Top all-time · #1487
Security
Personal blog · scarybeastsecurity.blogspot.comsecurityprogramming
Security is a personal blog at scarybeastsecurity.blogspot.com about security and programming. Since 2009, 50 different Hacker News readers have linked it 76 times, most often “Recovering “lost” treasure-filled floppy discs with an oscilloscope”. The last post was in 2021, but the archive is still widely read.
Most-linked posts?
- Recovering “lost” treasure-filled floppy discs with an oscilloscope6 people · 7 mentions · first linked 2021-05-17
- Compromising a Linux desktop using 6502 processor opcodes on the NES (2016)5 people · 5 mentions · first linked 2018-01-24
- The cleverest floppy disc protection ever? Western Security Ltd4 people · 4 mentions · first linked 2020-12-14
- Cross-domain privacy vulnerability using CSS, in all browsers3 people · 3 mentions · first linked 2009-12-30
- Ode to the use-after-free: one vulnerable function, a thousand possibilities3 people · 3 mentions · first linked 2017-05-06
- Yahoobleed: access other users' private Yahoo! Mail image attachments2 people · 3 mentions · first linked 2017-05-19
- Are we doing memory corruption mitigations wrong?2 people · 2 mentions · first linked 2017-05-16
- Turning a £400 BBC Micro (1981) into a $40k disc writer (1987)2 people · 2 mentions · first linked 2020-07-10
- Sampled sound 1980s style: from SN76489 square waves to samples2 people · 2 mentions · first linked 2020-06-02
- Risky design decisions in Google Chrome and Fedora enable drive-by downloads2 people · 2 mentions · first linked 2016-11-15
What Hacker News says?
> ...similar devices to _read_ disks at a magnetic level... It's not, though. It's reading the disk after the drive's analog-to-digital converter has had its way with the analog flux transitions coming off the head. There's auto gain control circuits in there, and a pre-amplifier, and finally the ADC. Greaseweazel and its ilk are closer to the flux than just reading the disk in the conventional manner but it isn't a…
Comment linking /2021/05/recovering-lost-treasure-filled-floppy.html
on “The Space Quest II Master Disk Blunder”Submitted Compromising a Linux desktop using 6502 opcodes on the NES as a story · 355 points
HN discussionThere is no angle position sensor on the CD, and only one continuous track. This could work if you burned multisession CD, scratched at some specific radius of the first session, followed by coding that information into executable burned in the second session. https://scarybeastsecurity.blogspot.com/2020/06/weak-bits-fl... http://dmweb.free.fr/?q=node/210 http://dmweb.free.fr/?q=node/1429 https://scarybeastsecurity.…
Comment linking /2020/12/the-cleverest-floppy-disc-protection.html
on “Full key extraction of Nvidia TSEC”Submitted The cleverest floppy disc protection ever? Western Security Ltd as a story · 339 points
HN discussion>By default, there are no services listening. Desktop linux , not "the Linux kernel". The kernel isn't amazing, but on the desktop side you regularly see downright absurd stuff like this https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit... and less surprising bugs like this https://donncha.is/2016/12/compromising-ubuntu-desktop/ The quality of software outside of some widely deployed server software tends…
Comment linking /2016/11/0day-exploit-compromising-linux-desktop.html
on “Kaspersky AV injected unique ID allowing sites to track users in incognito mode”Submitted Recovering “lost” treasure-filled floppy discs with an oscilloscope as a story · 306 points
HN discussionComplete AI is no the hardest problem in CS, parsing text is. Joking aside this reminded me of that CSS vulnerability that allowed attackers to read peoples mails: http://scarybeastsecurity.blogspot.com/2009/12/generic-cross...
Comment linking /2009/12/generic-cross-browser-cross-domain.html
on “Show HN: Big List of Naughty Strings for testing user-input data”Submitted Clocking a 6502 simulator to 15GHz as a story · 176 points
HN discussionSomeone posted this[0] recently about recovering old data from damaged floppies using oscilloscope. [0] https://scarybeastsecurity.blogspot.com/2021/05/recovering-l...
Comment linking /2021/05/recovering-lost-treasure-filled-floppy.html
on “Programmer's Resignation from 1985”Submitted Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA as a story · 169 points
HN discussionAddendum: Anyone remember GStreamer being a Linux vulnerability because it had a 6502 CPU emulator to run... NES music files, and hackers managed to jump outside of the VM. https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit... It makes me wonder how easy it is to break out of a particular anti-virus vendor's VM, in a vulnerability that wouldn't exist if you weren't even running AV (outside Defender) at all.
