Top all-time · #2487
IOActive
Company blog · ioactive.comsecurity
IOActive is the company blog at ioactive.com, writing about security. Since 2013, 30 different Hacker News readers have linked it 33 times, most often “Reverse Engineer’s Perspective on the Boeing 787 ‘51 days’ Directive”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Explore the latest trends in cybersecurity research and stay informed about evolving threats and protective measures.
Most-linked posts?
- Reverse Engineer’s Perspective on the Boeing 787 ‘51 days’ Directive4 people · 4 mentions · first linked 2022-10-17
- /ssl-traffic-analysis-on-google-maps/4 people · 4 mentions · first linked 2018-11-29
- /pdfs/IOActive_Remote_Car_Hacking.pdf2 people · 2 mentions · first linked 2017-06-06
- A Wake-up call for SATCOM security [pdf]2 people · 2 mentions · first linked 2014-08-06
- Vulnerabilities for Over Half a Million Belkin WeMo Users2 people · 2 mentions · first linked 2014-02-19
- Adventures in Automotive Networks and Control Units (2014) [pdf]2 people · 2 mentions · first linked 2018-08-13
- /pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf2 people · 2 mentions · first linked 2013-02-04
What Hacker News says?
It may be encrypted -- but is it protected against traffic analysis? The following papers are a good starting point: [1] Guessing the URLs being browsed by users over an encrypted TLS session: https://research.microsoft.com/en-us/um/people/gdane/papers/... [2] Guessing the co-ordinates of where a user is scrolling around on Google Maps over an encrypted TLS session: http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnG…
Comment linking /pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf
on “Hello Firefox, this is Chrome calling”Submitted Reverse Engineer’s Perspective on the Boeing 787 ‘51 days’ Directive as a story · 187 points
HN discussionIt's helpful to understand that the algorithm wasn't designed the way it's presented in this illustration, and consists of somewhat discrete components. It's an iterated design, like a block cipher, meaning that it's built around a simple round function that's repeated a bunch of times on each input, rather than a super-complicated function run once. It belongs to a large, important family of cryptographic hashes ca…
Comment linking /wp-content/uploads/2015/07/ldc_tutorial.pdf
on “Show HN: SHA-256 explained step-by-step visually”Submitted Vulnerabilities for Over Half a Million Belkin WeMo Users as a story · 30 points
HN discussionI wonder how much DBus (the Inter-Process-Communication (IPC) standard Linux desktops have been based around) is baked into QNX & instrumental to it! Maybe I can find out now? https://ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf or https://insights.sei.cmu.edu/blog/vehicle-cybersecurity-the-... That was such a time. It's sad that it was a security panic, to me, because there was incredible promise there... All…
Comment linking /pdfs/IOActive_Remote_Car_Hacking.pdf
on “QNX is now free for anything non-commercial, plus there's an RPi image”Submitted Better Safe Than Sorry: Model Context Protocol as a story · 2 points
HN discussionIf it has an immobilizer? You can find immobilizer bypasses on sale online, who knows if they work, or you can create your own and disable it yourself: https://www.youtube.com/watch?v=ispXq4EMrsY#t=24m45s https://github.com/fjvva/ecu-tool/wiki (see also https://ioactive.com/pdfs/IOActive_Adventures_in_Automotive_... and http://opengarages.org/handbook/ebook/ ) So besides relaying the key, you can just hack via the C…
Comment linking /pdfs/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf
on “Thieves boosting signal from key fobs inside homes to steal vehicles”Submitted Cybersecurity alert fatigue: why it happens, why it sucks, what to do about it as a story · 2 points
HN discussionSure. https://www.youtube.com/watch?v=MEYCU62yeYk and the mentioned paper i assume is https://ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf
Comment linking /pdfs/IOActive_Remote_Car_Hacking.pdf
on “An Introduction to the CAN Bus: How to Programmatically Control a Car”Submitted Remote Car Hacking [pdf] as a story · 2 points
HN discussion> If I'm watching a show, I don't necessarily want every single router along the way knowing what show i'm watching. Unless Netflix has also started padding their compressed video segments to a deterministic size, TLS doesn't really help with the "I don't want people to know what video I'm watching" problem, as the encrypted media segments are first compressed using a variable bitrate encoding that causes a unique p…
Comment linking /ssl-traffic-analysis-on-google-maps/
on “Netflix now supports TLS 1.3”Submitted Lenovo System Update Multiple Privilege Escalations[pdf] as a story · 2 points
HN discussionMassive fan of age and congrats on its success!! On size padding, I know you've patiently listened to me before on this, but I'll always take a chance to advocate for an approach like PURBs ( https://petsymposium.org/2019/files/papers/issue4/popets-201... ). Let's say you're in a country that suppresses certain material, like copies of the Bible, or the Hacker Manifesto, or whatever; if the authorities find an encry…
Comment linking /ssl-traffic-analysis-on-google-maps/
on “Age is a simple, modern and secure file encryption tool, format, and Go library”Submitted 5G vs. Wi-Fi: A Comparative Analysis of Security and Throughput Performance as a story · 1 points
HN discussionThe 787 is full fly by wire. Was there actually a failure of the flight control system? So far, there's not much info. Overview of 787 control system.[1] [1] https://ioactive.com/reverse-engineers-perspective-on-the-bo...
Comment linking /reverse-engineers-perspective-on-the-boeing-787-51-days-airworthiness-directive/
on “Pilot of Boeing flight says he lost control after instrument failure”Submitted Reverse Engineer's Perspective on Boeing 787 '51 days' Directive (2020) as a story · 1 points
HN discussionhttps://www.ioactive.com/remote-exploitation-of-an-unaltered... https://blackhat.com/docs/us-17/thursday/us-17-Nie-Free-Fall... https://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Expl...
