Top all-time · #6304
ReversingLabs
Company blog · blog.reversinglabs.comsecurityprogramming
ReversingLabs is the company blog at blog.reversinglabs.com, writing about security and programming. Since 2018, 13 different Hacker News readers have linked it 15 times, most often “Mining for Malicious Ruby Gems”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link ReversingLabs for malware analysis of software supply-chain attacks, such as the malicious RubyGems packages and the analysis of the SolarWinds Sunburst signing. The comments cite it as a source.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
RL Blog: AppSec & Supply Chain Security, Dev & DevSecOps, Threat Research, and Security Operations (SecOps)
Most-linked posts?
- Mining for Malicious Ruby Gems5 people · 6 mentions · first linked 2020-04-17
- /blog/sunburst-the-next-level-of-stealth2 people · 2 mentions · first linked 2020-12-17
- IconBurst: NPM software supply chain attack grabs data from apps, websites2 people · 2 mentions · first linked 2022-07-06
- Three New DDE Obfuscation Methods2 people · 2 mentions · first linked 2018-09-24
What Hacker News says?
From the original article[0]: > The script itself is rather simple. First, it creates a new VBScript Sle with the main malicious loop at the “%PROGRAMDATA%\Microsoft Essentials\Software Essentials.vbs” path. As its persistence mechanism, it then creates a new autorun registry key “HCU\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Software Essentials.” With this, the malware ensures that it is run every tim…
Comment linking /blog/mining-for-malicious-ruby-gems
on “Supply-chain attack hits RubyGems repository with malicious packages”Submitted Three New DDE Obfuscation Methods as a story · 21 points
HN discussionActual source: https://blog.reversinglabs.com/blog/mining-for-malicious-rub... https://news.ycombinator.com/item?id=22906714
Comment linking /blog/mining-for-malicious-ruby-gems
on “Supply-chain attack hits RubyGems repository with malicious packages”Submitted Mining for Malicious Ruby Gems as a story · 14 points
HN discussionThis is almost certainly just a funny and unfortunate coincidence. The malicious binary was signed, you can't do that with just FTP upload access. The code looks to be injected at build time according to this report by reversing labs: https://blog.reversinglabs.com/blog/sunburst-the-next-level-... 'Signing occurred within a minute of library compilation. That leaves no time for the attackers to be able to monitor th…
Comment linking /blog/sunburst-the-next-level-of-stealth
on “Advanced Persistent Threat Compromise of Government Agencies”Submitted IconBurst: NPM software supply chain attack grabs data from apps, websites as a story · 3 points
HN discussion> It doesn’t have access to the “fire the missiles” button, no matter what it spits out. ChatGPT surely doesn't, but perhaps its cousin does. Someone, or something, hacked that U.S. Nuclear Weapons Agency immediately after they stopped using floppy disks and went online. The announcement that the U.S. nuclear arsenal no longer relies on floppy disks was made in the New York Times on October 24th, 2019 (see https://a…
Comment linking /blog/sunburst-the-next-level-of-stealth
on “Perhaps It Is a Bad Thing That the Leading AI Companies Cannot Control Their AIs”Submitted Malware found in 725 Ruby libraries as a story · 2 points
HN discussionSubmitted Mining for Malicious Ruby Gems as a story · 2 points
HN discussionSubmitted Mining for Malicious Ruby Gems as a story · 2 points
HN discussionSubmitted SentinelSneak: Malicious PyPI module poses as security software development kit as a story · 1 points
HN discussionSubmitted IconBurst NPM software supply chain attack grabs data from apps and websites as a story · 1 points
HN discussionSubmitted Rana Android Malware as a story · 1 points
HN discussionSubmitted Integrating Isolation with Analytics as a story · 1 points
HN discussionSubmitted Three New DDE Obfuscation Methods as a story · 1 points
HN discussion
