Top all-time · #6210
blog.securityevaluators.com
Company blog · blog.securityevaluators.comsecurityhardware
blog.securityevaluators.com is the company blog at blog.securityevaluators.com, writing about security and hardware. Since 2016, 13 different Hacker News readers have linked it 15 times, most often “Reverse Engineering Bumble’s API (2020)”. No feed was found, so read it on the site itself.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link this security research blog for posts on WebSocket and CORS behaviour, a Bumble app location leak, and ICMP and traceroute. Commenters cite these posts as sources.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Reverse Engineering Bumble’s API (2020)2 people · 3 mentions · first linked 2020-11-16
- /icmp-the-good-the-bad-and-the-ugly-130413e560302 people · 2 mentions · first linked 2021-04-24
- /websockets-not-bound-by-cors-does-this-mean-2e7819374acc2 people · 2 mentions · first linked 2020-05-21
What Hacker News says?
> In seriousness, this is all because websockets aren't bound by CORS, for good reason. https://blog.securityevaluators.com/websockets-not-bound-by-... As far as I can tell, that article only explains that WebSockets aren't bound by CORS. It doesn't provide a reason (good or otherwise) why WebSockets were designed that way. Personally, I consider that feature to be a design flaw. If WebSockets handshakes respected t…
Comment linking /websockets-not-bound-by-cors-does-this-mean-2e7819374acc
on “Stealing secrets from developers using WebSockets”Submitted Reverse Engineering Bumble’s API (2020) as a story · 129 points
HN discussionThis is why you don't let @wongmjane inject code into websites. Imagine what features she'd learn about with tracebacks from developer machines! /s In seriousness, this is all because websockets aren't bound by CORS, for good reason. https://blog.securityevaluators.com/websockets-not-bound-by-... There's a simple fix though - hot reload websocket listeners like Webpack should only consider the connection valid if th…
Comment linking /websockets-not-bound-by-cors-does-this-mean-2e7819374acc
on “Stealing secrets from developers using WebSockets”Submitted Reverse Engineering Bumble’s API (2020) as a story · 3 points
HN discussionInterestingly, another researcher reported this exact same issue (being able to triangulate a user's location) last year: https://blog.securityevaluators.com/reverse-engineering-bumb...
Comment linking /reverse-engineering-bumbles-api-a2a0d39b3a87
on “Vulnerability in Bumble dating app reveals any user's exact location”Submitted How to Get into IoT Hardware Hacking (Introductory Tool Guide) as a story · 3 points
HN discussionIn a way yes, but I think the issue is largely caused by those up the chain that make it hard to deal with. Doing a search on should I block ICMP, or what ICMP to block, answers are: [1] No!!; some security issues; a lot of ICMP should be blocked; suggests further research [2] you should selectively filter; example iptables rule to allow echo; assess evaluate and make your own rules [3] listing of types and RFC reco…
Comment linking /icmp-the-good-the-bad-and-the-ugly-130413e56030
on “IPv6 Fragmentation Loss”Submitted ASUSWRT RCE via Buffer Overflow, ASLR Bypass as a story · 2 points
HN discussionOne perspective: http://shouldiblockicmp.com/ : - Don't block ICMP: Echo Request and Echo Reply, Fragmentation Needed (IPv4) / Packet Too Big (IPv6), Time Exceeded, and only within the boundary allow NDP and SLAAC (IPv6) But presumably none of that helps solve for what traceroute is used to help diagnose. "ICMP: The Good, the Bad, and the Ugly" (2016) https://blog.securityevaluators.com/icmp-the-good-the-bad-an... ;…
Comment linking /icmp-the-good-the-bad-and-the-ugly-130413e56030
on “Traceroute Isn't Real”Submitted A Breach in the Same-Origin Policy Induced by Mirroring External Content as a story · 2 points
HN discussionSubmitted Hacking the JavaScript Lottery as a story · 2 points
HN discussionSubmitted Social Psychology: Discovering the Weakest Link in Cybersecurity as a story · 1 points
HN discussionSubmitted Hacking Asustor AS-602T (CVE-2018-12313) Vuln on SNMP API Allows Root Commands as a story · 1 points
HN discussionSubmitted Industry Meltdown, or Just a Spectre? as a story · 1 points
HN discussionSubmitted A Breach in the Same-Origin Policy Induced by Mirroring External Content as a story · 1 points
HN discussion
