Research
Vulnerability research, teardowns and the occasional opinion about how we build systems. 9 posts, written between 2016 and 2025.
Drive capacities kept growing; unrecoverable read error rates did not. The arithmetic behind why a RAID 5 rebuild on modern disks is a bet you may lose.
A look inside VEEAM Backup Service's defences against ransomware: inline encryption detection, the incident API, and what they realistically catch.
An XML External Entity injection in the Magic xpi Integration Platform, found during an assessment: path disclosure, outbound connections, and the road to CVE-2023-52239.
Teardown and firmware analysis of a consumer WiFi camera: exposed services, the WLAN key stored in plaintext, and an admin password baked into the mobile app.
Single-page applications reach for JSON Web Tokens by default. For session handling that is usually the wrong trade. Here is what it costs you.
An integer underflow in 7-Zip's PPMd codec, surfaced by a week of AFL++ coverage-guided fuzzing. How the bug works, and why reaching it is harder than it looks.
An Android app disguised as a calculator promised to lock away your photos. It left them readable on external storage. Two CVEs and a look at the disclosure.
Wireshark dissectors can be written in C or in Lua. We benchmarked both across compiler optimisation levels to find out what the convenience actually costs.
Lenovo ships firmware updates as bootable Windows images. Getting a UEFI update onto a ThinkPad from a Linux-only machine, step by step.
No posts with that tag.