Top all-time · #3037
Positive Security
Company blog · positive.security/blogsecurity
Positive Security is the company blog at positive.security, writing about security. Since 2021, 25 different Hacker News readers have linked it 33 times, most often “Emulating AirTags to upload arbitrary data via Apple's FindMy network”. It is still writing: the last post was on 2025-01-10, and you can follow it by feed.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
Positive Security's research blog on AirTag and Find My tracking (send-my, find-you), deep-link attacks, urlscan data leaks, Blinkencity and Lodash vulnerabilities. Commenters cite it as the primary source for these findings.
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Positive Security is a Berlin based IT security consultancy and research collective.
Most-linked posts?
- Emulating AirTags to upload arbitrary data via Apple's FindMy network6 people · 6 mentions · first linked 2021-05-12
- BlinkenCity: From Art Project to Europe-Wide Blackout Scenario4 people · 4 mentions · first linked 2025-01-10
- Find You: Building a stealth AirTag clone3 people · 3 mentions · first linked 2022-02-21
- Allow arbitrary URLs, expect arbitrary code execution3 people · 3 mentions · first linked 2021-04-15
- Urlscan.io’s SOAR spot: Chatty security tools leaking private data3 people · 3 mentions · first linked 2022-11-02
- Linux marketplaces vulnerable to RCE and supply chain attacks2 people · 2 mentions · first linked 2021-06-22
- Vulnerabilities in the hidden magic of Lodash, Ramda and Underscore2 people · 2 mentions · first linked 2025-05-14
- Ransacking your password reset tokens2 people · 2 mentions · first linked 2023-01-26
- Hacking Auto-GPT and escaping its Docker container2 people · 2 mentions · first linked 2023-06-29
What Hacker News says?
An Apple airtag probably doesn't but it is apparently possible to send some data at a very low rate (the article in [1] says a few bits per hour) over the find my network [2] [1] https://positive.security/blog/send-my [2] https://github.com/positive-security/send-my
Comment linking /blog/send-my
on “216M Spy TVs – The LG Smart TV Problem [video]”Submitted Emulating AirTags to upload arbitrary data via Apple's FindMy network as a story · 490 points
HN discussionThere is a whole class of attacks related to “deep linking” and custom URL schemes that the operating system can pass to any application that registers itself to match it. At that point the sanitization is up to the application. I recently stumbled upon a nice write-up [0] that described this class of attack and surveyed which software was vulnerable to it. Many crypto clients were included. [0] https://positive.sec…
Comment linking /blog/url-open-rce
on “A fake job offer took down Axie Infinity”Submitted Microsoft Teams: 1 feature, 4 vulnerabilities as a story · 340 points
HN discussionI thought I read it in the article but I may have unconsciously extrapolated from and/or misread this part: “I came across this wonderful analysis by Positive Security[0] who focused on urlscan.io and used canary tokens to detect potential automated sources (security tools scanning emails for potentially malicious [links])” I don’t see any mention of messaging platforms generally. It only mentions email and does not…
Comment linking /blog/urlscan-data-leaks
on “You cannot simply publicly access private secure links, can you?”Submitted Find You: Building a stealth AirTag clone as a story · 225 points
HN discussionImpressive. Here is the blog post (also linked from their github) that talks about the bypass (the tldr; is that they rotate through public keys in a deterministic way, so Apple’s protections think it’s a new device each time and thus don’t warn about a persistent tracker). https://positive.security/blog/find-you
Comment linking /blog/find-you
on “Carpenter's AirTags help uncover 'massive' case of stolen tools in Maryland”Submitted Recovering redacted information from pixelated videos as a story · 203 points
HN discussionWe know exactly what goes in an airtag message. It’s very limited. https://positive.security/blog/send-my
Comment linking /blog/send-my
on “Want a killer product? Become more opinionated”Submitted Windows 10 RCE: The exploit is in the link as a story · 131 points
HN discussionthis seems their website https://positive.security/ not sure where they host their code
Comment linking /
on “38C3: Blinkencity, radio controlling street lamps and power plants [video]”Submitted Urlscan.io’s SOAR spot: Chatty security tools leaking private data as a story · 65 points
HN discussion> it’s often sufficient to generate a publicly available, unlisted/unindexed, hard to guess URL Unless a service is leaking or spidering the URL into a public index. https://positive.security/blog/urlscan-data-leaks https://arstechnica.com/information-technology/2014/05/dropb... https://security.stackexchange.com/questions/239762/how-are-...
Comment linking /blog/urlscan-data-leaks
on “Modern-day spying: sometimes old technology is more secure”Submitted Linux marketplaces vulnerable to RCE and supply chain attacks as a story · 17 points
HN discussionSo nice to see this here! We were inspired by Project Blinkenlights to conceive BlinkenCity, a city-wide installation of the same idea (abusing the radio-controllable individually-addressable street lamps in many German cities): https://positive.security/blog/blinkencity-38c3
Comment linking /blog/blinkencity-38c3
on “Project Blinkenlights”Submitted BlinkenCity: From Art Project to Europe-Wide Blackout Scenario as a story · 16 points
HN discussionYou'd be surprised: https://positive.security/blog/lodash-ramda-underscore-vulne...
Comment linking /blog/lodash-ramda-underscore-vulnerabilities
on “Show HN: SuperUtilsPlus – A Modern Alternative to Lodash”Submitted Allow arbitrary URLs, expect arbitrary code execution as a story · 13 points
HN discussion> Spain will need to make some very hard choices Thankfully there is now more focus and financing available to elevate the network quality - right? Portugal has added 1% onto the electricity price for that purpose alone: https://www.energy-storage.news/portugal-to-invest-e400-mill... I've followed "expert testimonials" in the Austrian news over the past years, and even there the importance of grid safety is a common…
Comment linking /blog/blinkencity-38c3
on “Wind power slashed 4.6B euros off electricity bills in Spain last year”Submitted Ransacking your password reset tokens as a story · 7 points
HN discussionThe blog post [0] of the researcher - which this article is based on [0] https://positive.security/blog/send-my
Comment linking /blog/send-my
on “Apple AirTag hacked again – free internet with no mobile data plan”Submitted Vulnerabilities in the hidden magic of Lodash, Ramda and Underscore as a story · 6 points
HN discussionThe linked blog post is more detailed and probably better to link to https://positive.security/blog/send-my
Comment linking /blog/send-my
on “Apple’s ‘Find My’ Network Exploited via Bluetooth”Submitted From XSS to RCE – dompdf 0-day as a story · 6 points
HN discussionLinked source: https://positive.security/blog/find-you
Comment linking /blog/find-you
on “No Privacy: Cloning the AirTag”Submitted Hacking Auto-GPT and escaping its Docker container as a story · 4 points
HN discussionSubmitted BlinkenCity: From Art Project to Europe-Wide Blackout Scenario as a story · 3 points
HN discussionSubmitted Banking AI XSS: The exploit is in the payment reference as a story · 2 points
HN discussionSubmitted Ransacking your password reset tokens as a story · 2 points
HN discussionSubmitted Hacking Auto-GPT and escaping its Docker container as a story · 1 points
HN discussion
