Top all-time · #3566
NowSecure
Company blog · nowsecure.com/blogsecurityprogramming
NowSecure is the company blog at nowsecure.com, writing about security and programming. Since 2015, 22 different Hacker News readers have linked it 34 times, most often “Reverse Engineering iMessage”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
NowSecure's blog covers mobile app security analysis, such as reverse engineering iMessage, static analysis of the DeepSeek Android and iOS apps, and a Samsung SwiftKey flaw. HN cites its posts as sources.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
NowSecure delivers enterprise mobile app security: test the apps you build and vet the apps you use for security, privacy, and hidden AI risk.
Most-linked posts?
- Reverse Engineering iMessage5 people · 5 mentions · first linked 2021-01-27
- Multiple Security and Privacy Flaws in DeepSeek iOS Mobile App2 people · 3 mentions · first linked 2025-02-06
- Remote Code Execution as System User on Samsung Phones2 people · 2 mentions · first linked 2015-06-16
What Hacker News says?
Despite their goal of enforcing in 2017, it is still not a hard requirement. Back then, about 80% of the apps we tested disabled ATS either partially or fully [1]. It’s rare to see Apple walk something back [2], but here is a blog at the time that talked about it [3]. [1] https://www.nowsecure.com/blog/2017/12/29/enable-ios-app-tra... [2] https://developer.apple.com/news/?id=12212016b [3] https://www.klundberg.com/b…
Comment linking /blog/2017/12/29/enable-ios-app-transport-security-ats/
on “South Korean regulator accuses DeepSeek of sharing user data with ByteDance”Submitted Multiple Security and Privacy Flaws in DeepSeek iOS Mobile App as a story · 17 points
HN discussionWe analyzed the iOS app[1] and observed similar traffic as well as a number of basic security issues (hardcoded encryption keys, use of 3DES and some traffic over HTTP). [1] https://www.nowsecure.com/blog/2025/02/06/nowsecure-uncovers...
Comment linking /blog/2025/02/06/nowsecure-uncovers-multiple-security-and-privacy-flaws-in-deepseek-ios-mobile-app/
on “South Korean regulator accuses DeepSeek of sharing user data with ByteDance”Submitted iOS Instrumentation without Jailbreak as a story · 16 points
HN discussionThere has been some research around the APN protocol and iMessage in the past by NowSecure[0] and otherse (see links in the article). I would guess the usefullness of a reverse engineered variant is just too low given the requirement for a valid serial number for each account. [0]: https://www.nowsecure.com/blog/2021/01/27/reverse-engineerin...
Comment linking /blog/2021/01/27/reverse-engineering-imessage-leveraging-the-hardware-to-protect-the-software/
on “Analyzing iMessage with SQL”Submitted Remote Code Execution as System User on Samsung Phones as a story · 15 points
HN discussionWe're Chicago-based startup [1] that helps secure mobile apps and devices and recently completed a 12.5m Series A. If you're interested in mobile security, you can get an idea about our work in a recently vulnerability we helped Samsung patch impacting 200m+ devices. [2] Over 50% of our company is remote and we're hiring 30+ people this year. If you're interested in mobile and/or security, would love to hear from yo…
Comment linking /careers/
on “Chicago startups to watch in 2015”Submitted Android Malware Analysis with Radare: Dissecting the Triada Trojan as a story · 5 points
HN discussionIf you want to easily do traffic inspection and forensic analysis of stored data for iOS and Android, you can check out the free Community Edition of our mobile app testing lab [1]. Disclaimer, co-founder here. [1] https://www.nowsecure.com/apptesting/community/
Comment linking /apptesting/community/
on “Ask HN: How can I verify that WhatsApp uses E2E encryption?”Submitted 1-in-2 phones sold in Africa exfiltrate whole-device activity to China as a story · 4 points
HN discussionIt would be great, but I wonder how realistic it is to expect. iMessage seems to be pretty strongly tied to the apple account identity, their internal credentials, their push servers, etc. https://www.nowsecure.com/blog/2021/01/27/reverse-engineerin... They'd have to either rewrite quite a bit to be more ecosystem-independent, or somehow port all the necessary layers to work on other systems. There's a good reason n…
Comment linking /blog/2021/01/27/reverse-engineering-imessage-leveraging-the-hardware-to-protect-the-software/
on “Apple reportedly expanding iMessage to compete with Facebook”Submitted Reverse Engineering iMessage as a story · 4 points
HN discussiontl;dr it does aggressive device fingerprinting, root detection, has anti-tampering mechanisms, bundles native code and has dynamic code loading and execution facilities. IMO, none of which should be necessary for an app like this A dynamic analysis is still needed to confirm what it actually does. I decided to do this after a researcher found obfuscated surveillance code in the web app https://apnews.com/article/dee…
Comment linking /press-releases/nowsecure-urges-enterprises-to-ban-the-deepseek-ios-mobile-app/
on “Static analysis of the DeepSeek Android app”Submitted A Zero-Click RCE Exploit for the Peloton Bike as a story · 3 points
HN discussionNowSecure has some details about this flaw [0]. Summary: The SwiftKey keyboard (which can't be uninstalled) checks for language packs via HTTP: http://skslm.swiftkey.net/samsung/downloads/v1.3-USA/languagePacks.json That returns a list of download URLs and SHA1 hashes (which are obviously useless when they're in the same plain text response). These download links look like: http://skslm.swiftkey.net/samsung/download…
Comment linking /blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/
on “Massive security flaw may threaten millions of Samsung Galaxy phones”Submitted Reverse Engineering iMessage: Leveraging the Hardware to Protect the Software as a story · 3 points
HN discussionSubmitted Samsung Keyboard Security Risk Disclosed: Over 600M+ Devices Worldwide Impacted as a story · 3 points
HN discussionSubmitted NowSecure Uncovers Multiple Security and Privacy Flaws in DeepSeek iOS App as a story · 2 points
HN discussionSubmitted Reverse Engineering iMessage as a story · 2 points
HN discussionSubmitted The Dirty COW vulnerability and mobile impact as a story · 2 points
HN discussionSubmitted iOS 9 Reverse Engineering with JavaScript as a story · 2 points
HN discussionSubmitted Raspberry Pi Hang Instruction as a story · 2 points
HN discussionSubmitted CVE-2015-0863 and CVE-2015-0864 – Corrupdate Vulnerabilities on Android as a story · 2 points
HN discussionSubmitted 1-in-2 phones sold in Africa exfiltrate whole-device activity to China as a story · 1 points
HN discussionSubmitted RCE found in diagnostic app affecting Android devices and connected vehicles as a story · 1 points
HN discussionSubmitted Decoding Apple Privacy Manifests for iOS Developers as a story · 1 points
HN discussionSubmitted Show HN: NowSecure Observer helps iOS devs with Privacy Manifests, app security as a story · 1 points
HN discussionSubmitted Standardizing Automated Security Testing for IoT: Bluetooth LE as a story · 1 points
HN discussionSubmitted Cycript on steroids: Pumping up portability and performance with Frida as a story · 1 points
HN discussionSubmitted Incident Response for Android and iOS as a story · 1 points
HN discussion
