5851
How we hacked Blackboard and changed our grades (2018)
A technical walk-through of how we hacked Blackboard and changed our grades.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,770 posts.
5852
Shifting Cyber Norms: Microsoft security POST-ing to you
tl;dr: Microsoft and other email security scanners will visit the links in email you transmit, and run the JavaScript in those links, including calls that lead to POSTs going out. This used to be unacceptable, since POSTs have side effects. Yet here we are. This breaks even somewhat sophisticated single-use sign-on /…
5853
Outlook.com is silently discarding email messages (2015)
Outlook.com and hotmail.com is silently discarding email messages from our SMTP server.
5854
Passwords For Your Facebook Account
This is interesting. You can log into your Facebook account using three passwords – one is the main password that you created and the other passwords can…
5855
Phone Numbers Stink as Identity Proof
Phone numbers stink for security and authentication. They stink because most of us have so much invested in these digits that they’ve become de facto identities. At the same time, when you lose control over a phone number — maybe it’s hijacked by fraudsters, you got separated or divorced, or you were way late on your…
5856
Security: OpenBSD vs. FreeBSD
Blog about network and security, showing example of Linux iptables and Snort configuration, and Windows security softwares.
5857
Framing Frames: Bypassing wi-fi encryption by manipulating transmit queues
Domien Schepers and Aanjhan Ranganathan, Northeastern University; Mathy Vanhoef, imec-DistriNet, KU Leuven
5858
5859
‘Land Lordz’ Service Powers Airbnb Scams
Scammers who make a living swindling Airbnb.com customers have a powerful new tool at their disposal: A software-as-a-service offering called “ Land Lordz ,” which helps automate the creation and management of fake Airbnb Web sites and the sending of messages to advertise the fraudulent listings.
5860
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
5861
Document poisoning in RAG systems: How attackers corrupt AI's sources
RAG poisoning attack walkthrough: an attacker injects fabricated documents into a ChromaDB knowledge base and the LLM reports false financials as fact. Fully reproducible, 100% local, no GPU required.
5862
Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
Read the latest thinking, news and research from the team at Container Solutions in our Cloud Native Blog.
5863
Here’s why we keep getting hacked – clear and present Billabong failures
It happened again last week. No, not Yahoo! Voices [https://www.troyhunt.com/2012/07/what-do-sony-and-yahoo-have-in-common.html], not the Phandroid Android forums [http://www.zdnet.com/android-forums-hacked-1-million-user-credentials-stolen-7000000817/] , not NVidia [http://www.zdnet.com/nvidia-confirms-
5864
Exploiting the Math.expm1 typing bug in V8
Minus zero behaves like zero, right?
5865
Pwned, the book
The first time I ever wrote publicly about a company's security vulnerabilities, my boss came to have a word with me after seeing my name in the news headlines. One of the worst days I've ever had was right in the middle of the Have I Been Pwned
5866
Thunderstrike 2: Mac firmware worm details
Collection of my projects and hacks.
5867
How to break everything by fuzz testing
Fuzz testing is a bit like the infinite monkey theorem, but instead of Shakespeare you get crashes.
5868
Tiny, cheap, and dangerous: Inside a fake iPhone charger
Thoughts on the death of Ma Ailun According to reports , a woman in China was tragically electrocuted using her iPhone while it was char...
5869
5870
Anatomy of a Failed (Nation-State?) Attack
A fake-interview scam tried to backdoor my machine with PinpinRAT, hidden in a malicious TypeScript patch. Analysis of the attack, payload, and indicators of compromise.
5871
5872
Tips for more effective fuzz testing with AFL++
Fuzz testing is incredibly effective for mechanically discovering software defects, yet remains underused and neglected. Pick any program that must gracefully accept complex input, written in any language , which has not yet been been fuzzed, and fuzz testing usually reveals at least one bug. At least one program…
5873
Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC
Desoldering a drone's flash chip and reconstructing the firmware from broken data.
5874
5875
Sequoia 1.3
Sequoia is a modular OpenPGP implementation in Rust.
5876
Victory for CloudFlare Against SOPA-like Court Order
Striking a blow against the continuing effort to force service providers to serve as IP police, CloudFlare and EFF have pushed back against a court order that would have required CloudFlare to monitor its service to enforce a trademark held by a group of music labels. Last week, Judge Alison J....
5877
Verified cryptography for Firefox 57
Traditionally, software is produced in this way: write some code, maybe do some code review, run unit-tests, and then hope it is correct. Hard experience shows that it is very ...
5878
Why not use DNS over HTTPS (DoH)?
DoH is not about protecting your DNS queries from peepers. That is a big lie. It is about making sure only one peeper can see all of your queries.
5879
Accused spy Alexander Yuk Ching Ma evidently beat the polygraph
On Thursday, 13 August 2020, FBI Special Agent Chris Jensen filed under seal a criminal complaint against Alexander Yuk Ching Ma of Honolulu, Hawaii, charging him with “Conspiracy to Gather and Communicate National Defense Information of the United States to a Foreign Nation.” On Monday, 17 August 2020, the complaint…
5880
Who's behind the SWAT USA reshipping service?
Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today’s Part II, we’ll examine clues about the real-life identity of “ Fearlless ,” the nickname…