Clik here to view.
Tracking Signal Identifiers
In the past few days Signal groups exploded in the news with revelations that Signal groups are the primary "ICE tracker" channels, may have dispatched Alex Pretti to his fatal encounter with DHS, and...
View ArticleClik here to view.
schadnfreude
You'll be happy when they can't spy on you. 🖧 Schadnfreude is a new end-to-end encrypted, anonymous ID and IP-hiding, decentralized, audio/video/file sharing/offline messaging multi-device platform...
View ArticleCovert credit calculation communications
Record numbers of people have been in the market for a house this past year. Now working at home, I also bought a house, with an office. Finding one in this market was frenzied, but I spent as much...
View ArticleClik here to view.
Moving Off Google
Not long ago, a well-known games developer posted the following horror story: I have used and been burned by a number of Google services over the years but certainly didn't think that attitude would...
View Articlerustun – Virtual Not Private Network in 100 Rust lines
While stuck at home I wrote a simple Linux tunnel ("VPN" but not encrypted/authenticated) in 100 lines of Rust. This is a PoC, not an OpenVPN replacement; just sending the IP layers and above over...
View ArticleClik here to view.
Stream Securely: Simply and Privately Preserving Live Video Evidence
Cell phone video has been a major game changer for society. While most cell videos are just for fun, some have also been critical as evidence to document acts of aggression, violence, and other...
View ArticleClik here to view.
Dispelling Decentralization Doubts
Recently at the 36th CCC, Moxie Marlinspike gave a talk titled "the ecosystem is moving" defending his choice to centralize Signal, claiming decentralized systems are unable to adapt and succeed and...
View ArticleShould there be restrictions on the release of hacking tools?
This is a text outline of the interactive version available here 1.1. No. Authors of such software should decide for themselves what the best release policy should be 1.1.1. Pro: Authors of security...
View ArticleInterface Identifier (IID) list
Interface Identifiers (IID's) are used to obtain function tables to call most methods of COM objects. In source code, a name like IID_Column will be used, but when this is compiled, the binary will...
View ArticleClik here to view.
Windows 10 Decontamination Scripts
Recently my personal laptop fell on some hard times and had to be sent to the laptop retirement home. The one hesitation I had with getting a new one was dealing with Windows 10. It has some security...
View ArticleSigned Malware
I recently saw a quote on Twitter along the lines of "I couldn't be in threat intel because I'd get too carried away, go too far, and end up calling some hacker's mom." I had to laugh since I can...
View ArticleHack-back in the Real World
ProtonMail just recently (yet briefly) bragged about shutting down a phishing campaign that it was the target of by hacking back the phishing server. (link) The phishers had obtained access to the...
View ArticleHoarder
A few years ago, I gave a DerbyCon presentation on the Ambush open-source host intrusion prevention system I was working on, as well as evasion techniques you can use against systems like that,...
View ArticleSupply Chainsaw: Practical software supply chain attacks for everyone
I recently presented Supply Chainsaw: Practical software supply chain attacks for everyone at the OPCDE technical security conference in Dubai. In between pictures of Sharknadoes and memes were an...
View ArticleGoals
In any complex system, a solution that best meets one goal will fall short in other areas. Computer programs to solve nearly any problem in the fastest manner will not be the algorithms that use the...
View ArticleClik here to view.
Climate Change Archive
For another short detour from information security... Climate policy is again in the news. The past year has seen record high temperatures, the election of a US President who claimed global warming was...
View ArticleClik here to view.
Just Too Much Administration – Breaking JEA, PowerShell’s New Security Barrier
Update - 10/9 The PowerShell team has been very responsive in addressing these issues. The documentation should be updated soon (if not yet). Lee Holmes from the PowerShell team also addressed these...
View ArticleIntercepting Passwords to Escalate Privileges on OS X
A few weeks ago, a lot of attention was paid to Dropbox for "hacking" macs. Dropbox asked for your admin password when it was installed, then used that root access to enable privileges later even if...
View ArticleThe Security Pretend Game – Sudo and Runas
tl;dr? Use completely unprivileged accounts for day-to-day tasks, then log out and log in with a privileged, trusted account for privileged tasks; don't use runas or sudo from your day-to-day account;...
View ArticleClik here to view.
Defying Analysis With Sparse Malware
If you're writing tools for red teaming or pentesting, the main point of your backdoors, or implants as people are starting to call them, is to enable remote control of a system without being detected....
View Article
