Mirai: how a Minecraft DDoS service broke the internet
11 min read
Ten Years Ago Today On the morning of September 20, 2016, the website of a lone security journalist went dark under a flood of junk traffic that peaked at…
Security Notes
Practical write-ups on application security, threat modelling and defensive engineering, for people who ship software.
All posts
The Bangladesh Bank SWIFT heist and the typo that saved $850M
10 min read
I have enough well sourced material across primary and credible reporting, plus four verified images. Writing the post now. The printer that wouldn't print On…
Passkeys: what they fix and the account recovery hole
11 min read
I have enough well sourced material. Writing the post now. The login that cannot be phished, and the back door that can In the summer of 2023, the casino giant…
Why password rotation policies died and auditors still ask
12 min read
The ritual nobody could explain Every ninety days, a message used to greet millions of office workers at login: Your password has expired. Please choose a new…
DigiNotar: the certificate authority that ceased to exist
12 min read
I have enough well sourced material and four verified images. Writing the post now. The email that broke a country's internet On the morning of August 28,…
Velociraptor: hunting one IOC across a fleet of endpoints
11 min read
I have enough well sourced material and four verified direct image URLs. Writing the post now. The one hash problem Picture the worst kind of Tuesday. A threat…
HTTP request smuggling: exploiting front-end and back-end disagreement
10 min read
The two clock problem In August 2025, a security researcher spent two weeks sending carefully malformed web requests at large companies and walked away with…
DNS exfiltration and how to detect it in your own logs
12 min read
The lookup that picked the victims In December 2020, SolarWinds told the SEC that fewer than 18,000 customers…
Does phishing simulation training actually work?
11 min read
I have strong, well dated sourcing and three verified direct image URLs. Writing the post now. The \$650 That Wasn't There In mid December 2020, roughly 500…
Stuxnet: four zero-days and one centrifuge plant
10 min read
The centrifuges that tore themselves apart Sometime in late 2009, inside a hardened hall buried eight metres under the desert near the Iranian town of Natanz,…
The Impacket toolkit: what each script actually does
11 min read
In October 2022, the U.S. Cybersecurity and Infrastructure Security Agency published an advisory https://www.cisa.gov/news events/cybersecurity advisories/aa22…
Alert fatigue and the math of false positives in a SOC
11 min read
All sources and images confirmed. Writing the post now. The alert that no one answered On November 30, 2013, a piece of malware called back to its command…
Device code phishing against Microsoft 365
12 min read
All images verified. I have enough from primary sources Microsoft, Volexity, RFC 8628, Microsoft Learn, Huntress/Unit 42 reporting . Writing the post now. A…
What a bug bounty actually pays per hour
12 min read
The Write tool is disabled, and the task is to return the post itself. Here it is: The headline number, and the number underneath it In March 2019, a 19 year…
Prompt injection in LLM apps: attacks and mitigations that hold
11 min read
A single email, zero clicks, and nothing the user could have done In January 2025, researchers at Aim Labs sent an ordinary looking email to a Microsoft 365…
Nuclei: writing a custom template for an uncovered vulnerability
11 min read
I have thorough, well sourced material and four verified images. Writing the post now. The five hour window When researchers disclosed a critical flaw in the…
NIS2 and DORA in practice for EU companies
11 min read
The morning the four hour clock started At 17:00 on a Tuesday, a payments processor serving several mid sized European banks notices that transactions are…
Breaking into security without a degree
10 min read
The paradox at the front door In the summer of 2025, a mid sized managed security provider posted an opening for an "entry level SOC analyst." The listing…
Timing side channels explained in fifty lines
13 min read
The sixteen cycles that broke TLS In early 2013, Adam Langley measured how long OpenSSL took to reject a corrupted TLS record. When the record claimed a large…
The attribution problem: why nation-state claims are probabilities
11 min read
I have thorough research across primary sources and multiple cases. Now I'll write the post. The night the Olympics went dark At 8 p.m. on 9 February 2018, as…
Atomic Red Team: simulating ATT&CK and finding logging gaps
11 min read
The alert that never came A red team operator opens a PowerShell window on a Windows workstation and types a single line. It downloads a script into memory and…
Trivy in CI: container scanning without the noise
12 min read
I have solid, well dated sourcing and four verified images. Writing the post now. The Wall of Red A developer opens a pull request to bump a base image from…
SSRF into cloud metadata: reproducing Capital One in a lab
11 min read
I have enough well sourced material. Writing the post now. The email that ended it arrived on a Sunday On July 17, 2019, someone sent a message to Capital…
Semgrep: custom rules for your own codebase's bad patterns
12 min read
The bug that grep can't see Somewhere in a large codebase right now, a developer is writing subprocess.call cmd, shell=True . It compiles. The tests pass. The…
NotPetya and Maersk: rebuilding from one surviving domain controller
12 min read
I have everything I need: the definitive Wired account, primary technical analyses from Kaspersky and ESET, official UK and US attribution statements, and four…
