July 8, 2026
• Project
A headless watcher that monitors a loyalty-program account, detects any change to its activity history (including edits and deletions of old rows), and alerts me on Telegram. It only reads my own account. About 900 lines of Python with 60 unit tests, built in three days.
Architecture fetch, diff, alert, then persist. Each run captures the account’s data, diffs it against stored state, sends one message summarizing changes, and only then saves the new state.
Read more →June 3, 2026
• 2 min read
Written up in October 2026. Dates are when I actually built it.
Reviewing your own code like you’re attacking it is humbling. I did that to my events collector and found a good one.
The bug /admin/send-digest emails every subscriber, and it sat behind HTTP Basic Auth. The check was shaped like this:
1 2 if cfg.basic_auth_user: # verify the Authorization header against configured credentials Read that again. If BASIC_AUTH_USER isn’t set, the whole check is skipped, and the endpoint is open.
Read more →October 22, 2024
Summary Ken Thompson’s legendary 1984 Turing Award lecture demonstrating how a compiler could be backdoored to insert vulnerabilities into code it compiles - including into future versions of itself - leaving no trace in the source code.
The Attack Thompson describes a three-stage attack:
Modify the compiler to recognize when it’s compiling login and insert a backdoor Modify the compiler to recognize when it’s compiling itself and insert the backdoor insertion code Remove all evidence from the source code The result: A compiler whose source appears clean but produces compromised binaries forever.
Read more →July 19, 2024
• 8 min read
About a week ago, I pushed a script to my GitHub that would monitor the Regal Cinemas website for new movies and report it to a Telegram bot. It was decently feature-rich, but I still wasn’t fully satisfied with it. The primary issue I kept noticing was that the bot would properly fire off an alert whenever a new movie was posted to the website, but oftentimes tickets couldn’t be acquired yet because showtimes are updated separately.
Read more →March 13, 2024
• 14 min read
Red Star OS (붉은별 사용자 영체계) is a North Korean operating system based on the Linux kernel. Its development began at the Korean Computer Center in 2002; until that time, English-language versions of Windows were commonly used in North Korea. As of 2018, the latest version of the system is Red Star OS 4.0, it is reported that the fourth version exists and is being tested locally, but at the moment most people in North Korea are still on the third version.
Read more →March 11, 2024
• 8 min read
In computing, firmware is a specific class of computer software that provides the low-level control for a device’s specific hardware. Firmware, such as the BIOS of a personal computer, may contain basic functions of a device, and may provide hardware abstraction services to higher-level software such as operating systems. For less complex devices, firmware may act as the device’s complete operating system, performing all control, monitoring and data manipulation functions. Typical examples of devices containing firmware are embedded systems (running embedded software), home and personal-use appliances, computers, and computer peripherals.
Read more →March 5, 2024
• 6 min read
This is not an article about which web browser is the best (there is no such thing) but an article about which browser has the most connections after a fresh install. The results shouldn’t be a surprise, really.
Of course, not everything is telemetry per se, some of the connections are from the ‘New Tab’ pages that include Youtube videos but I strongly believe that is the same thing: the software leaks information about you and/or your computer without you actually accepting the data exchange (because you don’t have a way to accept or deny the connection since it’s the first time you’re running the browser).
Read more →February 15, 2024
• 2 min read
An OpenPGP Web Key Directory is a method for users to discover the public key of a new contact. The user requests the public key from the contacts an organisation maintains.
Compared to previous key discovery schemes that relied on DNS, WKD can be easily deployed on any HTTPS server because WKD is a lookup scheme that relies on HTTPS and correctly placed files on your web server and no other software is required to run on the web server.
Read more →February 8, 2024
• 2 min read
Introduction Here is a small tutorial on encrypting a Microsoft Azure virtual machine disk.
Preparing the Azure Virtual Machine Enable the Azure Key Vault provider within your Azure subscription.
