Tag: hacking
-
Webpage Copy-Protection is Impossible (and that's great!)
A friend of mine was inconvenienced by an over-eager bit of Web copy-protection JavaScript this week, and it reminded me that more-than-ever, these scripts are both harmful (to legitimate users) and pointless (ineffective at preventing downloading).
-
Exploiting Fail2ban "portscan" permablocks over HTTP for denial-of-service
On a forum they and I share, Loebas suggested that I should be careful doing portscans in case I hit e.g. fail2ban rules. I counter that such rulesets would be a terrible idea (and are therefore uncommon), and provide a specific demonstration of how an attacker can turn them against the site's legitimate users!
-
Things Champ'd Up thinks are uniquely American
When I play Jackbox Games with my friends, I enable the 'filter US-centric content'. But what does that actually do? Let's swiftly do a bit of easy reverse-engineering on one of my favourite games in the series, Champ'd Up, and find out... what the developer thinks "US-centric" means!
-
The secret API I used to tell LeShuttle about different outbound and return passengers
Channel Tunnel operator LeShuttle's website wouldn't provide a working UI to specify that I'd have different passengers in my car for the outbound and return journeys. So, obviously, I reverse-engineered their API and pushed the information to their database directly.
-
Your 'App' Could Have Been a Webpage (so I fixed it for you...)
I was asked to install a mobile app to get access to the itinerary of a trip to Disneyland I'm taking with the kids. Fuck that noise: couldn't it have just been a Web page? An hour of reverse-engineering later, it is, and it's superior in virtually every way to the "app" that it replaces.
-
Exploiting Thoughtcrime in LLMs
New malware variants seem to include source code comments about how to build WMDs, presumably in an effort to hamper analysis by AI-based tools. I find myself wondering if the same technique can be used by authors to "protect" their work, too...
-
Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked
Meta decided to replace a lot of their tech support with a chatbot. Which meant giving that chatbot the power to manipulate data. Which meant, to the surprise of nobody whatsoever, that hackers tricked the chatbot into giving them access to other people's accounts.
-
NHS England rushes to hide software over AI hacking fears
New Scientist reports that the NHS are closed-sourcing a lot of their code, out of fear that AIs like Mythos will facilitate easier exploitation of their systems if they don't. Which is pretty-much... completely backwards thinking.
-
Why Security Engineering needs a Hacker Mentality
Security engineering is about a lot of things, but the best security engineers show the 'hacker mindset' characteristics of curiosity and imagination. Here's an example of how I found an XSS vulnerability in a forum, mostly by accident, and how curiosity was the key.
-
What can you do with a software privacy polariser?
Samsung's 2026 phones will feature a dynamic privacy filter, blacking-out parts of the screen selectively from shoulder-surfers. I'm so curious about the capabilities of (and API for) this technology: what could I make it do?
-
How an RM Nimbus Taught Me a Hacker Mentality
Thirty to thirty-five years ago, as a young and curious hacker, I broke out of the restrictions on my secondary school's computer lab and briefly achieved rockstar popularity amongst peers who, through my tools, could now play videogames instead of doing their coursework. But their interest in the results of my exploits were incompatible with my interest in the sheet joy of discovery... and, inevitably, this meant trouble.
-
Well my day, week, and year (which has been off to a slightly ropey start) got a whole heap better today when I received a postcard from August (@august@chaos.social) & Sappho (@kruemmelspalter@chaos.social), sent from 39c3 on a CCC postcard... with a CCC stamp (thanks, Deutsche Post)!
Alt
Both sides of a postcard. The reverse shows a red-on-black illustration of the shape of a computer keyboard, superimposed upon the outline of a star, alongside, white text reading 'Chaos Computer Club'. On the front is the message: 'My girlfriend and I really love your blog, so when we saw that you accept postcards, we knew we had to send you one from this year's Chaos Communication Congress - 39c3! You're awesome, please keep doing what you're doing! August & Sappho @august@chaos.social (Mastodon) kruemmelspalter.org (Website)'.
Super cool, and exactly the mood boost I needed today.
-
UK’s secret Apple iCloud backdoor order is a global emergency, say critics
The UK seems to be strongarming Apple to weaken the security of its consumer products, which is fucking stupid. Weakened and backdoored encryption in mainstream products doesn't help catch smart criminals. But it does help smart criminals to catch regular folks.
-
Endless SSH Tarpit on Debian
Given that I already routinely run my SSH servers on unusual ports, I'm surprised it took me until today before I discovered Endlessh, an SSH tarpit you can install on the conventional port to waste the time of anybody attempting a brute-force attack. Here's how I set it up on a Debian 12 server.
-
Good Food, Bad Authorisation
(BBC) Good Food has started adding "premium" content for which you have to install their app and pay for a subscription. Except the paywall they've put in place is so weak that I fell through it without even meaning to. It's a great - and relatively harmless - example of how front-end-first development is undermining the development of secure Web systems.