Blog

how ransomware encrypts your files so fast (and where the design breaks)

ransomware encrypts tens of thousands of files in minutes. that raises an obvious question: encryption is supposed to be slow and heavy, so how is a random payload on your machine chewing through a whole drive faster than your antivirus can react? the answer is that it never actually encrypts your files with the big key. it uses the classic hybrid scheme, and once you see the structure, you also see where it's fragile.

dga domains: how malware finds its c2 without hardcoding an ip

imagine you write malware and hardcode your command and control server as an IP. one day someone blocks it, or it gets taken down, and every infected machine you ever compromised goes dark forever. that's a terrible business model for a criminal. so modern malware solved it with one of the sneakiest tricks in the book: instead of storing where the server is, it computes it. hundreds or thousands of candidate domains per day, and the attacker only needs to register one

what happens when you delete a file (and why recovery works)

how cgroups and namespaces become a container (our beloved docker for example)

auditd: actually catching what changed on your server

living off the land: why modern attacks use your own tools instead of malware

dns tunneling: exfiltrating data through port 53

explaining deeply how the dns tunneling work

reverse shells: how attackers keep control after the break-in

explaining how the reverse shell work and why we don't use the bind shell

how a TCP connection actually starts and ends

how a TCP connection actually starts and ends (the 3-way handshake, on the wire)

how DNS actually works

explaining how dns work after years of using it

nuitka vs pyinstaller

binary builder for python

deploy serverless infrastructure with openwhisk

making your own serverless infrastructure to deploy your functions on

T-Pot: All-in-One Honeypot for Cybersecurity

a multi-honeypot platform that helps you detect and analyze cyber attacks

Why NAT Traversal Breaks P2P Apps (And How to Fix It)

wg-easy: the easiest way to setup a vpn

a web interface for your wireguard to setup and maange

Scaling PostgreSQL with Sharding

scaling postgres database for high traffic use case and optimizing