Michal Zalewski

Most-linked posts?

1. Pulling JPEGs out of thin air (2014)
   14 people · 14 mentions · first linked 2017-01-16
2. PSA: Don't run 'strings' on untrusted files (2014)
   8 people · 8 mentions · first linked 2016-03-30
3. Bash bug: the other two RCEs, or how we chipped away at the original fix
   5 people · 5 mentions · first linked 2014-10-01
4. Pulling JPEGs out of thin air
   5 people · 5 mentions · first linked 2014-11-07
5. Don't run 'strings' on untrusted files
   4 people · 4 mentions · first linked 2014-10-25
6. On Journeys
   3 people · 3 mentions · first linked 2015-03-30
7. Quick notes about the bash bug, its impact, and the fixes so far
   3 people · 3 mentions · first linked 2014-09-25
8. Bash bug: apply the unofficial patch now (CVE-2014-6277)
   3 people · 3 mentions · first linked 2014-09-27
9. Vulnerability databases and pie charts don't mix
   3 people · 3 mentions · first linked 2010-05-07
10. Finding bugs in SQLite, the easy way
    3 people · 3 mentions · first linked 2015-04-14

What Hacker News says?

1. 45h34jh53k4j · 2016-08-10

   I agree transcoding all user content is a must, but even that can be dangerous :-) as with ImageTragick which lcamtuf discussed here: https://lcamtuf.blogspot.com/2016/05/clearing-up-some-miscon...

   Comment linking /2016/05/clearing-up-some-misconceptions-around.html

   on “This JPEG is also a webpage”
2. atulagarwal · 2014-11-07

   Submitted Pulling JPEGs out of thin air as a story · 444 points

   HN discussion
3. f- · 2014-10-07

   If you followed some common-sense advice [1], you only needed two patches: the original one as a stop-gap measure for the original RCE on September 24, and Florian's prefix-adding patch that came out shortly thereafter (but has taken some time to appear upstream). Now, I'm a bit stumped how any obvious variant of the CVE-2014-6271 or CVE-2014-6278 RCE payloads could lead to accidental code execution somewhere else,…

   Comment linking /2014/09/bash-bug-apply-unofficial-patch-now.html

   on “Yahoo Hacked”
4. robinhouston · 2014-10-25

   Submitted Don't run 'strings' on untrusted files as a story · 392 points

   HN discussion
5. div0 · 2017-01-16

   This book influenced me tremendously. It explains how can random process (e.g. genetic mutation) builds highly non-random structures (e.g. the human eye). Recently I was using American Fuzzy Lop ( http://lcamtuf.coredump.cx/afl/ ) to find bugs in my software, and was able to appreciate the surprising effectiveness of the "random" strategy it employs to discover structures in the program. For example, AFL could const…

   Comment linking /2014/11/pulling-jpegs-out-of-thin-air.html

   on “Ask HN: What's the best computer science book you've read recently?”
6. shubhamjain · 2017-05-11

   Submitted Pulling JPEGs out of thin air (2014) as a story · 384 points

   HN discussion
7. bitskits · 2017-01-11

   Some further reading on the subject by lcamtuf (from 2011): https://lcamtuf.blogspot.com/2011/12/old-switcharoo.html

   Comment linking /2011/12/old-switcharoo.html

   on “The closest I've ever come to falling for a Gmail phishing attack”
8. robin_reala · 2015-04-14

   Submitted Finding bugs in SQLite, the easy way as a story · 340 points

   HN discussion
9. mbrubeck · 2014-06-06

   Here's the same exploit disguised as a game, to make it less obvious that it's tricking the user into interacting with it: http://lcamtuf.coredump.cx/yahh/ Documentation of the game proof-of-concept: http://lcamtuf.blogspot.com/2013/05/some-harmless-old-fashio...

   Comment linking /2013/05/some-harmless-old-fashioned-fun-with-css.html

   on “Who am I: A mind reader (don't forget to view source)”
10. dmit · 2014-11-30

    Submitted Nobody expects CDATA sections in XML as a story · 219 points

    HN discussion
11. gwillen · 2014-10-02

    As a followup, someone finally did find a full-blown 'execute whatever you like' exploit for the patched version of bash. http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-...

    Comment linking /2014/10/bash-bug-how-we-finally-cracked.html

    on “CVE-2014-7169: Bash Fix Incomplete, Still Exploitable”
12. dsr12 · 2018-02-03

    Submitted Progressing from Tech to Leadership as a story · 202 points

    HN discussion
13. Retr0id · 2024-07-21

    Competent fuzzers don't just use random bytes, they systematically explore the state-space of the target program. If there's a crash state to be found by feeding in a file full of null bytes, it's probably going to be found quickly. A fun example is that if you point AFL at a JPEG parser, it will eventually "learn" to produce valid JPEG files as test cases, without ever having been told what JPEG file is supposed to…

    Comment linking /2014/11/pulling-jpegs-out-of-thin-air.html

    on “Initial details about why CrowdStrike's CSAgent.sys crashed”
14. kawera · 2016-08-08

