121
I also hacked my car
Gonçalo MB. My personal website, projects, contacts and stuff.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 279 posts.
122
Escaping surveillance capitalism, at scale
Self-hosting and paid subscriptions promise an escape from surveillance capitalism. What guarantees do they really offer, and at what cost?
123
The Insecurity of Debian
The difference in security defaults between Debian and Red Hat.
124
Timeshare owner? The Mexican drug cartels want you
The FBI is warning timeshare owners to be wary of a prevalent telemarketing scam involving a violent Mexican drug cartel that tries to trick people into believing someone wants to buy their property. This is the story of a couple who recently lost more than $50,000 to an ongoing timeshare scam that spans at least two…
125
Inside the Massive Alleged AT&T Data Breach
I hate having to use that word - "alleged" - because it's so inconclusive and I know it will leave people with many unanswered questions. (Edit: 12 days after publishing this blog post, it looks like the "alleged" caveat can be dropped, see the addition at the end of the post
126
The sins of the 90s: Questioning a puzzling claim about mass surveillance
Meredith Whittaker, president of the Signal Foundation, gave an interesting talk at NDSS 2024 titled "AI, Encryption, and the Sins of the 90s".
127
128
Some Fritz!Box modems might have been hijacked
TL;DR: Fritz!Box devices using custom DNS resolution services like Pihole or Adguard might have been compromised by DNS hijacking and using those Fritz!Box devices might be unsafe, especially for Windows users. Update: I updated the article to downscale the severity of the situation. After posting the article on HN, I…
129
Don’t let your domain name become a sitting duck
More than a million domain names — including many registered by Fortune 100 firms and brand protection companies — are vulnerable to takeover by cybercriminals thanks to authentication weaknesses at a number of large web hosting providers and domain registrars, new research finds.
130
Reverse-engineering an encrypted IoT protocol
Extract metrics from your GoodWe solar PV system, and improve its security too
131
The Curious Case of MD5
Recently I came across a puzzling fact: the International Criminal Court hashes electronic evidence with MD5, even though MD5 is badly broken. So, why are lawyers using broken, outdated technology? The answer involves the common law system, cultural isolation, and a single man named Don L. Lewis.
132
Sei pays out $2M bug bounty
In April 2024, I found and reported two critical bugs to Sei Network concerning their layer-1 blockchain. One of these issues impacted the chain’s availability, and the other its integrity. The Sei Foundation awarded me $75,000 and $2,000,000 respectively for these reports.
133
SSH as a Sudo Replacement
A major caveat in tools like sudo and doas for that matter is that they rely on setuid binaries and privilege escalation in order to run commands as root.
134
135
ACF has been hijacked
It’s super late at night on Thanksgiving weekend in Canada. I shouldn’t be thinking about weird internet drama, but here we are.
136
Exodus Bitcoin Wallet: $490k swindle
Edit: There’s a short follow-up to this post: Exodus Bitcoin Wallet: Follow up. tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it…
137
Inside the failed attempt to backdoor SSH globally that got caught by chance
Why the threat actor rushed deployment.
138
Phish-friendly domain registry ".top" put on notice
The Chinese company in charge of handing out domain names ending in “ .top ” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that…
139
A High-Level Technical Overview of Homomorphic Encryption
About two years ago, I switched teams at Google to focus on fully homomorphic encryption (abbreviated FHE, or sometimes HE). Since then I’ve got to work on a lot of interesting projects, learning along the way about post-quantum cryptography, compiler design, and the ins and outs of fully homomorphic encryption. If…
140
141
Passwordless: a different kind of hell?
It's no secret that authenticating into services is an unresolved topic. With time, we have managed
142
I can't use my number pad for 2FA codes
This has to be the most infuriating bug report I've ever submitted. I went to type in my 2FA code on a website - but no numbers appeared on screen. Obviously, I was an idiot and had forgotten to press the NumLock button. D'oh! I toggled it on and typed again. No numbers appeared. I switched to another tab, my numbers…
143
Reverse-Engineering an IP Camera (2019)
A few days ago I had to replace the old IP camera I use to watch over my dogs and cats, and found out that IP cam technology changed a lot since I bought that old camera. IP cameras are now low-price and ubiquitous. I bought one of those generic models and installed it at my home, expecting to use the same software…
144
145
Samsung WB850F Firmware Reverse Engineering
Dissecting and symbol-mapping a camera firmware to get around WiFi hotspot mis-detection
146
The C bounded model checker: criminally underused
Follow along on a google colab: https://colab.research.google.com/github/philzook58/philzook58.github.io/blob/master/pynb/cbmc_tut.ipynb
147
"No way to prevent this" say users of only language where this regularly happens
Xe Iaso's personal website.
148
Déjà vu: Ghostly CVEs in my terminal title
As I've spoken and written about all modern terminals are actually "emulating" something dating from the 1970s.
149
Attack of the Week: Airdrop Tracing
It’s been a while since I wrote an “attack of the week” post, and the fault for this is entirely mine. I’ve been much too busy writing boring posts about Schnorr signatures!…
150
New 0-Day Attacks Linked to China's 'Volt Typhoon'
Malicious hackers are exploiting a zero-day vulnerability in Versa Director , a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon , a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the…