M
MWR Labs
labs.mwrinfosecurity.com · Company blog · on HN since 2012
MWR Labs, the research arm of a security consultancy, publishes vulnerability research on devices, browsers, kernels, and web frameworks.
What HN saysHN links it for security research such as Echo hacking, Kubernetes kubelet attacks, and honeypots using Sysdig Falco.
32HN people shared it
8linked it in comments
26stories submitted
416story points
7 years agolast shared
2012people per year2026
Most-shared posts
- 1Alexa, are you listening?7 people · 193 points · first shared 2017 · 153 comments on HN
- 2Analyzing honeypot interactions2 people · 58 points · first shared 2017 · 1 comments on HN
- 3Paypal Android App Remote Code Execution2 people · 34 points · first shared 2014 · 13 comments on HN
- 4WebUSB – How a website could steal data off your phone2 people · 12 points · first shared 2017 · 1 comments on HN
- 5Some Brief Notes on WebKit Heap Hardening2 people · 4 points · first shared 2018 · discussion on HN
- 6Windows 8 Kernel Memory Protections Bypass1 people · 77 points · first shared 2014 · 12 comments on HN
- 7Laravel cookie forgery, decryption, and RCE1 people · 25 points · first shared 2014 · 12 comments on HN
- 8Apple Safari – Wasm Section Exploit [pdf]1 people · 2 points · first shared 2018 · discussion on HN
- 9Android 4.4.2 Secure USB Debugging Bypass1 people · 2 points · first shared 2014 · discussion on HN
- 10Digital Lockpicking: Why Your Front Door Shouldn't Be on the Internet1 people · 2 points · first shared 2017 · discussion on HN
- 11Win an invitation to HackFu 20151 people · 1 points · first shared 2015 · discussion on HN
- 12A framework to search for android vulnerabilities1 people · 1 points · first shared 2012 · discussion on HN
- 13Mercury 2.2 is out1 people · 1 points · first shared 2013 · discussion on HN
- 14Creating Malicious Outlook Rules1 people · 1 points · first shared 2016 · discussion on HN
- 15What the Fuzz1 people · 1 points · first shared 2019 · discussion on HN
What HN people wrote when they linked it
xyzzy_plugh · 2018-07-08
The original Echo ran something akin to the Kindle e-reader Linux-based OS. Once the Fire Phone failed, many Android engineers were absorbed into the Echo projects and the follow-on products seem to have been migrated to FireOS (or vice versa?).
There are some sparse details about the original Echo floating around[0], but I couldn't find the specifics.
While they may be able to share some firmware, I'd still wager their kernels/drivers/firmware blobs are different enough due to drastically different components interfacing with the SoC. I personally question the value of putting Android on non-mobile screen-less devices (forgetting about the Echo Show).
0: https://labs.mwrinfosecurity.com/blog/alexa-are-you-listening/
ShaneWilton · 2015-07-25
I hadn't heard of SafeStack, but it sounds like very cool research. Thanks for sharing!
I'm by no means an expert on binary exploitation, so I don't feel qualified to answer your question. That being said, SafeStack sounds very similar to a fairly recent exploit mitigation technique known as heap partitioning, or heap isolation. My explanation wouldn't do the concept justice, but Google recently wrote a great article on how they're using the technique to eliminate some of the biggest causes of Flash 0day [1]. I don't know how effective the technique is in practice, but it seems to be in use by a few major browsers now, and it seems like Internet Explorer has been using it since June of last year [2].
[1] http://googleprojectzero.blogspot.com/2015/07/significant-flash-exploi…
[2] https://labs.mwrinfosecurity.com/blog/2014/06/20/isolated-heap-friends…
vuln · 2019-05-06
apurvadave · 2018-11-06
Another good honeypot story, this one using Sysdig Falco as an intrusion detection engine:
https://labs.mwrinfosecurity.com/blog/high-interaction-honeypots-with-…
crankylinuxuser · 2017-11-10
Oh look. The ethdevs lost more money. I guess we'll expect to see another hard fork, with more sinister language? (edit: 1)
Yeah, this whole episode is what's wrong with Ethereum. Solidity was sold as a cure-all. And its a bugridden festering sore that leaves money for the takings. These side effects should be caught if there was a good lang used: and Im talking about a possibly nonturing complete DSL.
Instead, we have innovative companies that are building on this quicksand thinking its a good foundation; its not. How many more millions will be lost before someone goes back to the drawing board and does this monetary infrastructure right?
(1) https://labs.mwrinfosecurity.com/assets/Uploads/_resampled/ResizedImag…
kardos · 2016-01-19
Even if you don't care about secrecy/privacy, things like this [1,2] and this [3] are reasons to do everything under HTTPS.
[1] https://news.ycombinator.com/item?id=10926696
[2] https://labs.mwrinfosecurity.com/blog/2013/09/24/webview-addjavascript…
[3] https://mitmproxy.org/
dmayer · 2014-03-29
There is a CVE (CVE-2012-6636) [1,2] related to the general issue they are mentioning. Basically one could use reflection to call any public function on any class in the app. Since Android 4.2 one now needs to add the @JavascriptInterface decorator to explicitly expose methods. At least this is my current understanding of this.
If the app then uses HTTP or HTTPS without certificate validation, it is easily possible to inject JavaScrpipt code even when no Cross-Site Scripting vulnerability exists in the app.
[1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6636
[2] https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjava…
Sanddancer · 2014-03-26
Vulnerable USB drivers exist in pretty much every OS. For example, here's a vulnerable USB driver under Linux: https://labs.mwrinfosecurity.com/system/assets/153/original/mwri_caiaq… , and a vulnerability in the FAT filesystem: http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1773.ht… . Those were found with real simple googling, I could find others with a tiny bit more work. Unfortunately, most kernel development teams do not spend anywhere near the time they should ensuring that the code they write is hardened and modular, so such attacks will only continue until we demand better development hygiene.