    Submitted CSS mix-blend-mode is bad for your browsing history as a story · 196 points

    HN discussion
15. f- · 2014-09-25

    Since the post is relatively non-technical, I'd like to underscore that there are substantial concerns with the original and the followup patch, because with or without it, the underlying bash code parser is still exposed to the Internet. Nobody has posted an RCE vector that would be universally bad for the patched version, but several people have already identified "hmm, that's unexpected" types of global side effe…

    Comment linking /2014/09/quick-notes-about-bash-bug-its-impact.html

    on “Everything you need to know about the Shellshock Bash bug”
16. rayraegah · 2019-03-23

    Submitted Pulling JPEGs out of thin air (2014) as a story · 177 points

    HN discussion
17. Excavator · 2015-11-26Recommends

    Some relevant, interesting, material on counting CVEs: https://plus.google.com/u/0/+JustinSchuh/posts/CNEgtJWYTb5 http://lcamtuf.blogspot.com/2010/05/vulnerability-databases-...

    Comment linking /2010/05/vulnerability-databases-and-pie-charts.html

    on “Firefox: We Don't Need Google's Money Any More”
18. robin_reala · 2014-09-25

    Submitted Quick notes about the bash bug, its impact, and the fixes so far as a story · 164 points

    HN discussion
19. amckenna · 2014-10-23

    For any that were not aware, this is the same Zalewski that did a lot of great work around the Shellshock bug. He found 2 additional issues with the parsing function after the initially reported bug. CVE-2014-6277 and CVE-2014-6278 http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-... I don't know where he finds time to sleep.

    Comment linking /2014/10/bash-bug-how-we-finally-cracked.html

    on “My adventures in CNC robotics”
20. stakent · 2014-10-01

    Submitted Bash bug: the other two RCEs, or how we chipped away at the original fix as a story · 152 points

    HN discussion
21. jameal · 2018-05-31

    There is a similar vulnerability with `mix-blend-mode` that enables a script to check whether a user has visited any given URL. It has existed since as early as 2016 and is still a problem today in Chrome 67. See: https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-b... And here is a demo: http://lcamtuf.coredump.cx/whack/ It has limitations which make it slightly impractical to check against a large number o…

    Comment linking /2016/08/css-mix-blend-mode-is-bad-for-keeping.html

    on “Side-channel attacking browsers through CSS3 features”
22. tptacek · 2010-10-29

    Submitted HTTP cookies, or how not to design protocols as a story · 142 points

    HN discussion
23. tptacek · 2014-01-18

    This is something Zalewski has written about: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-... --- if this kind of thing is interesting to you, his latest book, _The Tangled Web_, is excellent.

    Comment linking /2010/10/http-cookies-or-how-not-to-design.html

    on “Cookie Bomb or Let's Break the Internet”
24. stakent · 2014-09-27

    Submitted Bash bug: apply the unofficial patch now (CVE-2014-6277) as a story · 124 points

    HN discussion
25. twinge · 2014-11-24

    "strings" is also vulnerable: http://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on-... Inspecting files is apparently hazardous.

    Comment linking /2014/10/psa-dont-run-strings-on-untrusted-files.html

    on “On Linux, 'less' can probably get you owned”
26. tobik · 2016-02-16

    Submitted Automatically inferring file syntax with afl-analyze as a story · 119 points

    HN discussion
27. reginaldo · 2013-02-20Recommends

    Some blogs I like (most are not updated very frequently, though): Billy Rios (discovered GIFAR) http://xs-sniper.com/blog/ Michal Zalewski (one of the top security researchers in the world, wrote "The Tangled Web", a must-read) http://lcamtuf.blogspot.com Neal Poole: https://nealpoole.com/blog/ Nir Goldshlager: http://www.nirgoldshlager.com/ Michael Brooks: https://sitewatch.me/en/Blog Nils Jünemann: http://www.nils…

    Comment linking /

    on “How we hacked Facebook with OAuth2 and Chrome bugs”
28. spindritf · 2013-05-05

    Submitted Some harmless, old-fashioned fun with CSS as a story · 105 points

    HN discussion
29. touisteur · 2020-12-18

    I seem to remember really great interaction with lcamtuf (of AFL fame): https://lcamtuf.blogspot.com/2015/04/finding-bugs-in-sqlite-...

    Comment linking /2015/04/finding-bugs-in-sqlite-easy-way.html

    on “What If OpenDocument Used SQLite? (2014)”
30. dsr12 · 2018-03-04

    Submitted On journeys (2015) as a story · 100 points

    HN discussion

Search all of HN for lcamtuf.blogspot.com

Linked by the same people?

• NNate Lawsonrdist.root.org
• MMichal Zalewskilcamtuf.coredump.cx
• SSecurityscarybeastsecurity.blogspot.com
• EEric Rescorlaeducatedguesswork.org
• JJosh Habermanblog.reverberate.org
• Nneugierig.orgneugierig.org
• YYann Colletfastcompression.blogspot.com
• TThe Invisible Things Lab's blogtheinvisiblethings.blogspot.com