H
HP Security Research Blog
h30499.www3.hp.com · Company blog · on HN since 2012
HP's security research team publishes vulnerability analyses, exploit write-ups, and Pwn2Own results covering Windows, OpenSSL, Flash, and POS systems.
What HN saysHN links it for technical vulnerability write-ups, the Pwn2Own 2015 results, and the POS hacking post; commenters also grumble about its unwieldy URLs.
47HN people shared it
9linked it in comments
53stories submitted
456story points
11 years agolast shared
2012people per year2026
Most-shared posts
- 1Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix4 people · 92 points · first shared 2015 · 16 comments on HN
- 2Hacking POS Terminal for Fun and Non-profit3 people · 69 points · first shared 2014 · 16 comments on HN
- 3OpenSSL DTLS Fragment Out-of-Bounds Write: Breaking up is hard to do3 people · 2 points · first shared 2014 · discussion on HN
- 4How I learned to hack my TV (and started worrying about the future)2 people · 5 points · first shared 2014 · discussion on HN
- 5Technical Analysis of the SandWorm Vulnerability (CVE-2014-4114)2 people · 5 points · first shared 2014 · 1 comments on HN
- 6JavaScript Inheritance Revisited2 people · 3 points · first shared 2013 · discussion on HN
- 7Playing with Adobe Flash Player Exploits and Byte Code2 people · 3 points · first shared 2014 · discussion on HN
- 8Double-Dip: Using the latest IE 0-day to get RCE and an ASLR Bypass2 people · 2 points · first shared 2014 · discussion on HN
- 9Pwn2Own owned all major browsers1 people · 111 points · first shared 2013 · 63 comments on HN
- 10Zero-day vulnerability in Chrome on Nexus 4 and Samsung Galaxy S41 people · 95 points · first shared 2013 · 32 comments on HN
- 11Patch analysis of latest Microsoft Office vulnerability (CVE-2014-1761)1 people · 11 points · first shared 2014 · discussion on HN
- 12The mechanism behind Internet Explorer CVE-2014-17761 people · 7 points · first shared 2014 · 1 comments on HN
- 13Internet of Things Is the Frankenbeast of Information Security1 people · 4 points · first shared 2015 · discussion on HN
- 14A new model to deliver public cloud1 people · 3 points · first shared 2015 · discussion on HN
- 15A ZDI analyst’s perspective on ZDI-15-0301 people · 3 points · first shared 2015 · discussion on HN
What HN people wrote when they linked it
pavs · 2013-03-07
woah! whats with the hp site permalink/URI/url formatting?
http://h30499.www3.hp.com/
mariuz · 2012-10-06
Yes was a Microsoft Hand , they killend it and went to more complex indexed db that no one loves
http://h30499.www3.hp.com/t5/Following-the-Wh1t3-Rabbit-Down/W3C-Burie…
mccr8 · 2015-03-20
All were running on Windows, except Safari which was running on OSX. You can see the details at this overly long URL from the contest organizers:
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2015-Ex…
dagw · 2014-12-19
http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-sec…
This is probably the most complete report available to the public for easy download.
Wingman4l7 · 2014-07-15
This comment provides a lot of insight into the situation from the perspective of someone who claims to "install and provide tech support" for the Aloha POS system: http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Hacking-POS-Ter…
mnicky · 2014-06-08
It seems that both Heartbleed and this MITM vulnerability were introduced by Robin Seggelmann [1], which will surely drive a lot of speculations...
[1] http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-…
fyrabanks · 2014-05-17
People have also been (assumedly) using Shodan and default admin passwords to put "Vote for Josh" on exposed HP printers. http://h30499.www3.hp.com/t5/Printers-LaserJet-Experts-Online/Vote-for…
Moral_ · 2014-03-16
Not all of them. One was a use after free, which isn't related to buffer overflows. Two other ones are not clear what they were caused by:
By Mariusz Mlynski:
Against Mozilla Firefox, two vulnerabilities, one allowing privilege escalation within the browser and one bypassing browser security measures.
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-results…
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-results…
nradov · 2014-01-23
For those using the Java stack we have found HP's Fortify static analysis tool helpful in automatically detecting XXE vulnerabilities.
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Q2-2013-HP-Fort…