Top all-time · #1584
SRLabs
Company blog · srlabs.de/blogsecurityai
SRLabs is the company blog at srlabs.de, writing about security and ai. Since 2011, 44 different Hacker News readers have linked it 74 times, most often “Rooting SIM cards”. It is still writing: the last post was on 2026-08-04, and you can follow it by feed.
Rarely recommended · 3 of 37 sampled comments recommend it?
Why HN links it
Security research firm whose blog posts on SIM card, GSM, SS7, BadUSB and payment-terminal attacks are linked as primary sources. Its job ads also recur in HN hiring threads.
Summarised by Claude from a sample of 37 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A security research and consulting firm in Berlin, working since 2010. We test what the industry takes on trust: mobile networks, firmware, chain runtimes, AI deployments and the enterprise around them.
Most-linked posts?
- Rooting SIM cards4 people · 4 mentions · first linked 2013-07-21
- Outdated payment protocols expose customers and merchants3 people · 4 mentions · first linked 2015-12-27
- Turning USB peripherals into BadUSB3 people · 3 mentions · first linked 2014-07-31
- Bogusbazaar: A Criminal Network of Webshop Fraudsters3 people · 3 mentions · first linked 2024-05-08
- RCS technology exposes most mobile users to hacking (2019)3 people · 3 mentions · first linked 2019-11-29
- Turning USB peripherals into BadUSB2 people · 2 mentions · first linked 2014-08-02
- Cryptographic problems are reduced to their true hardness by SAT solver2 people · 2 mentions · first linked 2015-05-02
- Decrypting GSM phone calls2 people · 2 mentions · first linked 2013-12-14
- EDRs decrease your enterprise security, unless properly hardened2 people · 2 mentions · first linked 2022-08-24
- BadUSB – On accessories that turn evil [pdf]2 people · 2 mentions · first linked 2014-08-11
What Hacker News says?
Not really updated, but new applications can be remotely installed and then interact with the baseband and (to a limited extent) the smartphone OS. It‘s not "any entity", though – the provider’s keys are needed to do this, and they can already do much of that tracking using other, network-side means. If the signing keys are compromised, though, bad things can happen: https://www.srlabs.de/bites/rooting-sim-cards
Comment linking /bites/rooting-sim-cards
on “What is AT&T doing at 1111340002?”Submitted New SIM attacks de-mystified, protection tools now available as a story · 190 points
HN discussionI would also suggest watching Karsten Nohl/SRLabs security research into JavaCard and the "state of the SIM" from the Observe Make Hack 2013 camping conference, which is available at: https://archive.org/details/D4T204201301031400SimCardExploit... and his article at https://srlabs.de/rooting-sim-cards/
Comment linking /rooting-sim-cards/
on “The second operating system hiding in every mobile phone”Submitted Alexa and Google Home expose users to vishing and eavesdropping as a story · 178 points
HN discussionSRLabs | Security Engineer | Berlin, DE | Full Time Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities. Here are a few things that you will be doing: - Review systems to secure digital assets (e.g. cryptocurrency) from attackers - Analyze and present results to team member and clients - Work c…
Comment linking /blog
on “Ask HN: Who is hiring? (May 2024)”Submitted BadUSB – On accessories that turn evil [pdf] as a story · 84 points
HN discussionSRLabs | Security Research Month | Malaysia and Indonesia | February 10th - March 9th 2019 | On-site Join us for one month of hacking research in Malaysia and Indonesia! Every year, we ( https://srlabs.de ) escape the cold Berlin winter for a "Hackerurlaub" (hacker vacation). For the third year already now, we are inviting fellow hackers to join us. Flights, villa, fun and mentorship are all included. During the mon…
Comment linking /
on “Ask HN: Who is hiring? (November 2018)”Submitted Hexagon fuzz: Full-system emulated fuzzing of Qualcomm basebands as a story · 81 points
HN discussionSRLabs | Security Engineer | Berlin, DE | Full Time Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities. Here are a few things that you will be doing: - Review systems to secure digital assets (e.g. cryptocurrency) from attackers - Analyze and present results to team member and clients - Work c…
Comment linking /blog
on “Ask HN: Who is hiring? (September 2024)”Submitted Rooting SIM cards as a story · 64 points
HN discussionSRLabs | Security Engineer | Berlin, DE | Full Time Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities. Here are a few things that you will be doing: - Review systems to secure digital assets (e.g. cryptocurrency) from attackers - Analyze and present results to team member and clients - Work c…
Comment linking /blog
on “Ask HN: Who is hiring? (April 2024)”Submitted Outdated payment protocols expose customers and merchants as a story · 35 points