Comment linking /2016/11/0day-exploit-compromising-linux-desktop.html
on “7-Zip: Multiple Memory Corruptions via RAR and ZIP”Submitted Further hardening glibc malloc() against single byte overflows as a story · 131 points
HN discussionBoth Michal Zalewski[1] and Chris Evans[2] have commented on this, and I tend to agree with them. The actual implications for a CSRF like this are very minimal. [1] https://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not... [2] http://scarybeastsecurity.blogspot.com/2010/01/logout-xsrf-s...
Comment linking /2010/01/logout-xsrf-significant-web-app-bug.html
on “Hacker News CSRF Vulnerability”Submitted Reverse engineering a forgotten 1970s Intel dual core beast: 8271 (2020) as a story · 115 points
HN discussionThis is why you have never seen FTPS in the wild, from the vsftpd.conf manual page: ssl_enable If enabled, and vsftpd was compiled against OpenSSL, vsftpd will support secure connections via SSL. This applies to the control connection (including login) and also data connections. You'll need a client with SSL support too. NOTE!! Beware enabling this option. Only enable it if you need it. vsftpd can make no guar‐ ante…
Comment linking /2015/07/vsftpd-303-released-and-horrors-of-ftp.html
on “Alpaca Attack”Submitted A wild bug: 1970s Intel 8271 disc chip ate my data as a story · 97 points
HN discussionVU#804060 is talking about "cookie forcing". This is not a new discovery. Here's Chris Evans (not the actor) talking about it in 2008: http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcin... The best solution is to preload HSTS on a domain and include all subdomains, and we've been saying that for years. That prevents any HTTP connections, although it's obviously not an easy solution in many cases. The USENI…
Comment linking /2008/11/cookie-forcing.html
on “Cookies Lack Integrity: Real-World Implications”Submitted Dumping Yahoo authentication secrets with an out-of-bounds read as a story · 91 points
HN discussionI asked that question myself before[1], and others, too [2]. But the answer is a clear no. Read this explanation [3] on oss-security where someone lays out in detail in which ways ASAN creates security problems. It ultimately is just not built as a protection mechansim, but as a debugging tool. While you'd catch some bugs (UAFs, Buffer overreads), you introduce others. Maybe there could be a "like asan but designed…
Comment linking /2014/09/using-asan-as-protection.html
on “Millions of Binaries Later: A Look into Linux Hardening in the Wild”Submitted I got accidental code execution via glibc? as a story · 89 points
HN discussionThanks, that led me to http://scarybeastsecurity.blogspot.com/2009/12/generic-cross... .
Comment linking /2009/12/generic-cross-browser-cross-domain.html
on “32 Javascript Alternatives with Pure CSS – Updated”Submitted Weak bits floppy disc protection: an alternate origins story on 8-bit as a story · 65 points
HN discussionThis is YB (Yahoobleed) #2. You might also enjoy YB #1: "*bleed continues: 18 byte file, $14k bounty, for leaking private Yahoo! Mail images": https://scarybeastsecurity.blogspot.com/2017/05/bleed-contin...
Comment linking /2017/05/bleed-continues-18-byte-file-14k-bounty.html
on “Dumping Yahoo authentication secrets with an out-of-bounds read”Submitted Ode to the use-after-free: one vulnerable function, a thousand possibilities as a story · 65 points
HN discussionTo be fair, the Atari 2600 supports sprite multiplexing.[0] And you can drive a BBC Micro's floppy drive from its screen output lines…[1] [0]: https://en.wikipedia.org/wiki/Sprite_multiplexing [1]: https://scarybeastsecurity.blogspot.com/2020/07/turning-400-...
Comment linking /2020/07/turning-400-bbc-micro-1981-into-40000.html
on “The Atari 2600 Webserver”Submitted Backdoor in vsftpd download as a story · 44 points
HN discussionI wouldn't be so complacent, I'm reminded of this vulnerability: https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit...
Comment linking /2016/11/0day-exploit-compromising-linux-desktop.html
on “HiddenWasp Malware Stings Targeted Linux Systems”Submitted Advancing exploitation: a scriptless 0day exploit against Linux desktops as a story · 40 points
HN discussionYou can try with advanced techniques: https://scarybeastsecurity.blogspot.com/2021/05/recovering-l...
Comment linking /2021/05/recovering-lost-treasure-filled-floppy.html
on “Ask HN: What's the oldest file on your computer?”Submitted Cross-domain privacy vulnerability using CSS, in all browsers as a story · 40 points
HN discussion
