541
Thoughts on the Systemd Root Exploit
Sebastian Krahmer of the SUSE Security Team has discovered a local root exploit in systemd v228 . A local user on a system running systemd v228 can escalate to root privileges. That's bad.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 616 posts.
542
USPS ‘Informed Delivery’ Is Stalker’s Dream
A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service’s potential for misuse by private investigators, identity thieves, stalkers or abusive…
543
Command execution on Ansible controller from host
Onafhankelijk cybersecuritybedrijf in Nederland en Spanje. Pentest, MDR, NIS2-advies, incident response en CISO as a Service. Meer dan 20 jaar ervaring, 100+ security experts.
544
545
1Password X: A look at the future of 1Password in the browser
1Password X is our brand new, full-featured experience that runs entirely in your browser. Find out what it can do.
546
Senate Guts Privacy Rules. Will House Follow Suit?
Majority Leader McCarthy Confirms House to Immediately Act on Behalf of the Cable and Telephone Industry Following the Senate Vote Yesterday, the U.S. Senate by a razor thin margin of 50 to 48 voted to take away the privacy rights of Internet users as a favor to the cable and telephone industry....
547
Strengthening the Microsoft Edge Sandbox
In a recent post, we outlined the layered strategy that the Microsoft Edge security team employs to protect you from vulnerabilities that could be used to compromise your device or personal data. In particular, we showed how Microsoft Edge is leveraging technologies like Code Integrity Guard (CIG) and Arbitrary Code…
548
Introducing rkt’s ability to detect privilege escalation attacks on containers
No single cloud fits all. Explore how we build a more flexible future with hybrid cloud.
549
550
Updates for older platforms to protect against potential nation-state activity
Microsoft releases additional updates for older platforms to protect against potential nation-state activity
551
552
DAG Rosenstein’s “Responsible Encryption” Demand Is Bad
Deputy Attorney General Rod Rosenstein delivered a speech on Tuesday about what he calls “responsible encryption” today. It misses the mark, by far. Rosenstein starts with a fallacy, attempting to convince you that encryption is unprecedented: Our society has never had a system where evidence of...
553
Fingerprinting Firefox users with cached intermediate CA certificates
Fingerprinting Firefox users with cached intermediate CA certificates (#fiprinca) ...
554
OSX.Pirrit Mac Adware Part III: The DaVinci Code
Discover expert insights on the latest cybersecurity trends, challenges, and best practices shaping the industry today.
555
556
Privacy and Security Risks of Android VPN Permission-enabled Apps
Explore the science behind the headlines with our leading experts.
557
Someone cloned my website and is using it to scam people
I was looking on the DuckDuckGo search results for "anonymous bitcoin sms" today, just to see what was out there. My SMS Privacy was the top result, as expected. But the second result was new to me:
558
Cracking random number generators (xoroshiro128+)
In software, we generate random numbers by calling a function called a "random number generator". Such functions have hidden states, so that repeated calls to the function generate new numbers that appear random. If you know this state, you can predict all future outcomes of the random number generators. O'Neill, a…
559
EFF Applauds Amazon for Pushing Back on Request for Echo Data
The number of Internet-enabled sensors in homes across the country is steadily increasing. These sensors are collecting personal information about what’s going on inside the home, and they are doing so in a volume and detail never before possible. The law, of course, has not kept up. There are no...
560
561
Anomalous keys in Tor relays
Counting almost 7,000 relays , the Tor network is one of the largest volunteer-run anonymity networks operating today. Most of the volunteers who operate these relays choose to remain anonymous, and little is known about how they set up or operate their relays. As a result, it is not clear if all relays correctly…
562
Our continuing commitment to your privacy with Windows 10
At Microsoft, we are deeply committed to protecting our customers’ privacy. This includes providing clear choices and easy-to-use tools that put you in control of how your information is collected and used. Trust is a core pillar of our More Personal Computing vision, and we are working hard to make sure Windows 10 is…
563
WanaCrypt0r Ransomworm
Written by Sergei Shevchenko and Adrian Nish BACKGROUND Since the release of the ETERNALBLUE exploit by ‘The Shadow Brokers’ last month se...
564
Looking at how many sites use vulnerable JavaScript libraries
Last week, we released our first annual State of Open Source Security report. One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. In this post, we take a deep dive into that…
565
566
On Web Extensions shortcomings and their impact on add-on security
Recently, I reported a security issue in the new Firefox Screenshots feature (fixed in Firefox 56). This issue is remarkable for a number of reasons. First of all, the vulnerable code was running within the Web Extensions sandbox, meaning that it didn’t have full privileges like regular Firefox code. This code was…
567
Security Guidelines for Congressional Campaigns
Thank you for attending a training session! We covered a lot of ground, so these notes are meant to serve as a reference and reminder of the advice we gave you.
568
Certified Malice
One unfortunate (albeit entirely predictable) consequence of making HTTPS certificates “fast, open, automated, and free” is that both good guys and bad guys alike will take advantage of the offer a…
569
Sandstorm gets a security review
Take control of your web by running your own personal cloud server with Sandstorm.
570
SIDH in Go for quantum-resistant TLS 1.3
Most of today's cryptography is designed to be secure against an adversary with enormous amounts of computational power. This means estimating how much work certain computations require, and choosing cryptographic parameters based on our best estimates.