721
Stop donating your customers' data to Google Analytics
In 2020, with better alternatives available, using Google Analytics (GA) to track your web usage is n...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
722
Node.js packages don't deserve trust
Another week, another npm supply chain attack . Yikes! People on hacker news are wringing their hands about what should be done. The problem seems dire.
723
Vanishing from Hyundai’s data network
Finding and disabling the cellular modem for BlueLink in the Kona EV
724
Unauthenticated remote code execution in OpenCode
OpenCode is an open-source AI coding assistant. Prior to v1.1.10, it automatically spawned an HTTP server (default port 4096+) on startup. Since v1.1.10, the server is disabled by default but can be enabled via command-line flags or configuration file. When running, the server exposes endpoints for:
725
Moving your SSH port isn’t security by obscurity
I just came across another post on Hacker News talking about why you shouldn’t move your SSH port off of 22 because it’s Security by Obscurity. Ther
726
Microsoft Kills off ISVs by Foisting Its Own Products That Are No Better
Hi Folks! Meet David, the magnificent masterpiece sculpted by Michelangelo at the start of the 16th century. A photo of his face with that curious furrowed brow featured on our very first anti-cyber…
727
Hoax email blast abused poor coding in FBI website
The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing…
728
Image Scaling Attacks
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. Overview: …
729
AI is breaking two vulnerability cultures
A week ago the Copy Fail vulnerability came out, and Hyunwoo Kim immediately realized that the fixes were insufficient, sharing a patch the same day. In doing this he followed standard procedure for Linux, especially within networking: share the security impact with a closed list of Linux security engineers, while…
730
Rook to XSS: How I hacked chess.com with a rookie exploit
Playing Chess is one of the many hobbies I like to do in my spare time, apart from tinkering around with technology. However, I'm not very good at it, and after losing many games, I decided to see if I could do something I'm much better at; hacking the system!
731
My Lethal Trifecta talk at the Bay Area AI Security Meetup
I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, the lethal trifecta and the challenges of securing systems that use MCP. It wasn’t …
732
Running a fake power plant on the internet for a month
There is a lot more on the internet than just social media and banking websites…
733
Update: YouTube-dl reinstated thanks to EFF (2020)
In October, the popular and famous archivist tool youtube-dl was taken down by GitHub due to a DMCA request by the Recording Industry Association of America. I posted a detailed analysis explaining the relation between international, US, EU and German law, and showing why this request was very different from what most…
734
735
Reverse engineering a car key fob signal
I’ve had the curiosity to explore radio communication protocols for a few years now, ever since I’ve started fiddling around with an RTL-SDR dongle. I always had the goal of figuring out how data is transmitted in remote controls (car key fobs particularly), trying replay attacks, and other possible attack vectors.
736
Scammed out of $130K via fake Google call, spoofed Google email and auth sync
On June 19th, my life changed with a phone call.
737
Android now stops you sharing your location in photos
My wife and I run OpenBenches. It's a niche little site which lets people share photos of memorial benches and their locations. Most modern phones embed a geolocation within the photo's metadata, so we use that information to put the photos on a map. Google's Android has now broken that. On the web, we used to use…
738
739
740
741
Windows 10 20H2: ChkDsk damages filesystem on SSDs with KB4592438 installed
[German]In Windows 10 20H2 with installed cumulative update KB4592438, chkdsk causes massive issues. It destroys the file system during a disk check on SSDs, so Windows 10 can’t start after a reboot.
742
SSH over HTTPS
Tl;DR: to pass SSH through HTTPS you need to tweak client and server sides as the following:
743
Golang SSH Security
Working on a project for a client recently, I needed to speak the SSH protocol in Golang code. So I started with the x/crypto/ssh package, part of the suite of libraries from the Golang developers which is not part of the standard library and not part of their usual compatibility guarantees, but more along the lines…
744
What’s in a PR statement: LastPass breach explained
The LastPass statement on their latest breach is full of omissions, half-truths and outright lies. I’m providing the necessary context for some of their claims.
745
Ofcom concedes defeat in 4chan case
Insofar as a political organization like Ofcom is even capable of admitting defeat, it did so in the 4chan enforcement today. In testimony before the Commons Digital, Culture, Media, and Sport Comm…
746
One in every 600 websites has .git exposed
Deeply technical and hands-on AI and tech leader. Built, scaled and sold my own… · Experience: Cubes · Education: Nanzan University · Location: London Area, United Kingdom · 500+ connections on LinkedIn. View Jamie Brown’s profile on LinkedIn, a professional community of 1 billion members.
747
Unauthorized access to cameras in Safari on macOS and iOS
A vulnerability in Safari allowed hackers to access the iPhone and Macbook cameras. (CVE-2020-3852, CVE-2020-3864, CVE-2020-3865, CVE-2020-3885, CVE-2020-3887 & CVE-2020-9784)
748
How Google Chrome’s ad blocker works
Get the details on how the built-in ad-blocker in Google Chrome works. The ad-blocker only kicks in on websites in violation of the Better Ad Standards policies.
749
750
How to increase your chances of finding a hidden camera
Take note of the title of this blog. What you read below will give you some additional knowledge that may help you identify a hidden camera but it certainly won’t guarantee that. We got lucky…