ga-vu

lol, now this is the weirdest thing I've read in a while

They're not zero-days if they've been privately disclosed and patches are available.

This appears to be one of the four ZombieLoad/RIDL variations, rather than a new attack: https://zombieloadattack.com/

Exactly the type of content I want to find on HN.

Upvoted... twice!

Just a reminder that Comparitech "pays" security researchers for "data breaches" and most likely encourages people to report these things to them without getting servers patched: https://twitter.com/securinti/status/1196850409924681728

No offense, but if you need to "pay" for your researcher, you're probably not that ethical and are most likely behind some intentional offensive hacking, so people can make money off your back.

Did... did... did you just admit to spamming HN just for the clicks?

wow... you're really not that smart, are you?

It's not a "a comparable cryptographic certificate"

It's just a plaintext password

It's a university email, not Pentagon backend accounts.

It is a stupid law because they're being way too thorough and abrasive when they shouldn't.

How much do you wanna bet the German parliament is not protected in the same way... actually don't answer that... here's an article published today about a stupid vulnerability in the Bundestag's internal chat app: https://zero.bs/osintrecon-vs-pentestschwachstellenscan.html

lol... I looked at another article this account submitted.

They copied everything from another site, including the copyright:

"This report by The Canadian Press was first published Dec. 17, 2019.

Note to readers: This is a corrected story. An earlier version stated that the majority of LifeLabs customers were in Ontario and Quebec.

The Canadian Press. All rights reserved."

The article is a lame copy-paste job from a Bleeping Computer report. Of course it was all over the place.

Note to HN admins: This account signed up recently and is now spamming HN with its own links.... aka... a spammer.

Probably because reporters don't work for cyber-security firms and don't give a shit about the C&C URL... just saying.

Normally, companies would go after the users committing the copyright infringement, not the platform. This is just a money-grab. Similar to how they went after NGINX.

No

Probably because Cisco is a hardware vendor. NSO actually has support staff that will craft exploits to attack certain targets, fix your server so you won't get discovered, write phishing emails, if you need a hand getting off the ground. Big difference.

You don't say.

Someone's been reading Motherboard, I see.

Source: https://www.aclu.org/news/privacy-technology/ice-and-cbp-are...

For more insight and details.

That's just a description of the company, probably copy-pasted from some stock market site.

When someone says "how they built an empire" I expect to read their history and modus operandi.

Title says "how" but it doesn't explain anything.

It just lists that they run two malicious Chrome extensions.

Talk about clickbait.

20 VPS providers shut down this weekend, which brings the total to 68 in the past four months.

Pretty big deadpooling scam.

Glorious

Yes it was. I think everyone from Five Eyes to private cyber-security experts have said this already for the past two years.

Actual source: https://www.vpnmentor.com/blog/report-truedialog-leak/

Saved you a click

This article massively overhypes the breach. 2FA and password resets have a very short window of validity. The database contained historical messages and did not operate in real-time.

Another sound advice that the media is gonna overblow in 3, 2, 1...

paywall... ugh

For those interested into how this works, look into Time-Travel Debugging and the WebReplay API

Was there even an internet for someone to chronolog his murders back in 1982?

I don't get this article at all...

dupe: https://news.ycombinator.com/item?id=21606415

But the amazon fiiiireeeess... lungs of the eaaaaaaartthhh