Top all-time · #2782
coresecurity.com
Company blog · coresecurity.com/blogsecurity
coresecurity.com is the company blog at coresecurity.com, writing about security. Since 2011, 28 different Hacker News readers have linked it 36 times, most often “Playing with Relayed Credentials”. No feed was found, so read it on the site itself.
Too few sampled comments (19) to say how often HN recommends it.?
Why HN links it
HN commenters cite this Core Security site for its security advisories, research slides and articles on exploits, BIOS and firmware rootkits, and kernel vulnerabilities in BSD and VirtualBox. Comments mostly use the links as references.
Summarised by Claude from a sample of 19 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Playing with Relayed Credentials2 people · 2 mentions · first linked 2018-06-28
- /content/open-bsd-advisorie2 people · 2 mentions · first linked 2013-01-07
What Hacker News says?
It has more than 2M lines of C code. Almost all libraries were written from scratch. Every professional security researcher reading this just raised an eyebrow and thought to themselves, "That's a vulnerable application." In fact, your team (or a similar one at AOL) did introduce vulnerabilities[1][2]. If we assume that, as you imply, AOL really was exclusively composed of above average C developers writing high qua…
Comment linking /content/bevy-of-new-icq-vulnerabilities-surface
on “How to C in 2016”Submitted Broadcom Wifi firmware DoS with python proof of concept as a story · 3 points
HN discussionUnsure if there are any currently publicly known exploits, but it sure isn't unheard of for VirtualBox: * http://arstechnica.com/security/2015/05/extremely-serious-vi... * http://www.securityfocus.com/archive/1/495095 * https://www.cert.be/advisories/oracle-vm-virtualbox-two-priv... * http://www.coresecurity.com/content/virtualbox-privilege-esc...
Comment linking /content/virtualbox-privilege-escalation-vulnerability
on “Transmission BitTorrent app contained malware”Submitted Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2024-30051) as a story · 2 points
HN discussionIts certainly a grey area and covering all your bases legally before embarking on a penetration test would be good idea. Even with all the legal formalities, there needs to be a good level of trust between the client and the auditor for things to go smoothly. Two days later, Mr. Al-Khabaz decided to run a software program called Acunetix, designed to test for vulnerabilities in websites, to ensure that the issues he…
Comment linking /content/under-attack
on “Youth expelled from Montreal college after finding security flaw”Submitted Core Security – Getting Fun with Frida – Turbo Talk – Ekoparty (2016) [pdf] as a story · 2 points
HN discussionI did write a remote kernel exploit for OpenBSD, it was not an easy task, and this was in a time when there were basically no exploit countermeasures in kernel (2007) ( https://www.coresecurity.com/content/open-bsd-advisorie ) There are a bunch of local kernel exploits, all very practical and reliable. Kernel protections are something OpenBSD lacked until very recently.
Comment linking /content/open-bsd-advisorie
on “Why OpenBSD Is Important to Me”Submitted Playing with Relayed Credentials as a story · 2 points
HN discussionI think the author is right with the current state of the affairs and the insane pumped hype but he misses the core issues serious engineers and researchers want to solve. First, private blockchains is a misleading term since they don't share the core innovation behind Bitcoin: solving (under certain assumptions) the double spend/transaction problem in a decentralized way. This is the start of a series of computer s…
Comment linking /system/files/publications/2016/05/2Protocolos.pdf
on “Ten years in, nobody has come up with a use for blockchain”Submitted The Unpatched LSASS Remote Denial of Service (MS16-137) as a story · 2 points
HN discussionNo, I think having a high quality secure design and a security audit by examining code is how software is considered secure. OpenBSD audits every line of code that it ships, and the last remote root exploit I could find was 2007. DJB's stuff (qmail, djbdns) are designed to be secure from the ground up, and I believe are considered to be secure. (Opinions vary about other aspects of his stuff, though.) "It's been a w…
Comment linking /content/open-bsd-advisorie
on “Mosh: the mobile shell”Submitted Abusing GDI for ring0 exploit primitives as a story · 2 points
HN discussionShameless plug: Several years ago I did a tool that shows differences between disassembled functions basic-block graphs, that you can use for free and it is GPLv2 licensed. I believe my tool shows the differences in a better way than bindiff, and it piggybacks on a disassembler made by a former coworker and friend. Maybe someone wants to use it. http://www.coresecurity.com/corelabs-research/open-source-to... PS: I d…
