2041
Hijacking user sessions with the Heartbleed vulnerability
The Heartbleed issue is actually worse than it might immediately seem (and it seems pretty bad already).
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
2042
Linux Capabilities Revisited
Technical blog by Stephan Berger (@malmoeb)
2043
Jitsi privacy flaw enables one-click stealth audio and video capture
A Jitsi feature allows an attacker to transmit user's microphone and camera in the background without their consent.
2044
Planning Go 1.20 cryptography work
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
2045
When DEF CON partners with the U.S. Army
DEF CON has alienated many hackers by officially aligning its geopolitics with those of the U.S. military and announcing partnerships with the authoritarian countries of Bahrain and Singapore.
2046
Why [Insert Thing Here] Is Not a Password Killer
These days, I get a lot of messages from people on security related things. Often it's related to data breaches or sloppy behaviour on behalf of some online service playing fast and loose with HTTPS or passwords or some other easily observable security posture. But on a fairly regular
2047
Incapacitating Google Tag Manager (2022)
Drilling beneath the hype to expose the truth
2048
Delimiters won’t save you from prompt injection
Prompt injection remains an unsolved problem. The best we can do at the moment, disappointingly, is to raise awareness of the issue. As I pointed out last week, “if you …
2049
2050
Abusing the Chromium Devtools Scope Pane
tl;dr — Abusing the Chromium Devtools Scope Pane to track debugging of specific javascript functions
2051
Android NAT-T keepalive offload bypasses VPN lockdown
Technical report on Android VPN lockdown bypass via NAT-T keepalive offload.
2052
2053
Golang SSH Redux
I’ll cover the post/blog, and then I’d like to counter some misconceptions. While part of me thinks “I must’ve been very unclear to have so many people misunderstand”, I also saw how many people commented without bothering to read, so really there’s a limit to how much self-flagellation will happen.
2054
Shamir’s Secret Sharing Scheme
Consider a scenario in which you are tasked with managing the security of a bank's vault. The vault is considered impenetrable without a key, which you are g...
2055
2056
Who's Attacking My Server?
One of the unexpected 1 outcomes of the Russian invasion in Ukraine is a large increase in nefarious access attempts to servers under my control, not necessarily appearing to arise from Russian IP addresses. There are the usual attempts at brute-forcing SSH access, for instance, but also a flurry of malevolent HTTP(S)…
2057
Is this the new cyber normal?
A week of cyber incidents one after another – is this what every week is going to look like and what can we do about it?
2058
2059
Bypassing disk encryption on systems with automatic TPM2 unlock
oddlama's personal web page and blog
2060
Why Intel will never let owners control the ME
The Intel Management Engine is an auxillary microprocessor embedded into modern Intel x86 CPUs or chipsets. 1 It runs an Intel-signed proprietary binary blob. Due to code signing restrictions enforced by the hardware, it cannot be modified or replaced by the user. (AMD x86 CPUs have a similar auxillary microprocessor…
2061
2062
Samsung WB850F Firmware Reverse Engineering
Dissecting and symbol-mapping a camera firmware to get around WiFi hotspot mis-detection
2063
Exploiting DNS response parsing on the Wii U
It's annual Wii U exploit time! 😄 Image of the Wii U connection test screen on the GamePad. After reverse engineering parts of the Wii Us' ...
2064
2065
Using the HTML5 Fullscreen API for Phishing Attacks
Feross Aboukhadijeh is a computer security researcher, teacher, web developer, designer, long distance runner, gamer, music lover, and builder of websites that (sometimes) go viral.
2066
Linux Certificate Authority root stores have a too simple view of 'trust'
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2067
A 2FA app that tells you when you get `314159` (2024)
An indie project for early 2010s internet addicts
2068
Randomize your WiFi MAC address on Ubuntu
Your device’s MAC address can be used to track you across the WiFi networks you connect to. That data can be shared and sold, and often identifies you as an individual. It’s possible to limit this tracking by using pseudo-random MAC addresses.
2069
Bulletproof host Stark Industries evades EU sanctions
In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd. , a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new findings show those…
2070
DNS Wars
NANOG is now quite an institution in the Internet, particularly in the North American Internet community. It was an offshoot of the Regional Techs meetings, which were part of the NSFNET framework of the late 80s and early 90s. NANOG has thrived since then and is certainly one of the major network operational forums…