4111
Distribution packages considered insecure
If you ever have run a Linux-based operating system you are probably aware of the way that software is usually distributed on them: Using a software repository. Repositories are great for numerous …
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
4112
4113
The Sad State of Mobile XMPP in 2014
blog about networking, cameras, old gear, and xmpp
4114
iPhone Apps Surreptitiously Communicated with Unknown Servers
Long news article (alternate source) on iPhone privacy, specifically the enormous amount of data your apps are collecting without your knowledge. A lot of this happens in the middle of the night, when you’re probably not otherwise using your phone: IPhone apps I discovered tracking me by passing information to third…
4115
Phishing Darknet Users for Bitcoins
Writeup of a tool for creating bitcoin stealing phishing clones of onion services on large scale
4116
How botnets are created with hijacked Worpess, fake Flash downloads and Node.js
I just noticed the website of an old employer has been hacked and some JavaScript is injected into their corporate website that runs on WordPress. Ouch. Of course I notified them about it and they’re just trying to figure out what happened and how to fix it.
4117
4118
Licenses Over Data: A Case Study with Github v BitBucket
Our Commercial Lawyers deliver legal solutions to businesses in Brisbane and across Australia to meet their commercial targets.
4119
4120
Another cluster of potentially malicious Chrome extensions
I discovered a cluster of at least 109 extensions in Chrome Web Store. A few are committing affiliate fraud or spying, most are simply hoarding overly wide privileges before abusing them.
4121
A Hidden Cost of Ransomware: Wholesale Password Theft
Organizations in the throes of cleaning up after a ransomware outbreak typically will change passwords for all user accounts that have access to any email systems, servers and desktop workstations within their network. But all too often, ransomware victims fail to grasp that the crooks behind these attacks can and…
4122
SSH key and passwordless login basics for developers
SSH keys are useful to login over ssh (secure shell) without typing a password. They are also used by Github and other version control systems for passwordless authentication. Here is some basic information from the software developer point of view how to use SSH keys for maximum comfort and security. These…
4123
4124
The Apple goto fail vulnerability: lessons learned (2014)
Description of what we have learned
4125
Adobe credentials and the serious insecurity of password hints
Adobe had a little issue the other day with the small matter of 150 million accounts being breached and released to the public. Whoops. So what are we talking about? A shed load of records containing an internal ID, username, email, encrypted password and a password hint. Naked Security did
4126
4127
Dismantling a Crappy Malware Operation
Dismantling a Shoddy Malware Operation The Discovery I had been made aware of a malware spreading site called obspremium.com. This site is claiming to offer a so-called “premium” version of the popular open source recording and streaming program Open Broadcaster Software at obsproject.com. “OBS Premium” hosts a direct…
4128
Entropy Attacks
The conventional wisdom is that hashing more entropy sources can't hurt: if H is any modern cryptographic hash function then H(x,y,z) is at least as good a random number as H(x,y), no matter how awful z is. So we pile one source on top of another, hashing them all together and hoping that at least one of them is good.
4129
Cameras built to police Iranians became the regime's Achilles' heel
On the irony of cameras built to police Iranians becoming the regime’s Achilles’ heel
4130
Homoglyph attacks: How to create an internet hoax
For decades, social psychologists have understood that the link between attitudes and conduct is convoluted, if not weak. Both online and offline, this is
4131
PingFS
shysecurity blog
4132
4133
Obfuscated JavaScript, scam emails, and American Express
Reverse-engineering an obfuscated American Express phishing campaign from email to exfiltration endpoint.
4134
How Safe Browsing Works in Firefox
Firefox has had support for Google's Safe Browsing since 2005 when it started as a stand-alone Firefox extension . At first it was only available in the USA, but it was opened up to the rest of the world in 2006 and moved to the Google Toolbar . It then got integrated directly into Firefox 2.0 before the public launch…
4135
Security and Privacy Implications of Zoom
Over the past few weeks, Zoom’s use has exploded since it became the video conferencing platform of choice in today’s COVID-19 world. (My own university, Harvard, uses it for all of its classes. Boris Johnson had a cabinet meeting over Zoom.) Over that same period, the company has been exposed for having both lousy…
4136
Belgium Is Unsafe for CVD
This post is about the reason I will probably never try to warn any organisation in Belgium about any vulnerability again. Recently I have been dealing with an attempt at coordinated vulnerability disclosure (CVD) with an organisation in Belgium. This post is not about that, because I’m not allowed to write about it…
4137
GPG and Me (2015)
I receive a fair amount of email from strangers. My email address is public, which doesn’t seemto be a popular choice these days, but I’ve received enough inspiring correspondence over the yearsto leave it be.When I receive a GPG encrypted email from a stranger, though, I immediately get the fee...
4138
One way to fix your rubbish password database
Suppose for a moment that you are running a web site that has a poorly implemented password database that stores password hashes using some...
4139
Hidden Cam Above Bluetooth Pump Skimmer
Tiny hidden spy cameras are a common sight at ATMs that have been tampered with by crooks who specialize in retrofitting the machines with card skimmers. But until this past week I’d never heard of hidden cameras being used at gas pumps in tandem with Bluetooth-based card skimming devices.
4140
Nordstrom Finds Cash Register Skimmers
Scam artists who deploy credit and debit card skimmers most often target ATMs, yet thieves can also use inexpensive, store-bought skimming devices to compromise modern-day cash registers. Just this past weekend, for instance, department store chain Nordstrom said it found a half-dozen of these skimmers affixed to…