1171
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1172
X Just Accidentally Exposed a Covert Influence Network Targeting Americans
How a new X feature led to the most sweeping public exposure of covert foreign activity on a major platform since 2016.
1173
Never run ‘python’ in your downloads folder
Python can execute code. Make sure it executes only the code you want it to.
1174
Denuvo Analysis
This post is intended for educational purposes only. Denuvo is arguably the most successful digital rights management solution to have ever existed, and is therefore an interest to many. This blog contains a large amount of my personal notes and correspondence with other reverse engineers (see kudos ) which contains…
1175
The RCE that AMD wouldn't fix
Following backlash, AMD agreed to fix an MITM RCE I discovered in Ryzen Master. All in all, it took them over four months to roll out the fix.
1176
1177
A child’s privacy is worth more than likes (2022)
The Privacy Whisperer, by Luiza Jarovsky
1178
1179
1180
1181
1182
Learn Authentication the Hard Way: Part Three
This is the final installment of a three part series in which we dive into modern application authentication solutions - the hard way. Part One: The Hard Way Part Two: The Hard Way, Continued Part Three: The Hard Way: Return Of The Specification The Hard Way: Return Of The Specification We are continuing our quest to…
1183
That's not how 2FA works
Another day, another high-profile website cloned to phish credentials. Tess Rinearson@_tessrIs this a phishing attempt? Goes to "githubverification.com" and asks for username and pw (if so, it nearly got me!) /cc @github pic.x.com/jgt4oNvjF2❤️ 2,243💬 111🔁 016:12 - Sat 16 January 2021 In the replies, you’ll see lots of…
1184
1185
PayPal phishing scam uses invoices sent via PayPal
Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge. The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of…
1186
SQL patterns I use to catch transaction fraud
The actual queries I run when I'm hunting fraud in transaction data. Velocity, impossible distances, suspicious amounts, merchant clusters, off-hours buys, and window functions.
1187
1188
Metadata Equals Surveillance
Back in June, when the contents of Edward Snowden’s cache of NSA documents were just starting to be revealed and we learned about the NSA collecting phone metadata of every American, many people—including President Obama—discounted the seriousness of the NSA’s actions by saying that it’s just metadata. Lots and lots…
1189
Yet another macOS privacy protections bypass
Today I'm disclosing a macOS privacy protections bypass. I discovered that an application can use the venerable Unix command-line tool "ls" (list directory contents) to bypass both TCC (Transparency, Consent, and Control) and the sandbox, enabling unauthorized access to file metadata in directories that are supposed…
1190
Cross-Site Request Forgery is dead
After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution, it's Same-Site Cookies.
1191
A single byte write opened a root execution exploit
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
1192
1193
RaidForums gets raided, alleged admin arrested
The U.S. Department of Justice (DOJ) said today it seized the website and user database for RaidForums , an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged…
1194
1195
Why are free proxies free? (2013)
Personal Blog of Christian Haschek
1196
1197
A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding
SSH port forwarding explained in a clean and visual way. How to use local and remote port forwarding. What sshd settings may need to be adjusted. How to memorize the right flags.
1198
Reverse engineering my ADHD test
I decided to get evaluated for ADHD. Curiousity struck, and I had the bright idea to capture the page source and any outbound requests.
1199
300M Freely Downloadable Pwned Passwords
Edit 1: The following day, I loaded another set of passwords which has brought this up to 320M. More on why later on. Edit 2: The API model described below has subsequently been discontinued [https://www.troyhunt.com/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity/] in favour of the
1200