Top all-time · #1679
:: Orange Cyberdefense
Company blog · sensepost.com/blogsecurity
:: Orange Cyberdefense is the company blog at sensepost.com, writing about security. Since 2009, 43 different Hacker News readers have linked it 47 times, most often “Snoopy: A distributed tracking and profiling framework”. It is still writing: the last post was on 2026-07-08, and you can follow it by feed.
Most-linked posts?
- Snoopy: A distributed tracking and profiling framework4 people · 4 mentions · first linked 2013-02-25
- BlackHat Write-up: go-derper and mining memcaches3 people · 3 mentions · first linked 2010-08-05
- Left to My Own Devices – Fast NTCracking in Rust2 people · 2 mentions · first linked 2022-03-27
- A distinguisher for SHA256 using Bitcoin (mining faster along the way)2 people · 2 mentions · first linked 2017-11-01
- Duo Two-Factor Authentication Bypass2 people · 2 mentions · first linked 2021-04-22
- Macro-Less Code Exec in MSWord2 people · 2 mentions · first linked 2017-10-10
What Hacker News says?
It was moved out in Vista with great fanfare. A side effect was GDI was no longer hardware accelerated. With windows 7 and later hardware acceleration was added back necessitating parts of it return to the kernel. For obvious reasons this wasn't as widely publicized. This makes exploits like this possible: https://sensepost.com/blog/2017/abusing-gdi-objects-for-ring...
Comment linking /blog/2017/abusing-gdi-objects-for-ring0-primitives-revolution/
on “Windows code-execution zeroday is under active exploit, Microsoft warns”Submitted A Crash Course in X86 Assembly for Reverse Engineers (2013) [pdf] as a story · 217 points
HN discussionScrolling through their incident feed, it seems to be a bit more frequent than "extremely rare". Remember that critical industry is a sector where patching software is viewed as risky, because changing anything when it works is seen as unnecessary, and would often have weeks or months of pre-deployment testing. They work on a different time-base to the IT world. The ability to do a "bypass" is nice in theory, but th…
Comment linking /blog/2021/duo-two-factor-authentication-bypass/
on “Hackers breached Colonial Pipeline using compromised password”Submitted Macro-Less Code Exec in MSWord as a story · 87 points
HN discussionI wrote this about 13 years ago (a little tongue in cheek) but it held up: https://sensepost.com/blog/2009/twitter-killed-the-infosec-b... -snip- There’s something liberating about saying “here’s a link”, as opposed to taking the time to formulate your thoughts into a full blown posting. We were curious if this twitter-effect was real, imaginary or only applicable to lazy people like us.. Thanks to python-twitter an…
Comment linking /blog/2009/twitter-killed-the-infosec-blogging-star/
on “Ask HN: Can we ban Twitter links, please?”Submitted A closer look into the RSA SecureID software token as a story · 46 points
HN discussionBlog post about it: http://www.sensepost.com/blog/7557.html
Comment linking /blog/7557.html
on “Beginner's Guide to Wi-fi Interception”Submitted Macro-less code exec in msword as a story · 6 points
HN discussionWiFi probes are indeed a huge information/privacy leak. I'm guessing a lot of this has to do with the fact that WiFi was not designed from the beginning with security in mind. Simply using something like Kismet[0] yields a lot of information, even before any rigorous analysis is done. You'll see some probe requests with huge lists of SSIDs. Some of those SSIDs are comprised of an address (presumably a home address),…
Comment linking /blog/7557.html
on “Your wifi shows me where you live, work and travel”Submitted BlackHat Write-up: go-derper and mining memcaches as a story · 5 points
HN discussionhttps://source.android.com/docs/devices/admin/multi-user https://sensepost.com/blog/2020/multiple-android-user-profil...
Comment linking /blog/2020/multiple-android-user-profiles/
on “Android developers no longer need Windows USB drivers”Submitted WireSocks for Easy Proxied Routing as a story · 3 points
HN discussionAnother approach - controlling the USB device over WiFi, so it can be remotely triggered at any time: https://www.sensepost.com/blog/2016/universal-serial-abuse/
Comment linking /blog/2016/universal-serial-abuse/
on “What are malicious USB keys and how to create a realistic one?”Submitted Routopsy – Hacking Routing with Routers as a story · 3 points
HN discussionSimilar, but with memcached (2010): http://www.sensepost.com/blog/4873.html
Comment linking /blog/4873.html
on “Several thousand MongoDBs without access control on the Internet [pdf]”Submitted Hacking doom for fun, health and ammo as a story · 3 points
HN discussionWhen you turn your WiFi on, you can be tracked and attacked very easily. This is been known for a while, though not widely enough. If at one time you connected to an open network, your devices continues to scan for that network. I can spoof that network, you connect to it, and then I intercept all traffic. A full framework has been created for this, complete with the ability to fingerprint your browser/OS and send e…
Comment linking /blog/7557.html
on “Is looking for Wi-Fi access points purely passive?”Submitted A Crash Course in x86 Assembly for Reverse Engineers [pdf] as a story · 3 points
HN discussionThe blog entry on the topic is available at http://www.sensepost.com/blog/4873.html Also, GoWalla & Bit.Ly were informed pre-publication, and fixed their stuff.
Comment linking /blog/4873.html
on “Cache on Delivery (Mining random people's memcached)”Submitted A distinguisher for SHA256 using Bitcoin (mining faster along the way) as a story · 3 points
HN discussionYou might be able to build something like that in serverless, if you wanted to: https://blog.cloudflare.com/introducing-websockets-in-worker... (and updated keep-open pricing in https://blog.cloudflare.com/workers-pricing-scale-to-zero/ ) Or here's a writeup about writing a proxy in Node: https://sensepost.com/blog/2015/another-intercepting-proxy/
Comment linking /blog/2015/another-intercepting-proxy/
on “Ask HN: WebSocket Relay?”Submitted A distinguisher for SHA256 using Bitcoin (mining faster along the way) as a story · 3 points
HN discussionSubmitted Investigating an in-the-wild campaign using RCE in CraftCMS as a story · 2 points
HN discussionSubmitted SIM Hijacking as a story · 2 points
HN discussionSubmitted P4wnP1-LTE [on a USB LTE Modem] as a story · 2 points
HN discussionSubmitted Duo Two-Factor Authentication Bypass as a story · 2 points
HN discussionSubmitted Building a hipster-aware pi home server as a story · 2 points
HN discussionSubmitted Clash of the (Spam)Titan as a story · 2 points
HN discussionSubmitted A new look at null sessions and user enumeration as a story · 2 points
HN discussionSubmitted Exploiting MS16-098 RGNOBJ Integer Overflow on Windows 8.1 X64 as a story · 2 points
HN discussion
