511
Zimbra 0-day used to steal email data from government organizations
TAG’s discovery of a 0-day exploit used to steal email data from international government organizations.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 617 posts.
512
Who reads your email?
A look at diversity of MX records across all gTLDs and the Top 1M domains, indicating where SMTP is concentrated and what organizations might have broad access to the world's emails.
513
514
515
I don't trust Signal
I don't trust Signal because it pretends to be things which it provably isn't and forces use of their controlled the network. This means that if Signal wanted to, they could intercept messages. In this article I show receipts, that while each individual issue is not back-breaking: casts huge doubts to me on if i…
516
517
Two U.S. men charged in 2022 hacking of DEA portal
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in using fake emergency data requests from compromised police and government…
518
I hacked Gumroad’s API and broke a bunch of tools
A critical security vulnerability in Gumroad's API allowed anyone to generate unauthorized license keys for paid products without making a purchase.
519
Chat Control 2.0: EU set to approve end of private messaging, secure encryption
By making a minor concession EU governments hope to find a majority next week to approve the controversial „chat control“ bill. According to the proposed child sexual abuse regulation (CSAR), providers of messengers, e-mail and chat services would be forced to automatically search all private messag
520
521
A Year in Review of 0-days Exploited In-the-Wild in 2022
Maddie Stone, Security Researcher, Threat Analysis Group (TAG) This is Google’s fourth annual year-in-review of 0-days exploited in-the-wild...
522
Passwords Are Fine
How we can be better at authentication security
523
After 28 years, SSLv2 is still not gone from the internet
After 28 years, SSLv2 is still not gone from the internet... but we're getting there, Author: Jan Kopriva
524
Hardware trojans under a microscope (2022)
Table of Contents
525
Cloudflare launches easy to set up consent manager that respects users
Cloudflare Zaraz now can also help you with gathering and managing consent. With this new tool, you can easily collect user’s consent preferences on your website, using a consent modal, and apply your consent policy on third-party tools you load via Cloudflare Zaraz
526
NVD Damage Continued
There is something about having your product installed in over twenty billion instances all over the world and even out of the globe. In my case it helps me remain focused on and committed to working on the security aspects of curl. Ideally, we will never have our heartbleed moment. Security is also a generally ……
527
Adtech is built on a privacy fault line
The IAPP's Cobun Zweifel-Keegan rounds up the latest privacy developments from Washington, D.C., and elsewhere in the U.S. for the week of 24 July 2023.
528
529
UEFI Secure Boot on the Raspberry Pi
UPDATE: this post unexpectedly ended up on Hacker News and I received a lot of comments. The two most important points being made are (1) that Secure Boot on the RPi as …
530
Remote Code Execution as a Service
Learn how Earthly Compute, a remote code execution as a service, was built to handle bursty workloads and provide secure and fast remote execution ...
531
Sinkholed: A DNS Horror Story (2019)
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
532
How to get a heart attack while using JEB decompiler (2022)
Finding RCE during deobfuscation in JEB decompiler running on Java 18.
533
534
Open source supply chain security at Google [video]
I was a remote opening keynote speaker at ACM SCORED 2023 , which we decided meant that I sent a video to play and I was on Discord during the talk for attendees to text directly with question as the video played, and then we did some live but still remote Q&A after the talk.
535
The low, low cost of committing cybercrime
The low, low cost of (committing) cybercrime, Author: Jan Kopriva
536
Reliability via Automated Renewal Information
The Let’s Encrypt team is excited to announce that ACME Renewal Information (ARI) is live in production! ARI makes it possible for our subscribers to handle certificate revocation and renewal as easily and automatically as the process of getting a certificate in the first place. With ARI, Let’s Encrypt can signal to…
537
Microsoft’s Revocation of the Verisign Class 3 Public Primary G5 Root Cert
Microsoft has rolled back the revocation of the Verisign Class 3 Public Primary Certification Authority - G5 Root Certificate.
538
The i.MX8 cannot be deblobbed
Devices based on the i.MX8 or i.MX8M (such as the Librem phone or MNT Reform) have received popular coverage recently. The number of firmware blobs involved in the bringup of these devices is often a point of discussion. At times, people have considered whether some of these blobs could be replaced with libre…
539
root with a single command: sudo logrotate
Starting from the constraint that only sudo logrotate * may be run, and ending at root: abusing the log file flag to overwrite root owned scripts and ride cron to privilege escalation.
540
'Reptar', a new CPU vulnerability
A new CPU vulnerability, ‘Reptar,’ found by Google researchers, has been patched by Google and Intel. Here’s what you need to know.