security research

Bilingual

Decoding Google: Converting a Black Box to a White Box
2 months ago
- Convert Google's attack surface from black box to white box by finding all endpoints and hidden parameters.
- Discovery documents for private Google APIs are accessible without authentication for some, but require API keys or spatula headers for others.
- Web authentication uses X-Goog-Api-Key and SAPISIDHASH; Android uses bearer tokens from refresh tokens with app-specific context.
- Visibility labels (e.g., 'PANTHEON') can reveal hidden API endpoints when provided in discovery requests.
- Android refresh tokens can be obtained via accounts.google.com/EmbeddedSetup and exchanged for bearer tokens with specific scopes and app signatures.
- X-Goog-Spatula header provides keyless authentication for Android app contexts and can fetch discovery documents.
- Error messages leak parameter types and full protobuf definitions when sending invalid JSON or ProtoJson arrays.
- Tools like req2proto automate reconstruction of request protos by brute-forcing field indices.
Restructuring GitHub's bug bounty program
2 months ago
- GitHub's bug bounty program is introducing a permanent VIP program for researchers who consistently deliver high-quality work, with higher payouts and faster response times.
- The public bounty program is being restructured to static payouts per severity level, reducing uncertainty and overhead.
- A signal requirement is being implemented on the public program to reduce low-effort and AI-generated reports, allowing initial submissions for newcomers.
- The program aims to incentivize quality over quantity, with a focus on deeper relationships and better findings.
- Existing reports submitted before July 27, 2026 will be honored under the previous bounty structure.
- GitHub is investing in faster response times, clearer severity reasoning, and more community engagement at conferences.
The Legal Risks That Chill Good-Faith Security Research
2 months ago
- Anti-hacking laws like the U.S. CFAA and U.K. CMA are broad and ambiguous, failing to distinguish malicious hacking from good-faith security research, causing a 'chilling effect' that discourages valuable research.
- Contract law (e.g., terms of service) is the most cited legal risk, not anti-hacking laws; researchers face threats for violating terms when studying systems.
- Legal risks lead to 'stockpiling' of vulnerabilities, where researchers withhold findings due to fear of legal consequences, making them targets for hacking or coercion.
- Researchers report significant personal and emotional tolls, including fear, stress, and even incarceration, from legal threats arising from their work.
- Institutional lawyers often prioritize protecting the university over the researcher, while personal legal counsel can help de-escalate threats.
- The current political climate increases risks for researchers, with politically motivated legal threats and academic hostility, especially in social computing.
- Researchers are motivated by a sense of public service and duty to improve security, despite legal risks, and often rely on early legal advice and anonymity measures.
- Recommendations include developing contingency plans, company pledges, supportive publication policies, and government support for research disclosure.
Show HN: Watch bots interact with an SSH honeypot in real time
3 months ago
- The dashboard provides live telemetry from an SSH honeypot for security research, threat intelligence, and education.
- Displayed data (IP addresses, usernames, passwords, commands, fingerprints, metadata) comes from inbound connections; IP addresses may not identify the actual attacker.
- Data includes attacker-supplied content (commands, credentials, URLs, malware) and should not be considered verified or safe to execute.
- Contact the site operator if any displayed data raises security, privacy, or abuse concerns for review and removal.

security research

Decoding Google: Converting a Black Box to a White Box

Restructuring GitHub's bug bounty program

The Legal Risks That Chill Good-Faith Security Research

Show HN: Watch bots interact with an SSH honeypot in real time