$ az provider register -n Microsoft.KeyVault Create a resource group in your favorite location (keep in mind different locations enable different features, some VM sizes are not available in other locations).
$ az group create \ --name testResourceGroup \ --location centralus Create an Azure Key Vault and enable the Key Vault for use with disk encryption.
Read more →January 30, 2024
• 4 min read
I decided to make a log of all network connections a standard install of Windows 11 Pro (for ARM, 22H2, OS build 22621.1344) does.
The methodology is the same, standard setup without changing any of the default settings (Privacy ones, for example). Test device is on a clean user profile, all network connections blocked, application-level network connection whitelisting and only Little Snitch installed. So it’s actually Little Snitch that does all the heavy-lifting.
Read more →January 29, 2024
• 2 min read
NetworkManager is a program for providing detection and configuration for systems to automatically connect to networks. NetworkManager’s functionality can be useful for both wireless and wired networks, for wireless networks, NetworkManager prefers known wireless networks and has the ability to switch to the most reliable network.
If you want to reduce someone’s capabilities to track you, you should avoid broadcasting a persistent and likely unique software identifier; an empty (blank) hostname is also an option, but a static hostname of “localhost” is less likely to cause problems.
Read more →January 26, 2024
• 2 min read
LUKS can be used to encrypt a volume that’s stored inside a single file.
Start by creating a 2GB file (1M * 2k) that will hold the LUKS volume and fill it with random bytes. If you’re wondering why the strange filename, Solaris.1971.1080p.BluRay.x264-[YTS.AM].mp4.part, that’s so it is “hidden” as a temporary Transmission torrent file, away from prying eyes (unless your threat model is the NSA). If you want to use a qBittorrent temporary extension, change .
Read more →January 24, 2024
• 3 min read
If you work in security or you like to pretend you work in security, you must’ve heard about BusKill. Every infosec has one of those because it’s so cool pretending to be a 133t hacker and their threat model definitely requires an immediate shutdown of the computer, else the nefarious actors (APT21, APT22, APTsqrt(69)) will retrieve their bloated python scripts. And nobody want to lose their scripts.
But just in case you think it might be interesting to have a way to shut down (and lock, if it’s encrypted) your laptop in case somebody snatches it from your hands, keep reading because I have a solution that doesn’t involve paying those BusKill people your hard-earned pennies.
Read more →January 15, 2024
• 2 min read
You can set-up a VPN killswitch, which is a simple way to ensure that if your VPN connection is dropped, regardless of the reason, the Internet connections are not allowed (and your real IP will not be exposed). And this can be done easily using ufw on any Debian-based distro.
Start by installing ufw if it’s not already installed on your system:
1 $ sudo apt install ufw Configure ufw to deny all incoming and outgoing connections:
Read more →January 12, 2024
• 2 min read
The USBGuard software framework helps to protect your computer against rogue USB devices (a.k.a. BadUSB) by implementing basic whitelisting and blacklisting capabilities based on device attributes.
Basically, USBGuard prevents all unauthorized USB devices from connecting to your machine.
Start by installing it, if you’re running Ubuntu, Debian or other Debian-based distros:
1 $ sudo apt install usbguard Or, if you’re running Fedora:
1 $ sudo dnf install usbguard Make sure all USB devices that you want to be allowed by default to connect to your system are plugged in (don’t worry about the built-in USB devices, like your laptop webcam or Bluetooth module, they get whitelisted automatically), and generate the default policy:
Read more →January 5, 2024
• 4 min read
Warning Do not play with the samples unless you really know what you’re doing. All Windows versions before Windows 10 are still vulnerable to the WannaCry (WannaCrypt, WannaCry, WanaCrypt0r, WCrypt or WCRY) ransomware if not patched for MS-17-010.
The ransom is between $300 to $600, there is code to delete files in the virus, so it’s not just a threat.
The worm loops through every RDP session on a system to run the ransomware as that user, also installs the DOUBLEPULSAR backdoor and it corrupts shadow volumes to make recovery harder.
Read more →