Top all-time · #2656
Include Security Research Blog
Company blog · blog.includesecurity.comsecurityprogramming
Include Security Research Blog is the company blog at blog.includesecurity.com, writing about security and programming. Since 2014, 29 different Hacker News readers have linked it 37 times, most often “Reversing the Dropcam Part 1: Wireless and network communications”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (14) to say how often HN recommends it.?
Why HN links it
Linked for security research write-ups, mainly the 2014 Tinder exact-location leak and the Dropcam reverse-engineering series, plus a 2026 CTF article one commenter called interesting and well written.
Summarised by Claude from a sample of 14 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Team Research blog
Most-linked posts?
- Reversing the Dropcam Part 1: Wireless and network communications3 people · 4 mentions · first linked 2014-06-02
- How I was able to track the location of any Tinder user3 people · 4 mentions · first linked 2014-02-19
- The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy3 people · 3 mentions · first linked 2026-06-06
- Reversing the Dropcam Part 2: Rooting Your Dropcam3 people · 3 mentions · first linked 2014-06-02
- Firmware dumping technique for an ARM Cortex-M0 SoC (2015)2 people · 2 mentions · first linked 2015-11-16
- Coverage Guided Fuzzing – Extending Instrumentation to Hunt Down Bugs Faster2 people · 2 mentions · first linked 2024-04-25
What Hacker News says?
Aye, with Tinder, but no extra-devices or actual travel was needed: https://blog.includesecurity.com/2014/02/how-i-was-able-to-t...
Comment linking /2014/02/how-i-was-able-to-track-location-of-any.html
on “Amazon drivers are hanging smartphones in trees to get more work”Submitted How I was able to track the location of any Tinder user as a story · 180 points
HN discussionAs a longtime Dropcam owner, I find this very unsettling. Truth be told, Dropcam service has steadily decreased in quality ever since the Nest acquisition. Not a month passes without an unexplained multi-hour outage; our mobile apps are randomly logged out every few days, requiring us to enter lengthy passwords while nervously wondering what that motion alert might be about. One day the whole Nest rigmarole will bec…
Comment linking /2014/04/reverse-engineering-dropcam-rooting-the-device.html
on “Google's Nest is disabling some of its customers' old smart-home devices”Submitted How to exploit the x32 recvmmsg() kernel vulnerability CVE 2014-0038 as a story · 24 points
HN discussionThis is an excellent tool to have as a security consultant, and it just keeps getting better and better. When approaching a large codebase, it enables you to write custom rules that match on certain antipatterns you've spotted that may be unique to the codebase. That's the real value of the tool, but the repository of per-language rules is also convenient for quickly finding low-hanging fruit (like every use of a po…
Comment linking /2021/01/custom-static-analysis-rules-showdown-brakeman-vs-semgrep/
on “Semgrep: Semantic grep for code”Submitted Reversing the Dropcam Part 2: Rooting Your Dropcam as a story · 12 points
HN discussionThis is a special case of a Server-Side Request Forget vulnerability. Validating schemes is part of the answer but not the whole answer because attackers can still forge requests to internal resources you have firewalled off from the internet. These were recently released to help people deal with these issues since the details can be finicky: http://blog.includesecurity.com/2016/08/safeurl-server-side-...
Comment linking /2016/08/safeurl-server-side-request-forgery-protection-library.html
on “If your code accepts URIs as input, filter out “file://””Submitted The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy as a story · 5 points
HN discussionHey HN, we're IncludeSec. We've done thousands of assessmnts for hundreds of clients and are well on our way to replacing all of the legacy lower-quality junior heavy appsec consulting teams doing work in Silicon valley and the rest of the US tech sector...and we're continuing to growing quickly! (but we wont get too big, we like smaller company vibes) We're currently looking for these roles: 1) (US Only) An applica…
Comment linking /
on “Ask HN: Who is hiring? (December 2021)”Submitted Cross-Site WebSocket Hijacking Exploitation in 2025 as a story · 5 points
HN discussionTinder once had this exact problem. You could find users' exact locations via triangulation, since the API reported an exact distance from your location: http://blog.includesecurity.com/2014/02/how-i-was-able-to-tr...
