Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
In this blog post René Freingruber (@ReneFreingruber) from the SEC Consult Vulnerability Lab shares different filesystem tricks which were collected over the last years from various blog posts or found by himself.
A security flaw in New South Wales’ Internet voting system may have left as many as 66,000 votes vulnerable to interception and manipulation in a recent election, according to security researchers. Despite repeated assurances from the Electoral Commission that all Internet votes are “fully...
We're announcing the release of Hyperlight Wasm: a Hyperlight virtual machine “micro-guest” that can run wasm component workloads written in many programming languages. Learn more.
Discover the tools used in the Mr Robot television show to break into target computers. Then download, play and build your security knowledge.
Scan your iPhone for NSO Group's Pegasus malware using Mobile Verification Toolkit (MVT) by Amnesty International
We set up a MITM proxy and captured the decrypted HTTPS traffic from the official White House iOS app. On a single browsing session it contacts multiple Elfsight domains, sends your device fingerprint to OneSignal, and loads Google DoubleClick ad tracking. The privacy manifest says it collects nothing.
This week, the European Parliament's negotiators reached a broad majority agreement on a common position concerning the controversial EU chat control bill. The Commission’s bill proposes bulk scanning and reporting of private messages for allegedly suspicious content by using error-prone algorithms,
Posted by Nick Johnson | Filed under homomorphic-hashing , damn-cool-algorithms , fountain-codes
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
The Cambridge Programme on AI Science & Policy (CASP) is an interdisciplinary research programme on frontier AI at the University of Cambridge.
In the wake of Charlottesville, both GoDaddy and Google have refused to manage the domain registration for the Daily Stormer, a neo-Nazi website that, in the words of the Southern Poverty Law Center, is “dedicated to spreading anti-Semitism, neo-Nazism, and white nationalism.” Subsequently...
In recent days, the VPNFilter malware has attracted attention, much of it in the wake of a May 25 public service announcement from the FBI, as well as a number of announcements from vendors and security companies....
Edward Snowden said that he stepped forward because he came to realize that the US government is engaged in invasions of Americans' privacy on a vast and unprecedented scale, and was hiding its int...
For the first time, RL researchers discover malicious locally-installed npm packages infecting other legitimate packages.
Pillar Security researchers have uncovered a dangerous new supply chain attack vector we've named "Rules File Backdoor." This technique enables hackers to silently compromise AI-generated code by injecting hidden malicious instructions into seemingly innocent configuration files used by Cursor and GitHub Copilot—the…
Study of an Android runtime (ART) hijacking mechanism for bytecode injection through a step-by-step analysis of the packer used to protect the DJI Pilot Android application.
Update: On December 15, Judge Edward Shea issued his written opinion in United States v. Vargas, which you can read here. The public got an early holiday gift today when a federal court agreed with us that six weeks of continually video recording the frontyard of someone's home without a search...
We identified three independent remote code execution (RCE) vulnerabilities in the popular Counter-Strike: Global Offensive game. Each vulnerability can be triggered when the game client connects to our malicious python CS:GO server. This post details our journey through the CS:GO binary and conducts a technical deep…
Last week an important judicial ruling came down on a very intriguing case about open source license compliance. In this post, I'll talk about what makes it so interesting and potentially impactful across our industry.
Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry…
Stripe has made several significant, positive changes to its user tracking and privacy policies in the last week.
Let’s Encrypt has reached a point where we’re ready to announce our launch schedule. First certificate: Week of July 27, 2015 General availability: Week of September 14, 2015 We will issue the first end entity certificates under our root under tightly controlled circumstances. No cross-signature will be in place yet…
Randomness, entropy, and the Linux kernel.
The US imposes an almost total economic embargo on Iran, including a ban on all Iranian imports and sanctions on Iranian financial institutions.
My ISP was tampering with my DNS queries and handing back bogus IP addresses. Here are the misconceptions about DoH, DoT and DNSSEC that followed, and the setup I actually run.
Anthropic researchers find weaknesses in cryptographic algorithms with Claude Mythos Preview
More than a million domain names — including many registered by Fortune 100 firms and brand protection companies — are vulnerable to takeover by cybercriminals thanks to authentication weaknesses at a number of large web hosting providers and domain registrars, new research finds.
