The research reconstructs IBM i 7.5’s 32-byte Program Validation Value (PVV), which checks whether selected serialized program data is consistent. By tracing IBM’s object-integrity checker into Licensed Internal Code, the author derives the PVV’s HMAC-SHA-256 calculation: the system canonicalizes selected program data, normalizes saved pointers, builds a descriptor from program attributes and fixed LIC constants, and compares the result with four stored values. The descriptor contains no separate secret for authenticating a program’s origin, so anyone with the serialized program and the algorithm can recompute its PVV. Digital signatures provide origin checks where required; save-file checks and restore policy remain separate controls.
The implementation matched all 1,223 known-valid values in its supported corpus, with no unexplained mismatches, and parsed 1,239 of 1,256 attempted items. In controlled tests, repairing the PVV and separate save-file checks let selected native-instruction changes survive restore and resave. An ordinary USERB1 account restored a modified, USERB1-owned program through IBM’s restore API, and the resulting executable matched code demonstrated in a runtime test. The test showed USER-state code reading a USER-domain buffer, not crossing into the protected SYSTEM domain. IBM i rejected unsigned SYSTEM- and INHERIT-state variants. The findings demonstrate a constrained way to run altered native code, not a general bypass of IBM i’s domain protections.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.