Check Point Research
research.checkpoint.com · Company blog · on HN since 2017
Check Point Research is the security research team at Check Point, publishing vulnerability findings and malware analyses.
What HN saysHN links it for technical security write-ups, such as the SQLite code execution paper and malware analysis, which one commenter finds more detailed than news coverage.
118HN people shared it
33linked it in comments
118stories submitted
1.6Kstory points
3 months agolast shared
2017people per year2026
Most-shared posts
- 1Select code_execution from * using SQLite (2019)7 people · 1 points · first shared 2020 · discussion on HN
- 2Faxploit: Sending Fax Back to the Dark Ages5 people · 209 points · first shared 2018 · 61 comments on HN
- 3Opwnai: Cybercriminals Starting to Use ChatGPT5 people · 3 points · first shared 2023 · 1 comments on HN
- 4Gaining code execution using a malicious SQLite database4 people · 8 points · first shared 2019 · discussion on HN
- 5FakesApp: A Vulnerability in WhatsApp3 people · 9 points · first shared 2018 · 1 comments on HN
- 6Uncovering Drupalgeddon 23 people · 6 points · first shared 2018 · discussion on HN
- 7Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure3 people · 6 points · first shared 2020 · discussion on HN
- 8Rust Binary Analysis, Feature by Feature3 people · 3 points · first shared 2023 · discussion on HN
- 9Security probe of Qualcomm MSM data services3 people · 1 points · first shared 2021 · discussion on HN
- 10SimBad: A Rogue Adware Campaign on Google Play – Check Point Research3 people · 1 points · first shared 2019 · discussion on HN
- 1150 CVEs in 50 Days: Fuzzing Adobe Reader2 people · 345 points · first shared 2018 · 166 comments on HN
- 12Ransomware-ing a DSLR Camera2 people · 167 points · first shared 2019 · 32 comments on HN
- 13SIGRed: A 17 Year-Old Bug in Windows DNS Servers2 people · 52 points · first shared 2020 · 9 comments on HN
- 14Indra – Hackers Behind Recent Attacks on Iran2 people · 46 points · first shared 2021 · 17 comments on HN
- 15Jian – How the Chinese APT31 stole and used an unknown Equation Group 0-Day2 people · 32 points · first shared 2021 · 6 comments on HN
What HN people wrote when they linked it
jorams · 2024-11-29
This is a confused and frankly worthless article. It is malware made in Godot. It is not targeting users of Godot, it is not distributed through Godot-related channels, nothing got "hijacked" (except perhaps the infected systems).
The researchers talk about the possibility that data packs for real games could be infected in the future, but this malware just includes its own copy of the game engine.
Post by the researchers: https://research.checkpoint.com/2024/gaming-engines-an-undetected-play…
Statement by Godot: https://godotengine.org/article/statement-on-godloader-malware-loader/
rurban · 2020-06-13
It's not surprising. A hack is still a hack, even you apply industry best practices in testing. There are two major security entry points, and none of them were closed since.
This is the paper describing both. https://research.checkpoint.com/2019/select-code_execution-from-using-…
Kalium · 2019-05-30
It might be worth considering carefully how safe the practice of opening essentially random email links might be. Are you opening the links with a full suite of forensic measures in place, or are you dropping curl $URL into your terminal on your workstation? It looks like WSL isn't exactly a sandbox. It does seem to already be used by some malware: https://research.checkpoint.com/beware-bashware-new-method-malware-byp…
In a world with drive-by exploits and where opening a link leaks information, it perhaps could be considered unsafe to open essentially random links from emails. I've definitely worked with developers who seem to believe that curl is magical and inures them against every possible attack.
Curiosity is a wonderful thing! It's just sometimes it can be dangerous to a person and to the people around them. It might not be a bad thing for people to learn a smidge of caution.
happyPersonR · 2026-01-14
lol there’s no real technical details in this article sadly. Checkpoint has a better analysis.
https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware…
Some kind of opensource ish malware framework the kids are running that can use eBPF …. In addition to limiting CAP_BPF or CAP_SYS_ADMIN you should also take other measures.
wyldfire · 2025-07-03
Checkpoint found a bunch of issues [1][2] using QEMU and AFL some time ago. So it's possible that's why srlabs didn't find much yet.
