3151
Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
a post going over 4 exploits for CVE-2024-20017, a remotely exploitable buffer overflow in a component of the MediaTek MT7622 SDK.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3152
3153
Hard, Not Soft, Kill Switches
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
3154
NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
In this post, we show you how easy it is to introduce back doors that are easily missed by project owners… leaving your code insecure.
3155
Responsibility Deflected, the CLOUD Act Passes
UPDATE, March 23, 2018: President Donald Trump signed the $1.3 trillion government spending bill—which includes the CLOUD Act—into law Friday morning. “People deserve the right to a better process.”Those are the words of Jim McGovern, representative for Massachusetts and member of the House of...
3156
Hacking misconfigured AWS S3 buckets: A complete guide
AWS S3 (Simple Storage Service) buckets are a popular storage service used by software companies and organizations to store public as well as sensitive data. However, the implementation of this servic...
3157
Court Rules No Suspicion Needed for Laptop Searches at Border
Decision Dismisses ACLU Lawsuit Challenging DHS Search Policy as Unconstitutional...
3158
Finland’s most-wanted hacker nabbed in France
Julius “Zeekill” Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding…
3159
Who keeps an eye on clipboard access?
If there is any feature that “universally” describes the usage of computers, it is the copy/paste pattern. We are used to it, practically all the common graphical user interfaces have support for it, and it magically works.
3160
Bitsquatting Windows.com
Earlier this month, I came back around to seriously considering an attempt at bitsquatting. While the prior link goes into great depth on the topic, I will attempt to give a very high level overview here: If this sort of thing interests you: I tend to do stuff like this weekly. Give me a follow @_mattata
3161
Mitmproxy 7.0
We’re delighted to announce the release of mitmproxy 7, a free and open source interactive HTTPS proxy. This release is all about our new proxy core, which bring substantial improvements across the board and represents a massive milestone for the project.
3162
3163
The design of Chacha20
Chacha20 is a secure, fast, and amazingly simple encryption algorithm. Let's take a look.
3164
Unlocking a locked/deactivated e-waste Cricut Maker
How I returned a Cricut Maker back to service after Cricut remotely bricked the unit
3165
3166
Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection
A Hacker's Blog of Unintended Use and Insomnia.
3167
FBI is warning people against using public phone-charging stations
The FBI is warning people against using public phone-charging stations, worrying that the combination power-data port can be used to inject malware onto the devices: Avoid using free charging stations in airports, hotels, or shopping centers. Bad actors have figured out ways to use public USB ports to introduce…
3168
3169
Senators Urge FTC to Probe ID.me over Selfie Data
Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for “deceptive statements” the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service …
3170
On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM
Putting on my tinfoil hat.
3171
OpenSSH Backdoors
Imagine this: an OpenSSH backdoor is discovered, maintainers rush to push out a fixed release package, security researchers trade technical details on mailing lists to analyze the backdoor code. Speculation abounds on the attribution and motives of the attacker, and the tech media pounces on the story. A near miss
3172
3173
3174
Spying on HTTPS
When I launched Chrome on Thursday, I saw something unexpected: While most users probably would have no idea what to make of this, I happened to know what it means– Chrome is warning me that …
3175
How Equifax Was Breached in 2017
On a Saturday night, a security engineer at Equifax was updating an SSL certificate on a Network Intrusion Detection System (NIDS). Immediately after, suspicious connections were detected. After a more in-depth investigation, it became evident that the situation was far graver than anticipated. A service had to be…
3176
Using fake reviews to find dangerous extensions
Fake, positive reviews have infiltrated nearly every corner of life online these days, confusing consumers while offering an unwelcome advantage to fraudsters and sub-par products everywhere. Happily, identifying and tracking these fake reviewer accounts is often the easiest way to spot scams. Here’s the story of how…
3177
How to break a Captcha system in 15 minutes with Machine Learning
Let’s hack the world’s most popular Wordpress CAPTCHA Plug-in
3178
3179
3180
Decrypting encrypted files from Akira ransomware using a bunch of GPUs
I recently helped a company recover their data from the Akira ransomware without paying the ransom. I'm sharing how I did it, along with the full source code. Update: since this article was written, a new version of Akira ransomware has appeared that can't be decrypted with this method The c