631
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
632
How I discovered a hidden microphone on a Chinese NanoKVM
NanoKVM is a hardware KVM switch developed by the Chinese company Sipeed. Released last year, it enables remote control of a computer or server using a virtu...
633
A Hacker's Replacement for Gmail
Note: Since writing this I’ve replaced Exim with Postfix and Courier with Dovecot. This is outlined in the Addendum, but the main text is unchanged. Please read the whole guide before starting, as you can skip some of the steps and go straight to the final system.
634
You can't leak users' data if you don't hold it
When I was still working at Faculty , we took on a new client that was not yet named Matter . We eventually transitioned from an agency-client relationship to a startup relationship, where I became the VP of Technology. This is what I’ve been doing for the past two-ish years.
635
636
A supply chain attack on PyTorch
Security tends to lag behind adoption, and AI/ML is no exception. Four months ago, Adnan Khan and I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platform…
637
Google Chrome Keystone is modifying /var symlink on non SIP Macs causing k-panic
Reports that some AVID Users Macs would no longer boot. It now may be that a Google Chrome Keystone update modifies /var on NON SIP Protected Macs.
638
VPN – Very Precarious Narrative
A very long article about commercial VPNs, their marketing strategies, and the truth behind their privacy and security claims.
639
With questionable copyright claim, Jay-Z orders deepfake parodies off YouTube
With a questionable claim to copyright, Jay-Z ordered two deepfake audio parodies of his voice off YouTube. I talked to the video's creator about the future of AI for creative expression.
640
Prompt injection: what’s the worst that can happen?
Activity around building sophisticated applications on top of LLMs (Large Language Models) such as GPT-3/4/ChatGPT/etc is growing like wildfire right now. Many of these applications are potentially vulnerable to prompt …
641
Falling through the KRACKs
The big news in crypto today is the KRACK attack on WPA2 protected WiFi networks. Discovered by Mathy Vanhoef and Frank Piessens at KU Leuven, KRACK (Key Reinstallation Attack) leverages a vulnerab…
642
Examining a vintage RAM chip, I find a counterfeit with a different die inside
A die photo of a vintage 64-bit TTL RAM chip came up on Twitter recently, but the more I examined the photo the more puzzled I became. The c...
643
I Followed the Official AWS Amplify Guide and Was Charged $1,100
An interesting thing happens when you follow the official Amplify guide.
644
Going Dark, and the era of law enforcement hacking
I’m coming down from spending a few days at Usenix Security, right here in my hometown of Baltimore. This means that my days have been taken up with two kinds of conversation: first, explaini…
645
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
646
Google AdWords Exploit Seen in the Wild
See the ad for ebay at the top of the results? Not particularly interesting, right?…
647
Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
UPDATE: PLEASE HELP ME TEST UPATE TO THE UPDATE: Similar log entries are now found in another system log that is more persistent, see the article here . UPDATE: This is still vulnerable on current versions of macOS 10.13.3 when encrypted an ALREADY EXISTING unencrypted APFS volume
648
Password Managers
I’ve spent a lot of time trying to understand the attack surface of popular password managers. I think I’ve spent more time analyzing them than practically anybody else, and I think that qualifies me to have an opinion!
649
Linux Hardening Guide
Linux is not a secure operating system . However, there are steps you can take to improve it. This guide aims to explain how to harden Linux as much as possible for security and privacy. This guide attempts to be distribution-agnostic and is not tied to any specific one. DISCLAIMER: Do not attempt to apply anything in…
650
Re-entry to US without backscatter or pat-down
On November 21, 2010, I was allowed to enter the U.S. through an airport security checkpoint without being x-rayed or touched by a TSA officer. This post explains how.
651
652
Hacking into an insurance company by exploiting their premium calculator
A vulnerable API on Toyota Tsusho Insurance Broker India’s premium calculator website exposed Microsoft corporate cloud credentials.
653
Hacking Grindr Accounts with Copy and Paste
Sexuality, relationships and online dating are all rather personal things. They're aspects of our lives that many people choose to keep private or at the very least, share only with people of our choosing. Grindr [https://www.grindr.com/] is "The World's Largest Social Networking App for Gay,
654
655
Google’s fully homomorphic encryption compiler – a primer
Back in May of 2022 I transferred teams at Google to work on Fully Homomorphic Encryption (newsletter announcement). Since then I’ve been working on a variety of projects in the space, including being the primary maintainer on github.com/google/fully-homomorphic-encryption, which is an open source FHE compiler for…
656
Using Ghidra and Python to reverse engineer Ecco the Dolphin
Re-routing the encryption
657
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting
On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said…
658
I'm being cyberattacked by Tesla, Inc
A bungled Assetnote scan
659
Stopping phishing campaigns with Bash
Personal Blog of Christian Haschek
660
Two years spent spamming spammers back
I created a bot to respond to these types of emails…