Top all-time · #1037
Simone Margaritelli
Personal blog · evilsocket.netsecurityprogramming
Simone Margaritelli writes evilsocket, a personal blog at evilsocket.net about security and programming. Since 2014, 64 different Hacker News readers have linked it 90 times, most often “Attacking UNIX Systems via CUPS”. It is still writing: the last post was on 2026-04-01, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
Security and reverse-engineering posts by evilsocket, linked for CUPS vulnerability details, UAE activist spyware, GSM base station builds, and reversing Android apps.
- Recommended for · 1 comments
- A guide on reversing Android, which one commenter says they liked.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Hi! This is the security research blog of Simone Margaritelli, an Italian cybersecurity researcher and open-source developer. I build penetration testing tools…
Most-linked posts?
- Attacking UNIX Systems via CUPS7 people · 7 mentions · first linked 2024-09-26
- Reverse Engineering Apple’s Multipeer Connectivity Framework6 people · 6 mentions · first linked 2022-10-20
- Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.06 people · 6 mentions · first linked 2019-10-19
- How to Build Your Own Rogue GSM BTS for Fun and Profit4 people · 4 mentions · first linked 2016-04-01
- How to Build Your Own Rogue GSM BTS for Fun and Profit4 people · 4 mentions · first linked 2016-03-31
- How UAE Intelligence Tried to Hire Me to Spy on Its People (2016)3 people · 4 mentions · first linked 2016-07-28
- How to Create a Malware Detection System with Machine Learning2 people · 2 mentions · first linked 2019-05-23
- Pwning WPA/WPA2 Networks with Bettercap and the PMKID Client-Less Attack2 people · 2 mentions · first linked 2019-02-14
- OS X Mass Pwning Using BetterCap and the Sparkle Updater Vulnerability2 people · 2 mentions · first linked 2016-01-30
- Process behaviour anomaly detection using eBPF and unsupervised learning2 people · 2 mentions · first linked 2022-08-15
What Hacker News says?
The UAE really hates on activists, and appears to be hiring a bunch of people specifically to suppress activists/dissidents within the country. [1] Unfortunately, due to the amount of wealth the country has, it won't stop almost anybody from dealing with them unless Western sanctions are placed on the country, which are unlikely given the current geopolitical situation. https://www.evilsocket.net/2016/07/27/How-The-…
Comment linking /2016/07/27/How-The-United-Arab-Emirates-Intelligence-Tried-to-Hire-me-to-Spy-on-its-People/
on “NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender”Submitted Attacking UNIX Systems via CUPS as a story · 438 points
HN discussionI liked this guide on reversing Android. https://www.evilsocket.net/2017/04/27/Android-Applications-R... CharlesProxy is a must-have whether you're a dev or reverse-engineering. JADX is the best for reversing Android because it produces readable Android code which is fantastic for current Android developers who expect things to be organized like Android Studio.
Comment linking /2017/04/27/Android-Applications-Reversing-101/
on “Reverse-engineering the Starbucks ordering API”Submitted TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy as a story · 340 points
HN discussionThose are definitely already a thing, unfortunately. https://hackaday.com/tag/cell-site-simulator/ https://www.evilsocket.net/2016/03/31/how-to-build-your-own-...
Comment linking /2016/03/31/how-to-build-your-own-rogue-gsm-bts-for-fun-and-profit/
on “LTE Base Station Software”Submitted Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0 as a story · 336 points
HN discussionNo. For that, you'll want [0] (on HN a few days ago). This is mostly for making it easier to run your own legitimate GSM network, and of course the software has been available for a long time, it's just now available via the Debian repositories. [0]: https://www.evilsocket.net/2016/03/31/how-to-build-your-own-...
Comment linking /2016/03/31/how-to-build-your-own-rogue-gsm-bts-for-fun-and-profit/
on “You can now install a GSM network using apt-get”Submitted How to Build Your Own Rogue GSM BTS for Fun and Profit as a story · 262 points
HN discussionReminds of the ordeal of Simone. https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Em...
Comment linking /2016/07/27/How-The-United-Arab-Emirates-Intelligence-Tried-to-Hire-me-to-Spy-on-its-People/
on “Former NSA Hacker Describes Being Recruited for UAE Spy Program”Submitted Nike+ FuelBand SE BLE Protocol Reversed as a story · 185 points
HN discussionArticle looks a lot like this: https://evilsocket.net/2016/03/31/how-to-build-your-own-rogu...
