511
The curious case of the Raspberry Pi in the network closet
Personal Blog of Christian Haschek
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
512
Everything you need to know about the Shellshock Bash bug
This content is now available in the Pluralsight course "Understanding the Shellshock Bash Bug" [http://www.pluralsight.com/courses/shellshock-bash-bug]Remember Heartbleed [https://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html]? If you believe the hype today, Shellshock is in that league and with
513
I looked through attacks in my access logs
I've been self-hosting for over a decade. It's freeing because I own my data, and do not depend on any platform other than my cloud host, which I can easily switch off. Self-hosting gives much insight into what it takes to run a cloud service. Anyone
514
Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites
A blog on security, malware, cryptography, pentesting, javascript, php and whatnots
515
516
Stealing secrets from developers using WebSockets
This is a story of a convoluted, not-very-useful method for extracting codez from unwitting JavaScript developers working on top secret…
517
IP Spoofing
The recording and slides are available, but for easier consumption here's a transcript.
518
Did Claude increase bugs in rsync?
In order to avoid accuastions of this "just being Claude defending Claude," "AI slop," "probably all hallucinations," etc., I've decided it's probably worth explaining a few key points about how this report was created:
519
Two-tier encryption in the UK
Alice and Bill have identical Apple devices. Only one gets Apple’s strongest iCloud protection.
520
OpenAI bots knew about the RubyGems caching vulnerability
Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it’s wild. TL;DR: It seems like OpenAI Bots knew about the RubyGems caching…
521
You can't trust macOS Privacy and Security settings
How to gain access to the contents of privacy-protected folders even though Privacy & Security settings say that access is denied.
522
523
Use Touch ID for Sudo on Mac
The landscape of security is changing quite a bit. We've gone from basic username and password to 2FA, facial recognition, fingerprint recognition, and so
524
525
Fixing an Elgato HD60 S HDMI capture device with the help of Ghidra
This post has a little bit of everything. Hardware diagnostics, some suspiciously similar datasheets from two separate Taiwan chip manufacturers, and firmware reverse engineering. Read on if that sounds like fun!
526
Meltdown and Spectre Linux kernel status
By now, everyone knows that something “big” just got announced regarding computer security. Heck, when the Daily Mail does a report on it …
527
I got my money back from a scammer by contacting his mom on Facebook (2016)
Personal Blog of Christian Haschek
528
CircleCI trusts 8 analytics companies with your source code and API tokens
When you navigate to your project in CircleCI's UI, Javascript from eight different analytics companies gets loaded and executed in your browser.
529
Prompt injection explained, with video, slides, and a transcript
I participated in a webinar this morning about prompt injection, organized by LangChain and hosted by Harrison Chase, with Willem Pienaar, Kojin Oshiba (Robust Intelligence), and Jonathan Cohen and Christopher …
530
Investigating an “evil” RJ45 dongle
Reverse-engineering hardware can be difficult -- but sometimes, all you need is a comfy armchair and some Google Translate.
531
Chat control: EU Commission presents mass surveillance plan on May 11
Next week on Wednesday (May 11), the EU Commission will present an EU draft law on mandatory chat control to the public for the first time. Similar to Apple's highly controversial "SpyPhone" plans, the Commission wants to oblige all providers of email, chat and messaging services to search for susp
532
Apple AirTags draining battery of devices close by
If you have AirTags in the vicinity of your iPad it drains its battery for no reason. The past months I’ve been wondering why my iPad Pro always needed to be recharged when I used to use it without charging for weeks. I’m not the only one…
533
534
535
Deleting any Facebook album
What if your photos get deleted without your knowledge? That would be pretty upsetting, wouldn’t it? This post is about a vulnerability I found that allowed malicious users to delete any photo album on Facebook. Any photo album owned by a user, a page, or a group could be deleted. Graph API is the primary […]
536
Pressing YubiKeys
If you work in tech, you probably have a YubiKey. I have this one, the YubiKey 5C Nano:
537
538
How did Facebook intercept their competitor's encrypted mobile app traffic?
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
539
540
The Original Cookie specification from 1997 was GDPR compliant (2019)
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month