241
I Found Malware in a BeamNG Mod
An analysis using Process Monitor and WinDbg, dealing with JavaScript, WASM, and Windows shellcode.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 371 posts.
242
Go Cryptography State of the Union
I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.
243
Oh no, not again a meditation on NPM supply chain attacks
For enterprise software, the software supply chain presents some of the biggest risks today to data privacy and security.
244
Why can't we screenshot frames from DRM-protected video on Apple devices?
This “feature” accomplishes nothing of value for anyone, including the streaming services, but imposes a massive (and for most people, confusing and frustrating) hindrance on honest people simply trying to easily capture high-quality (as opposed to, say, using their damn phone to take a photograph of their reflective…
245
Things I learnt about passkeys when building passkeybot
Interesting things about passkeys in webauthn
246
How to distrust a CA without any certificate errors
A “distrust” is when a certification authority (CA) that issues HTTPS certificates to websites is removed from a root store because it is no longer trusted to issue certificates. This means certificates issued by that CA will be treated as invalid, likely causing certificate error interstitials in any browser that…
247
Alleged Jabber Zeus Coder 'MrICQ' in U.S. Custody
A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States, KrebsOnSecurity has learned.
248
Reviewing the cryptography used by Signal
Last year, I urged furries to stop using Telegram because it doesn’t actually provide them with any of the privacy guarantees they think it gives them. Instead of improving Telegram’s c…
249
250
Tinycolor supply chain attack post-mortem
Lessons learned from becoming the unexpected face of a npm supply-chain attack.
251
How does Ada's memory safety compare against Rust?
A comparison of how well Rust and Ada prevent the most common memory-related software errors.
252
ICE Is Buying a Tool to Track Phones, Without Warrants
Trump is quietly building a surveillance state, and almost no one is paying attention.
253
Reverse engineering Solos smart glasses
First and foremost: If you’ve got any documentation on this hardware, please contact me! I would love to read the actual specs for this protocol.
254
255
'Impossible-to-hack' security turns out to be no security
Teammate App had a publicly exposed database and told me to stop harassing them after I emailed them about it.
256
Who got arrested in the raid on the XSS crime forum?
On July 22, 2025, the European police agency Europol said a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS, a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS…
257
The issue of anti-cheat on Linux (2024)
Why are developers so hesitant to bring anti-cheat solutions to Linux?
258
Recursion kills: The story behind CVE-2024-8176 in libexpat
libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license .
259
Google does not want rights to things you do using Chrome (2008)
Alright, I’ve got another conspiracy theory misconception to dispel. :) After reading through the Chrome Terms of Service, some people are worried that Google is trying to assert rights on ev…
260
Reverse Engineering Yaesu FT-70D Firmware Encryption
This article dives into my full methodology for reverse engineering the tool mentioned in this article. It's a bit longer but is intended to be accessible to folks who aren't necessarily advanced reverse-engineers.
261
ICEBlock handled my vulnerability report in the worst possible way
Last week, I wrote about how Joshua Aaron's ICEBlock app, which allows people to anonymously report ICE sightings within a 5-mile radius, is – unfortunately, and despite apparent good intentions – activism theater. This was based on Joshua's talk at HOPE where he made it clear that he isn'
262
Running a Certificate Transparency log
Maybe you, yes you, should run a Certificate Transparency log. It’s cheaper, easier, and more important than ever.
263
Zero-knowledge proofs, encoding Sudoku and Mario speedruns without semantic leak
We published our video on zero-knowledge proofs! Surprisingly, making this video took a lot of work. Zero-knowledge proofs for coloring are one of those algorithms that, in hindsight, seem beautifu…
264
Mind the encryptionroot: How to save your data when ZFS loses its mind
While ZFS has a well-earned reputation for data integrity and reliability, OpenZFS native encryption has some incredibly sharp edges that will cut you if you don't know where to be careful. Unfortunately, I learned this the hard way, standing in a pool of my own blood and tears after thoroughly lacerating myself…
265
FBI, Dutch police disrupt 'Manipulaters' phishing gang
The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “ The Manipulaters ,” have been the subject of three stories published here…
266
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
267
Crates.io phishing attempt
Earlier this week, an npm supply chain attack. It’s turn for crates.io, the main public repository for Rust crates (packages). The phishing e-mail looks like this: And it leads to a GitHub login pa...
268
Cloudflare scrubs Aisuru botnet from top domains list
For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon , Apple , Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at…
269
Hacking the call records of millions of Americans
Imagine if anyone could punch in a phone number from the largest U.S. cell carrier and instantly retrieve a list of its recent incoming calls—complete with timestamps—without compromising the device, guessing a password, or alerting the user. Now imagine that number belongs to a journalist, a police officer, a…
270
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.