Top all-time · #1410
Synacktiv
Company blog · synacktiv.com/postssecurity
Synacktiv is the company blog at synacktiv.com, writing about security. Since 2014, 49 different Hacker News readers have linked it 64 times, most often “Exploring GrapheneOS secure allocator: Hardened Malloc”. It has a working feed you can follow.
Too few sampled comments (20) to say how often HN recommends it.?
Why HN links it
HN readers link Synacktiv's security research posts on exploits and reverse engineering of devices such as DJI and Sonos, plus vulnerabilities in iOS, GitHub Actions and PHP. Most comments cite them as sources.
Summarised by Claude from a sample of 20 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Synacktiv - IT Security expertise - Penetration tests, Security audits, Code review, Training, Consulting, Vulnerability research
Most-linked posts?
- Exploring GrapheneOS secure allocator: Hardened Malloc4 people · 4 mentions · first linked 2025-09-22
- iOS 18.4 – dlsym considered harmful4 people · 4 mentions · first linked 2025-04-15
- Return of the iOS sandbox escape: lightspeed's back in the race3 people · 4 mentions · first linked 2020-05-29
- MacOS: How to Gain Root with CVE-2018-4193 in [pdf]2 people · 2 mentions · first linked 2019-02-20
- Using your BMC as a DMA device: plugging PCILeech to HPE iLO 42 people · 2 mentions · first linked 2019-01-05
- /sites/default/files/2023-10/synacktiv-danfoss-sm800-sc255-sc355-auth-bypass.pdf2 people · 2 mentions · first linked 2026-10-13
- eBPF Rootkit2 people · 2 mentions · first linked 2025-11-22
- /en/publications/github-actions-exploitation-dependabot2 people · 2 mentions · first linked 2025-06-06
What Hacker News says?
More recent example of Apple "undoing" patches: https://www.synacktiv.com/posts/exploit/return-of-the-ios-sa...
Comment linking /posts/exploit/return-of-the-ios-sandbox-escape-lightspeeds-back-in-the-race.html
on “Zero-day in Sign in with Apple”Submitted Defend against vampires with 10 gbps network encryption as a story · 270 points
HN discussionThis sounds like someone (or someone's AI agent) saw the CVE and did a one-off drive-by attack instead of systematically targeting refrigreration systems and trying to find vulnerabilities. The article is dated August 2026. Synacktiv (a different company) reported the very same vulnerability for older system managers/controllers already in 2023. Their report[1] says Danfoss told the products are EOL and should be up…
Comment linking /sites/default/files/2023-10/synacktiv-danfoss-sm800-sc255-sc355-auth-bypass.pdf
on “Hackers activate automatic defrosting in supermarket fridges across Europe”Submitted Exploring GrapheneOS secure allocator: Hardened Malloc as a story · 106 points
HN discussionBut then you could compromise the GPU, probably :) Look at the bootloader, can you open a console? If not, can you desolder the flash and read the key? If not, can you access the bootloader when the flash is not detected anymore? ... Can you solder off the capacitors and glitch the power line, to do a [Voltage Fault Injection]( https://www.synacktiv.com/en/publications/how-to-voltage-fau... )? Can you solder a shunt…
Comment linking /en/publications/how-to-voltage-fault-injection
on “Extracting AI models from mobile apps”Submitted The iOS bug that made deleted photos reappear as a story · 67 points
HN discussionGrapheneOS provides massive security improvements over Android. You should read https://grapheneos.org/features#exploit-protection for an overview. Cellebrite quite clearly puts substantial effort into targeting GrapheneOS, much more than they do into targeting variants of Google Mobile Services Android across devices. Cellebrite provides much more detailed information and comparisons for GrapheneOS than any other v…
Comment linking /en/publications/exploring-grapheneos-secure-allocator-hardened-malloc
on “Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking”Submitted Exploiting a No-Name FreeBSD Kernel Vulnerability as a story · 37 points
HN discussionFor those looking for more info: https://blog.grimm-co.com/2020/07/dji-privacy-analysis-valid... https://www.synacktiv.com/en/publications/dji-pilot-android-... https://www.nytimes.com/2020/07/23/us/politics/dji-drones-se...
