691
Amazon's AI crawler is making my Git server unstable
Please, just stop.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
692
I got hacked: My Hetzner server started mining Monero
I got hacked, my server started mining Monero this morning.
693
The xz attack shell script
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…
694
695
hCaptcha now runs on fifteen percent of the internet
Discover how hCaptcha has become the largest independent CAPTCHA service and now runs on 15% of the internet.
696
Try This One Weird Trick Russian Hackers Hate
In a Twitter discussion last week on ransomware attacks, KrebsOnSecurity noted that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a Microsoft Windows computer that already has one of many types of virtual keyboards…
697
Google’s FLoC Is a Terrible Idea
Update, April 9, 2021 : We've launched Am I FLoCed, a new site that will tell you whether your Chrome browser has been turned into a guinea pig for Federated Learning of Cohorts or FLoC, Google’s latest targeted advertising experiment. The third-party cookie is dying, and Google is trying to create...
698
Data Exfiltration from Slack AI via indirect prompt injection
Authors: PromptArmor
699
Flock and Cyble Inc. weaponize “cybercrime” takedowns to silence critics
When a government contractor pays a company for "Takedown Services" to prevent transparency in government
700
Security Disclosure
Railway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention
701
Blur Tools for Signal
Right now, people around the world are marching and protesting against racism and police brutality, outraged by the most recent police murders of George Floyd and Breonna Taylor. At Signal, we support the people who have gone into the streets to make their voices heard. We believe that something ...
702
703
ProctorU is dystopian spyware
As part of my MSc, I have to take an online exam. Obviously, this means I am highly likely to cheat by looking up things on Wikipedia or by having a bit of paper with notes on it. EVIL! So, the exam body requires me to install ProctorU. It's a service which lets someone watch you through your laptop camera while you…
704
Say No to Palantir in the NHS
NHS England is rolling out software to run our health records from Palantir - fight back
705
706
What's the deal with all those weird wrong-number texts?
Digging into the world of "pig-butchering" scams
707
Reptar
We have a CPU mystery! We found a way to cause some processors to enter a glitch state where the normal rules don’t apply, but what does that mean…?
708
709
No boundaries for Facebook data: third-party trackers abuse Facebook Login
by Steven Englehardt [0], Gunes Acar, and Arvind Narayanan So far in the No boundaries series, we’ve uncovered how web trackers exfiltrate identifying information from web pages, browser password managers, and form inputs. Today we report yet another type of surreptitious data collection by third-party scripts that we…
710
4TB of voice samples just stolen from 40k AI contractors at Mercor
Lapsus$ posted Mercor on its leak site. Voice biometrics plus ID documents in one bundle is a deepfake-ready kit. Here is what to do.
711
712
Don’t Wanna Pay Ransom Gangs? Test Your Backups
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they’d had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even…
713
Xfinity Is Man-in-the-Middle Attacking My Internet
Xfinity injected 581 lines of JavaScript into unencrypted traffic as a data-cap warning, creating MITM risks, accessibility failures, and slower loads.
714
Something is wrong when the ‘telephone app’ on your phone becomes 3rd party
Since I am not living in my home country, I frequently use two different SIM cards and prefer having a phone with dual-sim support. This limits your choice s...
715
"Localhost tracking" explained. It could cost Meta €32B
You just can't finish off Zuckerberg.
716
Voice.ai: GPL Violations with a Side of DRM
the one good use of copyright is prying things open
717
Incident CVE-2026-LGTM
A series of unfortunate agents.
718
719
Is Telegram really an encrypted messaging app?
This blog is reserved for more serious things, and ordinarily I wouldn’t spend time on questions like the above. But much as I’d like to spend my time writing about exciting topics, som…
720
Apple already shipped attestation on the web, and we barely noticed
There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and apparently being...