1621
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1622
Decrypting encrypted files from Akira ransomware using a bunch of GPUs
I recently helped a company recover their data from the Akira ransomware without paying the ransom. I'm sharing how I did it, along with the full source code. Update: since this article was written, a new version of Akira ransomware has appeared that can't be decrypted with this method The c
1623
Dear USA, my data has left your building
NSA, GCHQ, Prism, FISA, Project Bullrun, Sigint. After Edward Snowden, former CIA and NSA employee, started revealing how massively, intensely and easily we are all being spied upon by the intelligence agencies of various governments, the terms above have suddenly been spending a great deal more time in the media…
1624
1625
Let's Encrypt: an automated certificate authority to encrypt the entire web
Let’s encrypt: an automated certificate authority to encrypt the entire web, Aas et al., CCS’19 This paper tells the story of Let’s Encrypt, from it’s early beginnings in 20…
1626
EC2's most dangerous feature
A review for readers unfamiliar with this feature: Amazon IAM ( Identity and Access Management ) is a service which allows for the creation of access credentials which are limited in scope; for example, you can have keys which can read objects from Amazon S3 but cannot write any objects. IAM Roles for EC2 are a…
1627
Into the Borg – SSRF inside Google production network
Intro - Testing Google Sites and Google Caja In March 2018, I reported an XSS in Google Caja, a tool to securely embed arbitrary html/javascript in a webpage. In May 2018, after the XSS was fixed, I r
1628
1629
Reverse Engineering Unknown File Formats with ImHex
An Introduction to File Formats and ImHex by Reverse Engineering FEZ's Save File Format
1630
1631
Analysis of bank PIN numbers
Is your PIN number too predictable? Detailed analysis on PIN number databases.
1632
Is true hacking dead? What we lost
Realtime rendering and videogame programming mostly, but I love computer science and visuals in all their forms. This is a notepad of my ideas.
1633
1634
1635
The NSA is Commandeering the Internet
It turns out that the NSA’s domestic and world-wide surveillance apparatus is even more extensive than we thought. Bluntly: The government has commandeered the Internet. Most of the largest Internet companies provide information to the NSA, betraying their users. Some, as we’ve learned, fight and lose. Others…
1636
A technical look at Iran's internet shutdowns
This post is written by a human being (me).
1637
1638
Many of the root certificates on Windows are not needed
As of today, Windows trusts 322 root certificates issued by 122 different organizations from 47 countries. This number is quite high, and has been steadily growing over the last few years. And it turns out many of those certificates are not needed at all by the vast majority of Windows users, can be distrusted with no…
1639
1640
AWS IAM Roles, a tale of unnecessary complexity
This is going to be a highly opinionated blog post. I think AWS is great and use it daily, but their implementation of IAM is unnecessarily complicated.
1641
1642
Here’s what Ashley Madison members have told me
I found myself in somewhat of a unique position last week: I’d made the Ashley Madison data searchable for verified subscribers of Have I been pwned? [https://haveibeenpwned.com/] (HIBP) and now – perhaps unsurprisingly in retrospect – I was being inundated with email. I mean hundreds of emails every day
1643
How can you be fooled by the U+202E trick? (2013)
Ethical Hacking, Malware Analysis, Disinfection Techniques, Information Security, Pentesting Techniques and all related with Computer Security.
1644
QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack
Cloud hosting provider iNSYNQ says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users…
1645
The order of files in /etc/ssh/sshd_config.d/ matters
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1646
Iran forged the wrong SSL certificate
If you want to be really evil, however, *.google.com is the wrong SSL certificate to forge. The right one? ssl.google-analytics.com .
1647
1648
Always Review Your Dependencies, AGPL Edition
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
1649
Remote code execution vulnerability in Google they are not willing to fix
This is a story about a security vulnerability in Google that allowed me to run arbitrary code on the computers of 50+ Google employees. Although Google initially considered my finding a serious security incident, later on, it changed its mind and stated that my finding is not, in fact, a vulnerability, but the…
1650