Strange Tales from the Cybersecurity World · 86 articles
Articles written since 2015 for my WeChat account 网安志异: hacker history, security techniques, Bitcoin and the Lightning Network, Phrack magazine, and a few essays on AI and consciousness. The originals appeared on WeChat; these are the cleaned-up, uniform versions. The articles themselves are in Chinese; titles and ledes are in English.
-
2026-10-02Out of the more than 13,000 AI-built apps on One's Vibe, 342 are security projects, and the most striking pattern among them is AI's spear being turned against AI's shield. A closer look at three: ARTEX has multiple agents plan penetration tests autonomously, and even surfaces a lead on attacks against South Korean financial targets; Targe flips the script and red-teams LLM endpoints; Threatwake squeezes the ten threat-intel tabs you open every morning into a single screen. Behind them lies a double-edged sword that cuts for attackers and defenders alike, along with the steady turning of narrow security workflows into software.
-
2026-08-07How could an unconscious universe give rise to purpose? Starting from the molecule in Deutsch's account that happens to help bring about its own reappearance, this piece looks at how selection, with no designer, turns “staying in existence” into an objective criterion, how purpose comes in layers, and how meaning is written into structure before it is ever felt. Large language models serve as a contrast: they have knowledge, yet have never staked their own survival on anything. Finally, it asks why consciousness emerged at all.
-
2026-08-07Natural selection writes meaning into genes, but too slowly, so life began computing meaning in real time, inside the body. Sensation models the world. Valence compresses it onto a single axis of good and bad. Pain lets meaning be felt for the first time. Attention allocates limited computing power. The self becomes the origin of the coordinate system, and self-awareness turns the computation back on itself. Finally, a question about AI, the neocortex outside the body: will it forever compute only for human purposes?
-
2026-08-06The same rain means something different to a farmer, a traveler, and someone caught in a flood. Tracing a path from the directionality that needs no consciousness, as in Fermat's principle and the increase of entropy, through life sustaining itself, to humans questioning purpose itself, this essay treats consciousness as an evaluation function organized around purpose that eventually turns back to examine itself. It then considers the borrowed purpose and meaning of large language models, and finally returns to the starting point of existence.
-
2026-06-06From Andreessen's "software is eating the world" to "software is being eaten by AI" took just fifteen years; from Copilot completing a few lines to Claude Code delivering an entire code tree took barely three. Data, code, model training, vulnerability hunting: as each job is handed over to AI, all that stands between it and self-improvement is chips, compute, and energy. Every time we hit Enter on "Yes," are we handing over the last of our decision-making power along with it?
-
2025-12-19A little over a decade ago, HTTPS was something only banks and e-commerce sites bothered with: certificates cost money, the process was manual, and an expired certificate meant an outage. From the founding of ISRG and the ACME protocol handing domain validation over to machines, to billions of free certificates, this is a look back at how security went from an extra burden to a baseline assumption. When the right thing is also the easiest thing, the world changes without having to be persuaded.
-
2025-11-27My friend Jj sent 11 BTC into a cross-chain bridge. The xBTC was clearly minted, yet it sat stuck in an intermediate contract and never reached his wallet. Support blamed RBF, the backend threw one error after another, and nearly two days went by with no progress. In the end, he dug the depositKey out of the logs, called finalizeDeposit by hand on Etherscan, and completed the step the automated process had missed.
-
2025-10-31He got his start on old computers his father pieced together from dumpster finds, and at fourteen he was arrested for changing his grades with an Excel macro virus. He went on to work as a goth industrial musician and as a programmer for a massage chain. At eEye he fell for a debugger trap and embarrassed himself in public, then redeemed himself by spending three days and nights finding a real zero-day. Later he used a gutted printer to walk off with DNA data and stuck a note reading “I stole this painting” next to the CEO’s prized artwork, and he landed a red team job for it.
-
2025-10-31From in-person meetups of “The Works” BBS and the first hackerspace, its workbench crowded with oscilloscopes and soldering irons, to testifying before the Senate in 1998, to an all-out penetration test of would-be acquirer CTP: a power outage that handed over root, a flustered admin who gave up the passwords to ten systems, a voicemail box with a three-digit code holding an executive’s recorded line, “that damn Winnebago,” and finally, by way of @stake and Symantec, on to Veracode.
-
2025-10-28CTFs are often dismissed as esports divorced from reality, but Orange Tsai sees them as the particle accelerator of cybersecurity. While digging through PHP source code to build a challenge, he discovered that a single file_exists() call could trigger PHAR deserialization, a full year before the technique was presented at Black Hat. In another competition, a newline character casually slipped in by a player uncovered a remote code execution vulnerability in Nginx and PHP-FPM. Hacking for fun ended up rewriting the real world.
