Top all-time · #3171
F‑Secure
Company blog · labs.f-secure.com/blogsecurity
F‑Secure is the company blog at labs.f-secure.com, writing about security. Since 2019, 24 different Hacker News readers have linked it 32 times, most often “The Fake Cisco – Hunting for Backdoors in Counterfeit Cisco Devices [pdf]”. No feed was found, so read it on the site itself.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers link F-Secure Labs mainly for its TamaGo posts on bare-metal Go, along with exploit research and security advisories such as iOS host-pairing, zero-click and WebAssembly bugs.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
Most-linked posts?
- /blog/tamago/2 people · 9 mentions · first linked 2020-04-14
- The Fake Cisco – Hunting for Backdoors in Counterfeit Cisco Devices [pdf]2 people · 2 mentions · first linked 2020-07-15
- Sniff, there leaks my BitLocker key2 people · 2 mentions · first linked 2020-12-21
- Multiple Vulnerabilities in Barco ClickShare2 people · 2 mentions · first linked 2019-12-18
- /assets/BlogFiles/apple-safari-wasm-section-vuln-write-up-2018-04-16.pdf2 people · 2 mentions · first linked 2020-08-20
What Hacker News says?
There was a vulnerability in this technique that was fixed in iOS 11: https://labs.f-secure.com/advisories/apple-ios-host-pairing-... . If someone found another vulnerability and shared it with Cellebrite, then it doesn't work. If they haven't, then it still does.
Comment linking /advisories/apple-ios-host-pairing-bypass/
on “Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer”Submitted Opening Up the Samsung Q60 Series Smart TV (2019) as a story · 165 points
HN discussionSure they would, so much that there people doing it right now. https://www.wildernesslabs.co/ https://labs.f-secure.com/blog/tamago/ https://www.ptc.com/en/products/developer-tools/perc
Comment linking /blog/tamago/
on “An iOS zero-click radio proximity exploit odyssey”Submitted The Fake Cisco as a story · 150 points
HN discussionF-Secure thinks otherwise, https://labs.f-secure.com/blog/tamago/
Comment linking /blog/tamago/
on “Eleven Years of Go”Submitted Faking a Positive Covid Test as a story · 137 points
HN discussionPerhaps, you can start by learning what WASM is: https://developer.mozilla.org/en-US/docs/WebAssembly As for vulnerabilities, here are nccgroup's slides about WASM explots: https://i.blackhat.com/us-18/Thu-August-9/us-18-Lukasiewicz-... Here's an example vulnerability in WASM parsing leading to RCE: https://labs.f-secure.com/assets/BlogFiles/apple-safari-wasm...
Comment linking /assets/BlogFiles/apple-safari-wasm-section-vuln-write-up-2018-04-16.pdf
on “Countering threats from North Korea”Submitted The Fake Cisco – Hunting for Backdoors in Counterfeit Cisco Devices [pdf] as a story · 62 points
HN discussionThis reminds me of when I was an intern at an InfoSec company 6 years ago. At the time, they were doing some research into mPOS devices (though I wasn't involved). They found and exploited a stack-based buffer overflow in the EMV parsing of a particular device, which allowed them to deliver a payload from the smart-card itself. To demo this attack, they wrote a flappy bird clone which was played using the number pad…
Comment linking /assets/BlogFiles/MWRI-Labs-BHUS14-Mission-mpossible-2014-08-04-2.pdf
on “Flappy Bird in 228 bytes”Submitted Faking a Positive Covid Test with Cue Readers as a story · 4 points
HN discussionNot to steal the thread, but for the Go sceptics in system programming, F-Secure decided also to prove them wrong and is shipping bare metal Go for their security solutions. https://labs.f-secure.com/blog/tamago/ https://www.f-secure.com/en/consulting/foundry
Comment linking /blog/tamago/
on “Biscuit: A monolithic, POSIX-subset operating system kernel in Go”Submitted Sniff, there leaks my BitLocker key as a story · 4 points
HN discussionSure it does, https://people.inf.ethz.ch/wirth/ProjectOberon/Sources/Kerne... https://labs.f-secure.com/blog/tamago/
Comment linking /blog/tamago/
on “Biscuit: A monolithic, POSIX-subset operating system kernel in Go”Submitted Misadventures in AWS as a story · 3 points
HN discussionSo given embedded soft real time bare metal Java AOT compilers, Java gets to be a systems language as well. :) https://www.ptc.com/en/products/developer-tools/perc As does Go actually, https://www.f-secure.com/en/consulting/foundry/usb-armory https://labs.f-secure.com/blog/tamago/
Comment linking /blog/tamago/
on “Rob Pike interview”Submitted Attacking Kubernetes Through Kubelet as a story · 3 points
HN discussionThis blog article from February of this year gives some context: https://labs.f-secure.com/blog/tamago/ > TamaGo reduces the attack surface of embedded systems firmware by removing any run time dependency on C code and inherently complex Operating Systems. > It does so with minimal changes to the Go run time and a set of packages to provide drivers for supported boards.
