2401
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
2402
Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it
This week we released our authorisation flow making it possible for you to go from building apps that talk to your bank account, to building apps that can talk to any bank account. This is huge. Check out this SMS bot (how on trend) I hacked up yesterday morning. (and don’t forget to join the beta wait list ).
2403
Fake recruiter lured aerospace employee with trojanized coding challenge
ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.
2404
2405
The State of Software Security in 2019
My goal in this post is to skim my observations on the state of software design and development over the past year, and to try to find a meaningful way forward for myself for 2019. My perspective is limited by the fact that I have worked exclusively in client-side software security for the past 7.5 years. Still, I…
2406
Belarus finally bans Tor
Country: Belarus Probed ISPs: Beltelecom (AS 6697) Censorship method: TCP injections We have recently heard of network anomalies in Belarus. Tor has been finally blocked in December 2016, although it had been explicitly declared that Tor should be blocked since February 2015. An anonymous cypherpunk has helped to…
2407
Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall
Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.
2408
How an empty S3 bucket can make your AWS bill explode
Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?
2409
2410
Hacking the largest airline and hotel rewards platform (2023)
Between March 2023 and May 2023, we identified multiple security vulnerabilities within points.com, the backend provider for a significant portion of airline and hotel rewards programs. These vulnerabilities would have enabled an attacker to access sensitive customer account information, including names, billing…
2411
Discord Desktop App RCE
A few months ago, I discovered a remote code execution issue in the Discord desktop application and I reported it via their Bug Bounty Prog...
2412
2413
2414
Instagram's URL Blackhole
While exploring the file system on a jailbroken iPhone 6s, I stumbled upon an interesting folder:
2415
Hackers Steal Phone, SMS Records for Nearly All AT&T Customers
AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people — nearly all of its customers. AT&T said it delayed disclosing the incident in response to “national security and public safety concerns,” noting that some of the records included data that…
2416
Cryptocurrency scams cost owners $7.7B in 2021, driven by DeFi-based “rug pulls”
Crypto scams were once again the largest form of crypto crime, with over $7.7 billion worth of cryptocurrency taken from victims worldwide.
2417
Users are losing out against Big Sur’s sealed System
macOS 11.2, 11.2.1 and 11.2.2 have come in quick succession. What do they tell us about how difficult it is to update Big Sur’s sealed System volume? Is this the way to go?
2418
Cloudflare loses 22% of its domains in Freenom .tk shutdown
A staggering 12.6 million domains on TLDs controlled by Freenom (.tk, .cf and .gq) have been shut down and no longer resolve, leading to a significant reduc ...
2419
2420
A Tor of the Dark Web
Tell me if you’ve been in this situation: you’re chatting about online anonymity with your wife and the other Knight-Mozilla Fellows over a pizza in Florence. A quiet-spoken stranger who had been sitting across the room walks up to your table and says “are you all here for the Tor hackathon?” You respond “why yes, yes…
2421
Dumping Memory to Bypass BitLocker on Windows 11
Memory-Dump-UEFI is a UEFI application for dumping the contents of RAM.
2422
2423
Apple’s device surveillance plan is a threat to user privacy – and press freedom
The backlash from privacy and human rights advocates to Apple's new plan this month for scanning photos on user devices to detect known child sexual abuse images has been loud and nearly unanimous. The tech raises press freedom problems, too.
2424
Google Home (in)Security
TL;DR: An undocumented API in Google home devices is easily exploitable. This command will reboot any on your local network: nmap –open -p 8008 192.168.1.0/24 | awk ‘/is up/ {print up};…
2425
2426
GrayKey iPhone unlocker poses serious security concerns
Ever since the case of the San Bernadino shooter pitted Apple against the FBI over the unlocking of an iPhone, opinions...
2427
Duplicate SSH Keys Everywhere
Back in December when I revamped the SSH banner and started collecting the fingerprint I noticed an odd behavior. It turns out that a few SSH keys are used a lot more than once. For example, the following SSH fingerprint can be found on more than 250,000 devices! dc:
2428
Blocking Visual Studio Code embedded reverse shell before it's too late
Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …
2429
Experian Sold Consumer Data to ID Theft Service
An identity theft service that sold Social Security and drivers license numbers — as well as bank account and credit card data on millions of Americans — purchased much of its data from Experian , one of the three major credit bureaus, according to a lengthy investigation by KrebsOnSecurity.
2430
Who is squatting IPv4 addresses?
It’s an established fact on the internet that we have ran out of IP(v4) addresses , and we are starting to see the pressure on obtaining IPv4 space. For example if you want to get a /24 block from RIPE NCC when you sign up as a member, then you are currently looking at a 2 month wait for a recycled IPv4 /24 block .