Top all-time · #238
WeLiveSecurity
Company blog · welivesecurity.comsecurity
WeLiveSecurity is the company blog at welivesecurity.com, writing about security. Since 2013, 206 different Hacker News readers have linked it 252 times, most often “An exploit kit hiding in the pixels of malicious ads”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Rarely recommended · 0 of 40 sampled comments recommend it?
Why HN links it
HN readers link ESET's WeLiveSecurity blog as a source on malware and security research, such as ransomware, fast-flux DNS, the LoJax UEFI rootkit and spyware. Comments mostly cite it rather than judge it.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
WeLiveSecurity comes from the brains at ESET - experienced researchers with in-depth knowledge of the latest threats and security trends.
Most-linked posts?
- An exploit kit hiding in the pixels of malicious ads5 people · 5 mentions · first linked 2016-12-06
- LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group5 people · 5 mentions · first linked 2018-09-27
- First in-the-wild UEFI bootkit bypassing UEFI Secure Boot5 people · 5 mentions · first linked 2023-03-01
- RomCom exploits Firefox and Windows zero days in the wild4 people · 4 mentions · first linked 2024-11-26
- German chat site faces fine under GDPR after data breach3 people · 4 mentions · first linked 2018-12-17
- Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole3 people · 3 mentions · first linked 2013-04-26
- European govt air-gapped systems breached using custom malware3 people · 3 mentions · first linked 2024-10-08
- Jumping the air gap: 15 years of nation‑state effort3 people · 3 mentions · first linked 2021-12-02
- First UEFI rootkit found in the wild [pdf]3 people · 3 mentions · first linked 2018-09-27
- The Dark Side of the ForSSHe // a Landscape of OpenSSH Backdoors [pdf]3 people · 3 mentions · first linked 2018-12-06
What Hacker News says?
They don't understand sideloading, but you know what they understand? Weird apps that block your phone and show ads constantly (yes this exists) Typosquatting apps Apps that hold your phone for ransom if you don't pay a certain debt (yes this exists) https://www.welivesecurity.com/en/eset-research/beware-preda...
Comment linking /en/eset-research/beware-predatory-fintech-loan-sharks-use-android-apps-reach-new-depths/
on “Google will allow only apps from verified developers to be installed on Android”Submitted LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group as a story · 386 points
HN discussionMy university sent around an email with a photo of GRUB displaying some ransomware message with a demand 222 bitcoins. Sure freaked me out, as a linux user who usually gets to ignore emails like this, but upon investigation it was unrelated [1] to today's events. The screenshot was of ransomware that while still terrifying, existed before today. [1] https://www.welivesecurity.com/2017/01/05/killdisk-now-targe...
Comment linking /2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted European govt air-gapped systems breached using custom malware as a story · 281 points
HN discussionZero click browser exploits still do pop up—it's also hard to say how common they are, because they're hard to detect, and likely to be used very judiciously by the people who discover them to avoid showing their hand. Ad networks have certainly been a direct vector for malware in the past. Within the past few years there were quite many malicious ads floating around that would trigger a redirect on load on iOS Safa…
Comment linking /en/eset-research/romcom-exploits-firefox-and-windows-zero-days-in-the-wild/
on “Meta projected 10% of 2024 revenue came from scams”Submitted Bootkitty: Analyzing the first UEFI bootkit for Linux as a story · 183 points
HN discussionThat's exactly what they are doing right now... https://www.welivesecurity.com/2021/05/11/whatsapp-limit-fea...
Comment linking /2021/05/11/whatsapp-limit-features-users-reject-new-data-sharing-rules/
on “Germany bans Facebook from handling WhatsApp data over privacy concerns”Submitted An exploit kit hiding in the pixels of malicious ads as a story · 137 points
HN discussion1. Sandboxing might help prevent certain types of attacks but the App Store review process goes above and beyond simple API restrictions and imposes rules on how you're allowed to use those APIs to prevent abuse of privacy. For example: just because I grant an app access to my contacts/photos for a legitimate purpose doesn't mean I want that company to exfiltrate that data and sell it to a third party. Sandboxing wo…
Comment linking /2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/0/
on “Epic Games steps up Apple fight with EU antitrust complaint”Submitted Security researchers identify new malware targeting Linux as a story · 135 points
HN discussionA quick search seems to turn up quite a few examples of webcam spying. I'd love to see actual numbers, but it doesn't seem to be "incredibly rare". https://www.dailymail.co.uk/sciencetech/article-5228017/Hack... https://www.dailymail.co.uk/news/article-2638874/More-90-peo... https://globalnews.ca/news/2158281/what-you-need-to-know-abo... https://www.telegraph.co.uk/technology/news/10131456/Hackers... This site claim…
Comment linking /2015/04/21/webcam-hacking/
on “Camera and microphone require HTTPS in Firefox 68”Submitted Firefox Under Fire: Anatomy of latest 0-day attack as a story · 114 points
HN discussionmalicious advertising networks and advertising/JS botnet things have used fast flux DNS for a long time now. It's fairly standard practice for hostnames and IPs of things serving malicious content to have extremely low DNS TTLs, the malicious actors have scripted/automated their changes. https://www.welivesecurity.com/2017/01/12/fast-flux-networks...
