151
Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
Have you ever been told that the company’s data on laptops is protected thanks to BitLocker? Well it turns out that this depends on BitLocker’s configuration…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 617 posts.
152
Google OAuth is broken (sort of)
Today I’m publicizing a Google OAuth vulnerability that allows employees at companies to retain indefinite access to applications like Slack and Zoom, after they’re off-boarded and removed from their company’s Google organization. The vulnerability is easy for a non-technical audience to understand and exploit.
153
154
We will not ‘walk out’ of UK, nor comply with any request to bypass encryption
Tutanota: We will not 'walk out' of UK like Signal. Nor will we comply with any request to bypass our encryption.
155
The FBI proves again it can’t be trusted with Section 702
The FBI doesn’t believe that either our rights or the limitations that Congress has placed upon them matter when it comes to the vast amount of information about us collected under FISA Section 702. The latest exhibit in this is in yet another newly declassified opinion of the Foreign Intelligence Surveillance Court…
156
LogoFAIL: Secure Boot bypass with manipulated boot logos
LogoFAIL by BINARLY: Discover how vulnerable image parsing impacts device manufacturers in the UEFI firmware ecosystem. Learn about critical LogoFAIL…
157
UCLA computer grad constructs “crown jewel of cryptography”
Aayush Jain’s dissertation, “Indistinguishability Obfuscation from Well-Studied Assumptions,” established the feasibility of mathematically rigorous software obfuscation from well-studied hardness conjectures. The central goal of software obfuscation is to transform source code to make it unintelligible without…
158
iCloud Drive silently deletes your content
The first time it happened, I was writing a paper. The paragraphs I had just typed vanished into thin air, faster than Time Machine or Backblaze could save them. Gone. The next occurrence was during app development; Xcode suddenly flagged numerous errors in previously error-free code. My recent changes to several…
159
Mozilla solves the Manifest V3 puzzle to save ad blockers
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
160
Valve bans 40k Dota 2 accounts using honeypot patch
Today, we permanently banned over 40,000 accounts that were using third-party software to cheat in Dota over the last few weeks. This software was able to access information used internally by the Dota client that wasn't visible during normal gameplay, giving the cheater an unfair advantage. While fixing the…
161
Mitigating the Hetzner/Linode XMPP.ru MitM interception incident
(If you just want some recommendations for what to do, skip down to the Recommendations section below .)
162
WInd3x, the iPod Bootrom exploit 10 years too late
This is a write-up of the wInd3x bootrom exploit affecting iPod Nanos from 3rd gen to 5th gen. A ready-made tool to use this exploit is available at github.com/freemyipod/wInd3x .
163
Today Is One of the Biggest Surveillance Votes. Will the FBI Stop Spying?
FISA Reform §702 Is a Threat to Democracy At Home and Abroad.
164
How I Made a Heap Overflow in Curl
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
165
Purple Llama: Towards open trust and safety in generative AI
Meta AI announces Purple Llama, a project for open trust and safety in generative AI, with tools for cybersecurity and input/output filtering.
166
167
The undocumented Android change that led to aCropalypse was reported during beta
The bug lies in closed-source Google-proprietary code so it’s a bit hard to inspect, but after some patch-diffing I concluded that the root cause was due to this horrible bit of API ‘design’: https://issuetracker.google.com/issues/180526528 .
168
The retaliation: Pranking my roommate with targeted Facebook ads (2014)
This is the chronicle of the most epic retaliation and how I pranked my roommate with targeted Facebook Ads to the point of complete paranoia and delusion.
169
How likely is losing a Google account?
Let's say you use a Google account as the root of your online identity: Gmail, Fi, "Sign in with Google", Google's password manager, etc. How much should you be worried that you'll suddenly find yourself unable to get into everything? Should you do something else instead? To get a sense of how common lockouts are and…
170
Chrome: Heap buffer overflow in WebP
The Stable and Extended stable channels has been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will...
171
Email addresses are not good 'permanent' identifiers for accounts
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
172
I use C when I believe in memory safety
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
173
Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures
Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Daniel Hirschberger, and Jörg Schwenk, Ruhr University Bochum
174
The Reluctant Sysadmin's Guide to Securing a Linux Server
I wrote a follow-up to this guide, which you should probably consider along with this article.
175
IPinside: Korea’s Mandatory Spyware
Banking websites in South Korea can only be used with IPinside installed. This application collects lots of data about the user, and it makes that data accessible to each and every website. The protection is inadequate.
176
Android 14 blocks all modification of system certificates, even as root?
Update: This post sparked a lot of excellent discussion and debate on workarounds, and there are now multiple working solutions to allow certificate injection...
177
No Source Code == No Patent
How we know you "have' the invention
178
Compromised PyTorch-nightly dependency chain between December 25th – December 30
If you installed PyTorch-nightly on Linux via pip between December 25, 2022 and December 30, 2022, please uninstall it and torchtriton immediately, and use the latest nightly binaries (newer than...
179
UK Threatens End-to-End Encryption
In an open letter, seven secure messaging apps—including Signal and WhatsApp—point out that the UK’s Online Safety Bill could destroy end-to-end encryption: As currently drafted, the Bill could break end-to-end encryption,opening the door to routine, general and indiscriminate surveillance of personal messages of…
180
Mullvad Browser
We have partnered with Mullvad VPN to develop the Mullvad Browser - a Tor Browser without Tor