Top all-time · #103
Securelist
Company blog · securelist.comsecurity
Securelist is the company blog at securelist.com, writing about security. Since 2010, 368 different Hacker News readers have linked it 475 times, most often “Operation Triangulation: What you get when attack iPhones of researchers”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
The Securelist blog houses Kaspersky’s threat intelligence reports, malware research, APT analysis and statistics
Most-linked posts?
- Operation Triangulation: What you get when attack iPhones of researchers8 people · 10 mentions · first linked 2023-12-27
- The Duqu 2.0 Technical Details [pdf]7 people · 8 mentions · first linked 2015-06-10
- Equation group questions and answers – Kaspersky Report [pdf]6 people · 8 mentions · first linked 2015-02-16
- ProjectSauron: top level cyber-espionage platform6 people · 7 mentions · first linked 2016-08-08
- Operation Triangulation: iOS devices targeted with previously unknown malware6 people · 6 mentions · first linked 2023-06-01
- Operation ShadowHammer5 people · 6 mentions · first linked 2019-03-25
- The Flame (Duqu-, Stuxnet-related malware): Questions and Answers5 people · 5 mentions · first linked 2012-05-28
- WannaCry ransomware used in widespread attacks all over the world5 people · 5 mentions · first linked 2017-05-12
- Operation Triangulation: iOS Security Issue4 people · 6 mentions · first linked 2023-06-01
- MoonBounce: The dark side of UEFI firmware4 people · 4 mentions · first linked 2022-01-20
What Hacker News says?
Here's one such claim: https://securelist.com/blog/incidents/75731/good-morning-and...
Comment linking /blog/incidents/75731/good-morning-android/
on “We’re dropping Google Ads”Submitted Operation Triangulation: What you get when attack iPhones of researchers as a story · 549 points
HN discussionAFAIK still no luck with Gauss from 2012 https://securelist.com/gauss-abnormal-distribution/36620/
Comment linking /gauss-abnormal-distribution/36620/
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted XZ backdoor story – Initial analysis as a story · 406 points
HN discussionThe exact same kind of RCE? https://securelist.com/zero-day-vulnerability-in-telegram/83... and others... https://www.notebookcheck.net/Researchers-at-Symantec-discov...
Comment linking /zero-day-vulnerability-in-telegram/83800/
on “Zero-click, wormable, cross-platform remote code execution in Microsoft Teams”Submitted Sophisticated OS X Backdoor Discovered as a story · 385 points
HN discussionThis was exactly the playbook that led to the xz backdoor. Just the quotes: https://news.ycombinator.com/item?id=39909905 Very long page but a lot more in depth. Search for “Jigar Kumar pressured Lasse Collin” https://securelist.com/xz-backdoor-story-part-2-social-engin... And an overview: https://en.wikipedia.org/wiki/XZ_Utils_backdoor
Comment linking /xz-backdoor-story-part-2-social-engineering/112476/
on “A competitor crippled a $23.5M bootcamp by becoming a Reddit moderator”Submitted Chrome 0-day exploit used in Operation WizardOpium as a story · 326 points
HN discussionAccording to Kaspersky, Russia was by far the worst hit: https://securelist.com/blog/incidents/78351/wannacry-ransomw... (Ukraine, India, and Taiwan were also unusually heavily affected.)
Comment linking /blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted Malware infects Android-based automotive head unit firmware as a story · 266 points
HN discussionThe tools in reference are from the Equation Group dump the Shadow Brokers did. Equation Group is believed to be the NSA (a group within). EG activity dates back to at least 1996. More info on EG: https://securelist.com/files/2015/02/Equation_group_question... The dump contains many tools; but the ones used in this attack are two exploits for vulnerabilities in Windows SMB (Server Message Block, a file sharing proto…
Comment linking /files/2015/02/Equation_group_questions_and_answers.pdf
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit as a story · 251 points
HN discussionThey were posted in the Kaspersky analysis https://securelist.com/blog/incidents/78351/wannacry-ransomw...
