Notes & essays
threat intelligence, making things, and the occasional long run.
No entries match that search.
The Mistaken PowDesk Threat Intel
How legitimate software was mistaken for malware, and how that attribution spread through threat intelligence.
Golang Detection Notes
Experiments with Go binaries, string storage, and YARA signatures across platforms and CPU architectures.
How to do good work in Cyber Threat Intelligence
Four ideas for producing defensible, useful intelligence and helping an entire team do better work.
Omnipotent adversary fallacy — should you give up your asymmetric advantages in cyber threat intel?
What defenders give up when they assume an adversary can see and do everything.
Common Cyber Threat Intel Biases
Recognizing the habits and assumptions that can quietly distort an intelligence assessment.
The life lessons of faceplanting
A lesson from the trail, learned the hard way.
YARA hunting in ancient civilizations
An ancient city, a suspicious shipment, and a different way to think about detection.
Do fake accounts on twitter affect stock prices?
An experiment in fake accounts, market signals, and the difficulty of drawing a useful conclusion.
Pragmatic Detection of GAN Profiles
Practical techniques for identifying synthetic profile photos, with examples and limitations.
LinkedIn GAN Network Analysis
Following connections through a network of likely inauthentic LinkedIn profiles.
How accurate are IHME models in Sweden?
Examining Sweden’s COVID-19 data and the accuracy of early IHME projections.
Stonecat Race Report — First 50 miler
Notes from a first 50-mile race at Stonecat.
Captchas to defeat SSH brute force attacks
In between the 6,000 ssh brute force attacks I receive everyday I try to come up with some clever countermeasure.
PHP Email Injection - Step by Step Part 1
I recently got to have a little fun with a colleague (who will remain nameless) who was using a PHP script for a contact form.
Cisco Botnets?
I've never heard of a Cisco botnet but I suppose it's possible.
You Are the Weakest Link!
Third-party browser plugins, ActiveX controls, and the limits of patching only Windows and Internet Explorer.
Update on ddabx.dll
I get a ton of hits to my blog from search engines for the string "ddabx.dll".
Paper: Anatomy of a Phish III
Notes on Michael Ligh’s Anatomy of a Phish III and the phishing tools and techniques examined in the report.
Snort sigs for latest Java Malware
Here are some snort signatures to detect a couple of recent pieces of Java malware.
More Information on Java Exploit
I've come across some additional information on the java exploit story.
Old Java Bug exploited from Ukraine
It's nothing new to see pages that use two or more browser vulnerabilities to infect innocent browsers.
Moving Browsing to the Edge
The latest 0-day exploit for Windows caused me to reflect a bit on how we do "browsing".
Help Wanted: Identify these security nuggets
I've recently come across a couple of incidents with some odd data.
Howto: Getting Remote Access to Windows Behind a Firewall
There are several services available to get remote access to your Windows PC such as gotomypc.com, logmein.com and many others.
New Java exploit site in the Ukraine
Every day I come across new sites hosting exploits and it's always tough to tell if it's something new or just a rehash of an old exploit.
Even the experts get hacked
In a somewhat disturbing incident the Washington Post reports that digital forensics company Guardian software was hacked in November.
Opening the Door to Security
This story just goes to show that good security isn't always about the latest high-tech flashy security devices, sometimes a little more is needed.
Vmware presentation on security
Vmware has a great presentation on security from VMWorld 2005.
PHP Email Injection
SecurePHP is carrying an article on email injection in the php mail() function.
Resources for VMM Based Security
While I'm working on some new research on practical implications of VMM security I thought I'd share some of the resources I've been working with.
Update on Virtualizing Overflows
I had some great feedback and discussion with a number of individuals on the Virtualizing Buffer Overflows post.
Job Benefits: Identity Theft Assistance
It's always nice when your employer has benefits that help you with the little things in life.
New Gmail Feature: False Security
On Wednesday Google added virus scanning to their gmail service.
Security using virtualization
In the course of some light research for Virtualizing buffer overflows I came across some interesting research from a couple of researchers at Stanford on using virtual machine monitors…
Virtualizing buffer overflows
Exploring the security implications of a virtualization host’s ability to modify a guest’s memory and execution.