361
The Yandex leak: How a Russian search giant uses consumer data
In late January 2023, almost 45 GB of source code from the Russian search giant Yandex was leaked on BreachForums by a former Yandex employee.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 617 posts.
362
Testing a new encrypted messaging app's extraordinary claims
How I accidentally breached a nonexistent database and found every private key in a 'state-of-the-art' encrypted messenger called Converso.
363
How to Escape a Container
Panoptica by Outshift delivers advanced cloud-native security insights to help teams protect modern applications and infrastructure at scale.
364
TeleSign profiles half of the world’s mobile phone users
TeleSign generates a “reputation score” and sells it to various clients. TeleSign secretly received the mobile phone data from BICS, a Belgian company that provides interconnection services
365
Targeted attack on our management with the Triangulation Trojan
So you’ve heard of blockchain. But how can you use it in your enterprise today? Vitaly Mzokov explores the benefits and security challenges.
366
Phishing domains tanked after Meta sued Freenom
The number of phishing websites tied to domain name registrar Freenom dropped precipitously in the months surrounding a recent lawsuit from social networking giant Meta , which alleged the free domain name provider has a long history of ignoring abuse complaints about phishing websites while monetizing traffic to…
367
Devirtualizing nike.com's bot protection
In this blog post, we'll examine the virtualization obfuscation used by Nike
368
The threat on your desk: Building an evil USB-C dock
BadUSB attacks have been a threat for years, but is the USB-C dock sitting on your desk the latest threat in disguise?
369
Tiffin Tom: Fish, chips and a side of identity theft
Apart from leaking everything, there's been "no breech". Avoid Tiffin Tom.
370
TouchEn nxKey: A keylogging anti-keylogger solution
TouchEn nxKey is supposed to combat keyloggers. Instead, this application made writing a keylogger extremely simple, allowed attacking banking websites and more.
371
Debunking the Myth of "Anonymous" Data
Today, almost everything about our lives is digitally recorded and stored somewhere. Each credit card purchase, personal medical diagnosis, and preference about music and books is recorded and then used to predict what we like and dislike, and—ultimately—who we are. This often happens without our...
372
Your WiFi Can See You
And it's so much worse than you think
373
Pwned or Bot
It's fascinating to see how creative people can get with breached data. Of course there's all the nasty stuff (phishing, identity theft, spam), but there are also some amazingly positive uses for data illegally taken from someone else's system. When I first built Have I Been Pwned
374
Global Encryption Day: Encryption's Critical Role in Safeguarding Human Rights
Today is the third annual Global Encryption Day, a day to highlight why encryption is critical for a safe, private internet.
375
Elixir/Erlang Secure Coding and Deployment Hardening Guidelines
Documentation, specifications and code from the Security Working Group of the Erlang Ecosystem Foundation
376
MSI's (in)Secure Boot
Before we start, maybe I will quickly explain what Secure Boot is. It is a security feature, which allows our computer to decline booting operating systems that have not been signed by a key that the firmware trusts.
377
California Court of Appeal finds geofence warrant unconstitutional
The California Court of Appeal has held that a geofence warrant seeking information on all devices located within several densely-populated areas in Los Angeles violated the Fourth Amendment. This is the first time an appellate court in the United States has reviewed a geofence warrant. The case is...
378
Memory safety is necessary, not sufficient
TL;DR: I think that a focus on memory safe languages (MSLs) versus non memory-safe languages is a bit of a red herring. The actual distinction is slightly…
379
SCOTUS declines to hear challenge to warrantless pole camera surveillance
WASHINGTON — The U.S. Supreme Court today declined to hear Moore v. United States, leaving in place a patchwork of lower court decisions on an...
380
Cloudflare is free of CAPTCHAs; Turnstile is free for everyone
Now that we’ve eliminated CAPTCHAs at Cloudflare, we want to hasten the demise of CAPTCHAs across the internet. We’re thrilled to announce that Turnstile is generally available, and Turnstile’s ‘Managed’ mode is now completely free to everyone for unlimited use.
381
382
Spoofing DNS records by abusing DHCP DNS dynamic updates
Akamai researchers discovered a new set of attacks against Active Directory (AD) using Microsoft DHCP servers that can lead to full AD takeover.
383
€1.2B GDPR fine for Meta
Facebook must stop further transfers of European personal data to the United States, given that Facebook is subject to US surveillance laws (like FISA 702 and EO 12.333).
384
385
Analyzing the Monoprice Blackbird HDCP 2.2 to 1.4 Down Converter
I got my hands on a Monoprice Blackbird 4K Pro HDCP 2.2 to 1.4 Converter . According to the marketing copy it “is the definitive solution for playback of new 4K HDCP 2.2 encoded content on 4K displays with the old HDCP 1.4 standard.”
386
Tokenized Tokens
Documentation and guides from the team at Fly.io.
387
Who wants to be tracked?
“We value your privacy…”, the clichéd beginning of many a privacy notice. I legitimately do value my own online privacy, and whenever I read that phrase as part of a website consent banner it sounds like lip service at best. Consent banners ostensibly exist to give users control over their data & personal privacy. Far…
388
389
390
Mashing Enter to bypass full disk encryption with TPM, Clevis dracut and systemd
This vulnerability allows a physically-present attacker to control the full disk encryption unlock process and gain complete access to decrypted content in some cases where a TPM, dracut and Clevis are used.