2191
How to dismantle a compiler bomb
You have heard of “zip bombs” (a tiny ZIP file that decompresses to multiple gigabytes) and “XML bombs” (small XML file abusing the entities to consume lots of memory), and …
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,334 posts.
2192
How I hacked my IP camera, and found this backdoor account
The time has come. I bought my second IoT device - in the form of a cheap IP camera. As it was the most affordable among all others, my exp...
2193
U.S. sanctions cloud provider 'Funnull' as top source of 'pig butchering' scams
The U.S. government today imposed economic sanctions on Funnull Technology Inc. , a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “ pig butchering .” In January 2025, KrebsOnSecurity detailed how Funnull was…
2194
The Claude Code Leak
What the accidental Claude Code source code leak tells us about the real value of code, product market fit, and why integration is what actually makes software great.
2195
Chrome Privacy
Dave Winer ends an otherwise quite reasonable piece about his concern at Facebook's
2196
How to Tell a Job Offer from an ID Theft Trap
One of the oldest scams around — the fake job interview that seeks only to harvest your personal and financial data — is on the rise, the FBI warns. Here’s the story of a recent LinkedIn impersonation scam that led to more than 100 people getting duped, and one almost-victim who decided the job offer was…
2197
Breach at IT Outsourcing Giant Wipro
Indian information technology (IT) outsourcing and consulting giant Wipro Ltd. [ NYSE:WIT ] is investigating reports that its own IT systems have been hacked and are being used to launch attacks against some of the company’s customers, multiple sources tell KrebsOnSecurity. Wipro has refused to respond to questions…
2198
Analysis of Obfuscation Techniques Found in Apple FairPlay
FairPlay comprises a set of algorithms created by Apple for digital rights management (also called DRM, digital rights management). FairPlay is currently used to manage the decryption of iOS applications during their installation on Apple devices. In fact, we know that Apple distributes all applications in the Apple…
2199
German police raid DDoS-friendly host FlyHosting
Authorities in Germany this week seized Internet servers that powered FlyHosting , a dark web offering that catered to cybercriminals operating DDoS-for-hire services, KrebsOnSecurity has learned. FlyHosting first advertised on cybercrime forums in November 2022, saying it was a Germany-based hosting firm that was…
2200
How I Tricked Symantec with a Fake Private Key
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
2201
OpenSSH Keystroke Obfuscation Bypass
A disclosure for an OpenSSH keystroke obfuscation bypass affecting current OpenSSH versions after 9.4.
2202
2203
Encryption at Rest: Whose Threat Model Is It Anyway?
Head’s up: This is a blog post about applied cryptography, with a focus on web and cloud applications that encrypt data at rest in a database or filesystem. While the lessons can be broadly a…
2204
Sendgrid under siege from hacked accounts
Email service provider Sendgrid is grappling with an unusually large number of customer accounts whose passwords have been cracked, sold to spammers, and abused for sending phishing and email malware attacks. Sendgrid’s parent company Twilio says it is working on a plan to require multi-factor authentication for all…
2205
Essential security for Linux servers (2013)
Father, Founder, and FuturistBuilding bestinterest.app and podcasting for coparents.Learn more about me.
2206
2207
Bitcoin Private Key Necromancy
tl;dr: https://github.com/pierce403/keyhunter ~ The Longer Version ~ A few weeks ago, a friend came to me with a problem. Way back...
2208
Aren't AMP Caches committing copyright infringement?
How can mass-copying pages from web publishers without a license not be mass-copyright infringement? The weird copyright law exemption that enables AMP Caches.
2209
2210
2211
2212
Apple's MacBook Pro DFU port documentation is wrong
According to the Apple support document How to identify the DFU port on Mac , the DFU (device firmware update) port location for MacBook Pro models with Apple silicon is as follows:
2213
Scam Alert: Fake DMCA Takedown for Link Insertion
There are a lot of scams out there, but one that's been plaguing bloggers like me lately is a novel twist: A fake DMCA takedown notice that's actually a link insertion scam! Beware: The notices I'm getting are very convincing-looking, complete with a fake law firm website!
2214
Linux Local Privilege Escalation via SUID /proc/pid/mem Write
Introducing Mempodipper , an exploit for CVE-2012-0056. /proc/ pid /mem is an interface for reading and writing, directly, process memory by seeking around with the same addresses as the process's virtual memory space. In 2.6.39, the protections against unauthorized access to /proc/ pid /mem were deemed sufficient…
2215
Hacking Transcend WiFi SD Cards
UPDATE : This post has been featured in the Hacker News front page! Thanks! I have also updated this post with additional information (at t...
2216
2217
Testing a new encrypted messaging app's extraordinary claims
How I accidentally breached a nonexistent database and found every private key in a 'state-of-the-art' encrypted messenger called Converso.
2218
It’s 255:19AM. Do you know what your validation criteria are?
Ed25519 signature validation criteria vary widely between implementations, creating risks for consensus systems. Here's why and how to fix it.
2219
On the new Snowden documents
If you don’t follow NSA news obsessively, you might have missed yesterday’s massive Snowden document dump from Der Spiegel. The documents provide a great deal of insight into how the NSA brea…
2220
SSL certificate requirements are becoming obnoxious
SSL requirements are quickly becoming obnoxious.