and here’re the docs I promised you. It’s not a report in one file, it’s a big folder of docs devoted to Hillary Clinton that I found on the DNC …
3617
Beware Keyloggers at Hotel Business Centers
The U.S. Secret Service is advising the hospitality industry to inspect computers made available to guests in hotel business centers, warning that crooks have been compromising hotel business center PCs with keystroke-logging malware in a bid to steal personal and financial data from guests.
3618
Introducing Qubes 1.0 ("a stable and reasonably secure desktop OS")
After nearly three years of work, I have a pleasure to announce that Qubes 1.0 has finally been released! To see the installation instructio...
3619
Linux Security Hardening and Other Tweaks
A collection of kernel and userland settings one can change to improve the security and usability of a Linux system. Targeted at Arch, but should work for other distros too.
3620
A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
1.0 The Silicon Root of Trust: Pre-Boot & Hardware Primitives The security of the macOS platform on Apple Silicon is not defined by the kernel; it is d...
3621
Re-Victimization from Police-Auctioned Cell Phones
Countless smartphones seized in arrests and searches by police forces across the United States are being auctioned online without first having the data on them erased, a practice that can lead to crime victims being re-victimized, a new study found. In response, the largest online marketplace for items seized in U.S…
3622
Deconstruction of Pinkie Pie's 64-bit Chrome exploit
Back in November 2012, a Chrome Releases blog post mysteriously stated: "Congratulations to Pinkie Pie for completing challenge: 64-bit exp...
3623
3624
3625
Bounty to Recover NIST's Elliptic Curve Seeds
This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late ’90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in…
3626
Leeks and Leaks
On the completely impossible situation of blocking the Tor .onion TLD to avoid leaks, but at the same time not block it to make users able to do what they want. dot-onion leaks The onion TLD is a Tor specific domain that does not mean much to the world outside of Tor. If you try … Continue reading Leeks and leaks →
3627
Pastes on Have I Been Pwned are no longer publicly listed
Over the weekend, a Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) subscriber contacted me after they found their Spotify credentials online. It turns out that this particular woman went searching for her specific password after finding "some guy listening to Mexican music from a foreign device on my acct"
3628
Hacking with PDF (2022)
Inspiration of how we can use PDF as an attack vector and perform multiple attacks with huge subsequences to the victim.
3629
Stuxnet was embarrassing, not amazing (2011)
As the New York Times posts yet another breathless story about Stuxnet, I’m surprised that no one has pointed out its obvious deficiencies. Everyone seems to be hyperventilating about its pur…
3630
Grsecurity: Potential contributory infringement and breach of contract risk
It's my strong opinion that your company should avoid the Grsecurity product sold at grsecurity.net because it presents a contributory infringement and breach of contract risk.