5311
Vulnerabilities in Heroku's Build System
Last week I discovered a major security flaw in the Heroku Cedar stack build. This vulnerability exposed sensitive information including API keys, private keys and server credentials.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,769 posts.
5312
Exploiting a Bug in Google's Glass
A few days ago, I posted to Twitter a picture I took of a Google Glass unit running software that I had modified. I did this while in the Bay Area after picking it up from Google's headquarters in Mountain View. I was unable to provide many more details at the time, as I first was busy driving home, and then became…
5313
How to Use Trend Micro's Rootkit Remover to Install a Rootkit
The opinions expressed in this publication are those of the authors. They do not reflect the opinions or views of my employer. All research was conducted independently. For a recent project, I had to do research into methods rootkits are detected and the most effective measures to catch them when
5314
Metasploit 5.0 Released
We are happy to announce the release of Metasploit 5.0, the culmination of work by the Metasploit team over the past year. Learn more.
5315
Ronin 2.0 – open-source Ruby toolkit for security research and development
After nearly a full year of non-stop development since the initial announcement of The Big Refactor , 4153 commits made, 700 issues closed , and a month of beta testing, Ronin 2.0.0 has finally been released!
5316
Protecting democratic elections through secure, verifiable voting
Today, at the Microsoft Build developer conference, CEO Satya Nadella announced ElectionGuard, a free open-source software development kit (SDK) from our Defending Democracy Program. ElectionGuard will make voting secure, more accessible, and more efficient anywhere it’s used in the United States or in democratic…
5317
5318
How we secure Monzo's banking platform
Our Security Infrastructure team introduces the principles we follow to build security in Monzo’s fast-moving engineering environment and how they work with other engineering teams to keep our customers and platform safe.
5319
Basic Electron Framework Exploitation
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
5320
5321
5322
UK sets up fake booter sites to muddy DDoS market
The United Kingdom’s National Crime Agency (NCA) has been busy setting up phony DDoS-for-hire websites that seek to collect information on users, remind them that launching DDoS attacks is illegal, and generally increase the level of paranoia for people looking to hire such services.
5323
UK version of “Online Harms Bill” wants to prefilter content without due process
Experts warn that ISPs would use black-box AI to comply Like our piece on Canada's Cyber-Security Bill earlier this year, this item was flagged in my work for the Internet Society, Canada Chapter, but this post does not necessarily reflect the opinion of the ISCC. It concerns a legal opinion…
5324
Vice.com Reveals John McAfee's Location In iPhone Metadata
Some time ago, the website Vice.com posted an article with the somewhat full of themselves title “We Are With John McAfee Right Now, Suckers”. In it, they reveal how they have been traveling with John for the better part of the week.
5325
Getting Hacked, Lessons Learned
I read Cody Brown’s blog post about getting hacked on Thursday of last week. I feel very badly for Cody and plan to send him some BTC once I get access back to my account. His post helped me avoid his fate. I woke up Friday morning (central european summer time) and saw a bunch […]
5326
Restaurant Delivery Payment-Skimming Campaign
InfoHawk research has uncovered a network of 820 suspicious restaurant domains impersonating major US chains, including Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. Some are running sophisticated payment-skimming attacks that capture credit card information and ask customers for their…
5327
Cracking Random Number Generators Using Machine Learning
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
5328
How the Military Will Hack the Election
Task Force Raider’s role in 2026 elections has military officers uneasy
5329
Popular Google Chrome extensions are constantly tracking you by default
Popular Google Chrome extensions are constantly tracking you per default, making it very difficult or impossible for you to opt-out.
5330
5331
Millions of email addresses leaking to advertising and analytics companies
Breaches have been found on websites including Wish.com, JetBlue.com, Quibi.com, WashingtonPost.com, NGPVan.com and numerous other…
5332
Hiding messages in x86 binaries using semantic duals
This is a quick writeup of a steganographic tool that I threw together: steg86 . It uses a quirk of the x86 instruction encoding format to hide messages in pre-existing binaries with no size or performance overhead.
5333
Verizon Routing Millions of IP Addresses for Cybercrime Gangs
Over the past few years, spammers have sought out large ranges of IP addresses. By spreading out their sending patterns across a wide range of IP addresses, they can attempt to defeat spam filters and get spam and malware emails delivered where they are not wanted. However, IPv4 addresses are getting scarce and hard…
5334
Privacy Is Not Dead: Beware the All-or-Nothing Mindset
Privacy is only dead if we let it die. Be careful about the all-or-nothing mindset in data privacy, it can do more damage than good to the cause. While striving for improvements, do not forget to cheer and celebrate each small win.
5335
Cooldown Support for Ruby Bundler
Most supply-chain attacks against RubyGems exploit a narrow window: an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it. ...
5336
5337
5338
New differential fuzzing tool reveals novel HTTP request smuggling techniques
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
5339
5340
Black Hat USA 2021 Review
中文 First of all, thank Orange Tsai for giving me the opportunity to participate in Black Hat USA 2021 in Las Vegas. This article would not exist without this ticket. I am going to share my thoughts and some technical topics on the two days of Black Hat USA 2021 in this article. The hotel and the conference venue are…