Top all-time · #486
Check Point Research
Company blog · research.checkpoint.comsecurity
Check Point Research is the company blog at research.checkpoint.com, writing about security. Since 2017, 121 different Hacker News readers have linked it 165 times, most often “Select code_execution from * using SQLite (2019)”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Rarely recommended · 2 of 40 sampled comments recommend it?
Why HN links it
Security research blog from Check Point on vulnerabilities and malware, such as SQLite file-based code execution, Agent Smith Android malware and Windows DNS bugs. Mostly cited as the primary source.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Latest Research by our Team
Most-linked posts?
- Select code_execution from * using SQLite (2019)7 people · 13 mentions · first linked 2020-02-20
- OpwnAI: Cybercriminals Starting to Use ChatGPT5 people · 5 mentions · first linked 2023-01-06
- Faxploit: Sending Fax Back to the Dark Ages5 people · 5 mentions · first linked 2018-08-13
- Gaining code execution using a malicious SQLite database4 people · 7 mentions · first linked 2019-08-12
- SimBad: A Rogue Adware Campaign on Google Play – Check Point Research3 people · 3 mentions · first linked 2019-03-13
- FakesApp: A Vulnerability in WhatsApp3 people · 3 mentions · first linked 2018-08-08
- Security probe of Qualcomm MSM data services3 people · 3 mentions · first linked 2021-05-07
- Rust Binary Analysis, Feature by Feature3 people · 3 mentions · first linked 2023-06-06
- Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure3 people · 3 mentions · first linked 2020-01-31
- Uncovering Drupalgeddon 23 people · 3 mentions · first linked 2018-04-12
What Hacker News says?
I find it remarkable that it succeeded, despite its complete and utter lack of security. It's trivial to overwrite its metatables to create rop chains via select, it's default fts hook is insecure. It's basically a hack. https://research.checkpoint.com/2019/select-code_execution-f...
Comment linking /2019/select-code_execution-from-using-sqlite/
on “Why SQLite succeeded as a database (2016)”Submitted 50 CVEs in 50 Days: Fuzzing Adobe Reader as a story · 344 points
HN discussionBut filesystems are secure (mostly, ignoring unicode issues) whilst sqlite is an insecure hack. You'll have hard time to harden sqlite, removing all the insecure defaults, fix the broken and exploitable full text search apis, but esp. its built-in hacks. Like explained here https://github.com/rurban/hardsqlite or here https://research.checkpoint.com/2019/select-code_execution-f...
Comment linking /2019/select-code_execution-from-using-sqlite/
on “SQLite the only database you will ever need in most cases”Submitted Faxploit: Sending Fax Back to the Dark Ages as a story · 207 points
HN discussionOpening untrusted SQLite files tends to not be safe: https://research.checkpoint.com/select-code_execution-from-u...
Comment linking /select-code_execution-from-using-sqlite/
on “Bring Your Own Client”Submitted Nazar: Analyzing malware that was uncovered in leaked NSA files as a story · 198 points
HN discussionBeware opening SQLite files you didn't create: https://research.checkpoint.com/select-code_execution-from-u...
Comment linking /select-code_execution-from-using-sqlite/
on “SQLite Is Serverless”Submitted Ransomware-ing a DSLR Camera as a story · 165 points
HN discussionI'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share. Majority of information about Windows malware I get from big computer security companies' research blogs like: https://www.trendmicro.com/en_us/research.html https://www.proofpoint.com/us/blog https://research.checkpoint.com/ https://blog.talosintelligenc…
Comment linking /
on “Many ransomware strains will abort if they detect a Russian keyboard installed (2021)”Submitted Safe-Linking – Eliminating a 20 year-old malloc() exploit primitive as a story · 115 points
HN discussionsqlite is a dirty hack. just because people like hacks doesn't mean it's ready for the serious stuff. it is not. https://research.checkpoint.com/2019/select-code_execution-f...
Comment linking /2019/select-code_execution-from-using-sqlite/
on “Systemd, ten years later: a historical and technical retrospective”Submitted Do you like to read? I can take over your Kindle with an e-book as a story · 66 points
HN discussionI think you massively underestimate the number of people that will click yes to install random packages on their own phones in order get access to free games or porn or whatever. https://research.checkpoint.com/2019/agent-smith-a-new-speci... https://blog.malwarebytes.com/android/2019/08/mobile-menace-... https://arstechnica.com/information-technology/2016/07/virul...
