Top all-time · #2214
Sam Curry
Personal blog · samcurry.netsecurityprogramming
Sam Curry's personal blog at samcurry.net covers security and programming. Since 2017, 36 different Hacker News readers have linked it 40 times, most often “Leaked Secrets and Unlimited Miles: Hacking the Largest Rewards Vendor”. No feed was found, so read it on the site itself.
A technical blog by Sam Curry
Most-linked posts?
- Leaked Secrets and Unlimited Miles: Hacking the Largest Rewards Vendor4 people · 4 mentions · first linked 2023-08-03
- Hacking Starbucks and Accessing Nearly 100M Customer Records4 people · 4 mentions · first linked 2020-06-21
- Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program3 people · 3 mentions · first linked 2019-07-15
- Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office3 people · 3 mentions · first linked 2025-10-14
- Hacking millions of modems and investigating who hacked my modem3 people · 3 mentions · first linked 2024-06-03
- Web Hackers vs. the Auto Industry2 people · 3 mentions · first linked 2023-01-03
- We Hacked Apple for 3 Months2 people · 2 mentions · first linked 2020-10-08
- Hacking Kia: Remotely controlling cars with just a license plate2 people · 2 mentions · first linked 2024-09-26
- Hacking Subaru: Tracking and controlling cars via the admin panel2 people · 2 mentions · first linked 2025-01-23
- Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40k Bounty2 people · 2 mentions · first linked 2019-12-22
What Hacker News says?
You're right iCloud itself wasn't "cracked", per se, but the XSS exploit is (was) incredibly malicious and did not require any social engineering that I can see. https://samcurry.net/hacking-apple/#vuln3
Comment linking /hacking-apple/
on “We Hacked Apple for 3 Months”Submitted We Hacked Apple for 3 Months as a story · 1454 points
HN discussion> Apple is probably much better than Garmin at securing their production environments Oops https://samcurry.net/hacking-apple/
Comment linking /hacking-apple/
on “Apple Watch momentum is building”Submitted Hacking millions of modems and investigating who hacked my modem as a story · 895 points
HN discussionRelevant: https://samcurry.net/hacking-millions-of-modems
Comment linking /hacking-millions-of-modems
on “New 0-Day Attacks Linked to China's 'Volt Typhoon'”Submitted Hacking millions of modems and investigating who hacked my modem as a story · 838 points
HN discussionAside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intid…
Comment linking /
on “Google YOLO clickjacking (2018)”Submitted Hacking Kia: Remotely controlling cars with just a license plate as a story · 630 points
HN discussionA very small very personal note: dear automakers what about making connected cars, BUT connected to their formal owners? Like hey a car with a webui built-in. So for instance instead of crapplications and crappy APIs [1] we can simply connect directly with dynDNS or a personal domain to our cars and owning them fully enough to decide how to upgrade their crapware, witch services gives to whom and so on? I have three…
Comment linking /web-hackers-vs-the-auto-industry/
on “Tracking and technology in cars is being weaponized by abusive partners”Submitted Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program as a story · 574 points
HN discussionThe article Jalopnik based its piece on (and didn't even link to): https://samcurry.net/hacking-subaru Previous HN discussion on that: https://news.ycombinator.com/item?id=42803279
Comment linking /hacking-subaru
on “Hackers crack Subaru's connected services to access data, door locks and more”Submitted Hacking Subaru: Tracking and controlling cars via the admin panel as a story · 548 points
HN discussionOriginal Article: https://samcurry.net/hacking-kia
Comment linking /hacking-kia
on “Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug”Submitted Hacking the largest airline and hotel rewards platform (2023) as a story · 311 points
HN discussionI have a new EV (a modest MG ZS long range 2022) and I'm not much concerned about privacy BUT much, much, much more about remote controls ability from the factory AND potentially someone else due to some crapware vulnerabilities who happen to be vast https://samcurry.net/web-hackers-vs-the-auto-industry/ My take is simple: - all cars can be connected BUT the connection must be user controllable, meaning the car must…
Comment linking /web-hackers-vs-the-auto-industry/
on “If You’ve Got a New Car, It’s a Data Privacy Nightmare”Submitted Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office as a story · 38 points
HN discussionStill don't see anything better than Mazda to buy, if you look at the "general modern car bullshit" bingo card including but not limited to: not enough real buttons, cybersecurity blunders ( https://samcurry.net/web-hackers-vs-the-auto-industry ) or ridiculous corner cutting. The MX-5 ND especially has no serious competition at its price, as a true sports car (manual gearbox, truly light weight, independent suspensi…
Comment linking /web-hackers-vs-the-auto-industry
on “Mazda's $10 Subscription for Remote Start Sparks Backlash”Submitted Hacking Chess.com and Accessing 50M Customer Records as a story · 11 points
HN discussionI count 16 separate post on twitter for something that could have been more readily digested as a single blog post. The author has a blog at https://samcurry.net/blog , why not create a blog post and link to it in a single tweet? Parsing it in its current form flairs up my ADD to the point I can barely follow along.
Comment linking /blog
on “We found how to remote unlock, start, locate, honk connected Hondas and Nissans”Submitted Leaked Secrets and Unlimited Miles: Hacking the Largest Rewards Vendor as a story · 5 points
HN discussionThis seems to be a too sophisticated attack, sometimes simplicity is better: https://samcurry.net/cracking-my-windshield-and-earning-1000...
Comment linking /cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/
on “Tesla.com/.gitignore”Submitted Vulnerabilities in Points.com: Compromising Rewards Programs and Getting Caught as a story · 5 points
HN discussionSubmitted Hacking the Largest Airline and Hotel Rewards Platform as a story · 3 points
HN discussionSubmitted Hacking the Largest Airline and Hotel Rewards Platform as a story · 3 points
HN discussionSubmitted Hacking Starbucks and Accessing Nearly 100M Customer Records as a story · 3 points
HN discussionSubmitted Reading ASP secrets for $17,000 as a story · 3 points
HN discussionSubmitted Hacking Starbucks and Accessing Nearly 100M Customer Records as a story · 2 points
HN discussionSubmitted Abusing HTTP Path Normalization and Cache Poisoning to Steal Rocket League Accs as a story · 2 points
HN discussionSubmitted Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40k Bounty as a story · 2 points
HN discussionSubmitted Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program as a story · 2 points
HN discussion
