Top all-time · #3743
Tinyhack.com
Personal blog · tinyhack.comsecuritysystems
Tinyhack.com is a personal blog at tinyhack.com about security and systems. Since 2014, 19 different Hacker News readers have linked it 21 times, most often “Mastercard Internet Gateway Service: Hashing Design Flaw”. It is still writing: the last post was on 2026-10-07, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link tinyhack.com for hardware and security hacking posts: bootROM exploits on MediaTek phones, cloud-connected appliances, Akira ransomware decryption, and SDR dongle modifications.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Mastercard Internet Gateway Service: Hashing Design Flaw3 people · 3 mentions · first linked 2017-09-05
- Decrypting encrypted files from Akira ransomware using a bunch of GPUs3 people · 3 mentions · first linked 2025-03-14
- Reverse Engineering Pokémon Go Plus2 people · 2 mentions · first linked 2018-11-21
- Implementing a web server in a single printf call (2014)2 people · 2 mentions · first linked 2018-09-23
- Extract sensitive data from Android 12/13 apps via "run-as" forgery2 people · 2 mentions · first linked 2024-06-18
- Exploiting the Futex Bug and uncovering Towelroot2 people · 2 mentions · first linked 2014-07-08
What Hacker News says?
"Factory reset" is a misnomer, a true factory reset would completely erase the internal storage and replace it with a clean copy of the OS. If that phone is based on a Mediatek SoC, I believe a true reset is possible - look up SPFlashTool and read about this useful exploit: https://tinyhack.com/2021/01/31/dissecting-a-mediatek-bootro...
Comment linking /2021/01/31/dissecting-a-mediatek-bootrom-exploit/
on “I won't connect my dishwasher to your cloud”Submitted Decrypting encrypted files from Akira ransomware using a bunch of GPUs as a story · 257 points
HN discussionLinked in the article, but the post describing the details is here: https://tinyhack.com/2025/03/13/decrypting-encrypted-files-f...
Comment linking /2025/03/13/decrypting-encrypted-files-from-akira-ransomware-linux-esxi-variant-2024-using-a-bunch-of-gpus/
on “Akira ransomware can be cracked with sixteen RTX 4090 GPUs in around ten hours”Submitted When you deleted /lib on Linux while still connected via SSH (2022) as a story · 191 points
HN discussionThe MTK platform was widely popular in certain Android modding communities as it was easy to completely rewrite all nonvolatile storage except for the boot ROM, making them effectively "unbrickable". There was no need to use any exploits specifically to root, as you could just go into BootROM mode by holding down a button while powering on and connect SPFlashTool to modify the system however you want. Now that they'…
Comment linking /2021/01/31/dissecting-a-mediatek-bootrom-exploit/
on “Samsung meets MediaTek: The story of a small bug chain [pdf]”Submitted Implementing a web server in a single printf() call as a story · 181 points
HN discussionSome cheap "blue" no-brand dongles don't have USB 3.0 traces: http://tinyhack.com/2018/05/05/fixing-osmo-fl2k-dongle-that-... Maiwo KCB003 dongle contains FL2K chip and have USB 3.0 ($15) https://www.gearbest.com/cables-connectors/pp_1238337.html?w... Source: https://hackernoon.com/osmo-fl2k-a-15-dtv-transmitter-fm-rad...
Comment linking /2018/05/05/fixing-osmo-fl2k-dongle-that-only-works-in-usb-2-0/
on “Osmo-FL2K: A TX-Only SDR Hacked from Commodity $5 USB to VGA Adapters”Submitted Mastercard Internet Gateway Service: Hashing Design Flaw as a story · 131 points
HN discussionSubmitted Reverse Engineering Pokémon Go Plus as a story · 71 points
HN discussionSubmitted Implementing a web server in a single printf call (2014) as a story · 68 points
HN discussionSubmitted Decrypting Encrypted files from Akira Ransomware using a bunch of GPUs as a story · 6 points
HN discussionSubmitted Reverse Engineering a Flutter App by Recompiling Flutter Engi as a story · 4 points
HN discussionSubmitted Reverse Engineering Pokémon Go Plus (2018) as a story · 3 points
HN discussionSubmitted RFID based toy/game for toddlers as a story · 3 points
HN discussionSubmitted Extract sensitive data from Android 12/13 apps via "run-as" forgery as a story · 2 points
HN discussionSubmitted Implementing a web server in a single printf() call (2014) as a story · 1 points
HN discussionSubmitted Extracting app data from Android 12/13 (pre-March 2024 update) without root as a story · 1 points
HN discussionSubmitted MIGS(mastercard gateway) 3D secure security flaw as a story · 1 points
HN discussionSubmitted Mastercard Internet Gateway Service: Hashing Design Flaw as a story · 1 points
HN discussionSubmitted Exploiting the Futex Bug and uncovering Towelroot as a story · 1 points
HN discussionSubmitted Exploiting the Futex Bug and uncovering Towelroot as a story · 1 points
HN discussion
