Top all-time · #1725
blog.lookout.com
Company blog · blog.lookout.com/blogsecurityprogramming
blog.lookout.com is the company blog at blog.lookout.com, writing about security and programming. Since 2012, 43 different Hacker News readers have linked it 55 times, most often “Why I Hacked Apple’s TouchID and Still Think it is Awesome”. No feed was found, so read it on the site itself.
Too few sampled comments (18) to say how often HN recommends it.?
Why HN links it
HN readers link Lookout's security research posts as sources on topics such as the TouchID fingerprint hack, Pegasus/Trident iPhone attacks, malicious SDKs, XcodeGhost and Tesla hacking. One commenter praised a malware post's writing.
Summarised by Claude from a sample of 18 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Why I Hacked Apple’s TouchID and Still Think it is Awesome5 people · 6 mentions · first linked 2013-09-24
- Sophisticated, persistent mobile attack against high-value targets on iOS4 people · 4 mentions · first linked 2016-08-25
- iPhone 6 TouchID hack2 people · 2 mentions · first linked 2014-09-23
- Dendroid malware takes over your camera, records audio (2014)2 people · 2 mentions · first linked 2015-07-15
- Hacking a Tesla Model S2 people · 2 mentions · first linked 2016-01-20
- Jailbreaking not a requirement for infecting iPhones with Hacking Team spyware2 people · 2 mentions · first linked 2015-07-10
What Hacker News says?
Ok, since most people seem to agree that that URL is the best source, we've changed to it from https://blog.lookout.com/blog/2016/08/25/trident-pegasus/ . Thanks.
Comment linking /blog/2016/08/25/trident-pegasus/
on “NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender”Submitted Why I Hacked Apple’s TouchID and Still Think it is Awesome as a story · 107 points
HN discussion>but in reality it's pretty damn simple Also, it's not remotely "pretty damn simple": https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples... "Creating the fake fingerprint is arguably the hardest part and by no means “easy.” It is a lengthy process that takes several hours and uses over a thousand dollars worth of equipment..."
Comment linking /blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/
on “Chaos Computer Club breaks Apple TouchID”Submitted iPhone 6 TouchID hack as a story · 52 points
HN discussion> They can launch background threads, intercept and log any and all UI interaction and UI widget/input field values, and call home. All of this without you ever calling a single method explicitly. Unrelated to Facebook, but some malicious SDK already doing it. For example, Igexin( https://blog.lookout.com/igexin-malicious-sdk ), and it's not the only one. Be careful when importing anything.
Comment linking /igexin-malicious-sdk
on “Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More”Submitted Jailbreaking not a requirement for infecting iPhones with Hacking Team spyware as a story · 10 points
HN discussionIf they have access to a live finger for the TouchID, sure they can bypass - but they could do that with the $5 guaranteed coercion method as well [1]. Copying a good fingerprint from a dead finger or a randomly placed print is not easy [2]. It's hard, doable but you get 5 tries so if you screw up, you have thrown away all the hard work of the print transfer. All bets are off if the iPhone is power-cycled. Best bet…
Comment linking /blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/
on “Apple Is Said to Be Working on an iPhone Even It Can’t Hack”Submitted Uncovering How the Recent Celebrity Image Breach Happened as a story · 8 points
HN discussionAttacking high-value dissidents: https://blog.lookout.com/blog/2016/08/25/trident-pegasus/
Comment linking /blog/2016/08/25/trident-pegasus/
on “The No More Ransom Project”Submitted Coinkrypt – cryptocoin mining malware that didnt work as a story · 6 points
HN discussionApps can be sideloaded on iOS really easily. There's a whole community of people ( https://reddit.com/r/sideloaded ) around modifying apps and sideloading them. https://ipasigner.io is an example - just click the app you want to install, go into iOS settings and give permissions to the cert, and boom you have a new sideloaded app installed. Takes less than a minute, no computer required. It used to be even simpler i…
Comment linking /ios-9-sideloading
on “Apple’s Guidelines Now Allow Executable Code in Educational Apps and Dev Tools”Submitted New adware “BeiTaAd” found hidden within popular applications in app store as a story · 4 points
