Top all-time · #8108
WithSecure™
Company blog · labs.withsecure.com/publicationssecurity
WithSecure™ is the company blog at labs.withsecure.com, writing about security. Since 2022, 9 different Hacker News readers have linked it 10 times. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link WithSecure Labs for security research posts on topics such as boot loader and kernel security, vulnerabilities in a BLE cloud lock, a TCP-over-file tunnel tool, and the Kapeka backdoor.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
What Hacker News says?
The keys to decrypt the kernel are in u-boot. u-boot's keys are in the low level boot loader, and the keys for that are sometimes burned in write-only fuses on the microcontroller itself. Other chips have OP-TEE or similar frameworks, and you just chain the keys all the way down to the initramfs and that data is wiped when you start init. You're reliant on the capabilities of the chip that you're working with, and a…
Comment linking /advisories/microchip-atsama5-soc-multiple-vulnerabilities-full-release
on “No more boot loader: Please use the kernel instead”Submitted Microsoft Office 365 Message Encryption Insecure Mode of Operation as a story · 146 points
HN discussionFWIW, there seems to have another attempt (about a year later) to bring these issues to the company's attention, also without success: > 1st September 2023 - Initial contact - Multiple points of contact within eLinkSmart e-mailed with a high-level description of the issues and proof-of-concept code. > 19th September 2023 - Follow-up after no response from vendor. > 11th October 2023 - Follow-up after no response fro…
Comment linking /publications/elinksmart---unlocking-bluetooth-le-padlocks-with-polite-request
on “The Weird BLE-Lock – Hacking Cloud Locks”Submitted KeePass trojanised in advanced malware campaign as a story · 5 points
HN discussionJust throwing some random ideas out... TCP over file tunnel? https://labs.withsecure.com/tools/tcp-over-file-tunnel or the similar https://blog.adamfurmanek.pl/2022/11/12/availability-anywher... Or maybe establish a named pipe ( https://learn.microsoft.com/en-us/windows/win32/ipc/named-pi... ) on the Windows host, and try to access and proxy through it on the guest? ( https://shvechkov.tripod.com/nptp.html ) Never t…
Comment linking /tools/tcp-over-file-tunnel
on “Ask HN: How to tunnel HTTP(s) through filesystem?”Submitted iOS Single App Mode Escape as a story · 4 points
HN discussionPress release & PDF link, https://www.withsecure.com/en/whats-new/pressroom/withsecure... https://labs.withsecure.com/content/dam/labs/docs/WithSecure...
Comment linking /content/dam/labs/docs/WithSecure-Research-Kapeka.pdf
on “Kapeka: A novel backdoor spotted in Eastern Europe”Submitted Fine-Tuning LLMs to Resist Indirect Prompt Injection Attacks as a story · 1 points
HN discussionSubmitted Forging Swift MT Payment Messages for fun and research (2020) as a story · 1 points
HN discussionSubmitted Kapeka: A novel backdoor spotted in Eastern Europe as a story · 1 points
HN discussion