Comment linking /en/publications/dji-pilot-android-application-security-analysis-1
on “DJI ban passes the House and moves on to the Senate”Submitted Another TCP/32764 backdoor [pdf] as a story · 33 points
HN discussionSynacktiv | System engineer, Pentester, Reverser and more | Paris, Toulouse, Lyon - France | ONSITE or REMOTE | https://www.synacktiv.com/en/ Synacktiv is an IT security company, founded in 2012 by consultants with more than 13 years of experience in security consulting and auditing, with a real passion for IT security. We are actually looking for growing our technical teams (system engineer, pentester, reverser) an…
Comment linking /en/
on “Ask HN: Who is hiring? (April 2019)”Submitted Exploring GrapheneOS secure allocator: Hardened Malloc as a story · 9 points
HN discussionTL;DR background for this one: there existed a zero day bug in iOS 11 related to how the kernel processed the lio_listio call. Apple fixed it then but introduced a memory leak. In iOS 13 Apple fixed the memory leak but reintroduced the vulnerability. The regression was found and packaged in a obfuscated jailbreaking tool (unc0ver); this post explains how the tool was deobfuscated. This resulted in an "emergency" iOS…
Comment linking /posts/exploit/the-fix-for-cve-2020-9859-and-the-lightspeed-vulnerability.html
on “How to unc0ver a 0-day in 4 hours or less”Submitted iOS 18.4 – dlsym considered harmful as a story · 5 points
HN discussion> The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", And it's _even worse_ than that. A famous french cybersecurity firm, Synacktiv, published a report in 2023 (!) about the code-of-the-day vulnerability, but it made less noise apparently [1] [1] https://www.synacktiv.com/sites/default/files/2023-10/synack...
Comment linking /sites/default/files/2023-10/synacktiv-danfoss-sm800-sc255-sc355-auth-bypass.pdf
on “France's supermarket fridges were vulnerable online for months”Submitted The iOS Bug That Made Deleted Photos Reappear as a story · 5 points
HN discussionTwo related links previously on HN (no comments): Introducing the Memory Process File System for PCILeech http://blog.frizk.net/2018/03/memory-process-file-system.htm... Using your BMC as a DMA device: Plugging PCILeech to HPE ILO 4 https://www.synacktiv.com/posts/exploit/using-your-bmc-as-a-...
Comment linking /posts/exploit/using-your-bmc-as-a-dma-device-plugging-pcileech-to-hpe-ilo-4.html
on “PCILeech”Submitted Let Me Cook You a Vulnerability: Exploiting the Thermomix TM5 as a story · 4 points
HN discussionI think this might be the fastest patch of a security issue affecting Apple's operating systems, ever. Aside from *.0.1 releases that fixed critical bugs with core features in new OSes, has anything been patched this fast? (I'm also obligated to post that the bug that this fixes is not new; it was discovered back in iOS 11, fixed, and Apple reopened it in an iOS 13 update: https://www.synacktiv.com/posts/exploit/ret…
Comment linking /posts/exploit/return-of-the-ios-sandbox-escape-lightspeeds-back-in-the-race.html
on “Apple patches CVE-2020-9859 (unc0ver)”Submitted Return of the iOS sandbox escape: lightspeed's back in the race as a story · 4 points
HN discussionThere are some kinds of heap isolation worth doing, eg some mentioned in https://www.synacktiv.com/sites/default/files/2022-10/attack... . But the good ones rely on PAC (pointer signing), which comes from CHERI and x86 doesn't have it.
Comment linking /sites/default/files/2022-10/attacking_safari_in_2022_slides.pdf
on “How to talk to your parents about hardware memory safety”Submitted Exploring GrapheneOS secure allocator: Hardened Malloc as a story · 3 points
HN discussionFixed link: https://www.synacktiv.com/en/publications/github-actions-exp...
Comment linking /en/publications/github-actions-exploitation-dependabot
on “Weaponizing Dependabot: Pwn Request at its finest”Submitted iOS: A journey in the USB networking stack as a story · 3 points
HN discussionThe folks at Synaktiv had a nice detailed blog post on this same vector last year[1]. The bottom line with these kinds of things is that virtually nobody should be using `pull_request_target`, even with “trusted” machine actors like Dependabot. It’s a pretty terrible footgun. [1]: https://www.synacktiv.com/en/publications/github-actions-exp...
Comment linking /en/publications/github-actions-exploitation-dependabot
on “Weaponizing Dependabot: Pwn Request at its finest”Submitted MacOS: How to Gain Root with CVE-2018-4193 in [pdf] as a story · 3 points
HN discussionChristmas CTF https://twitter.com/sudosev/status/1075213434273320960 https://pastebin.com/raw/7VL6usg6 https://pastebin.com/raw/Sm9PCxWv https://twitter.com/sudosev/status/1079069504498556930 HACKvent 2018 https://hackvent.hacking-lab.com SANS Holiday Hack Challenge 2018 https://www.holidayhackchallenge.com/2018 GreHack 2018 https://2018.challenge.grehack.fr writeup https://www.synacktiv.com/posts/challenges/grehack…
Comment linking /posts/challenges/grehack-2018-qualification-challenge.html
on “Ask HN: Anyone Interested in Capture the Flag (CTF) Events?”Submitted Using your BMC as a DMA device: plugging PCILeech to HPE iLO 4 as a story · 3 points
HN discussionSome encodings add a prefix, which then get sanitised by the liberal base64_decode. https://www.synacktiv.com/en/publications/php-filters-chain-...
Comment linking /en/publications/php-filters-chain-what-is-it-and-how-to-use-it
on “Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine”Submitted LightSpeed, a race for an iOS/MacOS sandbox escape as a story · 3 points
HN discussion
