2491
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
2492
A Closer Look at the Lapsus$ Data Extortion Group
Microsoft and identity management platform Okta both this week disclosed breaches involving LAPSUS$ , a relatively new cybercrime group that specializes in stealing data from big companies and threatening to publish it unless a ransom demand is paid. Here’s a closer look at LAPSUS$, and some of the low-tech but…
2493
Data is a Toxic Asset
Thefts of personal information aren’t unusual. Every week, thieves break into networks and steal data about people, often tens of millions at a time. Most of the time it’s information that’s needed to commit fraud, as happened in 2015 to Experian and the IRS. Sometimes it’s stolen for purposes of embarrassment or…
2494
Scamming the scammers – catching the virus call centre scammers red-handed
A few months back I got a call one evening which was clearly a virus call centre scam; you know, the ones that call you out of the blue, tell you your PC is infected with all sorts of nasties and offer to fix it for you? Or maybe you
2495
Petition the U.S. Government to Force the TSA to Follow the Law
This is important: In July 2011, a federal appeals court ruled that the Transportation Security Administration had to conduct a notice-and-comment rulemaking on its policy of using “Advanced Imaging Technology” for primary screening at airports. TSA was supposed to publish the policy in the Federal Register, take…
2496
Learning to break ciphers
Every now and then, I read a question about learning how to break ciphers, or more generally how to become a cryptographer/cryptologist. From my viewpoint, the most important part of learning this…
2497
The strange story of “Extended Random”
Yesterday, David Benjamin posted a pretty esoteric note on the IETF’s TLS mailing list. At a superficial level, the post describes some seizure-inducingly boring flaws in older Canon printers…
2498
2499
Reverse engineering Animal Crossing's developer mode
Last summer I began reverse engineering Animal Crossing for the GameCube to explore the possibility of creating mods for the game. I also wanted to document the process to create tutorials for people interested in ROM hacking and reverse engineering. In this post I explore the developer debugging features that are…
2500
A Critique on “A Critique on the OpenPGP Updates”
An occasional blog about OpenPGP keyservers and related issues
2501
LibreSSL's PRNG is Unsafe on Linux
The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1 ). Despite the 2.0.x version numbers, these are only preview releases and shouldn't be used in production yet, but have been released to solicit testing and feedback. After testing and examining the codebase, my…
2502
Secure Computing for Journalists
This morning on Twitter, Buzzfeed editor Miriam Elder asks the following question: Possibly stupid question: is the Signal desktop client as secure as the mobile app? — Miriam Elder (@MiriamElder) …
2503
An Example of a Sad Google Account Recovery Failure and Its Effects
UPDATE: 24 May 2023: A Proposal for “Enhanced Recovery Services” for Locked Out Google Accounts
2504
Universal's Audible Watermark (2012)
This is my personal blog. The views expressed on this page are mine alone. Update, April 8, 2013: Can you hear it? Take the watermark listening test. Update, January 14, 2015: Check out the results of the listening test. A while ago, I wrote about my confusion regarding Weird Spotify Compression Artifacts. It turns…
2505
PRISM? Come to Israel to study our surveillance state
It seems that those who were astonished, abhorred, enraged or outraged from finding out that the National Security Agency (NSA) tracked millions of united states citizens and did so with the cooperation of numerous internet service providers, telecommunication companies and web-based hosting services had not even…
2506
2507
Using a Canon EOS camera as a webcam in Debian
Learn how to use your Canon EOS camera as a webcam on Debian Linux with secure boot enabled. Step-by-step guide for installing dependencies, signing the v4l2loopback module, and using the camera in applications. Works with many camera brands including Canon, Fuji, HP, Kodak, Nikon, Pentax, Sanyo, and Sony.
2508
Complete, Persistent Compromise of Netgear Wireless Routers
UPDATE: Turns out, Jacob Holocomb ( @rootHak42 on Twitter) of Independent Security Evaluators found this bug back in April on a different d...
2509
AppLovin nonconsensual installs
Mobile adtech juggernaut AppLovin recently faced multiple allegations of misconduct . Allegations run the gamut—privacy, ad targeting, even national security and ties to China. I was among the researchers consulted by skeptical investors this spring, and I was quoted in one of their reports, explaining my concerns…
2510
2511
SimpleVisor – Intel VT-x hypervisor in 500 lines of C code
Simplevisor : SimpleVisor is a simple, portable, Intel VT-x hypervisor with two specific goals: using the least amount of assembly code (10 lines), and having the smallest amount of VMX-related code to support dynamic hyperjacking and unhyperjacking (that is, virtualizing the host state from within the host). It runs…
2512
2513
Hunting for Malicious Packages on PyPI
I installed every package on PyPI to look for malicious content. This is what I found.
2514
Github became the web's largest font piracy site (2017)
Front-end antics and typographic mischievousness
2515
Slightly safer vibecoding by adopting old hacker habits
I have seen a lot of public discussion around supply-chain attacks on the Python ecosystem, prompt injection risks when using coding agents,...
2516
2517
When str.lower() is a security vulnerability in Python
Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...
2518
No, I did not hack your MS Exchange server
New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name.
2519
Amazon Assistant lets Amazon track your every move on the web
Amazon Assistant browser extension delegates its wide range of privileges to Amazon web services. The potential for misuse is enormous.
2520