931
Firefox, you're supposed to be in my pocket, not the other way around
Personal blog of Julien (jvoisin) Voisin
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
932
Okta's NextJS-0auth troubles
When AI engineering fails: Dealing with hallucinations, misattribution, and broken code in an Okta/Auth0 pull request maintained by AI.
933
Infosec company pwned by 4chan user
risk visualize deez nuts
934
Don't trust me: I might be a spook
But the latest revelations scare me. It's one thing to find and exploit vulnerabilities in software; there's a lot of software out there which was written by developers with very little understanding of cryptography or software security, and it shows. If you care about security, we reasoned, stick to software written…
935
AI generated security reports about curl
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
936
Recovering secret keys from devices using video footage of their power LED
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
937
938
GoogleMeetRoulette: Joining random meetings
Finding Google Meet phone numbers and bruteforcing PINs to join random meetings
939
Hacking the Apple Webcam (Again)
$100,500 Apple Bug Bounty for hacking the webcam via a Safari Universal Cross-Site Scripting (UXSS) bug. CVE-2021-30861, CVE-2021-30975
940
Twitter's pivot to x.com is a gift to phishers
On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com , which until very…
941
Wanted to download an ISO, ended up writing a kernel exploit
My TP-Link EAP770 v1 corrupts downloads over Wi-Fi and TP-Link EOL'd it before I unboxed it. The fix is two zeros in sysfs. TP-Link's shell won't let me write them, so I wrote a kernel exploit for my own fucking access point.
942
If your code accepts URIs as input, filter out “file://”
There are many online sites that accept reading input from remote locations. For example a site might try to extract all the text from a webpage, or show you the HTTP-headers a given server sends back in response to a request.
943
A decade-old Steam bug
Valve has shown to occasionally not act on community feedback and bug reports. A story about a decade old bug.
944
My Google Workspace account suspension
As the title suggests, I have finally become the victim of Google’s account suspension.
945
Mark Felt-Tipped: Uncovering top-secret information by counting pixels
KEMUDITOTO merupakan official Situs Togel 4D & Toto TOGEL ONLINE Terjamin Maxwin dengan akses cepat, pilihan permainan lengkap, layanan responsif, dan nyaman digunakan setiap hari.
946
Barracuda urges replacing, not patching, its email security gateways
It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks , as the company…
947
948
949
Downloading Software Safely Is Nearly Impossible
Let’s say you have a brand-new Windows laptop and you’re just oh, so happy. You’re pretty sure the NSA did not interdict it during shipment , and thus that it comes only with the flaky goatware Microsoft, Lenovo, and any number of Lenovo’s business partners intended for it to have. Now all you need is an SSH client so…
950
Testing Phone-Sized Faraday Bags
Complex software is, to put it mildly, hard to get right (for details, see almost any other posting on this or any other security blog). Especially for gadgets that are rich with microphones, cameras, location and environmental sensors, and communication links (such as, you know, smartphones), errors and security…
951
Using Silk Road
History, background, visiting, ordering, using, & analyzing the drug market Silk Road 1
952
953
DHS asks Mozilla to take down MafiaaFire add-on
From time to time, we receive government requests for information, usually market information and occasionally subpoenas. Recently the US Department of Homeland Security contacted Mozilla and reque…
954
How kernel anti-cheats work
Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory…
955
The NSA: An Inside View
In which I relate my experience as an NSA employee and impart my thoughts on the policies in place, my former coworkers, and the current cyber war.
956
957
Microsoft is spying on users of its AI tools
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools—presumably coding tools—to improve their hacking abilities. From their report: In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries—tracked as Forest Blizzard, Emerald…
958
Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App
How an open redirect in Harvest’s Outlook Calendar integration leaked the OAuth tokens of connected Microsoft accounts, with a step-by-step proof of concept.
959
960
