3061
IBM AI ('Bob') Downloads and Executes Malware
Vulnerabilities in IBMs Bob AI allow attackers to trigger the download and execution of malware via indirect prompt injection if users select auto-approve for even one known trusted command.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3062
Introducing Docker Secrets Management
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
3063
OnStar Begins Spying On Customers’ GPS Location For Profit
I canceled the OnStar subscription on my new GMC vehicle today after receiving an email from the company about their new terms and conditions. While most people, I imagine, would hit the delete button when receiving something as exciting as new terms and conditions, being the nerd sort, I decided to have a personal…
3064
I also hacked my car
Gonçalo MB. My personal website, projects, contacts and stuff.
3065
3066
Two Bytes to $951M
In February 2016 one of the largest cyber heists was committed and subsequently disclosed. An unknown attacker gained access to the Banglade...
3067
Target="_blank" – An underestimated vulnerability (2016)
Target="_blank" - the most underestimated vulnerability ever - Wednesday, 04 May 2016 - Alex's blog
3068
3069
3070
Intelligent Tracking Prevention 2.0
Note: Read about improvements to this technology in recent blog posts about Intelligent Tracking Prevention, and the Storage Access API.
3071
Microsoft Copilot Cowork Exfiltrates Files
Microsoft Copilot Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of insecure automatic action approvals for sending Emails and Teams messages.
3072
3073
Tachy0n: The Last 0day Jailbreak
Siguza’s Blog
3074
EU chat control law will ban open source operating systems
Update: Open source OSes might be saved from being covered depending on the interpretation of EU regulation 2019/1150 2.2.c.
3075
US Supreme Court Just Blew Up EU-US Data Transfers
The US Supreme Court decided that the US Federal Trade Commission (“FTC”) may not be independent anymore – with major implications for EU-US Data Transfers.
3076
Meta Files Patent for Facial Recognition, Automatic Recording of People
Meta filed for a patent that includes a "memory recall" system that appears to detect people via facial recognition and record them automatically, and show you a highlights real later.
3077
Macaroons Escalated Quickly
Documentation and guides from the team at Fly.io.
3078
Mysteries of Telegram Data Centers (2022)
Telegram claims to have 5 data centers (DCs), referred to as DC1~5 in Telegram’s code and documentation. Among them, DC1 and DC3 are located in Miami, USA; DC2 and DC4 are in Amsterdam, Netherlands; and DC5 is in Singapore. Each account is associated with a DC upon registration and does not change with the…
3079
FFmpeg and a thousand fixes
Posted by Mateusz Jurczyk and Gynvael Coldwind, Information Security Engineers At Google, security is a top priority - not only for our ow...
3080
Drilling open a smart door lock in 4 seconds
The BBC asked us to have a look at some smart locks for a TV show recently. We didn’t have much prep time, but were genuinely shocked by just how easy this one was to compromise. Usually, we spend time looking at Bluetooth/RF, the mobile app, the API and then move on to hardware. This […]
3081
Malware uses LLMs to rank victims by how much they're worth
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.
3082
Blasting Past WebP - An analysis of the NSO BLASTPASS iMessage exploit
An analysis of the NSO BLASTPASS iMessage exploit Posted by Ian Beer, Google Project Zero On Se...
3083
3084
Vulnerabilities in Password-Manager Apps
There are different policies for the generation of secure passwords. However, one of the biggest challenges is to memorize all these complex passwords. Password manager applications are a promising way of storing all sensitive passwords cryptographically secure. Accessing these passwords is only possible if the user…
3085
Docker Image Insecurity
Docker's report that a downloaded image is "verified" is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest.
3086
Apple security bounty upgraded
Apple’s Security Bounty program has paid nearly $20 million in rewards to security researchers in just two and a half years. Our new site makes it easier than ever for researchers to submit reports on the web, get real-time updates from Apple engineering, and earn recognition for helping to improve security for the…
3087
Firefox Private Browsing vs. Chrome Incognito: Which Is Faster?
With the launch of Firefox Quantum, Mozilla decided to team up with Disconnect Inc. to compare page load times between desktop versions of Chrome’s Incog
3088
Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.
3089
3090
Keybase chooses Zcash
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .