Information Security
A security researcher purchased three routers advertised with "lifetime VPN" and discovered unsegmented networks exposing dozens of users, default admin:admin credentials, SSH backdoors for sellers, and servers running on $2.50 hosting.
Information Security
An investigation revealing how telecom carriers legally sell website visit data, call metadata, and geolocation to marketing agencies — enabling stalking, fraud, and corporate espionage for pennies.
Information Security
A security researcher discovered that Telegram's auto-delete feature on Android left images in an open cache folder. After months of delays, Telegram offered a €1,000 bounty — but with an 8-page NDA that demanded unlimited confidentiality, even over tax documents.
Information Security
A security researcher purchased five budget button phones and discovered that four contained undisclosed malicious functionality, including tracking, premium SMS trojans, and SMS-intercepting backdoors.
Information Security
Short answer: they don't, they don't care. A detailed account of multiple Skype security vulnerabilities that Microsoft refused to fix for years, including mass-report account blocking, weak security codes, and social engineering via support chat.
Information Security
A security researcher discovers an Android trojan disguised as a popular marketplace app, investigates the botnet infrastructure, and accidentally takes it down while searching for vulnerabilities.
Information Security
A security researcher chains five low-severity OAuth vulnerabilities together to gain full access to any GitHub user's private repositories, earning a $4,000 bug bounty.
Information Security
An analysis of Telegram's MTProto protocol reveals a suspicious modification to the Diffie-Hellman key exchange that could theoretically allow the server to perform undetectable MITM attacks on secret chats.
Information Security
A fascinating case study of how attackers chained together Amazon, Apple, Gmail, and Twitter vulnerabilities using only publicly available information to hijack all accounts and remotely wipe all devices.
Information Security
A freelancer hired to configure an email server stumbles upon an active intruder's screen session, discovers replaced SSH binaries, a Linux rootkit, and has to rescue the system from cascading segmentation faults.
Information Security
The story of a remarkable Cold War espionage device — a steel cylinder packed with tons of electronics and a plutonium power source, designed to tap into armored Soviet submarine communication cables in the Sea of Okhotsk.
Information Security
A first-person account of discovering an ATM skimmer in the wild, with detailed explanations of how skimming devices work, how criminals install and operate them, and practical tips for protecting yourself at ATMs.