Dec 14, 2022 - 50 Domains Worth Blocking: The Evolution of ViperSoftX's Underreported DGA
ViperSoftX is a multi-stage cryptocurrency stealer which is spread within torrents and filesharing sites, responsible for stealing hundreds of thousands of dollar-equivalent funds, mostly from individual users. Nearly three years after it was originally discovered, this malware campaign has more surprises in store, and I'm digging into its dropper/C2 ops. The first article of a series. Read more

Dec 9, 2022 - Request Amplification in Mastodon
Mastodon is a great replacement for Twitter, but who knew it was also a replacement for LOIC too? I'm joking - but an observed traffic amplification factor of over 36,000:1 isn't very funny, especially not for 'intended behavior.' Read more

Jun 5, 2022 - Cross-Certificates in Practice: HARICA's Root CA 2021 Transition
HARICA - the only non-DigiCert certificate authority offering .onion certificates (for Tor hidden services) - has recently switched over to signing new certificates with their 2021 CAs. Here are some cliff notes on how to use HARICA's cross-certificates in your trust chain if that becomes a problem for you or your website viewers. Read more

Mar 10, 2022 - How I'm Avoiding Your Unsolicited Calls
It's pretty sad that I'm paying money for a phone number to post online, specifically to get it pulled into the tools used by the multi-hundred-billion-dollar talent and marketing industries, just to have some peace and quiet during the day. In case you want to do the same, here's what I do and what (little) it took. Read more