3511
Alert: NPM modules hijacked
<p><strong>EDIT : User @nj48 appears to <a href="https://twitter.com/seldo/status/712673227630313472">have no malicious intentions</a>.</strong></p>
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3512
NATO Classified Cloud Platform Compromised
Hackers attempted to use the data in an extortion scheme, joking about altering the source code or sending it to Russian intelligence
3513
3514
A mysterious bug in the firmware of Google's Titan M chip
Starting with the release of the Pixel 3, all of Google's Pixel Android smartphones come with the Titan M security chip on board. When I realized the Pixel 3a XL I purchased also had it, I decided to try to take advantage of it in an app I work on. It turned out that using the Titan M chip through the Android Keystore…
3515
Infineon RSA Key Generation Issue
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
3516
3517
Who's Selling Credit Cards From Target
The previous two posts on this blog have featured stories about banks buying back credit and debit card accounts stolen in the Target hack and that ended up for sale on rescator[dot]la , a popular underground store. Today’s post looks a bit closer at open-source information on a possible real-life identity for the…
3518
NSA Hacked French President’s House
“Keith Alexander (Director of the NSA) told me he was disappointed because he never thought we would detect them and he even added: You guys are good.” Bernard Barbier French newspaper …
3519
Tor Browser 9.0
We want everyone in the world to be able to enjoy the privacy and freedom online Tor provides, and that's why over the past couple years, we've been working hard to boost our UX and localization efforts, with the biggest gains first visible in Tor Browser 8.0. In Tor Browser 9.0, we continue to build upon those…
3520
3521
3522
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
On April 13, 2022, the Real World Crypto steering committee presented the Max Levchin Prize for Real-World Cryptography to Let’s Encrypt. The following is the speech delivered by our Executive Director, Josh Aas, upon receiving the award. We’d like to thank our community for supporting us and invite you to join us in…
3523
The Battle for Power on the Internet
We’re in the middle of an epic battle for power in cyberspace. On one side are the traditional, organized, institutional powers such as governments and large multinational corporations. On the other are the distributed and nimble: grassroots movements, dissident groups, hackers, and criminals. Initially, the Internet…
3524
What NPM should do to stop a new colors attack
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…
3525
A story on home server security
Happy New Year! Or so I thought. After a refreshing Christmas vacation with my family, I was stashing something away in our storage room when I noticed the server fan running at maximum speed. This was very unexpected, considering my server is powered by an Intel i3 and should handle all the light tasks I run quite…
3526
If you are harassed by lasers
The green and blue "laser" dots at lower left are actually lens flare caused by the bright sun at upper right. The sun is reflecting off elements inside the lens, causing dots or flare. The flare is almost always located diagonally mirrored from a bright light source. Photo of a sunset, with upper and lower "beams"…
3527
Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera
Claimed end-to-end privacy doesn’t fully conceal your rear-end data
3528
3529
Our Approach to Privacy
Apple products, including Apple Intelligence, are designed to protect your privacy, because privacy is a fundamental human right.
3530
TSA-style body scanners are coming to public spaces
Civil Rights, Criminal Justice and Homeland Security
3531
Google confirms Java and OpenSSL crypto PRNG on Android are broken
News and insights on the Android platform, developer tools, and events.
3532
Unauthenticated RCE on a RIGOL oscilloscope
I work in a company that uses custom electronic boards, so there are plenty of instruments floating around that electrical engineers employ to debug faulty connections and solderings. One kind of tools used are the oscilloscopes, tools that measure signals and plot them in a graphically understandable way. We have a…
3533
3534
3535
3536
“Fractureiser” malware in popular Minecraft mods and modpacks
Malware is being distributed through Minecraft mods and modpacks mainly through CurseForge
3537
DoubleClickjacking: A New type of web hacking technique
data:blog.metaDescription
3538
3539
Linux Kernel Exploitation: Attack of the Vsock
What started off as casual scrolling through the KernelCTF submissions quickly spiraled into a weeks-long deep dive into a deceptively simple patch - and my first root shell from a Linux kernel exploit!
3540
CVE-2021-3011: Key recovery on Google Titan Key
Download the Writeup Illustration made by Romain Flamand Abstract The Google Titan Security Key is a FIDO U2F hardware device proposed by Google (available since July 2018) as a two-factor authentication token to sign in to applications (e.g. your Google account). Our work describes a side-channel attack that targets…