781
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
782
783
The Web Is Broken – Botnet Part 2
I guess you have all heard about the growing problem of AI companies trying to aggressively collect whatever data they can get their hands on to train their models. This has caused an explosive surge in web crawlers relentlessly hitting servers big and small. But who runs these crawlers? Turns out — it could be you!
784
Google to developers: We take down your extension because we can
Today, I found this email from Google in my inbox: We routinely review items in the Chrome Web Store for compliance with our Program policies to ensure a safe and trusted experience for our users. We recently found that your item, “Google search link fix,” with ID: cekfddagaicikmgoheekchngpadahmlf, did not comply with…
785
49% of workers, forced to change passwords, reuse same one with minor change
A new survey has revealed some alarming news about the way users are choosing their passwords in their homes and workplace.
786
Who Hacked Ashley Madison?
AshleyMadison.com , a site that helps married people cheat and whose slogan is “Life is Short, have an Affair,” recently put up a half million (Canadian) dollar bounty for information leading to the arrest and prosecution of the Impact Team — the name chosen by the hacker(s) who recently leaked data on more than 30…
787
788
789
790
791
792
How I got over 300 Tor exit nodes removed
On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.
793
Ghrc.io appears to be malicious
A simple typo of ghcr.io to ghrc.io would normally be a small goof. You’d typically get a 404 or similar error, finally work out the issue, fix it, and move along. But in this case, that typo appears to be doing something very malicious, stealing GitHub credentials. What’s ghcr.io? First, a quick bit of background…
794
As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption
With further confirmation of the longstanding rumor that the U.S. government (and, we can safely assume, other governments around the world) have been pressuring major Internet firms to provide their "master" SSL keys for government surveillance purposes, we are rapidly approaching a critical technological crossroad.
795
The 0.5 MB of nothing in all Apple Music files (2020)
Six percentage of each music files you’ve bought from Apple Music (iTunes Store) contain, literally, nothing. Why is Apple padding their music with zero-bytes?
796
Memory safe ‘curl’ for a more secure internet
tldr: work has started to make Hyper work as a backend in curl for HTTP. curl and its data transfer core, libcurl, is all written in C. The language C is known and infamous for not being memory safe and for being easy to mess up and as a result accidentally cause security problems. At … Continue reading rust in curl…
797
“Subject: Urgent Warning”
Back in December I got a desperate email from this person. A woman who said her Instagram had been hacked and since she found my contact info in the app she mailed me and asked for help. I of course replied and said that I have nothing to do with her being hacked but I … Continue reading “Subject: Urgent Warning” →
798
Please scan my towel
My friend Scott pointed out the towels in most hotels now have RFID tags to help with inventory control: I also knew that my RSA Conference badge would have an RFID tag in it so it could be scanne…
799
Escaping the Chrome Sandbox Through DevTools
This blog post details how I found CVE-2024-6778 and CVE-2024-5836, which are vulnerabilities within the Chromium web browser which allowed for a sandbox escape from a browser extension.
800
Visual guide to SSH tunneling and port forwarding (2023)
Sysadmin doing syadmin stuff
801
US Border Patrol says they can create central repository of traveler emails
The U.S. government has taken the opportunity during the global pandemic, when people aren't traveling out of the country much, to roll out a new platform for storing information they believe they are entitled to take from people crossing the border. A new filing reveals how the U.S. Border Patrol will store data from…
802
Dangerous domain corp.com goes up for sale
As an early domain name investor, Mike O’Connor had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O’Connor refused to auction perhaps the most sensitive domain in his stable…
803
The most dangerous code in the world
Abstract: SSL (Secure Sockets Layer) is the de facto standard for secure Internet communications. Security of SSL connections against an active network attacker depends on correctly validating public-key certificates presented when the connection is established. We demonstrate that SSL certificate validation is…
804
#include </etc/shadow>
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
805
Flipping Pages: New Linux vulnerability in nf_tables and exploitation techniques
A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different kernel targets once.
806
Spectre mitigations murder userspace performance
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
807
808
Retrieving your browsing history through a CAPTCHA
Web developer and cybersecurity researcher
809
This is why people fear the Internet of Things
Imagine buying an internet-enabled surveillance camera, network attached storage device, or home automation gizmo, only to find that it secretly and constantly phones home to a vast peer-to-peer (P2P) network run by the Chinese manufacturer of the hardware. Now imagine that the geek gear you bought doesn’t actually…
810
Curl’s backdoor threat
-- "Have you ever detected anyone trying to add a backdoor to curl?" -- "Have you ever been pressured by an organization or a person to add suspicious code to curl that you wouldn't otherwise accept?" -- "If a crime syndicate would kidnap your family to force you to comply, what backdoor would you be … Continue…