1951
Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
Last month we shared statistics on some popular reflection attacks. Back then the average SSDP attack size was ~12 Gbps.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
1952
A determined 'hacker' decrypts RDS-TMC
RDS-TMC uses an encryption algorithm simple enough to be run using pen-and-paper hardware.
1953
Shai Hulud launches second supply-chain attack
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
1954
Leaving Gmail for Mailbox.org
This was a tough decision, having used Gmail since 2007/2008. However, I had to draw the line and stop giving Google my data for free. The problem with email is …
1955
Menstrual tracking app data is gold mine for advertisers that risks women safety
Cambridge researchers urge public health bodies like the NHS to provide trustworthy, research-driven alternatives to platforms driven by profit.
1956
1957
A Digital Rumor Should Never Lead to a Police Raid
Law Enforcement, Courts Need to Better Understand IP Addresses, Stop Misuse If police raided a home based only on an anonymous phone call claiming residents broke the law, it would be clearly unconstitutional. Yet EFF has found that police and courts are regularly conducting and approving raids...
1958
macOS gatekeeper and file quarantine bypass
bypassing macOS's file quarantine, gatekeeper, and notarization requirements
1959
Password Managers: Under the Hood of Secrets Management
February 19, 2019
1960
Hacker in Snowflake extortions may be a U.S. soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a…
1961
Google OAuth is broken (sort of)
Today I’m publicizing a Google OAuth vulnerability that allows employees at companies to retain indefinite access to applications like Slack and Zoom, after they’re off-boarded and removed from their company’s Google organization. The vulnerability is easy for a non-technical audience to understand and exploit.
1962
AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS
I am fascinated by things that are simple on the surface and complex underneath! For example, consider the popular padlock icon that is used to signify that traffic to and from a web site is encrypted: How does the browser know that it should display the green padlock? Well, that’s quite the story! It all […]
1963
How we rooted Copilot
After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.
1964
The Day I Fell in Love with Fuzzing
In 2007 I wrote a pair of modding tools, binitools , for a space trading and combat simulation game named Freelancer . The game stores its non-art assets in the format of “binary INI” files, or “BINI” files. The motivation for the binary format over traditional INI files was probably performance: it’s faster to load…
1965
1966
A Kernel Hacker Meets Fuchsia OS
Fuchsia is a general-purpose open-source operating system created by Google. It is based on the Zircon microkernel written in C++ and is currently under active development. The developers say that Fuchsia is designed with a focus on security, updatability, and performance. As a Linux kernel hacker, I decided to take a…
1967
Moving Away from Gmail
tl;dr: I like PurelyMail and I will slowly switch all my online accounts to use it. I've been using it for almost three months and I didn't have any issues (except with some Hotmail/Outlook addresses). I have a GMail account since 2006 (that's the date
1968
Nevada cops use civil forfeiture to steal a veterans life savings
Last February, while driving down a Nevada highway on the way to visit his daughters, Stephen Lara was robbed in plain sight. But his assailants […]
1969
Sending spammers to password purgatory
How best to punish spammers? I give this topic a lot of thought because I spend a lot of time sifting through the endless rubbish they send me. And that's when it dawned on me: the punishment should fit the crime - robbing me of my time - which means that
1970
I didn't reverse-engineer the protocol for my blood pressure monitor in 24 hours
The personal website of James Belchamber.
1971
TinyKVM: Fast sandbox that runs on top of Varnish
TinyKVM can be used to sandbox regular Linux programs or programs with specialized APIs embedded into your servers.
1972
Chrome connects to three random domains at startup
When you start Chrome, it attempts to connect to three random domains. I've seen a few theories about why exactly this happens that brush up against the nefarious. The true rationale is incredibly mundane: hopefully this short summary will clear things up.
1973
1974
Brazilian Court Sanctions Lawyers for Prompt Injection in Court Filing
Two lawyers hid a white-on-white instruction inside a court filing telling the AI to go easy on their case. The court's AI caught it. The fine was $16,000.
1975
Microsoft’s new small print – how your personal data is abused
Microsoft has renewed its Privacy Policy and Service Agreement. The new services agreement goes into effect on 1 August 2015, only a couple of days after the launch of the Windows 10 operating system on 29 July. The new “privacy dashboard” is presented to give the users a possibility to control their data related to…
1976
More Memory Safety for Let's Encrypt: Deploying ntpd-rs
When we look at the general security posture of Let’s Encrypt, one of the things that worries us most is how much of the operating system and network infrastructure is written in unsafe languages like C and C++. The CA software itself is written in memory safe Golang, but from our server operating systems to our…
1977
VPN⁰: A Privacy-Preserving Distributed VPN
This research presents VPN⁰, the first distributed virtual private network offering a privacy preserving traffic authorization and validation mechanism.
1978
What is Differential Privacy?
Yesterday at the WWDC keynote, Apple announced a series of new security and privacy features, including one feature that’s drawn a bit of attention — and confusion. Specifically, Apple …
1979
1980
Eye of Sauron: Long-Range Hidden Spy Camera Detection (2024)
Qibo Zhang and Daibo Liu, Hunan University; Xinyu Zhang, University of California San Diego; Zhichao Cao, Michigan State University; Fanzi Zeng, Hongbo Jiang, and Wenqiang Jin, Hunan University