Top all-time · #4865
Ben Hawkes
Company blog · blog.isosceles.comsecurity
Ben Hawkes is the company blog at blog.isosceles.com, writing about security. Since 2023, 16 different Hacker News readers have linked it 24 times, most often “The WebP 0day”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link Ben Hawkes' security blog for technical write-ups of vulnerabilities, especially the libwebp/WebP 0-day analysis, plus pieces on Stagefright and Phineas Fisher hacking techniques.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Isosceles by Ben Hawkes. Analysis and insights covering the world of hacking, security research and application security.
Most-linked posts?
- The WebP 0day6 people · 6 mentions · first linked 2023-09-21
- Phineas Fisher, Hacktivism, and Magic Tricks5 people · 5 mentions · first linked 2023-09-14
- The Legacy of Stagefright3 people · 3 mentions · first linked 2023-07-26
- How to Build a Fuzzing Corpus3 people · 3 mentions · first linked 2023-08-16
- What is a good Linux kernel bug?2 people · 2 mentions · first linked 2023-08-30
- An Introduction to Exploit Reliability2 people · 2 mentions · first linked 2023-08-02
What Hacker News says?
The Shield TV has had an impressive support lifecycle for an Android device but it still falls well short of a 10 year support cycle. The Shield was released in May 2015 and its latest software update has an Android security patch level of April 2022 and was released November 2022. No more updates seem to be forthcoming. Notably, all Shield TVs today are vulnerable to remote code execution when displaying a maliciou…
Comment linking /the-webp-0day/
on “ChromeOS will soon be developed on large portions of the Android stack”Submitted OpenSSH Backdoors as a story · 257 points
HN discussionThe Isosceles blog post[0] on the initial webp exploit, linked by the article, says: > Google's OSS-Fuzz project has fuzzed hundreds of open source libraries for many years now, including libwebp and many other image decoding libraries. It's possible to look in full detail at the code coverage for OSS-Fuzz projects, and it's clear that lossless support for WebP was being fuzzed extensively… In fact one of the first…
Comment linking /the-webp-0day/
on “Blasting Past WebP - An analysis of the NSO BLASTPASS iMessage exploit”Submitted Robots Dream of Root Shells as a story · 19 points
HN discussion> I'm more worried about AV software Media codecs pretty much, single-handedly even, drove about a new era of defenses and mitigations in Android: https://blog.isosceles.com/the-legacy-of-stagefright/
Comment linking /the-legacy-of-stagefright/
on “Anonymous GitHub account mass-dropping undisclosed 0-days”Submitted Phineas Fisher, Hacktivism, and Magic Tricks as a story · 3 points
HN discussionRepro steps here: https://blog.isosceles.com/the-webp-0day/ This is pretty bad, there will be many vulnerable applications and someone just posted how to exploit it. I just reproduced it on a VM: SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/<name>/webp_test/examples/dwebp+0xb24e9) in BuildHuffmanTable Shadow bytes around the buggy address: ... Also, here's the webp it generated as base64, but chrome doesn'…
Comment linking /the-webp-0day/
on “Google assigns a CVE for libwebp and gives it a 10.0 score”Submitted What is a good Linux kernel bug? as a story · 3 points
HN discussionThere was a great explanation a few days back on why the vulnerability existed, and on why the fix was correct: https://blog.isosceles.com/the-webp-0day/ (Discussed in https://news.ycombinator.com/item?id=37600852 )
Comment linking /the-webp-0day/
on “Google assigns a CVE for libwebp and gives it a 10.0 score”Submitted The WebP 0day as a story · 2 points
HN discussionA related article: "Phineas Fisher, Hacktivism, and Magic Tricks", on the hacking techniques described in each of PF's publications and whether they would work as well today: https://blog.isosceles.com/phineas-fisher-hacktivism-and-mag...
Comment linking /phineas-fisher-hacktivism-and-magic-tricks/
on “Hack Back A DIY guide to rob banks”Submitted Phineas Fisher, Hacktivism, and Magic Tricks as a story · 2 points
HN discussionThis could be an important update to prevent phishing attacks with document attachments that contain malicious .webp images. I haven't seen one of those yet, but a non-weaponized, proof of concept malformed .webp is out there along with a detailed technical writeup, so it's only a matter of time: https://blog.isosceles.com/the-webp-0day/
Comment linking /the-webp-0day/
on “LibreOffice 7.6.2 and 7.5.7 Released to Address Critical WebP Vulnerability”Submitted Phineas Fisher, Hacktivism, and Magic Tricks as a story · 2 points
HN discussionSubmitted Phineas Fisher, Hacktivism, and Magic Tricks as a story · 2 points
HN discussionSubmitted How to Build a Fuzzing Corpus as a story · 2 points
HN discussionSubmitted An Introduction to Exploit Reliability as a story · 2 points
HN discussionSubmitted How to Build a Fuzzing Corpus as a story · 1 points
HN discussionSubmitted What is a “good” Linux Kernel bug? as a story · 1 points
HN discussionSubmitted Exploit Equivalence Classes as a story · 1 points
HN discussionSubmitted An Introduction to Exploit Reliability as a story · 1 points
HN discussionSubmitted How to Build a Fuzzing Corpus as a story · 1 points
HN discussionSubmitted The Legacy of Stagefright as a story · 1 points
HN discussionSubmitted The Legacy of Stagefright as a story · 1 points
HN discussion