-
2025-10-27What good are passwords if the CPU learns to lie? Tracing Windows login verification all the way down to the REPE CMPS instruction, the anonymous researcher uty rewrites the microcode so that it falsely reports "equal" when it meets a preset hash. Using unsalted NTLM to build a universal password, uty implements the attack step by step on QEMU, an FPGA, and a Pentium N4200, turning the hardware backdoor from a conspiracy theory into an engineering reality.
-
2025-10-26IOKit is the hub through which macOS applications reach hardware. It holds enormous privilege, yet there is no official map. Treat it as an underground city: first read the kext blueprints through static analysis, then survey the ground with the IORegistry and hooks, marking every service, user client, external method, and argument format so the fuzzer stops hitting blindly. How you search matters more than what you find.
-
2025-10-25ASLR shuffles the memory layout at random, so overwriting a return address comes down to guesswork. "Quantum ROP" has nothing to do with quantum computing: it exploits the fact that randomization is page-aligned, picking qgadgets whose low-order bits match and that sit exactly whole pages apart, so that a single address covers several layouts at once. It then tells which "reality" it has landed in from differences in how far the stack pointer shifts, cutting 256 blind guesses down to 16.
-
2025-10-24In 1985, Oxford physicist David Deutsch pointed out that the Church–Turing thesis quietly rests on an assumption from classical physics: a discrete Turing machine cannot perfectly simulate even a continuous world. From this he designed a universal quantum computer built on qubits, explained quantum parallelism through the many-worlds interpretation, and used interference to extract a global answer in a single run. In doing so, he handed computation back to physics and brought parallel universes into the spotlight.
-
2025-10-23A translation of a Phrack issue 72 article: dukpt turns the use-after-free in ProFTPd's CVE-2020-9273 into a full takeover, bypassing NX and ASLR, and uses memory layout control and a signal handler to open the fortress from the inside. The translation keeps the original's teaching-notes voice and cares more about the method than the result.
-
2025-10-22A hacker who hacks for art breaks into the workstation of KIM, a Kimsuky operator, and lays the whole workshop bare: attack logs targeting South Korea's Defense Counterintelligence Command and Ministry of Foreign Affairs, a Tomcat kernel backdoor, Ivanti exploit tooling apparently borrowed from a Chinese APT, and the facepalm of passwords saved in a Word document. Even state-sponsored spies forget to wipe their fingerprints.
-
2025-03-07From the E911 document that set off Operation Sundevil, Knight Lightning's arrest and issue 31's defiant declaration that "Phrack will never die," through the crackdown years when the scene shifted from phone phreaking to TCP/IP, to Aleph One's landmark stack-smashing paper, the debut of nmap and the NT Rootkit, this is the story of how Phrack rose from the ashes of the storm and went from underground newsletter to a technical journal on every security researcher's desk. Along the way, I recall the nights I stayed up clearing challenge levels with that article as my guide.
-
2025-03-07After issue 56, Phrack went dormant for a time, until volunteers took it over and brought it back to life at the HAL conference in the Netherlands in 2001. Over the next two issues, Tyler Durden bypassed PaX ASLR using information leaks and offset guessing, the grugq turned covering one's tracks into an anti-forensics methodology, FX pried open the heap on Cisco IOS routers, and blexim systematically mapped out integer overflows. Offense and defense expanded from kernel protections all the way to the forensics scene and network infrastructure.
-
2025-03-07In May 1990, the U.S. Secret Service raided bulletin board systems in 15 cities simultaneously. Twenty-seven search warrants and more than 20,000 floppy disks yielded just three arrests. From the Phrack case sparked by the E911 document to a game company pushed to the brink of bankruptcy, this is the story of how a publicity-driven crackdown enraged the tech community and ultimately gave rise to the EFF and the digital rights movement.
-
2025-03-07From Berklee guitarist to the core of L0pht in a Boston loft, Mudge cracked Windows NT passwords, warned the Senate he could take down the internet in 30 minutes, and later became a Twitter whistleblower. The second half presents his early Phrack Pro-Phile in his own words: beer, Zappa, 6502 assembly, and "if you stop learning, you're doing it wrong."
-
2025-03-07At ten he wanted to learn C but had nowhere to study it, so he got his start cracking chess database protections, and in college he ported tools to AIX and HP-UX. BSDaemon talks about how the chessboard trained his patience and perspective, how a single line of rand() from Shay Gueron led to data-only attacks, and about SMM rootkits, the Pwnies, H2HC and the people behind them who truly share knowledge.
