Conntrack Laundering: Bypassing Linux Firewalls
Two packets poison conntrack. A SYN walks through ESTABLISHED. How attackers reach services a Linux host firewall blocks.
Tagged: Detection
Results
3 entries, newest first
cfcanary: steal these credentials
Leave fake credentials where they shouldn't be touched. Get an alert when they're used. Canary tokens on your domain, in your Cloudflare account.
TCP over Microsoft Teams: a covert C2 channel for bulk data transfer
I tunneled a real IP link through Teams video calls by hiding packets in H.264 SEI NALs: 2.15 Mbps over three bonded meetings, byte-verified.
An eMudhra CA private key was literally 4
An approved export test derailed eMudhra's key ceremony. Eight weak CA keys got certified. Why did a legitimate deployment need this procedural exception?
Giant Steps: an adversarial audio modem that survives noise cancellation
Voice calls erase modem tones. I built a Rust modem that sends bytes as vowels and uses the spare pitch channel to play Coltrane. Listen to it work.
BrowserDefense: The browser is part of the endpoint
Browser-side telemetry for detection and response, with a working demonstration of Shadow Detection following page structure across changing domains.
From a U.S. Defense Contractor to Chinese Crypto Thieves
Tracing Coruna's spread into Chinese crypto theft through recovered iPhone exploits, wallet-stealing code, and a 5,000-USDT retail integration offer.
Dynamic Code Loading: But you consented, right?
Similarweb's extension harvests AI chats and browsing history. A remote server supplies its next instructions. Why does Google let it?
I put a Fly Brain in an RC car to sniff WiFi
I wired a simulated fly brain to an RC car, turning WiFi into smell and neural spikes into motion. What worked, what broke, and what still needed my code.
I Became the Action Replay for My Truck
Root in my truck’s Android head unit was trapped by SELinux — until I flipped one byte, rewrote my identity, and raced Mario Kart on the dashboard.
Inside UNC6671's Browser Implant
Source analysis of UNC6671's Chrome implant: DevTools control, keylogging, storage theft, camera capture, and durable detection.
I Nearly Hit Dial-Up Speeds Over a Guitar Cable
A from-scratch OFDM modem in Rust: almost 28.8k over a 30-foot guitar cable, plus a checksum-valid TCP/IP link over virtual audio.
No results.