Top all-time · #15423
Meta Red Team X
Company blog · rtx.meta.securitysecuritysystems
Meta Red Team X is the company blog at rtx.meta.security, writing about security and systems. Since 2023, 5 different Hacker News readers have linked it 5 times. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link this Meta Red Team X write-up on an Android 12/13 flaw, CVE-2024-0044, where a newline trick in package session input bypasses the run-as debuggability check to extract app data.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Technical writeups by Meta’s Security folks, including Red Team.
What Hacker News says?
Some context: CVE-2024-0044 - https://nvd.nist.gov/vuln/detail/CVE-2024-0044 > In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Bypassing the "run-as" debuggability check on Android via newline i…
Comment linking /exploitation/2024/03/04/Android-run-as-forgery.html
on “Extract sensitive data from Android 12/13 apps via "run-as" forgery”Submitted Missing signs: how several brands forgot to secure a key piece of Android as a story · 4 points
HN discussionSubmitted Becoming any Android app via Zygote command injection as a story · 2 points
HN discussionSubmitted Sandboxing ImageIO media parsing in macOS as a story · 1 points
HN discussionSubmitted CVE-2023-4039: GCC fails to guard dynamic stack allocations on ARM64 as a story · 1 points
HN discussion