Comment linking /corelabs-research/open-source-tools/aureliax
on “BinDiff now available for free”Submitted Abusing GDI for ring0 exploit primitives [pdf] as a story · 2 points
HN discussionCoreForce had this for Windows 2000/XP: http://www.coresecurity.com/corelabs-research/projects/core-... It was based on a port of OpenBSD's PF firewall and let you set fine-grained permissions on file, network, and registry access. It's a painful training process for newly-installed software (lots and lots of prompts) but I haven't seen anything else come close to what it offered. I wonder if that pain is why they s…
Comment linking /corelabs-research/projects/core-force
on “Bypassing Antivirus with Ten Lines of Code”Submitted Poisoning the Activation Cache to Elevate from Medium to High Integrity as a story · 1 points
HN discussion> How is one person being present during an upgrade enough to render the physical machines suspect and beyond repair/review? As soon as an unidentified attacker has unsupervised access to a piece of hardware it's game over. An exploit that uses persistence features like embedding itself into the BIOS/UEFI firmware (see e.g. https://www.coresecurity.com/core-labs/articles/the-bios-emb... ) can be very hard to get rid…
Comment linking /core-labs/articles/the-bios-embedded-anti-theft-persistant-agent-that-couldnt-response-handling-the-ostrich-defense
on “Colorado county's voting machines banned after security breach”Submitted Playing with NTLM relayed credentials during penetration testing as a story · 1 points
HN discussionFor a general audience this article is not clarifying enough where the hype is and where it isn’t. There is a clear distinction between public/permissionless blockchains (e.g. Bitcoin) and distributed ledgers (misnamed as private blockchains). The article is referring mainly to the later. Bitcoin is a theoretical and practical computer science innovation even if the Bitcoin price goes down to $ 0. The innovation cov…
Comment linking /system/files/publications/2016/05/PEO.pdf
on “Don't get caught up in blockchain hype”Submitted Quest KACE System Management Appliance Multiple Vulnerabilities as a story · 1 points
HN discussion> The binary TDDP protocol merits further research since it is available on a broad range of TP-Link devices. The tdpServer binary regularly get abused to root TP-link devices for Pwn2Own Tokyo : https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-... Also : - https://mjg59.dreamwidth.org/51672.html - https://www.coresecurity.com/core-labs/advisories/tp-link-td... - https://medium.com/@CoreSecurity/a-story-a…
Comment linking /core-labs/advisories/tp-link-tddp-multiple-vulnerabilities
on “Reverse Engineering the TP-Link HS110”Submitted Trend Micro Email Encryption Gateway Multiple Vulnerabilities as a story · 1 points
HN discussion> belief that somehow everything must be implemented at that level To make that concrete: I've known about commercial penetration test software[1] that uses multiple levels of agents, trading off footprint vs. capabilities, for over a decade. This is not even remotely a new idea. [1] E.g. Core Impact from http://www.coresecurity.com/
Comment linking /
on “The BadBIOS Analysis is Wrong”Submitted Trend Micro Smart Protection OS Command Injection as a story · 1 points
HN discussionSure. Here [1] is one for FreeBSD I found in a couple of minutes searching. I am sure you can find a more recent one. That is complete arbitrary kernel code execution for any user. I can easily find some for the other BSDs (I am a NetBSD developer), of course there was the famous remote code execution for OpenBSD [2]. Security is hard, all code has bugs. Never be complacent. Use layers of security, reduce risks, aud…
Comment linking /content/open-bsd-advisorie
on “Yet Another Reason Containers Don't Contain: Kernel Keyrings”Submitted Kerberos Delegation, SPNs and More as a story · 1 points
HN discussionSlides that go with this: https://www.coresecurity.com/system/files/publications/2016/...
Comment linking /system/files/publications/2016/05/Slides-Deactivate-the-rootkit-Sacco-Aortega-Ekoparty.pdf
on “Deactivate the Rootkit: Attacks on BIOS anti-theft technologies (2009) [pdf]”Submitted Deactivate the BiOS Rootkit (2009) as a story · 1 points
HN discussionI was never under the impression that docker was secure or even claimed to have security (do they?). I feel this is a common belief. For me Docker felt halfway between VirtualBox and Parallels. And VirtualBox had shared folder breakout exploits as far back as 2007. https://www.coresecurity.com/content/advisory-vmware
Comment linking /content/advisory-vmware
on “Full Docker Breakout Exploit”Submitted CORE Labs Research Publications as a story · 1 points
HN discussion
