7231
Gambling and Adult content DNS blocking using Mullvad VPN
We have expanded our DNS blocking service with Gambling and Adult content filters!
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
7232
Handling App Transport Security in iOS 9
The rollout of iOS 9 is expected to come this Fall and will introduce a new privacy feature called App Transport Security (ATS) to enforce ...
7233
A Blackstone real estate company exposed SSN digits, DOBs, addresses and more
Update: This post received some attention on Hacker News — see the discussion thread.
7234
Deluge of Fake Mac App Store Reviews
Yesterday I discovered a deluge of recent fake customer reviews for a number of top paid apps in the United States Mac App Store. (Each country has its own version of the App Store with separate reviews.) I've now checked the reviews for all of the current top 40 paid apps in the Mac App Store, and 8 of those apps…
7235
7236
7237
Retrofitting Temporal Memory Safety on C++
Eliminating use-after-frees vulnerabilities in Chrome with heap scanning.
7238
Security flaws in an SSO plugin for Caddy (2023)
We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources. During our evaluation, Caddy was deployed as a…
7239
BIMI and DMARC Can't Save You: The Overlooked DKIM Exploit
Analysts at Zone.eu, one the leading domain registrars and web hosting providers in Europe, have observed a vulnerability affecting the global e-mail ecosystem, stemming from unaddressed warnings in the DomainKeys Identified Mail (DKIM) standard that puts billions of users in risk. This is not an issue in a particular…
7240
root with a single command: sudo logrotate
Starting from the constraint that only sudo logrotate * may be run, and ending at root: abusing the log file flag to overwrite root owned scripts and ride cron to privilege escalation.
7241
Someone was breaking into Orange Spain RIPE account (and break their /12)
Ah. Orange Spain has had their /12 (and likely others) broken by (what appears to be) someone breaking into their RIPE account and making RPKI ROA's to somewher...
7242
Computer scientists develop 'mathematical jigsaw puzzles' to encrypt software
The "software obfuscation" system encrypts software so that it only allows someone to use a program as intended while preventing any deciphering of the code behind it.
7243
Adventures in Video Conferencing Part 1: The Wild World of WebRTC
Posted by Natalie Silvanovich, Project ZeroOver the past five years, video conferencing support i...
7244
7245
We found a phone with pre-installed malware via the Lifeline Assistance program
We discovered yet another phone model with pre-installed malware provided from the Lifeline Assistance program via Assurance Wireless by Virgin Mobile.
7246
Tor Browser 15.0
Tor Browser 15.0 is now available, featuring an update to Firefox ESR 140, improvements to tab management and the address bar on desktop, and screen lock for Android.
7247
7248
Google Address Sanitizer ("compile-time valgrind") to be part of GCC 4.8
This is the mail archive of the gcc-patches@gcc.gnu.org mailing list for the GCC project .
7249
Rooting, firmware analysis and persistent credentials of TP-Link TL-841N
round 2: rooting & analysing firmware of the TP-Link TL-WR841N
7250
7251
7252
A Guide to Synthesizing Adversarial Examples
Synthesizing adversarial examples for neural networks is surprisingly easy.
7253
GhostRace: Exploiting and mitigating speculative race conditions
Exploiting and Mitigating Speculative Race Conditions GhostRace: CVE-2024-2193 Race conditions arise when multiple threads attempt to access a shared resource without proper synchronization, often leading to vulnerabilities such as concurrent use-after-free. To mitigate their occurrence, operating systems rely on…
7254
Executing non-alphanumeric JavaScript without parentheses
I decided to look into non-alphanumeric JavaScript again and see if it was possible to execute it without parenthesis. A few years ago I did a presentation on non-alpha code if you want some more info
7255
Early Cascade Injection: From Windows process creation to stealthy injection
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.
7256
Zooming in on Zero-Click Exploits
Posted by Natalie Silvanovich, Project Zero Zoom is a video conferencing platform that has ...
7257
'Reptar', a new CPU vulnerability
A new CPU vulnerability, ‘Reptar,’ found by Google researchers, has been patched by Google and Intel. Here’s what you need to know.
7258
Web-based cryptography is always snake oil
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your…
7259
Stopping bad guys from using my open source project (feedback wanted)
I maintain a sorta-popular open source package, and I want to prevent big corporations and "bad guys" from using it. I want feedback on how to do this.
7260
ChatGPT's image generator can be manipulated to produce violent, sexual content
Mindgard reveals how ChatGPT's image generation safety filters can be bypassed with minor prompt adjustments, producing graphic violent and sexual content without users directly asking for it. Here's what was found, and why it matters.