1441
OnePlus OxygenOS built-in analytics
We take a look at the analytics built into the OxygenOS, the flavour of Android built by phone manufacturer OnePlus.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
1442
Hacking Google Bard – From Prompt Injection to Data Exfiltration
Recently Google Bard got some powerful updates, including Extensions. Extensions allow Bard to access YouTube, search for flights and hotels, and also to access …
1443
Apple memory holed its broken promise for an OCSP opt-out
When you launch an app, macOS connects to Apple's OCSP service to check whether the app's Developer ID code signing certificate has been revoked by Apple. In November 2020, Apple's OCSP service experienced a mass outage , preventing Mac users worldwide from launching apps. In response and remedy to this outage, Apple…
1444
Apple Confirms “Back Doors”, Downplays Their Severity
Apple responded to allegations of hidden services running on iOS devices with this knowledge base article . In it, they outlined three of the big services that I outlined in my talk. So again, Apple has, in a traditional sense, admitted to having backdoors on the device specifically for their own use.
1445
Going Dark: The war on encryption is on the rise
After Snowden’s whistleblowing in 2013, large parts of the internet became encrypted, enabling private and secure communication. Not everyone has welcomed this change. Most notably, the FBI and other U.S. government agencies have fought what is often called the “crypto wars”, the war on encryption. In recent years…
1446
Branch Privilege Injection: Exploiting branch predictor race conditions
Branch Privilege Injection ( CVE-2024-45332 ) brings back the full might of branch target injection attacks (Spectre-BTI) on Intel. Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race…
1447
1448
Why the password "this is fun" is 10 times more secure than "J4fS!2"
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month
1449
The weakest link by far is Apple
Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web…
1450
Machine Learning on Encrypted Data Without Decrypting It
Explore cutting-edge cryptographic techniques for machine learning on encrypted data. Discover how to process sensitive information without decryption, ensuring privacy and security.
1451
Lavabit SSL Cert Revoked
There is nothing here so move right along.
1452
GitLab discovers widespread NPM supply chain attack
Malware driving attack includes "dead man's switch" that can harm user data.
1453
You cannot simply publicly access private secure links, can you?
turns out, you can even search for them with powerful search engines!
1454
Running a Tor Exit Node for Fun and E-mails
The Tor Project is a non-profit organization in the United States that created Tor, The Onion Router, a free software that creates an open network of volunteers which helps people anonymize their traffic by routing it through three or more other computers before it reaches its final destination.
1455
Meta unlawfully ignores the users' right to easily withdraw consent: complaint
If Instagram and Facebook users want to withdraw their consent, they have to buy an expensive subscription
1456
Tor is a great sysadmin tool (2020)
Using Tor to aid various system administration tasks, including checking firewall rules, bypassing internal network restrictions and connecting to remote systems that are behind NAT/CGNAT.
1457
An Almost-Secret Algorithm Researchers Used to Break Thousands of RSA Keys
RSA encryption allows for anyone to send me messages that only I can decode. To set this up, I select two large random primes $latex p$ and $latex q$ (each of which is hundreds of bits long), and r…
1458
MarkMonitor left 60k domains for the taking
Thanks to Nagli and d0xing for helping figure out what was happening with this issue.
1459
Zoom Security Exploit: Cracking private meeting passwords
Short version: Zoom meetings were default protected by a 6 digit numeric password, meaning 1 million maximum passwords. I discovered a vulnerability in the Zoom web…
1460
Frontier AI has broken the open CTF format
Why frontier AI has broken the open CTF format, hollowed out the scoreboard, and made competitive CTF performance a weaker signal than it used to be.
1461
Rust in Android: move fast and fix things
Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we lo…
1462
First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. [ NYSE:FAF ] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage…
1463
OpenAI o1 system card
This report outlines the safety work carried out prior to releasing OpenAI o1 and o1-mini, including external red teaming and frontier risk evaluations according to our Preparedness Framework.
1464
GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in…
1465
SHA-3 Buffer Overflow
Update: This result appeared in the proceedings of CT-RSA 2023. A preprint is available.
1466
Remote code execution vulnerability in apt/apt-get
tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine i...
1467
How a double-free bug in WhatsApp turns to remote code execution
In this blog post, I’m going to share about a double-free vulnerability that I discovered in WhatsApp for Android, and how I turned it into an RCE. I informed this to Facebook. Facebook acknowledged and patched it officially in WhatsApp version 2.19.244. Facebook reserved CVE-2019-11932 for this issue.
1468
Getting any Facebook user's friend list and partial payment card details
I enjoy breaking websites.
1469
Tor at the Heart: Firefox
During the month of December, we're highlighting other organizations and projects that rely on...
1470
Google Cloud fraud defense, the next evolution of reCAPTCHA
Today at Next ‘26, we’re launching Google Cloud Fraud Defense, the trust platform for the agentic web and the next evolution of reCAPTCHA.