2791
Hacking Oklahoma State University's Student ID
READ THIS AFTER - a full follow up here: http://snelling.io/following-up-hacking-oklahoma-state-universitys-student-id
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
2792
It's Been a Year and Georgia.gov Continues to Be Hacked
Illegal drug transactions facilitated through Georgia's employee portal
2793
Wiretapping the Internet
On Monday, The New York Times reported that President Obama will seek sweeping laws enabling law enforcement to more easily eavesdrop on the internet. Technologies are changing, the administration argues, and modern digital systems aren’t as easy to monitor as traditional telephones. The government wants to force…
2794
HTTPS in the real world
In cryptography, trust is mathematically provable. Everything else is just faith.
2795
Reverse Engineering Yaesu FT-70D Firmware Encryption
This article dives into my full methodology for reverse engineering the tool mentioned in this article. It's a bit longer but is intended to be accessible to folks who aren't necessarily advanced reverse-engineers.
2796
2797
2798
Safari is now probably the influential wild card browser for user privacy
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2799
Application trust is hard, but Apple does it well
On November 12, 2020 Apple released macOS Big Sur. In the hours after the release went live, somewhere in Apple's infrastructure an OCSP esponder cried out in pain…
2800
Don't Roll Your Own
This is going to be a rant about modern web design practices. But before I get to that, let me begin with a familiar principle from the world of cryptography. Among software developers, and especially among those who work on security-sensitive systems, there is a well-known maxim: Don't roll your own crypto. This does…
2801
ICEBlock handled my vulnerability report in the worst possible way
Last week, I wrote about how Joshua Aaron's ICEBlock app, which allows people to anonymously report ICE sightings within a 5-mile radius, is – unfortunately, and despite apparent good intentions – activism theater. This was based on Joshua's talk at HOPE where he made it clear that he isn'
2802
The sorry state of OpenSSL usability (2017)
OpenSSL's inadequate documentation, confusing key formats, and deprecated interfaces make it difficult to use, despite its importance.
2803
Snowden's Dead Man's Switch
Edward Snowden has set up a dead man’s switch. He’s distributed encrypted copies of his document trove to various people, and has set up some sort of automatic system to distribute the key, should something happen to him. Dead man’s switches have a long history, both for safety (the machinery automatically stops if…
2804
Dropbear SSH, a lightweight alternative to OpenSSH
Dropbear is a small and lightweight SSH server and client that can replace OpenSSH on any POSIX platform such as GNU / Linux, * BSD, Cygwin … Dropbear is free software since it is released under MIT-style licenses.
2805
GitHub Spam
Spam on GitHub is getting out of control and affecting 10,000's of users daily. GitHub is seemly doing nothing about it, here is the proof.
2806
Why the US federal employee record breach is worse than others
During the week of June 8th, the Office of Personnel Management (OPM) announced that the records of all current and past US federal employees had been compromised. That includes standard employment information - address, social security numbers, etc - of over 4 million people ranging from a random forest ranger to US…
2807
2808
When Undercover Credit Card Buys Go Bad
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security…
2809
2810
Screenshot-proof images via temporal dithering
Snapchat 's (and now Facebook Poke 's) main claim to fame is that it lets you send "self-destructing" image messages. Setting aside the debate about the uses of this beyond sexting , the key vulnerability in both apps is the built-in ability to take screenshots. Both take a reactive approach, where you're notified if…
2811
Unprivileged process injection techniques in Linux
I'm joev, a security engineer 👋 You may know me from my work at Apple or on Metasploit, or from my CVEs.
2812
On Python security amidst recent Rails/YAML vulnerabilities
The Rails community has had a few high-profile security issues this week. They are well-summarized, with an alarming list of what follow-ons to expect, by Patrick McKenzie: What the Rails Security Issue Means for Your Startup.
2813
2814
Boring SSL
Earlier this year, before Apple had too many goto fails and GnuTLS had too few , before everyone learnt that TLS heart-beat messages were a thing and that some bugs are really old , I started a tidy up of the OpenSSL code that we use at Google.
2815
Debugging macOS Kernel Using VirtualBox
Update: In the HN discussion, awalton mentioned you can set CPUID flags in VMWare. Simply adding cpuid.7.ebx = "-----------0--------------------" to the vmx file will disable SMAP. Late last year, I upgraded my old MBP to the 2016 model with a Skylake processor. As I was debugging a kernel exploit, it turned out that…
2816
Reverse Engineering the Facebook Messenger API
Note: The focus of this article is to explain the process of reverse engineering, and it is not continually updated to reflect ongoing changes in Facebook APIs. If you are looking for updated details, consider basing your work on open-source projects like mautrix/meta , which is developed by my employer Beeper .
2817
Fooling around with encrypted reasoning blobs
Update August 11, 2026: A group of researchers from all over Europe were inspired by this post, and actually turned it into a real working attack! Check out their writeup and paper here. This is a …
2818
2819
Why Credit Card Fraud Is Still a Thing
Most of the civilized world years ago shifted to requiring computer chips in payment cards that make it far more expensive and difficult for thieves to clone and use them for fraud. One notable exception is the United States, which is still lurching toward this goal. Here’s a look at the havoc that lag has wrought, as…
2820
TP-Link Archer VR1600V V2 Super User Password Cracked
Well the news is out, I won’t explain the method for reasons, but our code warriors have a new fight. After requesting the SU password, they were told flat out it doesn’t exist and refe…