The Arup deepfake: $25M lost on a synthetic video call
10 min read
I have enough well sourced material and four verified Wikimedia image URLs. Writing the post now. The meeting that never happened Early in 2024, a finance…
Vastaamo: when stolen therapy notes became individual extortion
11 min read
Now I'll write the post. The email that arrived in tens of thousands of inboxes In late October 2020, roughly thirty thousand Finns opened an email that told…
How ransomware negotiation actually works
11 min read
The eight hour conversation nobody wants to have Somewhere right now, in a chat window that looks a lot like a retail help desk, a stranger is typing to a…
Open source maintainer burnout as a supply chain risk
12 min read
I have eight plus credible sources and four verified images. Writing the post now. A half second that saved the internet In late March 2024, a Microsoft…
The XZ Utils backdoor: a three-year social engineering campaign
11 min read
I have strong, well sourced material and four verified images. Writing the post now. The 500 millisecond anomaly In late March 2024, a Microsoft engineer named…
YARA and Sigma: writing detection rules from a real sample
11 min read
I have everything I need: verified primary sources and four confirmed images. Writing the post now. The domain that stopped the world's worst worm At 7:45 in…
Flipper Zero and RFID cloning: hype versus reality
13 min read
A door that opens in under five seconds Walk up to a badge reader in an older office building, hold a \$169 orange and white plastic brick against it, press…
Cyber insurance: what gets excluded when you claim
11 min read
I have thorough sourcing and five verified images. Writing the post now. The \$1.4 billion argument over what counts as war In the summer of 2017, a piece of…
CVSS is a broken prioritization tool: use KEV and EPSS
12 min read
All four images verified. Now I'll write the post. The number that broke triage A mid sized company runs a vulnerability scan on a Monday morning and gets back…
Sysmon and Wazuh: building a detection homelab end to end
11 min read
The alert that isn't there Most home networks are compromised in silence. A machine gets a malicious Office macro, a process spawns powershell.exe with an…
Target's HVAC vendor: ten years of third-party access lessons
11 min read
I have thorough, well sourced material. Now I'll write the post. The thermostat that wasn't Here is the detail that almost everyone gets wrong about the most…
Subdomain takeover: finding dangling DNS records at scale
14 min read
In November 2024, a team at watchTowr Labs went shopping for garbage. They looked for Amazon S3 storage buckets that organisations had once used and then…
Volatility: pulling credentials and injected code from memory
11 min read
The evidence that evaporates Turn off a computer and the assumption is that whatever it was doing vanishes. The passwords a user typed, the encryption keys…
MGM Resorts: a ten-minute help desk call versus the security stack
10 min read
The ten minute phone call On September 11, 2023, guests at some of the most profitable hotels on the Las Vegas Strip found themselves standing outside their…
Dependency confusion: testing your own organization for it
11 min read
I have strong, well dated sourcing Birsan's own disclosure, the Microsoft whitepaper, PEP 708, Sonatype's telemetry, Include Security's technical analysis, the…
BloodHound: mapping and fixing Active Directory attack paths
11 min read
I have well over eight credible sources and four verified images. Writing the post now. The map that assumes you are already inside Picture a penetration…
Lapsus$: teenagers versus nine-figure security budgets
11 min read
Now I have everything. Here is the post. The Fire Stick in the Travelodge In September 2022, a 17 year old sat in a Travelodge hotel room in Oxfordshire. He…
CyberChef: fifteen tasks that would otherwise need a script
11 min read
A recipe instead of a script You are three coffees into an incident. A colleague pastes you a single line pulled out of a suspicious email attachment:…
Ghidra from zero: reversing your first crackme
12 min read
I have everything I need. Writing the post now. The dialog box that will not open There is a specific kind of frustration that turns people into reverse…
Living off the land: detecting legitimate binaries behaving badly
10 min read
I have strong, verified material and four confirmed image URLs. Writing the post now. The intruder who never brought a weapon In late 2023, investigators…
Hashcat: rule-based attacks and why complexity rules fail
10 min read
I have solid research and four verified, relevant images. Writing the post now. The password that obeys every rule and protects nothing P@ssw0rd1 is a good…
JWT attacks: alg confusion, key injection, and library failures
11 min read
I have solid material from primary sources and four verified images. Writing the post now. The token that trusts itself In March 2015, a security researcher…
Kerberoasting explained from the Kerberos protocol up
10 min read
The click that unlocked 140 hospitals In February 2024, a contractor working for Ascension, one of the largest hospital systems in the United States, clicked a…
LastPass: how a home media server extended a breach
10 min read
I have everything I need. Here is the post. The front door was a movie library In late 2022, the login credentials protecting the encrypted password vaults of…
Wireshark: identifying C2 beaconing by timing patterns
11 min read
I have strong material from more than eight independent sources plus three verified images. Writing the post now. A sixty second heartbeat Somewhere on a…