Top all-time · #1562
The Hacker Blog
Personal blog · thehackerblog.comsecurity
The Hacker Blog is a personal blog at thehackerblog.com about security. Since 2013, 48 different Hacker News readers have linked it 77 times, most often “Taking control of all .io domains with a targeted registration”. The last post was in 2022, but the archive is still widely read.
A Hacker's Blog of Unintended Use and Insomnia.
Most-linked posts?
- Taking control of all .io domains with a targeted registration5 people · 8 mentions · first linked 2017-07-10
- /i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/4 people · 6 mentions · first linked 2018-05-18
- Gaining control of a .int TLD4 people · 5 mentions · first linked 2016-07-11
- /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/index.html4 people · 5 mentions · first linked 2017-08-03
- Sonar.js – A Framework for Scanning and Exploiting Internal Hosts with a Webpage2 people · 3 mentions · first linked 2016-08-26
- Compromising Angular via expired NPM publisher email domains2 people · 3 mentions · first linked 2022-02-11
- The Journey to Hijacking a Country’s TLD – The Hidden Risks of Domain Extensions2 people · 2 mentions · first linked 2017-06-05
- Obtaining Arbitrary Wildcard SSL Certs from Comodo via Dangling Markup Injection2 people · 2 mentions · first linked 2016-07-25
- Live view of orphaned domains pointed to release AWS IPs2 people · 2 mentions · first linked 2015-10-08
- Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection2 people · 2 mentions · first linked 2016-07-26
What Hacker News says?
Here is the obligatory post about how bad .io treated security less than 1 year back [1]. Someone was able to take over the whole .io zone just by registering a few domains. 1: https://thehackerblog.com/the-io-error-taking-control-of-all...
Comment linking /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/index.html
on “How a domain registrar can kill your business”Submitted Taking control of all .io domains with a targeted registration as a story · 1404 points
HN discussionFor those who host their own email (read: use your own domain for incoming), I'd like to remind/raise awareness about using `.io` which had two pretty serious security incidents recently (<3 years). Last incident: https://thehackerblog.com/the-io-error-taking-control-of-all...
Comment linking /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/index.html
on “Bye, Bye, Google”Submitted Taking Over DigitalOcean Domains via a Lax Domain Import System as a story · 385 points
HN discussionFrom the researcher who found it: we were able to compile a list of strategic defense-in-depth recommendations for Signal Desktop which we’ve sent to the Signal security team per their request. At the end of the day there will always be new “hot” vulnerabilities, but the “vendor” response is generally what separates the wheat from the chaff. The Signal team’s quick patch time along with a strong interest in mitigati…
Comment linking /i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/
on “Another flaw in Signal desktop app leaks chats in plaintext”Submitted The NoScript Misnomer as a story · 275 points
HN discussionI never understood why ccTLDs of some third-world countries became popular for hosting production code. There is a real risk of somebody stealing your domain due to vulnerable infrastructure and incompetence at the organizations that sometimes employ less than 10 people. The notable takeover of the .io ccTLD by Matthew Bryant [1] should have been a wakeup call for everybody. 1: https://thehackerblog.com/the-io-error…
Comment linking /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/index.html
on “.IO domain name reliability issues and how we’re working around them”Submitted Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection as a story · 258 points
HN discussion> While I agree that NoScript helps, it doesn't prevent everything either: https://thehackerblog.com/the-noscript-misnomer-why-should-i... . This is just a default whitelist that's trivial to remove. Yes, it's dumb, but it doesn't completely compromise NoScript if you're aware of the whitelist.
Comment linking /the-noscript-misnomer-why-should-i..
on “Firefox 41 will use less memory when running AdBlock Plus”Submitted Compromising Angular via expired NPM publisher email domains as a story · 194 points
HN discussionNo disagreement on Ghostery; that got uninstalled real fast when I figured out what they were really up to. While I agree that NoScript helps, it doesn't prevent everything either: https://thehackerblog.com/the-noscript-misnomer-why-should-i... I used to be a big RequestPolicy believer, but single-page apps (which feels like saying "horseless carriages" in mid-2015) make it a lot of work. https://github.com/gorhill/…
Comment linking /the-noscript-misnomer-why-should-i-trust-vjs-zendcdn-net/
on “Firefox 41 will use less memory when running AdBlock Plus”Submitted Every C99.php shell is backdoored as a story · 130 points
HN discussionThe author details how he did it here: http://thehackerblog.com/how-i-got-5000-github-followers-in-...
