2911
Userdir URLs like https://example.org/~username/ are dangerous
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
2912
2913
Hacking Airline Lounges for Free Meals
I think this is a great hack: A man bought a first-class ticket and used it to have free meals and drinks at the airport’s VIP lounge almost every day for nearly a year, Kwong Wah Yit Poh reported. The itinerary for the ticket was found to have been changed more than 300 times within a year, and the owner of the…
2914
Users Rationally Rejecting Security Advice (2009)
This paper, by Cormac Herley at Microsoft Research, sounds like me: Abstract: It is often suggested that users are hopelessly lazy and unmotivated on security questions. They chose weak passwords, ignore security warnings, and are oblivious to certicates errors. We argue that users’ rejection of the security advice…
2915
Shifting Cyber Norms: Microsoft security POST-ing to you
tl;dr: Microsoft and other email security scanners will visit the links in email you transmit, and run the JavaScript in those links, including calls that lead to POSTs going out. This used to be unacceptable, since POSTs have side effects. Yet here we are. This breaks even somewhat sophisticated single-use sign-on /…
2916
Outlook.com is silently discarding email messages (2015)
Outlook.com and hotmail.com is silently discarding email messages from our SMTP server.
2917
Passwords For Your Facebook Account
This is interesting. You can log into your Facebook account using three passwords – one is the main password that you created and the other passwords can…
2918
Phone Numbers Stink as Identity Proof
Phone numbers stink for security and authentication. They stink because most of us have so much invested in these digits that they’ve become de facto identities. At the same time, when you lose control over a phone number — maybe it’s hijacked by fraudsters, you got separated or divorced, or you were way late on your…
2919
Security: OpenBSD vs. FreeBSD
Blog about network and security, showing example of Linux iptables and Snort configuration, and Windows security softwares.
2920
‘Land Lordz’ Service Powers Airbnb Scams
Scammers who make a living swindling Airbnb.com customers have a powerful new tool at their disposal: A software-as-a-service offering called “ Land Lordz ,” which helps automate the creation and management of fake Airbnb Web sites and the sending of messages to advertise the fraudulent listings.
2921
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
2922
Document poisoning in RAG systems: How attackers corrupt AI's sources
RAG poisoning attack walkthrough: an attacker injects fabricated documents into a ChromaDB knowledge base and the LLM reports false financials as fact. Fully reproducible, 100% local, no GPU required.
2923
Here’s why we keep getting hacked – clear and present Billabong failures
It happened again last week. No, not Yahoo! Voices [https://www.troyhunt.com/2012/07/what-do-sony-and-yahoo-have-in-common.html], not the Phandroid Android forums [http://www.zdnet.com/android-forums-hacked-1-million-user-credentials-stolen-7000000817/] , not NVidia [http://www.zdnet.com/nvidia-confirms-
2924
Exploiting the Math.expm1 typing bug in V8
Minus zero behaves like zero, right?
2925
Pwned, the book
The first time I ever wrote publicly about a company's security vulnerabilities, my boss came to have a word with me after seeing my name in the news headlines. One of the worst days I've ever had was right in the middle of the Have I Been Pwned
2926
Thunderstrike 2: Mac firmware worm details
Collection of my projects and hacks.
2927
How to break everything by fuzz testing
Fuzz testing is a bit like the infinite monkey theorem, but instead of Shakespeare you get crashes.
2928
Tiny, cheap, and dangerous: Inside a fake iPhone charger
Thoughts on the death of Ma Ailun According to reports , a woman in China was tragically electrocuted using her iPhone while it was char...
2929
2930
Anatomy of a Failed (Nation-State?) Attack
A fake-interview scam tried to backdoor my machine with PinpinRAT, hidden in a malicious TypeScript patch. Analysis of the attack, payload, and indicators of compromise.
2931
Tips for more effective fuzz testing with AFL++
Fuzz testing is incredibly effective for mechanically discovering software defects, yet remains underused and neglected. Pick any program that must gracefully accept complex input, written in any language , which has not yet been been fuzzed, and fuzz testing usually reveals at least one bug. At least one program…
2932
Why not use DNS over HTTPS (DoH)?
DoH is not about protecting your DNS queries from peepers. That is a big lie. It is about making sure only one peeper can see all of your queries.
2933
Who's behind the SWAT USA reshipping service?
Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today’s Part II, we’ll examine clues about the real-life identity of “ Fearlless ,” the nickname…
2934
What, if anything, should I do about using Mozilla's Firefox
I have used it for a long time - 20 years now, including for a while the IceWeasel variant - and I like it as a browser.
2935
Bring Your Own Password Manager: Portable BitWarden on a Pi Zero
BYOPM is a self hosted portable Password Manager implementation based on BitWarden and Raspberry PI Zero.
2936
StartSSL domain validation vulnerability
StartSSL certificate authority is well known for offering free domain validated SSL certificates, and also sells organisation and extended v...
2937
CNN, NYTimes, Mashable all vulnerable to XSS
Pretending innocence, I ask why all these high profile websites have their homepages covered in spinning images? CNN (screenshot) The New York Times (screenshot) Mashable (screenshot) Fox News (screenshot) Okay, obviously enough, I’m messing with them. But how can I do that? The answer is cross site scripting (“XSS”)…
2938
2939
2940
An unexpected Redis sandbox escape affecting Debian-based distros
This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking, but there will be more on that later.