Comment linking /remote-exploitation-of-an-unaltered-passenger-vehicle/
on “Car is a smartphone on wheels. Here's who's listening”Submitted Adventures in Automotive Networks and Control Units (2014) [pdf] as a story · 1 points
HN discussion> One might say "But what about hackers?", luckily unlike Alexa or Google Home, it's hard for hackers to tinker with one these devices and find remotely-triggerable exploits. Yes, very hard for people with skills, indeed. https://thehackernews.com/2016/12/hacking-in-flight-system.h... https://www.wired.com/2015/05/feds-say-banned-researcher-com... https://ioactive.com/in-flight-hacking-system/
Comment linking /in-flight-hacking-system/
on “American Airlines Has Cameras in Their Screens Too”Submitted A Wake-up call for SATCOM security [pdf] as a story · 1 points
HN discussionPrevious: https://news.ycombinator.com/item?id=22761395 https://news.ycombinator.com/item?id=33233827 More interesting, a root cause analysis: https://news.ycombinator.com/item?id=33239443 https://ioactive.com/reverse-engineers-perspective-on-the-bo... The 47 bit timestamp at 32MHz would explain the duration (Though not why it isn't 33MHz?).
Comment linking /reverse-engineers-perspective-on-the-boeing-787-51-days-airworthiness-directive/
on “Boeing 787s must be reset every 51 days or 'misleading data' is shown (2020)”I took a quick look at the source code. It's providing end-to-end encryption with libsodium, using crypto_box [1], crypto_secretbox[2], and crypto_pwhash for password-based key derivation [3]. The public key model appears to be TOFU [4]. It's doing a distinct crypto_box per notification [5]. It doesn't use an authenticated key exchange or offer key rotation or forward secrecy, but that's probably fine for this use c…
Comment linking /ssl-traffic-analysis-on-google-maps/
on “Show HN: End-to-end encrypted location sharing service like Google Latitude”Cryptography Engineering is less advanced than Serious Cryptography (but it's "take-y-er"; there's a lot of opinion / best practices stuff in it, and a lot of that is good). I'd say that if you've read and grokked Serious Cryptography, and you don't want to write code, something like _IMC_ (Silverman, above) is an interesting next step, in that you'll mostly be reasoning about math, and you'll be working at a much l…
Comment linking /wp-content/uploads/2015/07/ldc_tutorial.pdf
on “Ask HN: Best book on modern cryptography?”There is an article[1] about finding out what location at google maps user is looking at, based on observing TLS packets and nothing else. If task at hand is to match encrypted connection to a smaller number of alternative (say identify accesses to popular place, like gmail/facebook login page, etc), same technique of observing packet size distribution over time should probably work quite reliably, and cgiproxy will…
Comment linking /pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf
on “My Experience With the Great Firewall of China”- 13 · 2014-11-03
> "Nothing is recorded or sent across the network. Peace of mind, without giving up on privacy." Devices like this still make me uncomfortable, given the track record of even large companies making extremely insecure devices[1]. [1]: http://www.ioactive.com/news-events/IOActive_advisory_belkin...
Comment linking /news-events/IOActive_advisory_belkinwemo_2014.html
on “Point – A smart house sitter” Original source: https://ioactive.com/event/def-con-talk-amd-sinkclose-univer...
Comment linking /event/def-con-talk-amd-sinkclose-universal-ring-2-privilege-escalation/
on “Researchers discover potentially catastrophic exploit present in AMD chips”There is at least one attempt [0] of input manipulation I am aware of, but it was several years ago, unproven, and I have to assume that input data manipulation vulnerabilities are unlikely to be present. If a new destructive attack could be found by visual data input, mass simultaneous deployment would be the most effective use of it, the logistical issues of which are a substantial barrier to efficacy. Changing st…
Comment linking /sql-injection-in-the-wild/
on “Cities Are Forced to Funnel License Plate Data to a Federal Surveillance Program”Thank you for commenting about it. There are _always_ bugs in software. Your assertion that it's pure fantasy to pivot from the flight entertainment system goes against there near infinite space of sidechannel attacks and demonstrated attacks on even airgapped systems; it's almost a law of physics that you are wrong. The "self promotion" angle was brought up last time this was discussed: https://news.ycombinator.com…
Comment linking /arm-ida-and-cross-check-reversing-the-787s-core-network/
on “Software Vulnerabilities in the Boeing 787”Ridiculous article.. Here's the actual blog post, and the 25-page whitepaper. http://blog.ioactive.com/2014/04/a-wake-up-call-for-satcom-s... http://www.ioactive.com/pdfs/IOActive_SATCOM_Security_WhiteP... On a side note, what's with all the similar press photos of this guy in front of graffiti? https://imgur.com/a/nOuff
Comment linking /pdfs/IOActive_SATCOM_Security_WhitePaper.pdf
on “Hacker Says He Can Break Into Airplane Systems Using In-Flight Wi-Fi”I'm glad places like IOActive exist. Reading up on their procedure ( http://www.ioactive.com/pdfs/IOActive_Advisory_SimpliSafe-Re... ), they gave the vendor 5 months to even respond before posting this. All and all a much better process than a "hacker" posting it to his blog because a company didn't respond to his email the day before. There's no such thing as perfect security via alarm. However, if a company refuse…
Comment linking /pdfs/IOActive_Advisory_SimpliSafe-Replay.pdf
on “SimpliSafe Alarm System Replay Attack”
