211
Docker Security Cheat Sheet
Website with the collection of all the cheat sheets of the project.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 678 posts.
212
Gift card gang extracts cash from 100k inboxes daily
Some of the most successful and lucrative online scams employ a “low-and-slow” approach — avoiding detection or interference from researchers and law enforcement agencies by stealing small bits of cash from many people over an extended period. Here’s the story of a cybercrime group that compromises up to 100,000 email…
213
A deep dive on a Facebook reseller of bikes stolen in Colorado
Bike Index tracks a Colorado-to-Mexico stolen bike pipeline - and learns things along the way
214
Escaping VirtualBox 6.1: Part 1
This post is about a VirtualBox escape for the latest currently available version (VirtualBox 6.1.16 on Windows). The vulnerabilities were discovered and exploited by our team Sauercl0ud as part of the RealWorld CTF 2020/2021. The vulnerability was known to the organizers, requires the guest to be able to insert…
215
Pwned passwords, open source in the .NET foundation and working with the FBI
I've got 2 massive things to announce today that have been a long time in the works and by pure coincidence, have aligned such that I can share them together here today. One you would have been waiting for and one totally out of left field. Both these announcements
216
How to handle secrets on the command line
How to keep secret credentials safe on the command line.
217
The modern packager’s security nightmare
One of the most important tasks of the distribution packager is to ensure that the software shipped to our users is free of security vulnerabilities. While finding and fixing the vulnerable code is…
218
That's not how 2FA works
Another day, another high-profile website cloned to phish credentials. Tess Rinearson@_tessrIs this a phishing attempt? Goes to "githubverification.com" and asks for username and pw (if so, it nearly got me!) /cc @github pic.x.com/jgt4oNvjF2❤️ 2,243💬 111🔁 016:12 - Sat 16 January 2021 In the replies, you’ll see lots of…
219
220
What is BGP? – BGP routing explained
Border Gateway Protocol (BGP) is the routing protocol for the Internet. Much like the post office processing mail, BGP picks the most effecient routes for delivering Internet traffic.
221
The Gates to Hell: Apple’s Notarizing
NeoFinder is a powerful and very fast disk cataloging tool for songs, videos, photos, all your digital documents
222
Firefox Release Includes Total Cookie Protection and Multiple Picture-in-Picture
Beginning last year, the internet began playing a bigger role in our lives than ever before. In the US, we went from only three percent of workers to more
223
Securing a Postgres Database
A comprehensive overview of the best practices for securing access to PostgreSQL databases.
224
Cryptocurrency scams cost owners $7.7B in 2021, driven by DeFi-based “rug pulls”
Crypto scams were once again the largest form of crypto crime, with over $7.7 billion worth of cryptocurrency taken from victims worldwide.
225
Users are losing out against Big Sur’s sealed System
macOS 11.2, 11.2.1 and 11.2.2 have come in quick succession. What do they tell us about how difficult it is to update Big Sur’s sealed System volume? Is this the way to go?
226
Apple’s device surveillance plan is a threat to user privacy – and press freedom
The backlash from privacy and human rights advocates to Apple's new plan this month for scanning photos on user devices to detect known child sexual abuse images has been loud and nearly unanimous. The tech raises press freedom problems, too.
227
How did LastPass master passwords get compromised?
LastPass accounts are under attack. I look into how user’s master passwords might have leaked.
228
Freenom, the free domains website, is a scam
Self-taught developer. Go, Rust, Python and Javascript. - hackermondev
229
Reverse engineering software licensing from early-2000s abandonware
This series concerns a software licensing system used in a proprietary software application from circa 2004. The software was available in an unregistered trial mode with limited functionality. A free licence could be obtained by registering online with the software vendor. The software became abandonware circa 2009…
230
Using Ghidra to Reverse Engineer Super Monkey Ball for GameCube
In Part 1, we used Dolphin’s debugger to find the location of Player 1’s score in RAM . In this article, our goal is to hack the score calculation routine so that the bonus goals do not award so many points.
231
New EU data blockage as German court would ban many cookie management providers
Alston & Bird’s Dan Felz and Peter Swire look at the recent Wiesbaden Administrative Cou
232
Google Joins Apple to Opt-out of Mobile Advertising IDs
Android 12 makes interest-based advertising obsolete to set off an irreversible collapse in Facebook’s ad ecosystem
233
234
The patent troll that won a $308M jury trial against Apple
*If you’re the owner of this website and have questions, reach out to Bluehost. We’re happy to help.
235
What3Words – The Algorithm
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…
236
Google launches new vulnerability reward platform
Posted by Jan Keller, Technical Program Manager, Google VRP A little over 10 years ago , we launched our Vulnerability Rewards Program (VR...
237
Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
Summary of CVE-2021-4228 (Log4Shell), trivial RCE in log4j, a common Java logging framework. Includes list of affected platforms.
238
Why Authorization Is Hard
There's a fundamental tension in authorization. Is it business logic or authorization logic? Should it be in the app, or separate? Let’s talk about what makes a
239
Indian Government Breached, Massive Amount of Critical Vulnerabilities
A writeup detailing the vulnerability reporting process that took place after Sakura Samurai had breached the Indian Government
240
SAML Is Insecure by Design
What is SAML? Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. Source: Wikipedia SAML is often used for single-sign on (“Sign in with Google”, “Sign in with Twitter” etc.). It means when you want to log in to example.com, example.com…