Top all-time · #1194
MalwareTech
Personal blog · malwaretech.comsecurity
MalwareTech is a personal blog at malwaretech.com about security. Since 2013, 57 different Hacker News readers have linked it 62 times, most often “Accidentally Stopping a Global Cyber Attack”. It is still writing: the last post was on 2026-09-03, and you can follow it by feed.
Rarely recommended · 2 of 30 sampled comments recommend it?
Why HN links it
MalwareTech's blog is linked for malware and security write-ups, including the WannaCry kill-switch explanation, hard-disk firmware hacking, botnets, and a 2024 IPv6 CVE exploit analysis.
- Recommended for · 2 comments
- 2024 IPv6 CVE exploit write-up called worthwhile reading; a Tor VM guide called recent and confirmed working.
Summarised by Claude from a sample of 30 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Accidentally Stopping a Global Cyber Attack8 people · 9 mentions · first linked 2017-05-13
- /2015/04/hard-disk-firmware-hacking-part-1.html3 people · 4 mentions · first linked 2017-11-29
- Marcus Hutchins – How I Found My First Ever ZeroDay (In RDP)3 people · 3 mentions · first linked 2021-01-01
- Public Statement3 people · 3 mentions · first linked 2019-04-19
- CVE-2024-38063 – Remotely Exploiting Windows via IPv63 people · 3 mentions · first linked 2024-08-28
- Petya Ransomware Attack – What’s Known2 people · 3 mentions · first linked 2017-06-27
- Mapping Mirai: A Botnet Case Study2 people · 2 mentions · first linked 2016-10-04
- Best Programming Languages to Learn for Malware Analysis2 people · 2 mentions · first linked 2018-03-19
- Exploring Peer to Peer Botnets2 people · 2 mentions · first linked 2017-05-12
- YouTube’s Policy on Hacking Tutorials Is Problematic (2019)2 people · 2 mentions · first linked 2019-07-04
What Hacker News says?
The "instruction hacking.." bit at the end seems a bit out of place given the rest of the page. What it feels like is that its a poorly written attempt to ban software cracking and the computerized version of the previous "Instructional theft" ban without giving people the mental strings to discover how to get free warez and bypass things like hotel keycards, free token cards for the arcade/etc. Frankly, I'm frequen…
Comment linking /2019/07/youtubes-new-policy-on-hacking-tutorial-is-a-problem.html
on “YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube”Submitted Accidentally Stopping a Global Cyber Attack as a story · 1981 points
HN discussionMalwareTech wrote a blog about it: https://www.malwaretech.com/2017/05/how-to-accidentally-stop...
Comment linking /2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted Every Reason Why I Hate AI and You Should Too as a story · 71 points
HN discussionhttps://www.malwaretech.com/2016/01/exploring-peer-to-peer-b...
Comment linking /2016/01/exploring-peer-to-peer-botnets.html
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted Every Reason Why I Hate AI and You Should Too as a story · 64 points
HN discussionThis might be relevant: https://www.malwaretech.com/2022/11/everything-you-need-to-k...
Comment linking /2022/11/everything-you-need-to-know-about-the-openssl-3-0-7-patch.html
on “OpenSSL 3.0.7 fixes X.509 email address buffer overflows”Submitted Surviving reformats by infecting the hard disk firmware as a story · 64 points
HN discussionHere it is > For anyone still into IRC, MalwareTech has partnered with sigterm.no to launch a new IRC network. It’s still fairly new so don’t expect an instant response, but everyone is welcome (socializing or just asking for help). https://www.malwaretech.com/2014/10/new-irc-launc.html
Comment linking /2014/10/new-irc-launc.html
on “Researcher Who Stopped WannaCry Ransomware Detained in US After Def Con”Submitted Bootkit Disk Forensics – Part 1 as a story · 26 points
HN discussionI found this explanation pretty convincing as to why there was such a dumb kill switch embedded in the malware: "I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis" From https://www.malwaretech.com/2017/05/how-to-ac…
Comment linking /2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
on “Rejection Letter”Submitted Analysis of CVE-2019-0708 (BlueKeep) as a story · 18 points
HN discussionHe applied for GHCQ but while waiting for clearance, he was offered a better job offer. https://www.malwaretech.com/2016/05/infosec-without-degree.h...