Comment linking /2019/agent-smith-a-new-species-of-mobile-malware/
on “Apple: Person-to-person experiences do not have to use in-app purchase”Submitted New Wormable Android Malware Spreads by Creating Auto-Replies in WhatsApp as a story · 61 points
HN discussion> SQLite databases are commonly used as storage containers for sending structured content across the internet. Can SQLite databases still attack the host that opens them? https://research.checkpoint.com/select-code_execution-from-u...
Comment linking /select-code_execution-from-using-sqlite/
on “SQLite briefing for Linux kernel hackers (2019)”Submitted SIGRed: A 17 Year-Old Bug in Windows DNS Servers as a story · 52 points
HN discussionAPT 40 and 31 are well documented [1] [2]. [1] https://www.fireeye.com/blog/threat-research/2019/03/apt40-e... [2] https://research.checkpoint.com/2021/the-story-of-jian/
Comment linking /2021/the-story-of-jian/
on “U.S. and key allies accuse China of Microsoft Exchange cyberattacks”Submitted Indra – Hackers Behind Recent Attacks on Iran as a story · 44 points
HN discussionThe problem is not the implementation language of sqlite, the problem is the author. Hacks upon hacks, and nothing of it in the docs. Instead it represents itself as the most secure of all databases. World class, whilst being worst of its class. Hardening sqlite to get some security back from the insanity internally is a herculean task. I only scratched the surface with mine. Fts accepting custom tokenizers by point…
Comment linking /2019/select-code_execution-from-using-sqlite/
on “What If OpenDocument Used SQLite? (2014)”Submitted Attacking Weak RC4-Like Ciphers the Hard Way as a story · 36 points
HN discussionFurther reading: https://research.checkpoint.com/2019/select-code_execution-f... I've never seen mention of this being fixed in any way. SQLite is not an acceptable format to transfer between computers.
Comment linking /2019/select-code_execution-from-using-sqlite/
on “What If OpenDocument Used SQLite? (2014)”Submitted Jian – How the Chinese APT31 stole and used an unknown Equation Group 0-Day as a story · 32 points
HN discussionIt's a multi-hundred-thousand line project (current count, excluding tests, is about 210,000). Like any project of a similar size, it has a history of security vulnerabilities. OpenBSD removed it because it was too much code to audit. OpenBSD dodged several issues like this RCE ( https://research.checkpoint.com/2019/select-code_execution-f... ) as a result. See https://www.cvedetails.com/vulnerability-list/vendor_id…
Comment linking /2019/select-code_execution-from-using-sqlite/
on “What If OpenDocument Used SQLite? (2014)”Submitted Vulnerabilities in MediaTek DSP could lead to eavesdropping audio in Android as a story · 14 points
HN discussionBeware opening sqlite files from untrusted sources. https://research.checkpoint.com/select-code_execution-from-u...
Comment linking /select-code_execution-from-using-sqlite/
on “35% Faster Than The Filesystem (2017)”Submitted Denial of Fuzzing: Rust in the Windows Kernel as a story · 13 points
HN discussionCheck Point's write up can be found here: https://research.checkpoint.com/agent-smith-a-new-species-of...
Comment linking /agent-smith-a-new-species-of-mobile-malware/
on “Malicious apps infect 25M Android devices with 'Agent Smith' malware”Submitted Extracting a 19 Year Old Code Execution from WinRAR as a story · 11 points
HN discussionMultiple Kernel Vulnerabilities Affecting All Qualcomm Devices (2020) https://blog.zimperium.com/multiple-kernel-vulnerabilities-a... The Road to Qualcomm TrustZone Apps Fuzzing (2019) https://research.checkpoint.com/2019/the-road-to-qualcomm-tr... QualPwn - Exploiting Qualcomm WLAN and Modem Over The Air (2019) https://blade.tencent.com/en/advisories/qualpwn/ QuadRooter: New Android Vulnerabilities in Over 900 Mill…
Comment linking /2019/the-road-to-qualcomm-trustzone-apps-fuzzing/
on “Snapdragon chip flaws put 1B Android phones at risk of data theft”Submitted SIGRed: Exploiting a 17 Year-Old Bug in Windows DNS Servers as a story · 9 points
HN discussion
