2341
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,334 posts.
2342
2343
Finding and exploiting hidden features of Animal Crossing's NES emulator
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
2344
Chrome's experiment of hiding the URL is great for security
iOS has hidden the pathname of URLs for some time now, but recently Chrome Canary introduced something similar behind a flag.
2345
How to compromise your system with a job interview
The current situation on the IT job market is hard. So you are lucky when a recruiter on LinkedIn reaches out to you having a suitable match for a new position based on your prior experience. It might not be what it seems at a first glance.
2346
2347
2348
Does Zoom use end-to-end encryption?
TL;DR: It’s complicated. Yesterday Zoom (the videoconferencing company, not the defunct telecom) put out a clarification post describing their encryption practices. This is a nice example of …
2349
Pwned Passwords in Practice: Real World Examples of Blocking the Worst Passwords
Back in August, I pushed out a service as part of Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) to help organisations block bad passwords from their online things. I called it "Pwned Passwords" and released 320M of them from real-world data breaches [https://www.troyhunt.com/introducing-306-
2350
Analyzing the Monoprice Blackbird HDCP 2.2 to 1.4 Down Converter
I got my hands on a Monoprice Blackbird 4K Pro HDCP 2.2 to 1.4 Converter . According to the marketing copy it “is the definitive solution for playback of new 4K HDCP 2.2 encoded content on 4K displays with the old HDCP 1.4 standard.”
2351
A CVE Dispute
A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE or not. No more bogus CVEs. 57 CVEs … Continue reading a CVE dispute →
2352
It took me nine years to hack my Xbox 360
I purchased a Matrix CoolRunner Rev D back in 2017. This little chip is called a glitcher and it’s a type of modchip. Its sole purpose, the reason it was designed, is to deliver a short pulse of energy (~ 100 nanoseconds) to an Xbox 360 Console.
2353
Recommended Security Reading
dfir.org is the personal page of Andrew Case ( @attrc ). This website serves as a central location for all of my research, software projects, and speaking events.
2354
Who wants to be tracked?
“We value your privacy…”, the clichéd beginning of many a privacy notice. I legitimately do value my own online privacy, and whenever I read that phrase as part of a website consent banner it sounds like lip service at best. Consent banners ostensibly exist to give users control over their data & personal privacy. Far…
2355
Freeing My Phone from Google
Phones are so full of ads that you don’t even notice them anymore. Suggestions and notifications you didn’t ask for, tracking mechanisms you don’t even know are there, services over which you have no control. It’s absurd how much smartphones, a large extension of our private and social lives, are controlled and…
2356
TPM GPIO fail: How bad OEM firmware ruins Intel TPM security
In this article I demonstrate a software only attack that allows an operating system to set the PCRs of a discrete TPM device to arbitrary values and unseal any secret that uses a PCR based sealing policy (such as disk encryption keys used by unattended unlock TPM FDE schemes).
2357
2358
2359
Linux kernel security work
Lots of the CVE world seems to focus on “security bugs” but I’ve found that it is not all that well known exactly how the Linux kernel security process works. I gave a talk about this back in 2023 and at other conferences since then, attempting to explain how it works, but I also thought it would be good to explain…
2360
Dystopian Surveillance Is Becoming a Reality
Apple recently announced an upcoming feature for their new Apple Watches called “Audio Intelligence,” which will always be listening to a...
2361
How I protect my Forgejo instance from AI web crawlers
This article describes my nginx configuration and strategy on how to prevent web crawlers from putting down my instance while still serving most people with minimal amount of friction.
2362
2363
Firewall rules: not as secure as you think
A post outlining tricks for firewall privilege escalation
2364
Faking Twitter unfurling to phish you
Do you trust links? Well, you shouldn’t. Do you trust this link: Twitter says this link should take you to Uniswap, nobody would be none-the-wiser because we…
2365
Class Breaks
There’s a concept from computer security known as a class break. It’s a particular security vulnerability that breaks not just one system, but an entire class of systems. Examples might be a vulnerability in a particular operating system that allows an attacker to take remote control of every computer that runs on…
2366
Hacking a Virtual Power Plant
I recently had solar panels and a battery storage system from GivEnergy installed at my house. A major selling point for me was that they have a local network API which can be used to monitor and…
2367
2368
Blowback from the NSA surveillance.
There’s one piece of blowback that isn’t being discussed—aside from the fact that Snowden has killed the chances of any liberal arts major getting a DoD job for at least a decade—and that’s how the massive NSA surveillance of the Internet affects the US’s role in Internet governance. Ron Deibert makes this point: But…
2369
Reverse engineering an ancient wireless security keypad using RTL-SDR
A few weeks ago, some friends and I decided that our houses weren’t crammed full enough with useless crap and so we embarked on a journey to a large junk shop surplus warehouse. The place was a vast hangar brimming with old and curious pieces of technology ranging from IBM keyboards to VHS video editing …
2370