HN discussionLookout Security describes it as malware[2] and as malicious, as does Palo Alto Networks[3], Ars[4], Reuters[5] and The NY Times[6]. From here[1]: > Remote control security risks > XcodeGhost can be remotely controlled via commands sent by an attacker from a Command and control server through HTTP. This data is encrypted using the DES algorithm in ECB mode. Not only is this encryption mode known to be weak, the encr…
Comment linking /blog/2015/09/20/xcodeghost
on “Senators introduce bipartisan antitrust bill to promote app store competition”Submitted Hacking a Tesla Model S as a story · 4 points
HN discussionAgreed – FYI: Tesla Model S (and likely X and 3) vehicles use a locked-down gateway (offering specific API actions, which result in CAN communication, etc) between their Ethernet network and CAN [1] [1] https://www.blackhat.com/docs/us-17/thursday/us-17-Nie-Free-... (page 19), https://blog.lookout.com/hacking-a-tesla
Comment linking /hacking-a-tesla
on “Reboot Your Dreamliner Every 248 Days to Avoid Integer Overflow (2015)”Submitted Linux flaw that allows anyone to hijack Internet traffic affects 80% of Android as a story · 3 points
HN discussionOn the contrary, Apple has served malware to far more users than Google despite having far fewer total users. https://blog.lookout.com/xcodeghost-apps Apple also uses your GPS data to update its location service (for profit), and unlike Android offers no way to opt out — if you want to get your location on an iDevice, Apple will get it, too. If you want to do something crazy like write apps for your own device witho…
Comment linking /xcodeghost-apps
on “Google Play has been spreading advanced Android malware for years”Submitted The Bearer of BadNews as a story · 3 points
HN discussionThe original source has more information and wider list of targets (UC San Diego, Heritage Foundation, United States Institute of Peace): https://blog.lookout.com/lookout-phishing-ai-discovers-phish...
Comment linking /lookout-phishing-ai-discovers-phishing-attack-targeting-humanitarian-organizations
on “U.N., Unicef, Red Cross Under Ongoing Mobile Attack”Submitted Multiyear Surveillance Campaigns Discovered Targeting Uyghurs as a story · 2 points
HN discussionhttps://blog.lookout.com/blog/2014/09/23/iphone-6-touchid-ha...
Comment linking /blog/2014/09/23/iphone-6-touchid-hack/
on “Walmart Pay”Submitted Advanced Persistent Threat actor conducting global espionage from Lebanon as a story · 2 points
HN discussion> I think it won't be too long until they can dust your fingerprints, take a picture of it, then have it 3d printed on a substrate that will fool a simple fingerprint scanner. I'm struggling to find good references right at this moment - but I've seen reports/video of this being done using more basic means, years ago. But I may be misremembering details. It seems that it's already possible to produce usable fingerpr…
Comment linking /why-i-hacked-apples-touchid-and-still-think-it-is-awesome
on “You don't need to burn off your fingertips (and other biometric myths)”Submitted Machine Learning in cybersecurity: Cutting through the hype as a story · 2 points
HN discussionOne of the arrested ones is 20, and he allegedly created Dendroid — a malware that can take remote control of an Android device. He designed, developed and deployed this software (bypassing Google Play's malware detection system) which seems to be quite complex and capable [0]. This proves that he possess a certain set of marketable skills that are quite south after in the industry. So I'm wondering - is this really…
Comment linking /blog/2014/03/06/dendroid/
on “Malware and Hacking Forum Darkode Is Shut Down; Dozens Arrested”Submitted SonicSpy: Over a thousand spyware apps discovered, some in Google Play as a story · 2 points
HN discussionThis is not actually true. It is, in fact, a fingerprint reader. https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples...
Comment linking /blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/
on “Judge Rules Suspect Can Be Required to Unlock Phone with Fingerprint”Submitted Sophisticated, persistent mobile attack against high-value targets on iOS as a story · 2 points
HN discussionsince I was (for some reason) wanting more details, https://blog.lookout.com/blog/2015/08/07/hacking-a-tesla/ is something I came across
Comment linking /blog/2015/08/07/hacking-a-tesla/
on “Getting root access on a Tesla Model S”Submitted Sophisticated, persistent mobile attack against high-value targets on iOS as a story · 2 points
HN discussion
