Top all-time · #2324
TrustedSec
Company blog · trustedsec.com/blogsecurityprogramming
TrustedSec is the company blog at trustedsec.com, writing about security and programming. Since 2013, 32 different Hacker News readers have linked it 37 times, most often “Shellshock DHCP Remote Code Execution – Proof of Concept”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Experience fundamentally different cybersecurity for business success, providing end-to-end consulting from penetration testing to design and hardening.
Most-linked posts?
- Shellshock DHCP Remote Code Execution – Proof of Concept3 people · 3 mentions · first linked 2014-09-25
- XZ Utils Made Me Paranoid2 people · 2 mentions · first linked 2024-05-08
- Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump2 people · 2 mentions · first linked 2016-06-20
What Hacker News says?
You need both. https://www.trustedsec.com/2016/06/introduction-gpu-password...
Comment linking /2016/06/introduction-gpu-password-cracking-owning-linkedin-password-dump/
on “"Pwned Passwords" V2 With Half a Billion Passwords”Submitted Shellshock DHCP Remote Code Execution – Proof of Concept as a story · 355 points
HN discussionI think even just using DHCP put your Mac at risk: https://www.trustedsec.com/september-2014/shellshock-dhcp-rc...
Comment linking /september-2014/shellshock-dhcp-rce-proof-concept/
on “Bash 'shellshock' bug is wormable”Submitted Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump as a story · 164 points
HN discussionApplets, unless especially privileged by the user, run in a sandbox that prevent them from interacting with the local OS [1]. They certainly cannot run EXEs, again, unless the user consents. In theory the Applet sandbox works really well. It's an extremely secure environment that's been deployed widely in the most demanding conditions -- think banks and governments. In practice the Applet security model encountered…
Comment linking /2013/04/java-7-update-21-applet-security-change-analysis/
on “Adobe Flash’s Gaming Legacy and My Efforts To Save It”Submitted A Brief History of Password Storage, Transmission, and Cracking as a story · 40 points
HN discussionIt's surprisingly common. Here's[1] the most recent example of Schneier talking out of his domain with the potential to cause damage. The problem is that Schneier is a pundit, not a security expert. He has a good knowledge of cryptography but as a media pundit he's often asked questions outside of his domain and on responding or commenting he's referred to in the media as an expert. This is precisely what happened w…
Comment linking /march-2013/the-debate-on-security-education-and-awareness/
on “Changes to the Blog”Submitted Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found as a story · 6 points
HN discussionThis might give it some more context: https://www.trustedsec.com/march-2017/classy-inter-domain-ro...
Comment linking /march-2017/classy-inter-domain-routing-enumeration/
on “HardCIDR will query ARIN and a pool of BGP route servers”Submitted XZ Utils Made Me Paranoid as a story · 4 points
HN discussionThe original bug report said "very highly unlikely it's technically remotely exploitable", but it seems that may not be the case. "Working with the exploit, its trivial to get a working remote exploit to work, below is a simple rewritten RCE from the exploit PoC": https://www.trustedsec.com/february-2014/python-remote-code-...
Comment linking /february-2014/python-remote-code-execution-socket-recvfrom_into/
on “Python socket.recvfrom_into() remote buffer overflow”Submitted Console Cowboys: Navigating the Modern Terminal Frontier as a story · 3 points
HN discussionThis is a good overview of how hackers actually crack hashes if anyone is interested. https://www.trustedsec.com/june-2016/introduction-gpu-passwo... The other things to take into account: Code complexity, quality, and cost of ownership. Rolling your own scheme when mature and well tested code already exists is generally something to be avoided, especially when crypto is involved. Force multipliers. Your server is p…
Comment linking /june-2016/introduction-gpu-password-cracking-owning-linkedin-password-dump/
on “Guide to User Data Security”Submitted XZ Utils Made Me Paranoid as a story · 3 points
HN discussioni belive the bug can be used to execute code on your mac with a dhcp server https://www.trustedsec.com/september-2014/shellshock-dhcp-rc...
Comment linking /september-2014/shellshock-dhcp-rce-proof-concept/
on “Apple is not addressing the Bash bug”Submitted Solving NIST Password Complexities: Guidance from a GRC Perspective as a story · 2 points
HN discussionUnder his site's "Presentations" section ( https://www.trustedsec.com/downloads/presentations/ ), it lists this talk... "July 2010 – Blackhat and Defcon Presentation on PowerShell" ( http://www.trustedsec.com/files/PowerShell_Defcon.pdf )
Comment linking /files/PowerShell_Defcon.pdf
on “No security ever built into Obamacare site: Hacker”Submitted Critical vulnerability in progress MoveIt Transfer as a story · 2 points
HN discussionDavid Kennedy's Bio: https://www.trustedsec.com/about-us/leadership/
Comment linking /about-us/leadership/
on “No security ever built into Obamacare site: Hacker”Submitted The Curious Case of the Password Database as a story · 2 points
HN discussionI thought Heartbleed attacks were difficult to detect. How did they determine they used the Heartbleed vulnerability, especially since the attack happened only a week after Heartbleed was revealed? > "Community Health ... disclosed yesterday that Chinese hackers stole patients’ Social Security numbers, names and addresses, without revealing how the hackers got in." And then... > “We never had any tangible proof of a…
Comment linking /august-2014/chs-hacked-heartbleed-exclusive-trustedsec/
on “Heartbleed Flaw Said Used in Hospital Hacking”Submitted Red Teaming with Cobalt Strike – Not So Obvious Features – TrustedSec as a story · 2 points
HN discussion(It's actually "broadcasting" to the proxy (WPAD) server.) I just skimmed the article but the idea sounded really familiar (so forgive me if I'm wrong) but this is what I think is going on... You set up a "rogue" host providing DHCP and proxy services. In the DHCP response to the client, the server can tell the client what proxy server to use (see "WPAD"). When the client contacts it, the "rogue" proxy server then b…
Comment linking /july-2013/wpad-man-in-the-middle-clear-text-passwords/
on “Snagging creds from locked Windows/OS X machines using USB-Armory/Hak5-Turtle”Submitted Is Zoom’s Lack of End-to-End Encryption a Problem? as a story · 2 points
HN discussionWill you be adding Wire to the list? https://www.trustedsec.com/2016/12/wire-messenger-new-compet...
Comment linking /2016/12/wire-messenger-new-competitor-signal/
on “Privacy Respecting Services and Software”Submitted A Buyer’s Guide to Beginning SDR as a story · 2 points
HN discussionThere's been tons of dumps posted. Normally I see the download or magnet links on Reddit or HN. Even with hashes people have broken 69% [0] to 85% [1] of the accounts. There's mailing list or forums for various related tools (cracking tools, gpu cracking, have I been pwned, etc.) that discuss these kinds of things, including where to get the passwords and/or hashes. One of the summaries claimed that 3% of the cracke…
Comment linking /blog/introduction-gpu-password-cracking-owning-linkedin-password-dump/
on “LastPass: Notice of Recent Security Incident”Submitted Is the Affordable Health Care Website Secure? Probably not. as a story · 2 points
HN discussionSubmitted Vulnify: Giving Your Agents a CVE Brain as a story · 1 points
HN discussionSubmitted Specula – Turning Outlook into a C2 with One Registry Change as a story · 1 points
HN discussion
