Top all-time · #12843
Oversecured Blog: News, Techniques & Guides
Company blog · blog.oversecured.comsecurityprogramming
Oversecured Blog: News, Techniques & Guides is the company blog at blog.oversecured.com, writing about security and programming. Since 2020, 6 different Hacker News readers have linked it 10 times, most often “MavenGate: a supply chain attack for Java and Android applications”. No feed was found, so read it on the site itself.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link Oversecured's Android and app-security research, such as its WebView request-interception write-up and the MavenGate supply-chain post, as references for their own points.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Insights on mobile app security, vulnerability research, and best practices from Oversecured experts.
Most-linked posts?
- MavenGate: a supply chain attack for Java and Android applications3 people · 3 mentions · first linked 2024-01-19
- Google Play Core library for Android, persistent LCE is still alive2 people · 2 mentions · first linked 2020-12-04
What Hacker News says?
No. Having many packages might not be the only reason to start an attack. This post shows it is/was possible in the Maven ecosystem: https://blog.oversecured.com/Introducing-MavenGate-a-supply-...
Comment linking /Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications/
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted MavenGate: a supply chain attack for Java and Android applications as a story · 3 points
HN discussionHonestly, this is pretty sloppy and Google should know better. I've done a lot of work with WebView on Android and it's a straightforward process to intercept requests to whitelist domains. It's well trodden ground [1], especially for apps that use the WebView for their entire UI. This is an oversight by everyone from the dev team to the product manager to the QA working on it. 1. https://blog.oversecured.com/Androi…
Comment linking /Android-security-checklist-webview/
on “Google has a secret browser hidden inside the settings”Submitted Two weeks of securing Samsung devices: Part 1 as a story · 3 points
HN discussionSubmitted MavenGate: A supply chain attack method for Java and Android applications as a story · 2 points
HN discussionSubmitted Why dynamic code loading could be dangerous for your apps: a Google example as a story · 2 points
HN discussionSubmitted How to exploit memory corruption bugs on Android and an example in PayPal apps as a story · 2 points
HN discussionSubmitted Google Play Core library for Android, persistent LCE is still alive as a story · 2 points
HN discussionSubmitted Exploring vulnerabilities in WebResourceResponse and an example in Amazon apps as a story · 1 points
HN discussionSubmitted Oversecured discovers persistent code execution in the Google Play Core Library as a story · 1 points
HN discussion