Comment linking /blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted Potent malware that hid for six years spread through routers as a story · 203 points
HN discussionEdit: Botnet stats and spread (switch to 24H to see full picture): https://intel.malwaretech.com/botnet/wcrypt Live map: https://intel.malwaretech.com/WannaCrypt.html Relevant MS security bulletin: https://technet.microsoft.com/en-us/library/security/ms17-01... Edit: Analysis from Kaspersky Lab: https://securelist.com/blog/incidents/78351/wannacry-ransomw...
Comment linking /blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted Network Tunneling with QEMU as a story · 187 points
HN discussionConsider, for example, an app that might initially request access to your contacts for a legitimate purpose (like messaging your friends), but secretly scrapes your contacts and sells it to third parties. This is a privacy abuse that is not prevented by sandboxing since the user explicitly granted those permissions. The problem is the user has no control what the developer actually does with the data after the permi…
Comment linking /mobile-malware-evolution-2019/96280/
on “Epic, Spotify, and Tinder form advocacy group to push for app store changes”Submitted Code highlighting extension for Cursor AI used for $500k theft as a story · 182 points
HN discussion> if you look at Android or OSX you don't see 51% of users having malware on their machine Have you actually looked up the statistics? According to Kaspersky ( https://securelist.com/mobile-malware-evolution-2019/96280/ ) mobile malware attacks in 2019 affected: 60.64% of users in Iran, 44.43% in Pakistan, 43.17% in Bangladesh, 40.20% in Algeria, 37.98% in India, 35.12% in Indonesia, etc. These are not small numbers…
Comment linking /mobile-malware-evolution-2019/96280/
on “Epic, Spotify, and Tinder form advocacy group to push for app store changes”Submitted DarkPulsar as a story · 170 points
HN discussionOkay, that was interesting reading. Now I actually know what Stuxnet did and how it worked. The un-named nls_933w.dll responsible for modifying firmware on "over a dozen" HDDs is only termed as Stuxnet- like however: https://securelist.com/equation-the-death-star-of-malware-ga... That's remarkably impressive though. HDDs aren't impenetrable walls - http://spritesmods.com/?art=hddhack - but reflashing firmware on ove…
Comment linking /equation-the-death-star-of-malware-galaxy/68750/
on “Ask HN: What is your favorite CS paper?”Submitted The Mystery of the Encrypted Gauss Payload as a story · 157 points
HN discussionThe IME, like Computrace which is similarly awful[1], is intended to be used for enterprise management. It's nice for someone in IT to be able to remotely wipe a company laptop that was left in an airport, but there's absolutely no reason why consumer devices should be burdened with these backdoors. AMD has something called the PSP which essentially serves the same purposes of the IME which is also undocumented and…
Comment linking /absolute-computrace-revisited/58278/
on “Disabling the Intel Management Engine”Submitted Duqu 2.0 Hits Kaspersky Lab as a story · 149 points
HN discussionKaspersky detected more than 1.1 million malicious APKs for android in 2024 [^1] As per Apple, they rejected 2 million app submissions in 2024 [^2] So from a birds eye perspective there doesn't appear to be much difference, with iOS even taking the lead, but the key difference is that Kaspersky is not Google, and can only detect malicious software after it has been published. Apple has rejected app submissions over…
Comment linking /mobile-threat-report-2024/115494/
on “Proton joins suit against Apple for practices that harm developers and consumers”Submitted Researchers Connect Flame to Stuxnet as a story · 148 points
HN discussionThe link is included in the article ("Kaspersky’s full description is below, from its <link>quarterly APT report</link> released today.") The linked article's url is https://securelist.com/apt-trends-report-q1-2021/101967/ , which is from a site called "SECURELIST by Kaspersky".
Comment linking /apt-trends-report-q1-2021/101967/
on “Kaspersky believes it found new CIA malware”Submitted RansomEXX Trojan attacks Linux systems as a story · 146 points
HN discussionThis made me laugh: "Upon execution, it decrypts (using a custom algorithm derived from GTA IV hashing) its configuration [...]" From https://securelist.com/triangulation-validators-modules/1108...
Comment linking /triangulation-validators-modules/110847/
on “Operation Triangulation: What you get when attack iPhones of researchers”Submitted MoonBounce: The dark side of UEFI firmware as a story · 139 points
HN discussion
