2071
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
2072
Typical implementations of payment processing and related security issues
Thanks to @yarbabin for the logo Electronic payment systems have existed on the Internet for a long time, and some bugs in them are twenty years old. We’ve found critical vulnerabilities allowing us…
2073
Close the Washington Monument
Securing the Washington Monument from terrorism has turned out to be a surprisingly difficult job. The concrete fence around the building protects it from attacking vehicles, but there’s no visually appealing way to house the airport-level security mechanisms the National Park Service has decided are a must for…
2074
2075
Beginner's Guide to Wi-fi Interception
You know how security people get all uppity about SSL this and SSL that? Stuff like posting creds over HTTPS isn’t enough, you have to load login forms over HTTPS as well and then you can’t send auth cookies over HTTP because they’ll get sniffed and sessions
2076
2077
Backdooring JavaScript using minifier bugs
In addition to unforgettable life experiences and personal growth, one thing I got out of DEF CON 23 was a copy of POC||GTFO 0x08 from Travis Goodspeed. The coolest article I’ve read so far in it is “Deniable Backdoors Using Compiler Bugs,” in which the authors abused a pre-existing bug in CLANG to create a backdoored…
2078
What does $1265 of bugs look like?
To start with, there's a lot of spelling mistakes — 53, by my count. Within a few hours of my announcing the bug bounties, someone had run a spell checker against all of the comments in the Tarsnap source code and found about half of these; the rest, consisting mostly of cases where one English word was replaced by…
2079
I still don't think companies serve you ads based on your microphone
One of my weirder hobbies is trying to convince people that the idea that companies are listening to you through your phone’s microphone and serving you targeted ads is a …
2080
Money Laundering via Author Impersonation on Amazon
Patrick Reames had no idea why Amazon.com sent him a 1099 form saying he’d made almost $24,000 selling books via Createspace , the company’s on-demand publishing arm. That is, until he searched the site for his name and discovered someone has been using it to peddle a $555 book that’s full of nothing but gibberish.
2081
2082
Hacking the PS4 / PS5 Through the PS2 Emulator
In this article I will discuss how I successfully escaped the PS2 emulator developed for the PlayStation 4. See also Part 2 , covering the next part of the exploit chain, and PlayStation's response to the research.
2083
Your wifi shows me where you live, work and travel
Many people may already know that all your devices try to broadcast your previous connections. I expect that many more have no idea that’s happening. There have been articles published about it before, but without specific examples.
2084
Everything you wanted to know about SQL injection (but were afraid to ask)
This content is now available in the Pluralsight course "Ethical Hacking: SQL Injection" [http://www.pluralsight.com/courses/ethical-hacking-sql-injection]Put on your black hats folks, it’s time to learn some genuinely interesting things about SQL injection. Now remember – y’all play nice with the bits and
2085
Analysis of PS4's security and the state of hacking
Since there haven't been any major public announcements regarding PS4 hacking for a long time now, I wanted to explain a bit about how far PS4 hacking has come, and what is preventing further progression.
2086
2087
2088
2089
Don't Use RAR
Group for Apps and Services on Exascale Research Infrastructure is a research, development, and teaching unit at FIDIT + MedRi.
2090
Disable AI in Firefox
Quick reference for how to turn off AI features in Firefox
2091
SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack
For the past several months, I’ve been receiving and then ignoring a steady stream of concerning emails from Sendgrid, the popular email delivery service owned by Twilio that I use for sendin…
2092
History of AOL Warez
Link to original post on rajuabju.com Before I begin, let me state the following: This is my personal perspective of the history of Warez ...
2093
The C bounded model checker: criminally underused
Follow along on a google colab: https://colab.research.google.com/github/philzook58/philzook58.github.io/blob/master/pynb/cbmc_tut.ipynb
2094
Authentication and the Have I Been Pwned API
The very first feature I added to Have I Been Pwned after I launched it back in December 2013 was the public API [https://www.troyhunt.com/have-i-been-pwned-you-can-now-ask-api/]. My thinking at the time was that it would make the data more easily
2095
Hidden Messages in Emojis and Hacking the US Treasury
On December 30th, while most of us were preparing for a New Year’s Eve celebration, the US Treasury was prepping a notice to lawmakers to notify them that their systems, which (obviously) contain highly sensitive, confidential data, had been compromised.
2096
How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?
The latest Snowden document is the US intelligence ‘black budget.’ There’s a lot of information in the few pages the Washington Post decided to publish, including an introduction by Director of National Intelligence James Clapper. In it, he drops a tantalizing hint: ‘Also, we are investing in groundbreaking…
2097
2098
2099
Chinese app included malware to gain competitive advantage
Google says it has suspended the app for the Chinese e-commerce giant Pinduoduo after malware was found in versions of the software. The move comes just weeks after Chinese security researchers published an analysis suggesting the popular e-commerce app sought to seize total control over affected devices by exploiting…
2100
Verizon, caught red-handed
Verizon has now on multiple occasions refused to connect my Google Nexus 7 LTE tablet, though the device was publicized widely as working on Verizon and...