Topics /
The most popular blog posts about security & privacy on Hacker News. 312 posts.
This started with a consulting snafu: Government organisation A got government organisation B to develop a web application. Government organisation B subcontracted part of the work to somebody. Hosting and maintenance of the project was later contracted out to a private-sector company C. Company C discovered that the…
By now most infosec professionals are aware of various ways SMS text messaging can be hijacked. For example so-called “SIM Swap” attacks…
Management of kernel extensions has changed significantly in Big Sur and later. This overview for users contrasts kexts with user-level extensions which are replacing them.
This investigation into email tracking attempts to deconstruct tracking links and pixels and highlight the data that is being collected. It covers Mailchimp, …
User Generated Content is great, innit? As a company, I want users to submit photos, so I don't have to do any content curation. Moderation? Nah mate, stick some AI on there to filter out anything offensive and we're golden. *sigh* James Whatley (inactive)@WhatleydudeSurprised Loch Ness isn't trending tbqh.❤️ 7💬 0🔁…
This is the story of how all non-admin users can read the registry — and so elevate privileges and access sensitive credential information…
🔎I authored this blog post whilst I was an employee of Gitpod for Gitpod. I no longer work at Gitpod. In what seems like a long time ago, in part because it is, I learned the catastrophic capabilities of this command the hard way, and I'm sure folks my
DDraceNetwork is an open source online game I’ve been running since 2013 with a community of volunteers. The game is available for free, I’m hosting servers for it in many countries around the world so that we have trusted official ranks . The servers are paid for by donations , which I stop collecting once the cost…
中文 First of all, thank Orange Tsai for giving me the opportunity to participate in Black Hat USA 2021 in Las Vegas. This article would not exist without this ticket. I am going to share my thoughts and some technical topics on the two days of Black Hat USA 2021 in this article. The hotel and the conference venue are…
There’s a tradition in my family that everyone takes a turn stirring a secret wish into the yearly christmas pudding . It’s important that the wishes remain secret to the wisher or the pudding magics wont work so since moving to America I’ve implemented a new way of hashing my wish so it can be stirred in via text…
This blog post is intended for a less technical audience – specifically parents and nurseries using the NurseryCam system. NurseryCam is a camera system that is installed in nurseries, allowi…
Disclaimer: I’m no sysadmin extraordinaire, please please please correct me if there’s something blatantly wrong here:
This morning, my wife noticed that Alexa was insistently flashing its little blue lights. "Alexa... Notifications?" "You have one notification. An item on your wishlist has dropped in price. The … is now only £…" And that's how my wife found out what I planned to get her for her birthday! What happened to cause this?…
This article has now been extensively corrected and modified.
Violation of privacy by proxy is still violation of privacy.
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
… and seL4 and RISC-V Foundations form an alliance In June 2020 we announced that the seL4 microkernel, the world’s first operating system (OS) kernel with a machine-checked proof of implemen…
Back in 2017 (feels like ages ago) I decided to take a peek into the ShadowBrokers leaks and reverse some of the tools. I started on dewdrop simply because it had a macOS version. I made local presentations at 0xOpoSec and BSidesLisbon but those slides were never published for obvious reasons (aka live implants all…
Contact Facebook customer service for your customer service needs. Reach out via phone, email, or social media.
personal web-log
This article will examine in details what happened during the two transactions that exploited vulnerabilities to open under-collateralized positions in bZx, causing a loss of equity worth more than a million dollar in total.
Working in information/cybersecurity and technology risk is a fascinating and challenging career, as I’ve covered here. There is, mostly, a great spirit of sharing and collaboration among security professionals. However, I’ve observed one disturbing and growing trend in the past few years that might be characterized…
A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using…
I spent a lot of time and effort digging up the numbers and facts for this post! Lots of people keep referring to the awesome summary put together by a friendly pseudonymous "Tim" which says that "53 out of 95" (55.7%) security flaws in curl could've been prevented if curl had been written in Rust. … Continue reading…
Back in May 27, 2020 Microsoft published a blog post describing a new feature in Notepad:
Identifying and exploiting over 70 cache poisoning vulnerabilities across major bug bounty programs, including GitHub, GitLab, Shopify and HackerOne.