Comment linking /blog/tamago/
on “TamaGo – bare metal Go for ARM SoCs”Submitted Sniff, there leaks my BitLocker key as a story · 2 points
HN discussionAnother alternative for bare metal Go is TamaGo, developed by F-Secure for their USB armory pen. https://labs.f-secure.com/blog/tamago/
Comment linking /blog/tamago/
on “Show HN: A Go unikernel capable of running GUI programs”Submitted Samsung S20 – RCE via Samsung Galaxy Store App as a story · 2 points
HN discussionSee also the F-secure timeline where the salt team's gpg key had been expired for years, salt had a lack of clear communication, and general sloth in response https://labs.f-secure.com/advisories/saltstack-authorization...
Comment linking /advisories/saltstack-authorization-bypass/
on “SaltStack Mining Attack”Submitted The Fake Cisco: Hunting for Backdoors in Counterfeit Cisco Devices [pdf] as a story · 2 points
HN discussionDepends, while I am not big fan of Go, not everyone thinks that way, https://github.com/f-secure-foundry/tamago https://labs.f-secure.com/blog/tamago/ https://www.f-secure.com/en/consulting/foundry
Comment linking /blog/tamago/
on “Bjarne Stroustrup Weighs in on Distributed Systems, Type Safety and Rust”Submitted Forging Swift MT Payment Messages for Fun as a story · 2 points
HN discussionI am not sure I understand the sentence "limiting the WA spec to only try to sandbox the WA binary from outside memory". I would not say that we (as in: the authors of the paper) are trying to limit the spec, or that we tried to only look into those parts of the spec that are not concerned with security. (I hope I do not misunderstand your point.) The spec/language/memory organization of WebAssembly really does not…
Comment linking /assets/BlogFiles/apple-safari-wasm-section-vuln-write-up-2018-04-16.pdf
on “Everything old is new again: binary security of WebAssembly”Submitted CVE: SaltStack Authorization Bypass as a story · 1 points
HN discussionI really like Twinkly lights. You can 3D map lights on the christmas tree with your phone and then play with individually controllable RGBW light points. They are relatively cheap, even non-DIY people can buy and use them. It would be great if they provided some official API, but if you want to hack them, there are ways to do it: https://labs.f-secure.com/blog/twinkly-twinkly-little-star/
Comment linking /blog/twinkly-twinkly-little-star/
on “NeoPixel Christmas Tree Lights Controlled by a Raspberry Pi”Submitted Alexa, Are You Listening? as a story · 1 points
HN discussionActually some people actually chose Go instead, to prove a point, https://www.f-secure.com/en/consulting/foundry/usb-armory https://labs.f-secure.com/blog/tamago/ > Our work focuses in supporting free standing Go applications that can be coded as usual, while running on bare metal hardware and without an underlying OS.
Comment linking /blog/tamago/
on “Why Go Is Not Good”Submitted Multiple Vulnerabilities in Barco ClickShare as a story · 1 points
HN discussion
