Top all-time · #2665
Aleph Research
Company blog · alephsecurity.comsecurityhardware
Aleph Research is the company blog at alephsecurity.com, writing about security and hardware. Since 2017, 29 different Hacker News readers have linked it 32 times, most often “Overcoming (some) Spectre browser mitigations”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
HN commenters link Aleph Research's posts on running iOS/XNU in QEMU, Spectre-based browser exploits, Qualcomm EDL boot access and an older Nexus 6 initroot injection. They mostly cite them as sources.
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Aleph Research: Security Research by HCL Software
Most-linked posts?
- Overcoming (some) Spectre browser mitigations5 people · 6 mentions · first linked 2018-06-27
- /2019/06/17/xnu-qemu-arm64-1/4 people · 4 mentions · first linked 2019-06-25
- Accelerating iOS on QEMU with hardware virtualization (KVM)4 people · 4 mentions · first linked 2020-07-19
- Attacking Nexus 9 with Malicious Headphones3 people · 3 mentions · first linked 2017-03-09
- Exploiting Qualcomm EDL Programmer Tools (1): Gaining Access and PBL Internals3 people · 3 mentions · first linked 2018-01-23
- Running iOS in QEMU to an interactive bash shell2 people · 2 mentions · first linked 2019-12-05
- Bypassing Nexus 6 Secure Boot Through Kernel Command-Line Injection2 people · 2 mentions · first linked 2017-05-23
- Exploiting crash handlers: LPE on Ubuntu2 people · 2 mentions · first linked 2021-02-17
What Hacker News says?
The Raspberry Pi has an ARM processor, while macOS requires an x86_64 processor, so you could not build a Hackintosh. One could conceivably run iOS, as enough is understood to emulate the OS on similar hardware (see https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/ ).
Comment linking /2019/06/17/xnu-qemu-arm64-1/
on “Raspberry Pi 4”Submitted SuDump: Exploiting suid binaries through the kernel as a story · 62 points
HN discussionHere's an example of post-mitigation reading of protected memory using Javascript and Spectre https://alephsecurity.com/2018/06/26/spectre-browser-query-c... I think it's just silly that you would rely on browser mitigations like disabling high precision timers when that's obviously just a hack.
Comment linking /2018/06/26/spectre-browser-query-cache/
on “More Intel speculative execution vulnerabilities”Submitted Accelerating iOS on QEMU with hardware virtualization (KVM) as a story · 22 points
HN discussionThere are variants of Spectre that do not require a high resolution timer. Here's some thoughts on working around browser mitigations: https://alephsecurity.com/2018/06/26/spectre-browser-query-c...
Comment linking /2018/06/26/spectre-browser-query-cache/
on “Make Linux Fast Again (2019)”Submitted Running iOS in QEMU to an interactive bash shell as a story · 11 points
HN discussionPrevious thread from 18 months ago: https://news.ycombinator.com/item?id=22870905 Latest blog post: https://alephsecurity.com/2020/07/19/xnu-qemu-kvm/
Comment linking /2020/07/19/xnu-qemu-kvm/
on “iOS on QEMU”Submitted Overcoming (some) Spectre browser mitigations as a story · 5 points
HN discussionThe "this blogpost" link about KVM has the wrong domain, https://alephsecurity.com/2020/07/19/xnu-qemu-kvm/ for the post.