HN discussionSRLabs | Security Engineer | Berlin, DE | Full Time Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities. Here are a few things that you will be doing: - Review systems to secure digital assets (e.g. cryptocurrency) from attackers - Analyze and present results to team member and clients - Work c…
Comment linking /blog
on “Ask HN: Who is hiring? (October 2024)”Submitted Turning USB peripherals into BadUSB as a story · 7 points
HN discussionAll mobile computing and connectivity hardware is unverifiable in reality and by design. It's not some property exclusive to Google Pixels. Their business model also does not involve selling data afaik, it's selling access to their adspaces [1] all over the internet including the ability to target people (based on information Google jealously hoard). They stand to lose just as much as most other OEMs if they did sus…
Comment linking /blog/android-patch-gap-2020
on “LineageOS 23”Submitted Incorrectly patched ZyXEL vulnerability becomes zero-day again as a story · 4 points
HN discussionReally, none of this is surprising or new. If you're bored/curious, here's some fun reading on exploring/exploiting telecom networks. Spoiler alert: it's really easy and it has been forever. Big ups to Philippe Langlois for all his great research over the years. Interview: Telecom Security Expert Philippe Langlois on GCHQ Spying ( http://www.spiegel.de/international/europe/interview-telecom... ) Vulnerabilities and…
Comment linking /gsmmap/
on “German researchers discover flaw that could let anyone listen to cell calls”Submitted AI-generated code, AI-generated findings, and the verification bottleneck as a story · 3 points
HN discussionSRLabs | Security Engineer | Berlin, DE | Full Time Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities. Here are a few things that you will be doing: - Review systems to secure digital assets (e.g. cryptocurrency) from attackers - Analyze and present results to team member and clients - Work c…
Comment linking /bites
on “Ask HN: Who is hiring? (October 2022)”Submitted Fuzzing go binaries using LibAFL as a story · 3 points
HN discussionSRLabs | Security Engineer | Berlin, DE | Full Time Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities. Here are a few things that you will be doing: - Review systems to secure digital assets (e.g. cryptocurrency) from attackers - Analyze and present results to team member and clients - Work c…
Comment linking /bites
on “Ask HN: Who is hiring? (November 2022)”Submitted Certiception – the ADCS honeypot we always wanted as a story · 3 points
HN discussionPlugging things in your USB port has been known as a dangerous activity for quite some time.[1,2] It's surprising that someone at Elsevier thought it would be a good idea to use these techniques though. [1] https://srlabs.de/badusb [2] https://media.blackhat.com/bh-dc-11/Larimer/BlackHat_DC_2011...
Comment linking /badusb
on “Elsevier, that just freaked me out”Submitted Bogusbazaar: A Criminal Network of Webshop Fraudsters as a story · 3 points
HN discussionWe've read here recently, re: Snowden in Hong Kong, (rooted?) phones and ($5?) SIMs are inexpensive and popular in HK. Are there varieties of --I don't know, what-- `rooted(?)', `unformatted(?)' SIMs that become desirable to a knowledgeable hacker community, beyond what consumers get with their service? edit: I just now found on HN front page: https://srlabs.de/rooting-sim-cards/
Comment linking /rooting-sim-cards/
on “SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones”Submitted Decrypting GSM phone calls as a story · 3 points
HN discussionThis appears to be confirmed - from https://srlabs.de/rooting-sim-cards/ : A rainbow table resolves this plaintext-signature tuple to a 56-bit DES key within two minutes on a standard computer. The cracked DES key enables an attacker to send properly signed binary SMS, which download Java applets onto the SIM. It's particularly sad that the same key is used for the MAC in both directions (network-to-SIM and SIM-to-n…
Comment linking /rooting-sim-cards/
on “SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones”Submitted Decrypting GSM phone calls as a story · 3 points
HN discussioncbmc: http://www.cprover.org/cbmc/applications.shtml cmbc is easiest to install, they even have binaries. easy samples also in the manual: http://www.cprover.org/cprover-manual/modeling-assertions.sh... klee: https://klee.github.io/tutorials/ pretty hard to install coq: https://coq.inria.fr/a-short-introduction-to-coq the real beast out there. easy to install. but hardly usable for normal hackers, because of their m…
Comment linking /minisat-intro/
on “Reversing the Petya ransomware with constraint solvers”Submitted OpenVPN 2.7 security audit: 18 findings, one critical bug as a story · 2 points
HN discussion