[1] https://research.checkpoint.com/2021/security-probe-of-qualcomm-msm/
[2] https://blog.checkpoint.com/security/achilles-small-chip-big-peril/
mrkramer · 2025-06-30
I'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share.
Majority of information about Windows malware I get from big computer security companies' research blogs like:
https://www.trendmicro.com/en_us/research.html
https://www.proofpoint.com/us/blog
https://research.checkpoint.com/
https://blog.talosintelligence.com/
https://www.welivesecurity.com/en/
Microsoft also got good security research blog: https://www.microsoft.com/en-us/security/blog/
Majority of the research combes down to researching malware's capabilities regarding malware persistence, anti-VM techniques and anti-debugging techniques.
Here is for example good compilation of malware's anti-debugging and anti-VM techniques:
https://anti-debug.checkpoint.com/
https://github.com/CheckPointSW/Evasions
lifthrasiir · 2023-06-25
Ah! Sorry for the confusion, you are right that there can be at most one Windows Sandbox running at a time. But Windows Sandbox is based on Windows Containers [1] which can coexist (Defender already uses the same technology, so this must be true), and it seems that the single instance limitation of Sandbox is more or less artificial [2]. I haven't yet seen a third-party attempt to emulate Sandbox but it looks in principle possible.
[1] https://learn.microsoft.com/en-us/virtualization/windowscontainers/abo…
[2] https://research.checkpoint.com/2021/playing-in-the-windows-sandbox/
Grimburger · 2023-01-10
The research report link is probably a better source here than the re-hashing and brief commentary by Schneier. https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to…
That said, it's not anything more than posting some screenshots from hacking forums talking about using ChatGPT, I don't think anyone here would be surprised at the results.
bookofjoe · 2023-01-08
>OPWNAI : CYBERCRIMINALS STARTING TO USE CHATGPT
https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to…
throwaway47292 · 2021-10-26
offtopic:
sqlite is bad example, for example features like the FTS tokenizer code (https://research.checkpoint.com/2019/select-code_execution-from-using-… which were probably paid by commercial requests or sponsors.
That is not to say sqlite does not have 100% coverage, it of course does, but you are building on top of infrastructure which is really really hard to be kept safe.
Rust somehow makes it harder to make certain kinds of bugs, which comes at its own cost.
PS: I don't like or dislike rust, just I have seen the sqlite example being brought a lot, and a lot of people didn't expect sqlite file to be an attack vector :) so nobody is even looking there.
dmhmr · 2021-07-19
APT 40 and 31 are well documented [1] [2].
[1] https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a…
[2] https://research.checkpoint.com/2021/the-story-of-jian/
afrcnc · 2021-05-07
jamii · 2021-03-22
Despite being an 'easy problem' it has led to code execution on android/ios:
https://research.checkpoint.com/2019/select-code_execution-from-using-…
> We established that simply querying a database may not be as safe as you expect. Using our innovative techniques of Query Hijacking and Query Oriented Programming, we proved that memory corruption issues in SQLite can now be reliably exploited. As our permissions hierarchies become more segmented than ever, it is clear that we must rethink the boundaries of trusted/untrusted SQL input. To demonstrate these concepts, we achieved remote code execution on a password stealer backend running PHP7 and gained persistency with higher privileges on iOS. We believe that these are just a couple of use cases in the endless landscape of SQLite.
yencabulator · 2021-03-11
Opening untrusted SQLite files tends to not be safe: https://research.checkpoint.com/select-code_execution-from-using-sqlit…
magnat · 2021-01-21
Opening and querying untrusted SQLite database can lead to (remote) code execution. Original research at https://research.checkpoint.com/2019/select-code_execution-from-using-…
ori_b · 2020-12-18
It's a multi-hundred-thousand line project (current count, excluding tests, is about 210,000). Like any project of a similar size, it has a history of security vulnerabilities. OpenBSD removed it because it was too much code to audit. OpenBSD dodged several issues like this RCE (https://research.checkpoint.com/2019/select-code_execution-from-using-… as a result.
