Top all-time · #9053
Malware don’t need Coffee
Personal blog · malware.dontneedcoffee.comsecurityprogramming
Malware don’t need Coffee is a personal blog at malware.dontneedcoffee.com about security and programming. Since 2012, 9 different Hacker News readers have linked it 12 times, most often “Flash 0 day”. The last post was in 2020, but the archive is still widely read.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
Malware analysis and reverse engineering blog. HN links its posts on VM detection by malware, keyloggers, and an unpatched Flash vulnerability. One commenter names it a useful esoteric site.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Flash 0 day3 people · 4 mentions · first linked 2015-01-22
What Hacker News says?
Malware will often detect the presence of a VM and refuse to run, requiring you to identify and defeat the VM checks or more insidiously appear to run normally but modify the actions it takes. [0] Generally these problems are solved by modifying the VM so it can no longer be detected. [1] [0] http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html [1] http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3478
Comment linking /2016/04/bedepantiVM.html
on “Reverse Engineering Malware 101”Submitted Flash 0 day as a story · 4 points
HN discussionWindows XP/2003/Vista/7/8 (x32/x64) Apparently this keylogger was used: http://malware.dontneedcoffee.com/2013/10/jolly-roger-steale...
Comment linking /2013/10/jolly-roger-stealer-c-panel.html
on “Two million Facebook, Gmail and Twitter passwords stolen”Submitted Java 0day remote execution spotted in the wild (Disable Java in browser now) as a story · 2 points
HN discussionWindows XP/2003/Vista/7/8 (x32/x64) Apparently this one: http://malware.dontneedcoffee.com/2013/10/jolly-roger-steale...
Comment linking /2013/10/jolly-roger-stealer-c-panel.html
on “Two million Facebook, Gmail and Twitter passwords stolen”Submitted Newest public Java exploit (CVE-2012-5076) found in the wild for first time as a story · 2 points
HN discussionAt least one malware crew even setup a specific C&C server for researchers. The malware still would install correctly if detected a VM but it would use a different domain generation algorithm that would connect to a completely different infrastructure than the one used for regular infections. This is very difficult to notice as the behavior is no different than what you would expect from a regular infection. http://…
Comment linking /2016/04/bedepantiVM.html
on “Investigating a malware sample which sometimes fails to behave maliciously”Submitted MDNC Project Comes to an End as a story · 1 points
HN discussionHere's a more serious source (EMET is mentioned towards the end of the blog post) ... http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerab...
Comment linking /2015/01/unpatched-vulnerability-0day-in-flash.html
on “CVE-2015-0311 – Adobe Flash Player Remote Vulnerability”Apparently Chrome isn't affected: http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerab...
Comment linking /2015/01/unpatched-vulnerability-0day-in-flash.html
on “CVE-2015-0311 – Adobe Flash Player Remote Vulnerability”Do you know that Chrome is vulnerable, or are you just going by the version numbers? Chrome sandboxes plugins in order to give an extra layer of protection against exactly these kind of exploits. The interesting question will be how it helps in this case. Do you have any info? ADDED: initial reports suggest Chrome is NOT affected; whether its thanks to Chrome's sandboxing model or whether its because Chrome has patc…
Comment linking /2015/01/unpatched-vulnerability-0day-in-flash.html
on “CVE-2015-0311 – Adobe Flash Player Remote Vulnerability”I am contending with what "esoteric" means here but I'd say http://malware.dontneedcoffee.com/
Comment linking /
on “Ask HN: What are the most esoteric but useful sites on the web?”
