121
We outsmarted CSGO cheaters with IdentityLogger
Learn how IdentityLogger used fingerprinting to combat ban evasion, protecting our CSGO community from relentless cheaters.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 536 posts.
122
Writing secure Go code
Security testing starts with understanding vulnerabilities. The CVE website lists known software flaws. The OWASP Top Ten highlights common weaknesses. With this knowledge, we can improve our Go development. This article shows how to put in place robust practices. They are fuzz inputs, verify dependencies, and use…
123
Abusing Go's Infrastructure
I apologize if this information is already known, but I couldn’t find any references about it and I wanted to understand what was going on and share with you because I think there is some value doing it. In case this wasn’t known, I apologize to the Go team for not talking to them first and jumping the full disclosure…
124
RCE Vulnerability in QBittorrent
[…] Security has unveiled a critical vulnerability that has lingered in the popular torrent client qBittorrent for over 14 […]
125
AI generated security reports about curl
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
126
Twitter's pivot to x.com is a gift to phishers
On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com , which until very…
127
EFF’s concerns about the UN Cybercrime Convention
Update: This post has been updated to clarify the scope of the compelled assistance provisions and the broad nature of criminalization and electronic evidence gathering. The final version of the draft convention can still be used to expand the reach of repression under the pretext of combating...
128
A decade-old Steam bug
Valve has shown to occasionally not act on community feedback and bug reports. A story about a decade old bug.
129
Microsoft is spying on users of its AI tools
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools—presumably coding tools—to improve their hacking abilities. From their report: In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries—tracked as Forest Blizzard, Emerald…
130
Breaking Free from DRM: Hacking My Air Purifier
I searched the web for a deal on a decent air purifier and the Xiaomi 4 Pro seemed to meet all my requirements. The filter size, scheduler and air volume ticked all the boxes. I set it up and thought nothing of it until last week my room was lit with the ‘ 0% remaining ’ replace filter warning. I had set my unit up to…
131
How to lose a fortune with one bad click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him…
132
Notepad++: Help us to take down the parasite website
I’ve received numerous complaints via email, social media, and forums regarding a website that poses a significant threat to our community. The copycat site in question is https://notepad.plus/ which appears prominently when users google for “download Notepad++”.
133
I found a 1-click exploit in South Korea's biggest mobile chat app
Stealing another KakaoTalk user’s chat messages with a simple 1-click exploit.
134
Hacker in Snowflake extortions may be a U.S. soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a…
135
More Memory Safety for Let's Encrypt: Deploying ntpd-rs
When we look at the general security posture of Let’s Encrypt, one of the things that worries us most is how much of the operating system and network infrastructure is written in unsafe languages like C and C++. The CA software itself is written in memory safe Golang, but from our server operating systems to our…
136
Second factor SMS: Worse than its reputation
One-time passwords are often sent via SMS. Security researchers from the CCC recently had live access to over 200 million such SMS messages from more than 200 affected companies.
137
How I tripped over the Debian weak keys vulnerability
Those of you who haven’t been in IT for far, far too long might not know that next month will be the 16th(!) anniversary of the disclosure of what was, at the time, a fairly earth-shattering revelation: that for about 18 months, the Debian OpenSSL package was generating entirely predictable private keys .
138
The "email is authentication" pattern
By Ruben Schade in Eora/Sydney, Australia.
139
Kobold letters: HTML emails are a risk
Anyone who has had to deal with HTML emails on a technical level has probably reached the point where they wanted to quit their job or just set fire to all the mail clients due to their inconsistent implementations. But HTML emails are not just a source of frustration, they can also be a serious security risk.
140
CrowdStrike will be liable for damages in France, based on the OVH precedent
Hello, Today I am doing a quick post to cover the recent CrowdStrike incident that is estimated to have disabled 8.5M computers and caused more than $5.4B in damages since last week. Now a common q…
141
Anonymous Source Shared Leaked Google Search API Documents
Update: We are diving deep into the Google API leak and what it means for marketers in our next episode of SparkToro Office Hours on June 27. Join Michael
142
FTC Report Confirms: Commercial Surveillance Is Out of Control
A new Federal Trade Commission (FTC) report confirms what EFF has been warning about for years: tech giants are widely harvesting and sharing your personal information to fuel their online behavioral advertising businesses.
143
Eliminating Memory Safety Vulnerabilities at the Source
Posted by Jeff Vander Stoep - Android team, and Alex Rebert - Security Foundations Memory safety vulnerabilities remain a pervasive threa...
144
ZenHammer: Rowhammer attacks on AMD Zen-based platforms
Our work shows that it is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations. This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems , which greatly increases the attack surface, considering today’s AMD market share…
145
United States discloses nuclear warhead numbers; restores nuclear transparency
The Federation of American Scientists applauds the United States for declassifying the number of nuclear warheads in its military stockpile and the number of retired and dismantled warheads.
146
Mozilla Drops Onerep After CEO Admits to Running People-Search Networks
The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep , an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by KrebsOnSecurity…
147
WireGuard: Beyond the most basic configuration
Last week I wanted to replace my OpenVPN setup with WireGuard. The basics were well-documented, going beyond the basics was a bit trickier. Let me teach you want I learned. The basics But first, let’s summarize the basics. I have a server with a hosting provider that I want to use as a VPN server. I won’t delve into…
148
Bitwarden Heist – How to break into password vaults without using passwords
Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello …
149
Swift Homomorphic Encryption
We’re excited to announce a new open source Swift package for homomorphic encryption in Swift: swift-homomorphic-encryption.
150
Someone has been attempting to DDoS us for weeks and we do nothing
Someone has been attempting to DDoS us for weeks now. They have flooded our server with hundreds of millions of requests and attempted to download our setup…