NowSecure Blog
nowsecure.com · Company blog · on HN since 2015
NowSecure's company blog publishes mobile security research, including reverse engineering of iMessage, app flaws in DeepSeek, and Samsung vulnerabilities.
What HN saysHN links its research on iMessage internals and the Samsung keyboard flaw, where a commenter summarizes insecure SwiftKey language pack downloads over HTTP.
22HN people shared it
5linked it in comments
24stories submitted
91story points
4 months agolast shared
2015people per year2026
Most-shared posts
- 1Reverse Engineering iMessage5 people · 9 points · first shared 2021 · discussion on HN
- 2Multiple Security and Privacy Flaws in DeepSeek iOS Mobile App2 people · 19 points · first shared 2025 · 6 comments on HN
- 3Remote Code Execution as System User on Samsung Phones2 people · 15 points · first shared 2015 · 1 comments on HN
- 4iOS Instrumentation without Jailbreak1 people · 16 points · first shared 2015 · discussion on HN
- 51-in-2 phones sold in Africa exfiltrate whole-device activity to China1 people · 5 points · first shared 2026 · discussion on HN
- 6Android Malware Analysis with Radare: Dissecting the Triada Trojan1 people · 5 points · first shared 2016 · discussion on HN
- 7Samsung Keyboard Security Risk Disclosed: Over 600M+ Devices Worldwide Impacted1 people · 3 points · first shared 2015 · discussion on HN
- 8A Zero-Click RCE Exploit for the Peloton Bike1 people · 3 points · first shared 2022 · discussion on HN
- 9The Dirty COW vulnerability and mobile impact1 people · 2 points · first shared 2016 · discussion on HN
- 10CVE-2015-0863 and CVE-2015-0864 – Corrupdate Vulnerabilities on Android1 people · 2 points · first shared 2015 · discussion on HN
- 11iOS 9 Reverse Engineering with JavaScript1 people · 2 points · first shared 2015 · discussion on HN
- 12Raspberry Pi Hang Instruction1 people · 2 points · first shared 2015 · discussion on HN
- 13Show HN: NowSecure Observer helps iOS devs with Privacy Manifests, app security1 people · 1 points · first shared 2023 · discussion on HN
- 14Reverse Engineering with JavaScript1 people · 1 points · first shared 2015 · discussion on HN
- 15Cycript on steroids: Pumping up portability and performance with Frida1 people · 1 points · first shared 2016 · discussion on HN
What HN people wrote when they linked it
ahoog42 · 2015-02-07
We're Chicago-based startup [1] that helps secure mobile apps and devices and recently completed a 12.5m Series A.
If you're interested in mobile security, you can get an idea about our work in a recently vulnerability we helped Samsung patch impacting 200m+ devices. [2]
Over 50% of our company is remote and we're hiring 30+ people this year. If you're interested in mobile and/or security, would love to hear from you. [3]
[1] https://www.nowsecure.com/
[2] https://www.nowsecure.com/blog/2015/01/27/samsung-corrupdate-vulnerabi…
[3] https://www.nowsecure.com/careers/
mbac32768 · 2025-02-07
tl;dr it does aggressive device fingerprinting, root detection, has anti-tampering mechanisms, bundles native code and has dynamic code loading and execution facilities.
IMO, none of which should be necessary for an app like this
A dynamic analysis is still needed to confirm what it actually does.
I decided to do this after a researcher found obfuscated surveillance code in the web app https://apnews.com/article/deepseek-china-generative-ai-internet-secur…
NowSecure found similar not great runtime behavior in the iOS mobile app https://www.nowsecure.com/press-releases/nowsecure-urges-enterprises-t…
viraptor · 2021-04-22
It would be great, but I wonder how realistic it is to expect. iMessage seems to be pretty strongly tied to the apple account identity, their internal credentials, their push servers, etc. https://www.nowsecure.com/blog/2021/01/27/reverse-engineering-imessage…
They'd have to either rewrite quite a bit to be more ecosystem-independent, or somehow port all the necessary layers to work on other systems. There's a good reason nobody reverse engineered and reimplemented iMessage so far, even though it's "just a messaging app".
c0balt · 2022-04-20
There has been some research around the APN protocol and iMessage in the past by NowSecure[0] and otherse (see links in the article). I would guess the usefullness of a reverse engineered variant is just too low given the requirement for a valid serial number for each account.
[0]: https://www.nowsecure.com/blog/2021/01/27/reverse-engineering-imessage…
_jomo · 2015-06-17
NowSecure has some details about this flaw [0]. Summary:
The SwiftKey keyboard (which can't be uninstalled) checks for language packs via HTTP:
http://skslm.swiftkey.net/samsung/downloads/v1.3-USA/languagePacks.jso…
That returns a list of download URLs and SHA1 hashes (which are obviously useless when they're in the same plain text response).
These download links look like:
http://skslm.swiftkey.net/samsung/downloads/v1.3-USA/en_US.zip
The zip file is downloaded and then extracted as system user. The zip file may contain paths like ../../../../../../../../data/payload, which basically allows to write anywhere on the file system.
This can be (ab)used for a system level remote code execution.
Ryan Welton also published a video demonstrating the exploit. [1]
0: https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-sys…
1: https://www.youtube.com/watch?v=uvvejToiWrY