See https://www.cvedetails.com/vulnerability-list/vendor_id-9237/Sqlite.ht…
Hundreds of thousands of lines of code are simply going to have vulnerabilities and bugs. It's unavoidable with that level of complexity. I'm skeptical anything that complicated is a wise choice for a general file format -- especially when smaller, simpler, and more easily debuggable and independently implementable formats exist.
nodamage · 2020-09-12
I think you massively underestimate the number of people that will click yes to install random packages on their own phones in order get access to free games or porn or whatever.
https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobi…
https://blog.malwarebytes.com/android/2019/08/mobile-menace-monday-and…
https://arstechnica.com/information-technology/2016/07/virulent-auto-r…
krn · 2020-08-08
Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices (2020)
https://blog.zimperium.com/multiple-kernel-vulnerabilities-affecting-a…
The Road to Qualcomm TrustZone Apps Fuzzing (2019)
https://research.checkpoint.com/2019/the-road-to-qualcomm-trustzone-ap…
QualPwn - Exploiting Qualcomm WLAN and Modem Over The Air (2019)
https://blade.tencent.com/en/advisories/qualpwn/
QuadRooter: New Android Vulnerabilities in Over 900 Million Devices (2016)
https://blog.checkpoint.com/2016/08/07/quadrooter/
bonfire · 2020-07-15
I think the attack vectors in Windows are so so large that fuzzing to find everything is close to impossible (or even physically impossible). However there are bugs found by fuzzing that were disclosed in Windows - for example https://research.checkpoint.com/2020/bugs-on-the-windshield-fuzzing-th…
tetha · 2020-07-14
Fairly complete attack details are out already.
https://research.checkpoint.com/2020/resolving-your-way-into-domain-ad…
Including possible javascript vectors to trigger reflection attacks on LAN servers. Yey. This isn't going to take days, this will be fun tomorrow.
eyalitki · 2020-07-02
Here is the link to the full technical paper: https://research.checkpoint.com/2020/apache-guacamole-rce/
vuln · 2020-01-08
Here's the report by Check Point Research, a lot more information and specifics.
https://research.checkpoint.com/2020/tik-or-tok-is-tiktok-secure-enoug…
pabs3 · 2019-11-10
Fax machines are just as insecure as that server. Last year taking over a network using just a fax number was demonstrated:
https://research.checkpoint.com/sending-fax-back-to-the-dark-ages/
wolf550e · 2019-08-18
Beware opening sqlite files from untrusted sources.
https://research.checkpoint.com/select-code_execution-from-using-sqlit…
HerraBRE · 2019-08-05
That's an interesting idea.
I'd hesitate to implement it though, because of secondary risks. It would need to be thought through very carefully, and there are a whole bunch of abuse scenarios that would need to be avoided or mitigated.
As a rule, Mailpile does very little when it receives a mail - until the user has interacted with it, we have to assume the mail is junk and/or potentially hostile.
See the chapter on Oracles here: https://research.checkpoint.com/cryptographic-attacks-a-guide-for-the-… - automatically triggering sender-controlled network access based on the contents of e-mail opens the door for such things.
This applies not only to cryptographic attacks, but also to more pedestrian exploitation of bugs in the app itself, or silly things like turning Mailpiles into DDoS attack robots.
kevinbojarski · 2019-07-11
Check Point's write up can be found here: https://research.checkpoint.com/agent-smith-a-new-species-of-mobile-ma…
kllrnohj · 2019-03-14
Based off of the actual research ( https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-goog… ) it looks like TechChrunch just got critical details very wrong. The adware didn't "install itself" at all, it was just bundled into the app up-front.
But the overwhelming majority of this attack, popping open URLs & showing ads, is something Q is looking to put a stop to wholesale: https://developer.android.com/preview/privacy/background-activity-star…
ackfoo · 2019-03-13
That link provides no actual information. It's like a superhero film: junk food for the mind.
Here's the actual article at Check Point, not linked from the garbage article:
https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-goog…
Turns out the malware is delivered in the RXDrioder SDK, which developers incorporated to get ad revenue, I guess.
Check Point claims that the app developers appear to have been hoodwinked into incorporating the SDK because they are independent of the SDK developer. Which may mean that these DL numbers are not as inflated as people think.
Fuck. If that's true, our app market really is driven by 12-year-old boys. Which is why my serious technical apps with years of development behind them are selling like 3 copies. And why Apple thinks innovation equals new emojis.
cesarb · 2018-11-19
> You can't get a PDF-borne virus from an old-school fax reception.
How about a JPEG-borne virus instead? https://research.checkpoint.com/sending-fax-back-to-the-dark-ages/
sjcsjc · 2018-08-13