Comment linking /2017/01/12/fast-flux-networks-work/
on “Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta”Submitted Beyond KrØØk: Even more Wi‑Fi chips vulnerable to eavesdropping as a story · 97 points
HN discussionI would be very surprised if it is that high now even with the early adopter skew. Reports say that last year it was around a quarter of smartphone users use passcode locks on their work phone ( http://www.welivesecurity.com/2012/02/28/sizing-up-the-byod-... ). I imagine 5S rates are higher than that, but 90% would be insanely impressive. When it comes to computer security, as usual, people's apathy is the biggest p…
Comment linking /2012/02/28/sizing-up-the-byod-security-challenge/
on “Fingerprints are Usernames, not Passwords”Submitted KrØØk: Serious vulnerability affecting encryption of billion+ Wi‑Fi devices as a story · 76 points
HN discussionI can't understand how you can ignore for your personal analysis that the majority of people /disapprove/ of the current surveillance practices[1]. People on this thread keep alluding to the majority not caring, but even if there's apathy in actions, I'm optimistic that at least most people viscerally know it's not right. [1]: http://www.welivesecurity.com/2013/10/29/survey-says-77-of-a...
Comment linking /2013/10/29/survey-says-77-of-americans-reject-nsa-mass-electronic-surveillance-of-americans/
on “Wikimedia v. NSA: Wikimedia Foundation files suit against NSA”Submitted Jumping the Air Gap: 15 Years of Nation-State Effort [pdf] as a story · 70 points
HN discussionhttps://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo...
Comment linking /2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
on “Retiring Windows 10 and Microsoft's move towards a surveillance state”Submitted RomCom exploits Firefox and Windows zero days in the wild as a story · 58 points
HN discussion> That would never happen. A network tap would be able to detect a malicious update even if the main PC was implanted very well, and a Microsoft-signed malicious update would be worldwide news. While I don't know of that specific scenario, Stuxnet used a hardware vendor's key to install infected drivers[1]. There was also a Chinese registrar that allowed a customer to man-in-the-middle Google[2]. Depending on how Wi…
Comment linking /2010/07/22/why-steal-digital-certificates/
on “Another Ransomware Outbreak Is Going Global”Submitted OS X/Keydnap spreads via signed Transmission application as a story · 36 points
HN discussionThe first GDPR fine was against knuddels.de because they accidentally stored passwords in plain text [0]: “By storing the passwords in clear text, the company knowingly violated its duty to ensure data security in the processing of personal data in accordance with GDPR Article 32(1)(a),” [0] https://www.welivesecurity.com/2018/11/27/german-chat-site-f...
Comment linking /2018/11/27/german-chat-site-faces-fine-gdpr/
on “Amazon Sends 1,700 Alexa Voice Recordings to a Random Person”Submitted The Dark Side of the ForSSHe // a Landscape of OpenSSH Backdoors [pdf] as a story · 13 points
HN discussionThe report just didn't get into that much detail but they did say: "the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques." A "range of techniques" includes things like rootkits. >No rootkits, The attackers did use stealthy persistence techniques often called 'rootkits". "the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with per…
Comment linking /wp-content/uploads/2016/10/eset-sednit-part1.pdf
on “Technical report on DNC hack [pdf]”Submitted Siegeware: When Criminals Take Over Your Smart Building as a story · 9 points
HN discussionI'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share. Majority of information about Windows malware I get from big computer security companies' research blogs like: https://www.trendmicro.com/en_us/research.html https://www.proofpoint.com/us/blog https://research.checkpoint.com/ https://blog.talosintelligenc…
Comment linking /en/
on “Many ransomware strains will abort if they detect a Russian keyboard installed (2021)”Submitted I tracked down developer of Android adware affecting millions of users as a story · 8 points
HN discussion> often in horrific ways Let me guess, loan shark apps, or is there something even worse that I wasn't aware of? (Essentially ransomware that people "voluntarily" install in order to get a predatory loan, often without knowing how it actually operates. If they fail to pay, not only is their phone locked, but the data from it is used to threaten/extort them, from threatening to send their nudes to their contacts to d…
Comment linking /en/eset-research/beware-predatory-fintech-loan-sharks-use-android-apps-reach-new-depths/
on “The recently lost file upload feature in the Nextcloud app for Android”Submitted Android Ransomware is back – spreads via SMS to victim contacts as a story · 8 points
HN discussion
