1981
Nobody expects CDATA sections in XML
I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1982
You cannot have a digital copy of the DC Code
On how the law was taken away from the people of Washington, DC by legal shenanigans
1983
Smuggling USB Sticks
"This Is Not A Film" by Iranian director Jafar Panahi, who is under house arrest in his country for alleged “propaganda against the regime,” will be screened under the Free Jafar Panahi Program of the 13th Cinemanila. The film was smuggled from Iran in a Flash-Drive hidden inside a cake to Cannes for screening a few…
1984
SMS phishers harvested phone numbers, shipment data from UPS tracking tool
The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details…
1985
Private spies hired by FBI and corporations infiltrate Discord, Reddit, WhatsApp
Leading “threat intelligence” firms are creating fake online personas to gain access to every corner of the web.
1986
Phishing with Linkedin's Intro
Security and Programming Blog
1987
Why I’m not speaking at CPDP: It’s the privacy-washing
13 Jan, 2016 The sponsorship of privacy and human rights conferences by corporations that erode our privacy and human rights is a clear conflict of interests that we must challenge. The revolution will not be sponsored by those we are revolting against.
1988
Facebook exploit – Confirm website visitor identities
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
1989
The CIA's “Development Tradecraft Do's and Dont's”
Useful best practices for malware writers, courtesy of the CIA. Seems like a lot of good advice. General: DO obfuscate or encrypt all strings and configuration data that directly relate to tool functionality. Consideration should be made to also only de-obfuscating strings in-memory at the moment the data is needed…
1990
1991
1992
Security Keys
Security Keys are (generally) USB-connected hardware fobs that are capable of key generation and oracle signing. Websites can “enroll” a security key by asking it to generate a public key bound to an “appId” (which is limited by the browser based on the site's origin). Later, when a user wants to log in, the website…
1993
1994
1995
Most laser printer printed pages have tracking watermark
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><a href="http://brahmsyellowdots.blogspot.com/2008/10/it-begins.html">About This Blog</a>
1996
1997
Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
1998
Hacking the Nintendo DSi Browser
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
1999
Attacking Merkle Trees with a second preimage attack
Hacking, hardware, software, and general curiosities of computing machinery! Docendo discumus.
2000
Passwordless: a different kind of hell?
It's no secret that authenticating into services is an unresolved topic. With time, we have managed
2001
The Now-Defunct Firms Behind 8chan, QAnon
Some of the world’s largest Internet firms have taken steps to crack down on disinformation spread by QAnon conspiracy theorists and the hate-filled anonymous message board 8chan . But according to a California-based security researcher, those seeking to de-platform these communities may have overlooked a simple legal…
2002
Gab Has Been Breached
I've investigated hundreds of data breaches over the years (there are 514 of them in Have I Been Pwned [https://haveibeenpwned.com/] as I write this), and for the most part, the situation with Gab is just another day on the internet. But Gab is also different, having grown
2003
I can't use my number pad for 2FA codes
This has to be the most infuriating bug report I've ever submitted. I went to type in my 2FA code on a website - but no numbers appeared on screen. Obviously, I was an idiot and had forgotten to press the NumLock button. D'oh! I toggled it on and typed again. No numbers appeared. I switched to another tab, my numbers…
2004
Do not use redirection characters in your shell prompt
Over the years of troubleshooting performance problems in the Unix/Linux world, I have seen multiple cases where a regularly used command line tool in a customer server just stops working for some reason. The tool just returns immediately, doing absolutely nothing. No output printed, no coredumps and the exit code is…
2005
Meltdown and Spectre Linux Kernel Status
I keep getting a lot of private emails about my previous post about the latest status of the Linux kernel patches to resolve both the Meltdown and …
2006
ldd arbitrary code execution (2009)
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
2007
2008
How your data is collected and commoditised via “free” online services
I get a lot of people popping up with data breaches for Have I been pwned [https://haveibeenpwned.com/] (HIBP). There’s an interesting story in that itself actually, one I must get around to writing in the future as folks come from all sorts of different backgrounds and offer
2009
Thomas Jefferson and Apple versus the FBI
When Prohibition began, anti-alcohol crusaders demanded that the St. Louis Public Library burn every book that explained "the home production of alcohol for drinks". The librarian insisted on keeping the books but agreed to hide them from the "general public".
2010
Why I stopped using StartSSL (Hint: it involves a Chinese company)
StartSSL uses https://auth.startssl.com/ for the front-end to access to their PKIs (login to the PKI, create, revoke certificates...). It's the Core of their service and the critical part of their infrastructure.