5131
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
5132
Did the Clinton Email Server Have an Internet-Based Printer?
The Associated Press today points to a remarkable footnote in a recent State Department inspector general report on the Hillary Clinton email scandal: The mail was managed from the vanity domain “ clintonemail.com .” But here’s a potentially more explosive finding: A review of the historic domain registration records…
5133
Stop Breaking TLS
Rant ahead: I hate TLS “Inspection” software with a burning passion and I wish we collectively as an industry would just knock it the fuck off and stop pretending it’s some great security benefit. Every time I encounter it, in whatever form, it’s a gigantic headache that makes everyone’s life worse off and as far as I…
5134
5135
WebBundles harmful to content blocking, security tools, and the open web
Google is proposing a new standard called WebBundles. This standard allows websites to “bundle” resources together, and will make it impossible for browsers to reason about sub-resources by URL. While we appreciate the problems the WebBundles and related proposals aim to solve, we believe there are other, better ways…
5136
Bypassing Browser Security Warnings with Pseudo Password Fields
It seems that there is no limit to human ingenuity when it comes to working around limitations within one's environment. For example, imagine you genuinely wanted to run a device requiring mains power in the centre of your inflatable pool - you're flat out of luck, right? Wrong! Or
5137
Kaspersky exposes hidden malware on GitHub stealing personal data
Kaspersky Global Research & Analysis Team (GReAT) discovered hundreds of open source repositories with multistaged malware targeting gamers and cryptoinvestors within a new campaign that was dubbed by Kaspersky as GitVenom. The infected projects include an automation instrument for interacting with Instagram accounts…
5138
How do you know when macOS detects and remediates malware?
macOS may alert you when you’re trying to open or run a file, with an alert informing you that malware was detected. But what about in scans?
5139
Crypto wallet security as seen by security engineers
How to build secure crypto wallets, analysing issues found during crypto wallet security audits.
5140
If malware authors ever learn how to spell we're all screwed
Forgive the lousy screenshot and transparency in the title bar, but I just got ...
5141
DraftKings: a $21B SPAC betting it can hide its black market operations
Initial Disclosure: After extensive research, we have taken a short position in shares of DraftKings, Inc. This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
5142
5143
Attacking Titan M with Only One Byte
Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.
5144
5145
5146
267M Facebook users IDs and phone numbers exposed online
Databases exposed by a criminal group leaked more than 300 million Facebook user IDs, names, and phone numbers on the web.
5147
5148
Apple neglects to patch two zero-day, wild vulnerabilities for Big Sur, Catalina
Apple has chosen to leave Big Sur and Catalina (around 35 to 40 percent of all Macs) in danger of actively exploited vulnerabilities that have only been patched for macOS Monterey.
5149
Mac OS High Sierra automatically checks EFI firmware each week
Every week, Macs running High Sierra will check the integrity of their EFI firmware, in a bid to detect tampering by malware.
5150
5151
Dropping Linux capabilities to improve container security
Increase container security by dropping capabilities in Docker. Learn how to drop unnecessary capabilities for increased security.
5152
5153
Vendors, Disclosure, and a bit of WebUSB Madness
Update 2018-06-19: Yubico updated their statement on 2018-06-18, apologizing and crediting us: https://twitter.com/Yubico/status/1008816076610625536
5154
Pwncloud – Bad crypto in the Owncloud encryption module
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
5155
I Found Malware in a BeamNG Mod
An analysis using Process Monitor and WinDbg, dealing with JavaScript, WASM, and Windows shellcode.
5156
Using Large Language Models to Catch Vulnerabilities
Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offe...
5157
Dual_EC_DRBG backdoor: a proof of concept
Dual_EC_DRBG is an pseudo-random number generator promoted by NIST in NIST SP 800-90A and created by NSA. This algorithm is problematic because it has been made mandatory by the FIPS norm (and should be implemented in every FIPS approved software) and some vendors even promoted this algorithm as first source of…
5158
Privacy Update: Third-party Tracking
Read this post for a privacy update regarding third-party tracking code on our website.
5159
‘eyeDisk’ USB drive secured with iris recognition reveals password in plain text
Last year, about the time we were messing around with a virtually unheard-of hardware wallet we got a bit excited about the word “unhackable”. Long story short, I ended up supporting a selection of kickstarters that had the word “unhackable” or similar in their title. Of these, at least one got funded and got…
5160
An unexpected journey into Microsoft Defender's signature World
Microsoft Defender is the endpoint security solution preinstalled on every Windows machine since Windows 7. It's a fairly complex piece of software, addressing both EDR and EPP use cases. As such, Microsoft markets two different products. Microsoft Defender for Endpoint is a cloud based endpoint security solution that…