Top all-time · #6279
Jon Oberheide
Personal blog · jon.oberheide.org/blogsecuritysystems
Jon Oberheide's personal blog at jon.oberheide.org covers security and systems. Since 2010, 13 different Hacker News readers have linked it 13 times, most often “A Peek Inside the GTalkService Connection (security of Android apk installs)”. It is still writing: the last post was on 2026-10-24, and you can follow it by feed.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
Personal security blog of Jon Oberheide. HN commenters link his posts on Android remote app removal, Chrome-based one-shot exploits, Android app-store XSS, and Pwn2Own disclosure timing, mostly as sources.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Jon Oberheide - Board Member & Startup Advisor
Most-linked posts?
- /blog/2010/06/25/remote-kill-and-install-on-google-android/3 people · 3 mentions · first linked 2010-06-25
- A Peek Inside the GTalkService Connection (security of Android apk installs)2 people · 2 mentions · first linked 2010-06-28
- How Pwn2Own Was Almost Won Via XSS2 people · 2 mentions · first linked 2011-03-08
What Hacker News says?
I might have my facts incorrect here but if an App is removed from the Play / iOS app stores isn't it removed from users devices? What happens to any money you put into those apps? Technically speaking, Google does have this capability to remotely wipe apps from devices [1], but they only do it when the app constitutes a security threat (i.e. malware) to users who were tricked into installing it. As far as I know, t…
Comment linking /blog/2010/06/25/remote-kill-and-install-on-google-android/
on “EA refuses to refund user for SimCity, threatens account ban”Submitted How Pwn2Own Was Almost Won Via XSS as a story · 64 points
HN discussionMemory DOS will not happen with normal recursion, only a tradional stackoverflow. And by adding some content after the fixed number of [ or {, this will by on the stack as argument to the recursive function. There are so many possible exploits. See eg. https://jon.oberheide.org/files/infiltrate12-thestackisback.... or search for "stack overflow recursion exploit"
Comment linking /files/infiltrate12-thestackisback.pdf
on “Bad JSON Parsers”Submitted Automating a Yubikey for Agentic Logins as a story · 2 points
HN discussionnice. and one search away: http://jon.oberheide.org/blog/2010/06/25/remote-kill-and-ins...
Comment linking /blog/2010/06/25/remote-kill-and-install-on-google-android/
on “How Plan B found the Droid I was looking for”Submitted Dexcode Teardown of the Android SMS Trojan as a story · 1 points
HN discussionWouldn't Chrome be able to auto login on the play store website and click the install button there? There have been XSS attacks on the play store website allowing this before. Edit: I had this in mind https://jon.oberheide.org/blog/2011/03/07/how-i-almost-won-p...
Comment linking /blog/2011/03/07/how-i-almost-won-pwn2own-via-xss/
on “Latest Android phones hijacked with one-shot Chrome exploit”Submitted A Peek Inside the GTalkService Connection (security of Android apk installs) as a story · 1 points
HN discussionActually that's not true. Kernels aren't infallible and while there's the 'many eyes' aspect of Open Source kernels, Linux is huge, so tracking stuff down often crosses multiple files, sometimes unrelated. I went to a really excellent talk at the last DC4420 ( http://www.dc4420.org/ ) on 0day in the Linux Kernel. The example provided was a double free bug that was really just a basic schoolboy error. A brief look th…
Comment linking /files/source10-linuxkernel-jonoberheide.pdf
on “Gain control of a Linux System via an USB-Device due to strcpy”Submitted Android Hax as a story · 1 points
HN discussionHere is more info from the security researcher who wrote the app that got removed: http://jon.oberheide.org/blog/2010/06/25/remote-kill-and-ins...
Comment linking /blog/2010/06/25/remote-kill-and-install-on-google-android/
on “Android Developers Blog: Exercising Our Remote Application Removal Feature”You're right - I misread the product description (updated parent post). I was assuming they'd be doing something tricky like asking for INSTALL_PACKAGES ( http://developer.android.com/reference/android/Manifest.perm... ) and dropping something on the device. Thankfully they don't do that. As someone who has hacked on Android before (ie: http://unrevoked.com ), I wouldn't be surprised if there were ways to silently i…
Comment linking /blog/2010/06/28/a-peek-inside-the-gtalkservice-connection/
on “Android Income Report”Pwn2Own is harmful. Jon Oberheide's article[1] convinced me of that. Bug bounties encourage the disclosure of vulnerabilities as soon as they're discovered; contests like Pwn2own, with specific starting dates, encourage the accumulation of undisclosed vulnerabilities until the contest begins. It unnaturally extends the lifetime of bug, and hurts users by leaving them vulnerable for longer than necessary. [1] http://…
Comment linking /blog/2011/03/07/how-i-almost-won-pwn2own-via-xss/
on “Pwn2own considered (somewhat) harmful”
