421
Jailed Just-in-Time Compilation on iOS
Saagar Jha's website.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 612 posts.
422
Virtual Machine Detection in the Browser (2019)
Virtual Machine (VM) detection is nothing new. Malware has been doing it for over a decade now. Over time the techniques have advanced as defenders learned new ways of avoiding VM detection. A while back a friend and I were working on a project related to exploit delivery via a web application for redteaming purposes…
423
Cofactor Explained: Clearing Elliptic Curves' dirty little secret
Efficient elliptic curves tend not to have a prime order. This discusses the problems this causes, and the solutions.
424
Sealed Rust Update
Part 2 - The Plan
425
Leakage paths for the Apple / Google Bluetooth tracing system
Plus general overview
426
Using ‘radioactive data’ to detect if a data set was used for training
Facebook AI has developed a new technique to mark the images in a dataset, so that researchers can then determine if a particular machine learning model...
427
428
Application trust is hard, but Apple does it well
On November 12, 2020 Apple released macOS Big Sur. In the hours after the release went live, somewhere in Apple's infrastructure an OCSP esponder cried out in pain…
429
DOMPurify bypass: XSS via HTML namespace confusion
Securitum is a pure pentesting company specialising in the security of IT systems. We have experience in performing security audits (including penetration tests) - mainly for financial/e-commerce/industrial sectors. We have performed penetration tests and cyber security services for leading European banks (see…
430
Why Credit Card Fraud Is Still a Thing
Most of the civilized world years ago shifted to requiring computer chips in payment cards that make it far more expensive and difficult for thieves to clone and use them for fraud. One notable exception is the United States, which is still lurching toward this goal. Here’s a look at the havoc that lag has wrought, as…
431
TP-Link Archer VR1600V V2 Super User Password Cracked
Well the news is out, I won’t explain the method for reasons, but our code warriors have a new fight. After requesting the SU password, they were told flat out it doesn’t exist and refe…
432
Office Drama on macOS
infecting macOS via macro-laden documents and 0days
433
What a one line change did to the Chrome sandbox
Posted by James Forshaw, Project ZeroThe Chromium sandbox on Windows has stood the test of time. ...
434
Tracking systems of TV streaming devices
Watching you watch: the tracking ecosystem of over-the-top TV streaming devices, Moghaddam et al., CCS’19 The results from this paper are all too predictable: channels on Over-The-Top (OTT) s…
435
Guidance to developers affected by effort to block less secure browsers, apps
We are always working to improve security protections of Google accounts. Our security systems automatically detect, alert and help protect our users against a range of security threats. One form of phishing, known as “ man-in-the-middle ”, is hard to detect when an embedded browser framework (e.g., Chromium Embedded…
436
The Infosec Apocalypse
The rise of tooling for vulnerability detection combined with pressure driven by Vendor Due Diligence is causing a massive enterprise freezeout for non-mainstream technologies across the board. Of particular concern is the impact this will have on the adoption of functional programming in enterprise and small business…
437
Bahamas Company Registry Leaked
The people are the best thing about a life in science fiction – eclectic, bright, opinionated, talented – people like Elise Mathson: writer, jeweller, and all-round brilliant person (she's up for a Hugo this year).
438
United States wants HTTPS for all government sites, all the time
The Sophos Blog
439
Sandboxing and workload isolation
Documentation and guides from the team at Fly.io.
440
Privacy Badger Is Changing to Protect You Better
Privacy Badger was created to protect users from pervasive non-consensual tracking, and to do so automatically, without relying on human-edited lists of known trackers. While our goals remain the same, our approach is changing. It is time for Privacy Badger to evolve.Thanks to disclosures from...
441
Threema apps are Open Source
In Celebration of Becoming Open Source, Threema is 50% Off
442
Sequoia PGP 1.0 Released: The Seedling Is a Sapling
Sequoia is a modular OpenPGP implementation in Rust.
443
Is your chip card secure? Much depends on where you bank
Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But a recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain…
444
Userdir URLs like https://example.org/~username/ are dangerous
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
445
How to break everything by fuzz testing
Fuzz testing is a bit like the infinite monkey theorem, but instead of Shakespeare you get crashes.
446
Accused spy Alexander Yuk Ching Ma evidently beat the polygraph
On Thursday, 13 August 2020, FBI Special Agent Chris Jensen filed under seal a criminal complaint against Alexander Yuk Ching Ma of Honolulu, Hawaii, charging him with “Conspiracy to Gather and Communicate National Defense Information of the United States to a Foreign Nation.” On Monday, 17 August 2020, the complaint…
447
448
Scammers registering date-based domain names
Yesterday, January 2nd, my wife received a billing alert from her phone provider. Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date. If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is…
449
450