Comment linking /2020/07/19/xnu-qemu-kvm/
on “iOS on QEMU”Submitted Attacking Nexus 9 with Malicious Headphones as a story · 5 points
HN discussionNot that I've heard of. Recently I stumbled upon this guy trying to get it to work in QEMU: https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/
Comment linking /2019/06/17/xnu-qemu-arm64-1/
on “Running postmarketOS on iPhone 7”Submitted Exploiting crash handlers: LPE on Ubuntu as a story · 3 points
HN discussionSomewhat related (KVM for iPhone processors): https://alephsecurity.com/2020/07/19/xnu-qemu-kvm/
Comment linking /2020/07/19/xnu-qemu-kvm/
on “Booting a macOS Apple Silicon Kernel in QEMU”Submitted Untethered initroot CVE-2016-10277 as a story · 3 points
HN discussionProbably the blog posts are a better starting point: - https://alephsecurity.com/2019/06/25/xnu-qemu-arm64-2/ - https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/ - Here some more recent screenshots: https://twitter.com/JonathanAfek/status/1221719094661197825
Comment linking /2019/06/17/xnu-qemu-arm64-1/
on “Xnu-QEMU-Arm64: iOS on QEMU”Submitted Attacking Nexus 9 with Malicious Headphones as a story · 3 points
HN discussionThere is a project [1][2] to emulate iOS in QEMU. You can find more details about installation process and research itself in their articles [3][4]. [1] https://github.com/alephsecurity/xnu-qemu-arm64 [2] https://github.com/alephsecurity/xnu-qemu-arm64-tools [3] https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/ [4] https://alephsecurity.com/2019/06/25/xnu-qemu-arm64-2/
Comment linking /2019/06/25/xnu-qemu-arm64-2/
on “PureDarwin – Darwin-based open source OS”Submitted Exploiting Qualcomm EDL Programmer Tools (1): Gaining Access and PBL Internals as a story · 2 points
HN discussionI just realized that my comment made it appear as if you can get a high-resolution timer without SharedArrayBuffer; I don't know of anyone who has done that yet. But people have made exploits that don't rely on it: https://alephsecurity.com/2018/06/26/spectre-browser-query-c...
Comment linking /2018/06/26/spectre-browser-query-cache/
on “Linux 5.8 Set to Optionally Flush the L1d Cache on Context Switch”Submitted Overcoming (some) Spectre browser mitigations as a story · 2 points
HN discussionShort answer "not really". While it could be used to recover the phone, it requires a "programmer" program, which is signed by the vendor (Google, here) that hasn't been leaked. Or, really, I should say that these programs should be made available as "software rights to repair". --- Some reading: https://alephsecurity.com/2018/01/22/qualcomm-edl-1/ A more up-to-date open source tool: https://github.com/bkerler/edl/…
Comment linking /2018/01/22/qualcomm-edl-1/
on “Google Pixel 3 (XL) bricking out of nothing”Submitted Exploiting Qualcomm EDL Programmers as a story · 2 points
HN discussionIt's possible to get macOS arm64 working on Arm hardware (except Rosetta on Arm cores that don't implement TSO/SC, or you're stuck with a single core). However, Arm macOS assumes an Armv8.3-A architecture baseline. Patching at runtime from Armv8.3-A to v8.2-A is quite feasible, to 8.0-A like an RPi4 is another matter. Of course, this will apply to VMs only (for now at least). https://alephsecurity.com/2019/06/17/xnu…
Comment linking /2019/06/17/xnu-qemu-arm64-1/
on “Ask HN: Will Apple M1 mean better support for Raspberry Pi?”Submitted Bypassing Nexus 6 Secure Boot Through Kernel Command-Line Injection as a story · 2 points
HN discussionIs Qualcomm serious? The kernel commandline parameter injection is basically the same thing from a decade ago on Motorola phones [0]. 0: https://alephsecurity.com/2017/05/23/nexus6-initroot/
Comment linking /2017/05/23/nexus6-initroot/
on “Qualcomm exploit chain brings bootloader unlocking freedom to Android flagships”Submitted All OnePlus Devices Are Vulnerable to Downgrade Attacks as a story · 2 points
HN discussionSubmitted Exploiting crash handlers: LPE on Ubuntu as a story · 1 points
HN discussionSubmitted Overcoming (some) Spectre browser mitigations as a story · 1 points
HN discussionSubmitted Exploiting Qualcomm EDL Programmers, Part 1 as a story · 1 points
HN discussionSubmitted Attacking Nexus 9 with Malicious Headphones as a story · 1 points
HN discussion
