7651
64-Bit Linux Return-Oriented Programming
Update : Dongli Zhang reports that newer Linux versions organize the stack differently . The code below will need to be modified accordingly.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
7652
Introducing App Engine Firewall
A key security feature for application developers and administrators is to be able to allow or deny incoming requests based on source IP addresses. This capability can help you do production testing without exposing your app to the world, block access to your app from specific geographies or block requests from a…
7653
Hacking Twitter's Javascript
New Twitter uses a massive amount of javascript (for a webapp). Nearly 1 Megabyte of minified, obfuscated javascript powers the site's frontend.
7654
7655
Superhuman AI Exfiltrates Emails
Superhuman AI was able to exfiltrate sensitive emails from user accounts - without the user even being aware. This vulnerability was rapidly remediated by the Superhuman team.
7656
Cryptographically Secure PHP Development
Your field guide to building secure cryptography features in PHP
7657
Leaked admin access token to Python, PyPI, and PSF GitHub repos
The JFrog Security Research team has recently discovered and reported a leaked access token with administrator access to Python’s, PyPI’s and Python Software Foundation’s GitHub repositories, which was leaked in a public Docker container hosted on Docker Hub. As a community service, the JFrog Security Research team…
7658
7659
7660
7661
My Reddit AMA on the Law of Web Scraping
On Friday, I did a Reddit AMA with the r/WebScrapingInsider subreddit about the law of web scraping. You can see the entire discussion here. I posted an introduction to the AMA, which I am sharing here: __ Hi everyone, and...
7662
UK Online Safety Bill threatens encryption, secure communication, and reporting
Does the image above, depicting the rescue of a child who attempted to reach the U.K. by sea, present the act of immigration in “a positive light”? It’s an absurd question, of course. It’s journalism – an effort to convey in visual terms the stark truth that tens of thousands of migrants and asylum-seekers try to…
7663
7664
Open Letter From UK Security Researchers
Dear Reader, The first set of publications based on Edward Snowden’s files were concerned with surveillance of internet communication h...
7665
Android Bug Superior to Master Key
Assuming you enjoy this article, I encourage you to read the next one in the series: Yet Another Android Master Key Bug .
7666
7667
7668
7669
7670
Serverless security implications from infra to OWASP
By its very nature, Serverless (FaaS) addresses some of today’s biggest security concerns but it doesn’t fix it all. This post outlines the top areas where Serverless helps or hinders our security efforts, offering advice on how to address concerns and thoughts on what’s to come next.
7671
Distributing unnotarized Mac apps in a text file
This isn't a late April Fools joke. (My April Fools joke that I got hired by Apple as a Swift Evangelist backfired with a profusion of congratulations.) This blog post is a kind of follow-up to some previous blog posts. Last month I wondered what's the best way to distribute Mac apps without notarization , and I…
7672
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE
After my previous post on ARM exploitation, where we crafted an exploit for a known vulnerability, I decided to continue the research on a more modern IoT target. In this follow-up post, I will take you through building a considerably more complex binary exploit. We will explore the path from firmware extraction and…
7673
Judge's Investigation into Patent Troll Results in Criminal Referrals
In 2022, three companies with strange names and no clear business purpose beyond patent litigation filed dozens of lawsuits in Delaware federal court, accusing businesses of all sizes of patent infringement. Some of these complaints claimed patent rights over basic aspects of modern life; one, for...
7674
But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1)
Vulnerabilities and exploits in common targets like browsers are often associated with memory safety issues. Typically this involves either a direct error in memory management or a way to corrupt internal object state in the JavaScript engine. One way to eliminate such memory safety issues is to use
7675
The end of Roe will bring about a sea change in the encryption debate
With the Supreme Court poised to rip away a constitutional right that’s been the law of the land for nearly half a century by overturning Roe v. Wade, it’s time for the gloves to come off in the encryption debate. For a quarter of a century, it has
7676
Microsoft Defender ATP for Linux is now generally available
Today we are excited to announce general availability of Microsoft Defender Advanced Threat Protection (ATP) for Linux! - This initial release delivers...
7677
Liberty Reserve Founder Arrested, Site Shuttered
The founder of Liberty Reserve , a digital currency that has evolved as perhaps the most popular form of payment in the cybercrime underground, was reportedly arrested in Spain this week on suspicion of money laundering. News of the law enforcement action may help explain an ongoing three-day outage at…
7678
Consent, GDPR and Google Analytics
A discussion about the Austrian Google Analytics case, and if consent of the user would have made the difference.
7679
Mailpile Chooses AGPL v3
I finally put the team's original plan into action, launching a vote on our new roadmap site , asking our community of backers to help us choose a single license for the project.
7680