391
Police CyberAlarm Uses Alarming Cryptography
Today we’re going to be talking about this code, shared on Twitter by Paul Moore. It’s worth noting that this code snippet was after Paul attempted to alert them to security issues with…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 642 posts.
392
A Closer Look at the Lapsus$ Data Extortion Group
Microsoft and identity management platform Okta both this week disclosed breaches involving LAPSUS$ , a relatively new cybercrime group that specializes in stealing data from big companies and threatening to publish it unless a ransom demand is paid. Here’s a closer look at LAPSUS$, and some of the low-tech but…
393
MikroTik authentication revealed
A deep-dive into MikroTik's hand-rolled Elliptic Curve Secure Remote Protocol (EC-SRP) cryptography used in client-server authentication
394
GitHub Copilot isn't worth the risk
Copilot may be a glimpse into the future of AI, but it comes with a lot of legal and security baggage.
395
396
Universal's Audible Watermark (2012)
This is my personal blog. The views expressed on this page are mine alone. Update, April 8, 2013: Can you hear it? Take the watermark listening test. Update, January 14, 2015: Check out the results of the listening test. A while ago, I wrote about my confusion regarding Weird Spotify Compression Artifacts. It turns…
397
Using a Canon EOS camera as a webcam in Debian
Learn how to use your Canon EOS camera as a webcam on Debian Linux with secure boot enabled. Step-by-step guide for installing dependencies, signing the v4l2loopback module, and using the camera in applications. Works with many camera brands including Canon, Fuji, HP, Kodak, Nikon, Pentax, Sanyo, and Sony.
398
399
Over 20k servers have their iLO interfaces exposed to the internet
Over 20 thousand servers have their iLO interfaces exposed to the internet, many with outdated and vulnerable versions of FW, Author: Jan Kopriva
400
Telegram: No-SIM Signup, Auto-Delete All Chats, Topics 2.0 and more
With this update, you can have a Telegram account without a SIM card and set up a global timer to automatically delete messages in all new chats. Topics in groups are now even more powerful – and available for groups with 100+ members.
401
Apple’s macOS Ventura – New Security Changes
With macOS 13, Apple have made some bold and potentially disruptive changes to Mac security. We explore them here.
402
Ignore 98% of dependency alerts: introducing Semgrep Supply Chain
An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.
403
Interoperability without sacrificing privacy: Matrix and the DMA
Matrix, the open protocol for secure decentralised communications
404
405
Attacking Titan M with Only One Byte
Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.
406
Apple neglects to patch two zero-day, wild vulnerabilities for Big Sur, Catalina
Apple has chosen to leave Big Sur and Catalina (around 35 to 40 percent of all Macs) in danger of actively exploited vulnerabilities that have only been patched for macOS Monterey.
407
Can a Tarot card reading be defamatory?
Crazed Tik-Toker's Tirade Against University Professor Raises Fact v. Opinion Issue
408
409
The most backdoor-looking bug I’ve ever seen (2021)
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
410
SIM swapper abducted, beaten, held for ransom
A Florida teenager who served as a lackey for a cybercriminal group that specializes in cryptocurrency thefts was beaten and kidnapped last week by a rival cybercrime gang. The teen’s captives held guns to his head while forcing him to record a video message pleading with his crew to fork over a $200,000 ransom in…
411
Indian government withdraws Personal Data Protection Bill
The government has withdrawn the Personal Data Protection Bill, which had been in the works for three years, slamming the brakes indefinitely on privacy safeguards in India.
412
Requiring MFA on popular gem maintainers
News and updates from the RubyGems team — releases, security advisories, and project announcements.
413
Best Practices for Securing SSH
This article explores 5 SSH best practices you should observe to boost the security of your infrastructure.
414
Consider Disabling Browser Push Notifications on Family and Friends Devices
A terrible user-hostile browser feature is being misused, surprising no one.
415
Fog Revealed: A guided tour of how cops can browse your location data
In Part 1 of our series on Fog Data Science, we saw how when you give some apps permission to view your location, it can end up being packaged and sold to numerous other companies. Fog Data Science is one of those companies, and it has created a sleek search engine called Fog Reveal that allows cops to browse through…
416
Fuzzing rust-minidump for Embarrassment and Crashes – Part 2
For the last year, we've been working on the development of rust-minidump. The final part in this series takes you through fuzzing rust-minidump.
417
PyPI package 'secretslib' drops fileless Linux malware to mine Monero
Sonatype identified a 'secretslib' PyPI package that covertly installs cryptominers on Linux systems.
418
How we secure Monzo's banking platform
Our Security Infrastructure team introduces the principles we follow to build security in Monzo’s fast-moving engineering environment and how they work with other engineering teams to keep our customers and platform safe.
419
Lasershark: Fast, bidirectional communication into air-gapped systems
We present a novel approach to infiltrate data to air-gapped systems without any additional hardware on-site.
420
PyPI: Python packets steal AWS keys from users
Multiple Python packages caught by Sonatype were seen uploading secrets such as AWS keys and environment variables to a web endpoint.