Comment linking /2014/02/how-i-was-able-to-track-location-of-any.html
on “Show HN: Anonymous messaging with a 1km radius”Submitted Spelunking in Comments and Documentation for Security Footguns as a story · 4 points
HN discussionI wonder how hackable it is. Edit: http://blog.includesecurity.com/2014/04/reverse-engineering-... , http://blog.includesecurity.com/2014/03/Reverse-Engineering-...
Comment linking /2014/03/Reverse-Engineering-Dropcam-Communications.html
on “Drop dead”Submitted Memory Corruption in Delphi as a story · 3 points
HN discussionHey HN, here's a link to the tech details of the vuln: http://blog.includesecurity.com/2014/02/how-i-was-able-to-tr... and a video demonstrating the app we made for exploiting this vuln: http://www.youtube.com/watch?v=3E2DwdS_PvQ&t=1m18s
Comment linking /2014/02/how-i-was-able-to-track-location-of-any.html
on “A Tinder Flaw Exposed Users' Exact Locations”Submitted Coverage Guided Fuzzing – Extending Instrumentation to Hunt Down Bugs Faster as a story · 3 points
HN discussionHey HN here is a link to the tech details: http://blog.includesecurity.com/2014/02/how-i-was-able-to-tr...
Comment linking /2014/02/how-i-was-able-to-track-location-of-any.html
on “Ask HN: Is HN user interface ever going to be updated/improved?”Submitted Hunting for Mass Assignment Vulnerabilities Using GitHub CodeSearch and Grep.app as a story · 3 points
HN discussionFrom a previous HN discussion, these are known DNS addresses to block in regards to Smart TVs being used a residential proxies: https://news.ycombinator.com/item?id=48422993 Specific Domains: proxyjs.brdtnet.com proxyjs.luminatinet.com proxyjs.bright-sdk.com clientsdk.bright-sdk.com clientsdk.brdtnet.com Wildcard domains: *.brdtnet.com *.luminatinet.com *.luminati.io Source: https://blog.includesecurity.com/2026/06/…
Comment linking /2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/
on “Residential Proxies Are a National Security Threat”Submitted Drive by Compromise: A Tale of Four WiFi Routers as a story · 3 points
HN discussionInteresting and well written article that mirrors/foreshadows how LLMs do and will change other scenes. As I don't know much about the CTF scene, I looked for other takes on this topic. Here's an article from 2015 about how tool-assistance already changed CTFs: > Individual skill will undoubtedly be a factor next year. But, I'm left wondering whether next year's DEFCON CTF will tell us anything more than how well-de…
Comment linking /2026/04/ctfs-in-the-ai-era/
on “The CTF scene is dead”Submitted Custom Static Analysis Rules Showdown: Brakeman vs. Semgrep as a story · 3 points
HN discussionThanks for the link, I will give it a proper read first thing tomorrow morning. From my very quick skim your attack is far more advanced than what I did. It was enough to just set some registers via the debugger and single step an instruction. With just a single load gadget I could dump the entire ROM. I did not bother with a write gadget as for the Nordic SoC you can just reflash the extracted image without enablin…
Comment linking /2015/11/firmware-dumping-technique-for-an-arm-cortex-m0-soc/
on “Bypassing Readout Protection in Nordic Semiconductor Microcontrollers”Submitted A light-weight forensic analysis of the AshleyMadison Hack as a story · 3 points
HN discussionReversing the Dropcam Part 1: Wireless and network communications http://blog.includesecurity.com/2014/03/Reverse-Engineering-...
Comment linking /2014/03/Reverse-Engineering-Dropcam-Communications.html
on “Rooting your Dropcam ”Submitted Discovering Deserialization Gadget Chains in Rubyland as a story · 2 points
HN discussionReversing the Dropcam Part 1: Wireless and network communications http://blog.includesecurity.com/2014/03/Reverse-Engineering-...
Comment linking /2014/03/Reverse-Engineering-Dropcam-Communications.html
on a deleted threadSubmitted Firmware dumping technique for an ARM Cortex-M0 SoC (2015) as a story · 2 points
HN discussionSubmitted Firmware Dumping Technique for an ARM Cortex-M0 SoC as a story · 2 points
HN discussionSubmitted The smart TV in your living room is a node in the AI scraping economy as a story · 1 points
HN discussion