Comment linking /2016/05/infosec-without-degree.html
on “Doxing the hero who stopped WannaCry was irresponsible and dumb”Submitted Bootkit Disk Forensics – Part 2 as a story · 5 points
HN discussionSee this: https://www.malwaretech.com/2015/04/hard-disk-firmware-hacki... Not definitive for the whole product line, but at least evidence of one popular WD drive with a Marvell/ARM controller. Google "Western digital Marvell" for more...like https://www.prnewswire.com/news-releases/marvell-achieves-si... (over one billion WD units with Marvell/ARM chips on board)
Comment linking /2015/04/hard-disk-firmware-hacking-part-1.html
on “Western Digital Plans to Ship More Than One Billion RISC-V Cores a Year”Submitted An in-depth look at hacking back, active defense, and cyber letters of marque as a story · 4 points
HN discussionThis person got pretty far with the Marvell ARM WD drive controller in 2015: https://www.malwaretech.com/2015/04/hard-disk-firmware-hacki... Also see: http://spritesmods.com/?art=hddhack&page=1
Comment linking /2015/04/hard-disk-firmware-hacking-part-1.html
on “Verilog sources for Western Digital's open source RISC-V core”Submitted Marcus Hutchins – How I Found My First Ever ZeroDay (In RDP) as a story · 4 points
HN discussionHe named his own blogpost of the incident "How to Accidentally Stop a Global Cyber Attacks". He thought it was trying to spread like a worm, and they followed standard procedure to register the domain and black hole the traffic. https://www.malwaretech.com/2017/05/how-to-accidentally-stop...
Comment linking /2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
on “Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack”Submitted The US Needs a New Cybersecurity Strategy: More Offensive Cyber Operations Isn' as a story · 3 points
HN discussionYou could reformat the drives but what if someone has infected the firmware on the drive? Check out: https://www.malwaretech.com/2015/04/hard-disk-firmware-hacki...
Comment linking /2015/04/hard-disk-firmware-hacking-part-1.html
on “DoD: Turn Off Your Fitbit, Garmin, Apple Watch GPS”Submitted Best Programming Languages to Learn for Malware Analysis as a story · 3 points
HN discussionYes. This is very easy to install using PFsense inside a virtual machine. Here's a guide that is recent and I can confirm that it works: http://www.malwaretech.com/2015/08/creating-ultimate-tor-vir...
Comment linking /2015/08/creating-ultimate-tor-virtual-network.html
on “Apple Jumps on the WebRTC Bandwagon”Submitted CVE-2024-38063 – Remotely Exploiting Windows via IPv6 as a story · 2 points
HN discussionEdit: just read this ... In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). https://www.malwaretech.com/2017/05/how-to-accidentally-stop... Does someone have…
Comment linking /2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
on “WannaCry – New Variants Detected”Submitted A Realistic Look at Implications of ChatGPT for Cybercrime as a story · 2 points
HN discussionThe point of the killswitch is to detect if the worm is running inside a sandbox. Some sandboxes will resolve any domain you try to ping, so an easy way to detect this is to ping a non-existent domain name. I'm not totally sure how pinging an existing domain would give you the same behavior, but doing something like checking a handful of random non-existent domains from a large list could do the trick. From the soun…
Comment linking /2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
on “WannaCry – New Variants Detected”Submitted YouTube’s Policy on Hacking Tutorials Is Problematic (2019) as a story · 2 points
HN discussionFrom https://www.malwaretech.com/2017/05/how-to-accidentally-stop... , posted earlier: <quote> In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). I believe t…
Comment linking /2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html
on “WannaCry – New Variants Detected”Submitted I Found My First Ever ZeroDay (In RDP) as a story · 2 points
HN discussion
