1951
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1952
macOS Zero-Day Used Against Hong-Kong Activists
Google researchers discovered a MacOS zero-day exploit being used against Hong Kong activists. It was a “watering hole” attack, which means the malware was hidden in a legitimate website. Users visiting that website would get infected. From an article: Google’s researchers were able to trigger the exploits and study…
1953
Welcoming the Nepalese Government to Have I Been Pwned
Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond
1954
1955
1956
Inside the failed attempt to backdoor SSH globally that got caught by chance
Why the threat actor rushed deployment.
1957
Phish-friendly domain registry ".top" put on notice
The Chinese company in charge of handing out domain names ending in “ .top ” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that…
1958
Can We Stop Pretending SMS Is Secure Now?
SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that…
1959
U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, First-Ever Report
What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations. In a first-of-its-kind report,
1960
How Apple’s iCloud Drive deletes your files without warning
[…] with iCloud Drive, you can safely store all your presentations, spreadsheets, PDFs, images, and any other kind of document in iCloud. Then access them from your iPhone, iPad, iPod touch, Mac, or PC […]
1961
Plex vulnerabilities being exploited in the wild to drop a cryptominer
Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitati...
1962
A most elegant TCP hole punching algorithm
The algorithm in this post needs “double buckets” to be reliable. Otherwise, the two sides can split on bucket boundaries and fail to converge. If the first bucket fails, compute an additional bucket step for convergence. My algorithm trades slow startup for less infrastructure.
1963
Cisco can't stop using hard-coded passwords
There’s a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A…
1964
OpenAI – vulnerability responsible disclosure
Update with OpenAI response added What happened? On 29 May 2025 I privately reported a vulnerability to the OpenAI disclosure mailbox using an encrypted email. The flaw allows peeking at chat responses intended for other users. This content may contain personal data, confidential business plans, …
1965
1966
Set up an email server in two hours
You may be concerned that the NSA is reading your e-mail. Is there really anything you can do about it though? After all, you don’t really want to move off of GMail / Google Apps. And no plac…
1967
CORS is not meant to secure an API endpoint
CORS does not secure your API: why browser-side API keys are unsafe, and how to protect Drupal JSON:API endpoints with proper authentication.
1968
Learning from OpenBSD can make computers marginally less horrible
The following document is an attempt to consolidate down a number of threads spanning separate discussions from around the 'net I have been having on the subject of operating system development models and OpenBSD. I will break up this document into several sections each of which will handle separate pillars of my…
1969
Running Unsupported iOS on Deprecated Devices
Earlier this year I demoed iOS 6 running on an iPod touch 3 - a device that Apple never gave iOS 6 to, making iOS 5.1.1 the latest build it can run
1970
Reverse engineering Xiaomi air purifier NFC stickers
For a very thorough write-up on how this all works , please visit : https://unethical.info/2024/01/24/hacking-my-air-purifier/
1971
Popular iPhone and iPad Apps Snooping on the Pasteboard
This article provides an investigation of some popular apps that frequently access the pasteboard without user consent. These apps range from popular games and social networking apps, to news apps of major news organizations. We found that many apps quietly read any text found in the pasteboard every time the app is…
1972
How Obama’s BlackBerry got secured (2013)
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
1973
Remote Code Execution Found in CocoaPods
tl;dr CocoaPods is a popular package manager used by lots of iOS apps (among other Swift and Objective-C Cocoa applications). I found a remote code execution...
1974
A High-Level Technical Overview of Homomorphic Encryption
About two years ago, I switched teams at Google to focus on fully homomorphic encryption (abbreviated FHE, or sometimes HE). Since then I’ve got to work on a lot of interesting projects, learning along the way about post-quantum cryptography, compiler design, and the ins and outs of fully homomorphic encryption. If…
1975
1976
Why CVE-2022-3602 was not detected by fuzz testing
So recently a very hyped memory corruption security vulnerability was discovered in the OpenSSL punycode parser. Some folks including Hanno ...
1977
1978
Feedly gets hit by DDoS attack, refuses to give in to blackmail
Feedly reports that it is suffering from a denial-of-service attack that could impact users’ ability to catch up with the latest updates from their favourite websites.
1979
1980
The God Login
I graduated with a Computer Science minor from the University of Virginia in 1992. The reason it’s a minor and not a major is because to major in CS at UVa you had to go through the Engineering School, and I was absolutely not cut out for that kind