Comment linking /how-i-got-5000-github-followers-in-less-than-24-hours/
on “GitHub's Explore Email”Submitted The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability as a story · 117 points
HN discussionI completely understand the difficulty, but so far I haven't heard of whether or not Signal is even working on getting rid of phone numbers. Also worth mentioning that Matrix isn't just working on encrypting contacts databases. They are also working on decentralization, which is a much more difficult problem. So I'm not surprised that they are running into issues every once and a while (though Signal has had securit…
Comment linking /i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/
on “Signal is secure, as proven by hackers”Submitted Taking Over 20K DigitalOcean Domains via a Lax Domain Import System (2016) as a story · 114 points
HN discussionI wonder if they messed up again and let someone register the .io nameservers https://thehackerblog.com/the-io-error-taking-control-of-all...
Comment linking /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/
on “Some .io nameservers are returning wrong results again”Submitted The Journey to Hijacking a Country’s TLD – The Hidden Risks of Domain Extensions as a story · 55 points
HN discussionENS (Ethereum Name Service) [0], Handshake (An experimental peer-to-peer root naming system.) are so far the only valid use-cases and a need for a blockchain. Unless you want a repeat of this [2] or this [3] with .io or someone on the other end changing the domain or address from one to another whenever they want to. [0] https://ens.domains [1] https://handshake.org [2] https://news.ycombinator.com/item?id=21611677…
Comment linking /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/
on “The endless search for a crypto use case”Submitted A More Universal Router Payload – Backdooring the Linksys WRT54G Firmware as a story · 37 points
HN discussionI guess the most backdoor-looking bug I've ever seen (referring of course to Signal Desktop's usage of React's __dangerouslySetInnerHTML to render user-supplied messages in a Node.js privileged context) is below the technical authors paygrade. ( https://thehackerblog.com/i-too-like-to-live-dangerously-acc... ) - CVE-2018-11101
Comment linking /i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/
on “The most backdoor-looking bug I've ever seen (2021)”Submitted Still Not Fixed: Taking over 20K DigitalOcean Domains via Lax Domain System as a story · 8 points
HN discussionThis approach seems to work without DNS rebinding: https://thehackerblog.com/sonar-a-framework-for-scanning-and... Edit: Note that the example does try to do some DNS rebinding on the router, but that's the end goal. The attack itself doesn't rely on rebinding. It does require "already logged on to the router" users, but I suspect an attack using default login credentials is possible as well.
Comment linking /sonar-a-framework-for-scanning-and-exploiting-internal-hosts-with-a-webpage/
on “Mirai Botnet Linked to Dyn DNS DDoS Attacks”Submitted How I Got 5,000 GitHub Followers In Less Than 24 Hours as a story · 8 points
HN discussionJust tested in Windows with a registry file generated via the linked web interface[0]. Dark Reader was not prevented from accessing sites that should have been excluded based on the imported policy, even after a reboot. Has anyone successfully tested Chrome Galvanizer? [0] https://thehackerblog.com/galvanizer/
Comment linking /galvanizer/
on “ChromeGalvanizer – Harden your browser against extension backdoors and exploits”Submitted Accidentally Finding RCE in Signal Desktop via HTML Injection in Quoted Replies as a story · 5 points
HN discussionThey absolutely can. Just one example of how ICAAN regulation helps: ICAAN requires that the .org registry let domain owners lock in their current price for 10 years if a price increase is announced, and prohibits different renewal prices for different domains. ccTLDs can just increase prices with no notice, or price gouge popular domains. And .io is certainly worse than .org will ever be - there have been numerous…
Comment linking /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/index.html
on “News.gmane.org is now news.gmane.io”Submitted Gaining control of a .int TLD as a story · 5 points
HN discussion> You have more control over it, and it is fully accessible from the open web. Do you want this again? [0] [1]. The so-called 'open web' is complete nonsense which technologists at large tech companies have taken control to push on their next grifting and surveillance products. For example, Google Chrome being used as the dominant browser and Google already leading control over web standards, privacy violations and…
Comment linking /the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/
on “Brave Integration Deepens Support for Unstoppable Domains”Submitted Stealing Lastpass Passwords with Clickjacking as a story · 5 points
HN discussion
