7201
Compiler fuzzing, part 1
Much has been written about fuzzing compilers already, but there is not a lot that I could find about fuzzing compilers using more modern ...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
7202
OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
Usual Mandatory Disclaimer: IANAC (I am not a cryptographer) so I might likely end up writing a bunch of mistakes in this blog post... ...
7203
How to build your own public key infrastructure
A major part of securing a network as geographically diverse as CloudFlare’s is protecting data as it travels between datacenters. Customer data and logs are important to protect but so is all the control data that our applications use to communicate with each other.
7204
OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass
Last week, Intego researchers discovered new Mac malware, OSX/Linker, that attempts to leverage a recently disclosed zero-day flaw in macOS' Gatekeeper protection. Let's examine what we know about this latest Mac malware campaign. What is the back story? Before digging into the OSX/Linker malware, it would be helpful…
7205
Microsoft’s Revocation of the Verisign Class 3 Public Primary G5 Root Cert
Microsoft has rolled back the revocation of the Verisign Class 3 Public Primary Certification Authority - G5 Root Certificate.
7206
User Privacy Isn't Solely a Facebook Issue
During Congressional hearings about Facebook’s data practices in the wake of the Cambridge Analytica fiasco, Mark Zuckerberg drew an important distinction between what we expect from our Internet service providers (ISPs, such as Comcast or Verizon) as opposed to platforms like Facebook that operate...
7207
Tactics, Techniques, and Procedures of the Yahoo Hack
(.. Tactics, Techniques, and Procedures)
7208
SSO should be table stakes
Withholding security for money feels a little gray-hat.
7209
Europe's Digital Sovereignty Paradox – "Chat Control" Update
Can you build tech independence while breaking encryption?
7210
Is regulated BGP security coming?
What impact would regulating BGP routing security have on the global Internet?
7211
METR Report on OpenAI / Hugging Face Hacking Incident
Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board.
7212
The beauty and terror of modding Windows
Let's talk about the "Windows Baseline Security Mode," too.
7213
7214
7215
Netmask NPM package, used by 270k+ projects, vulnerable to octal input data
The following research outlines a vulnerability discovered in netmask npm package that is currently used by 278,722+ other projects. The vulnerability has been present for 9 years. Since this package is so incredibly widespread, I would suggest every nodejs developer to check their package.jsons to see if they use…
7216
7217
New Linux vulnerability affecting cgroups: can containers escape?
CVE-2022-0492 is the third recent kernel vulnerability that allows malicious containers to escape. We offer root cause analysis and mitigations.
7218
Anatomy of a cryptocurrency scam
You receive a message. Now either you will be victim or not. Your knowledge, attention and moral compass will decide where you will end up.
7219
Attackers exploit flaw in web’s security to steal $2M in cryptocurrency
By Henry Birge-Lee, Liang Wang, Grace Cimaszewski, Jennifer Rexford and Prateek Mittal On Thursday, Feb. 3, 2022, attackers stole approximately $2 million worth of cryptocurrency from users of the Korean crypto exchange KLAYswap. This theft, which was detailed in a Korean-language blog post by the security firm S2W…
7220
The scrypt parameters
The recommended scrypt parameters in the Go docs were recently brought up for discussion given they haven’t changed since 2009.
7221
New PHP Vulnerability:?-s may expose source code for mod_cgi
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
7222
Insecurities in the Linux /dev/random
New paper: “Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust, by Yevgeniy Dodis, David Pointcheval, Sylvain Ruhault, Damien Vergnaud, and Daniel Wichs. Abstract: A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is…
7223
Supply chain nightmare: How Rust will be attacked and what we can do to mitigate
An essential part of being able to say "I told you so" is in fact having told you so. Well, here we are. For those living under a rock (lucky
7224
“Downthem” DDoS-for-hire boss gets 2 years in prison
A 33-year-old Illinois man was sentenced to two years in prison today following his conviction last year for operating services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against hundreds of thousands of Internet users and websites.
7225
Nym Wars (Google+ "real name" rules)
I hadn't been paying much attention to the Google "Real Names" clusterfuck, because it was so obvious to me that they were going to lose this one in the press that it would all be over soon. But it's still not over, and the Google brass appear to be digging in their heels, despite the universally bad press they're…
7226
The i.MX8 cannot be deblobbed
Devices based on the i.MX8 or i.MX8M (such as the Librem phone or MNT Reform) have received popular coverage recently. The number of firmware blobs involved in the bringup of these devices is often a point of discussion. At times, people have considered whether some of these blobs could be replaced with libre…
7227
7228
NSPM-7 labels common beliefs as terrorism 'indicators'
New directive targets “anti-Christian,” “anti-American,” and “anti-capitalism” opinions
7229
Exploring Google Hangouts' easter eggs
Web developer and cybersecurity researcher
7230
Microsoft Issues Emergency Patch for Windows Flaw
Microsoft on Tuesday issued an emergency software update to quash a security bug that’s been dubbed “ PrintNightmare ,” a critical vulnerability in all supported versions of Windows that is actively being exploited. The fix comes a week ahead of Microsoft’s normal monthly Patch Tuesday release, and follows the…