Comment linking /2016/03/31/how-to-build-your-own-rogue-gsm-bts-for-fun-and-profit/
on “Building a GSM BTS Using the BladeRF, RPi and YateBTS”Submitted Living Only on Bitcoins as a story · 182 points
HN discussion> So, I really think we need to start shipping some kind of client side firewall with a good UX by default (something like little snitch?). This is not a solution but makes it worse. Adding more vulnerable code widens the attack surface. The history of so called security software (aka snakeoil) has shown that it doesn’t protects but causes more harm. A Linux system shall show with “# ss -lpn” [1] only ports and proc…
Comment linking /2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
on “You're probably not vulnerable to the CUPS CVE”Submitted How the United Arab Emirates Intelligence Tried to Hire Me to Spy on Its People as a story · 152 points
HN discussionA blog post dropped: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems...
Comment linking /2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
on “A 9.9 CVE has been announced for Linux”Submitted How I defeated an anti-tamper APK with some Python and a homemade Smali emulator as a story · 147 points
HN discussionAttacking UNIX Systems via CUPS, Part I, 2024-09-26 (linked at end of page) https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems...
Comment linking /2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
on “Cups Remote Code Execution Vulnerability Fix Available”Submitted Process behaviour anomaly detection using eBPF and unsupervised learning as a story · 119 points
HN discussionOriginal writeup from the creator: https://www.evilsocket.net/2019/10/19/Weaponizing-and-Gamify...
Comment linking /2019/10/19/Weaponizing-and-Gamifying-AI-for-WiFi-Hacking-Presenting-Pwnagotchi-1-0-0/
on “'Pwnagotchi' Is the Open Source Handheld That Eats Wi-Fi Handshakes”Submitted Autopwn every Android device on your network using BetterCap as a story · 106 points
HN discussion>, the title is incorrect. Differing philosophies of how to interpret titles. Prescriptive vs Descriptive language.[0] There can be different usages of "Unix": #1: Unix is a UNIX(tm) System V descendent. In this strict definition, you get the common reminder that "Linux is not a Unix!" #2: "Unix" as a loose generic term for a family of o/s that looks/feels like Unix. Sometimes deliberately styled as asterisk "*nix"…
Comment linking /2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
on “Things Unix can do atomically”Submitted Using ARM Inline Assembly and Naked Functions to Fool Disassemblers as a story · 26 points
HN discussionThe reporter has now posted details at https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems... Red Hat has also made a statement at https://www.redhat.com/en/blog/red-hat-response-openprinting...
Comment linking /2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
on “Doomsday '9.9 RCE bug' might hit every Linux system”Submitted Hacking a Herb Vaporizer to Set Its Temperature Limit from 190C to 6553.5C as a story · 15 points
HN discussionMore details from the original author: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems...
Comment linking /2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
on “Unauthenticated RCE Flaw with CVSS 9.9 Rating for Linux Systems Affects Cups”Submitted How UAE Intelligence Tried to Hire Me to Spy on Its People (2016) as a story · 15 points
HN discussionhttps://www.evilsocket.net/2019/10/19/Weaponizing-and-Gamify... Blog post
Comment linking /2019/10/19/Weaponizing-and-Gamifying-AI-for-WiFi-Hacking-Presenting-Pwnagotchi-1-0-0/
on “AI WiFi hacking device, that's also a virtual pet”Submitted Reverse Engineering Apple’s Multipeer Connectivity Framework as a story · 9 points
HN discussionI would be very surprised if EDR products didn't use some form of anomaly detection (e.g. autoencoders[1], ANN embeddings etc.) I've gotten into trouble with employers over editing system configuration files and trying to start reverse shells, and I can't imagine execve() or connect()+dup2() are malicious either. [1] https://www.evilsocket.net/2022/08/15/Process-behaviour-anom...
Comment linking /2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/
on “CISA bulletin – PRC state-sponsored cyber actor techniques [pdf]”Submitted How to Build Your Own Rogue GSM BTS for Fun and Profit as a story · 6 points
HN discussion