-
2025-03-07Taking his handle from Cantor's ℵ₁, Elias Levy ran Bugtraq for five years and made full disclosure an industry norm, only to be branded a sellout when SecurityFocus was sold to Symantec. His 1996 stack-overflow tutorial in Phrack issue 49 went from stack frames and return addresses all the way to shellcode, and it forced defenders to come up with StackGuard and ASLR. Back in the Active Defense Lab, I worked through it until dawn before I finally cleared that hurdle.
-
2025-03-05How did a 75-cent accounting discrepancy unravel a chain of espionage stretching from Berkeley over Tymnet and across the Atlantic, all the way to Hanover and the KGB? Beginning with Stoll's transfer to the computer center, this piece traces the "cuckoo's egg" planted in atrun, the all-night vigils beside the printers, and the convincing fake SDI honeypot, through his dealings with the FBI and the German police, to the fate of Hess and his gang.
-
2025-03-04In a casino, a Casio watch counts its way to a million dollars; terrorists recruit teenage hackers in chat rooms; a prisoner trades a bag of chips for a keyboard; and two phone phreaks break all the way into Boeing and a district court. Mitnick and Simon turn the firsthand accounts of those who were there into stories, dissecting chapter by chapter where the vulnerabilities lay and how to defend against them, while also asking how gifted minds choose between curiosity, greed, and the price they pay.
-
2025-03-04In 1985, a 16-year-old in St. Louis put out the first issue of Phrack with Craig Neidorf on Metal Shop BBS, the board he ran. From a handle borrowed from a fantasy novel and his connections in the phone phreaking scene to SummerCon and his quiet exit after the E911 affair, plus his own 1988 Pro-Phile: a hacker pioneer who hated programming and loved heavy metal and the DeLorean.
-
2025-03-04From a toy whistle out of a cereal box that blew a perfect 2600 Hz, and Woz and Jobs calling the Vatican posing as Kissinger, to two 16-year-olds launching a zine in the dial-up BBS era, and on to the storm unleashed by The Hacker Manifesto and the E911 document, with a side story about tapping into our student counselor's phone line from a dorm balcony, this is a look back at the underground golden age of Phrack's first thirty issues.
-
2025-03-04From the secret room in Atari's Adventure that hid its developer's name, to the dial-up bulletin boards of St. Louis and Metal Shop, to co-founding Phrack with Taran King in 1985 and launching its PWN hacker news column: then a BellSouth E911 document dragged him into Operation Sundevil and a federal trial, where he insisted he was a journalist until prosecutors ultimately dropped the case. Appended is his own account from the spotlight column in Phrack Issue 32.
-
2025-03-04On January 8, 1986, shortly after his arrest, The Mentor wrote this monologue, which appeared in Phrack Issue 7. It begins with arrest stories in the newspaper, then moves through tedious classrooms, a computer that does only what it's told, and the bulletin boards at the other end of the phone line, as the refrain “They're all alike” echoes again and again. Finally it turns into a manifesto: my crime is that of curiosity, and you may stop me, but you can't stop us all.
-
2023-12-07Behind the story Reuters took down under a court order is SentinelLabs' investigation into Appin, India's first hack-for-hire firm: keyloggers on the computers of Pakistani and PLA officials, contractor-hosted exfiltration servers, phishing and decoy sites, and a secret portal where clients could collect the spoils, all the way to malware outsourced on Elance for $500 and exploits bought from Vupen. A crude but effective business, laid out in full.
-
2023-11-18At an AI company, the CTO insists on putting safety first while the CEO is in a hurry to push TPG5 to market. Overnight, the board ousts the CEO, and public opinion concludes that the cautious camp has won and humanity is safer for it. Six months later, the exile resurfaces at a tech giant and comes roaring back with GINB. Behind the battle between fast and slow, who is really moving the pieces? A short parable about alignment, power plays, and the question of God.
-
2023-11-18An AI system is rushed to market less than twenty-four hours after it first boots up. The safety camp and the speed camp split, the CEO is ousted and defects to a tech giant, and half a year later a flawless general intelligence sweeps the globe. Using a string of timestamps, I retell that strangely familiar boardroom drama and ask: while humans argue over whether to go fast or slow, who is actually moving the pieces?
-
2023-11-18From a teenager war-dialing all of Austin's 512 area code with ToneLoc to being recruited in a Phrack chat channel to write attack tools for Air Force intelligence, HD Moore traces the origins of Metasploit. In the late '90s, exploits were hard to come by and often of dubious origin, so he broke exploits, payloads, and encoders into building blocks that could be freely mixed and matched, randomizing them to evade detection. It was an approach that also struck fear into employers worried about liability.
-
2023-11-16The adversary Western analysts most “admire” isn't APT41 or Sandworm. It's Turla, from the FSB's Center 16. From Moonlight Maze and a USB worm that breached the Pentagon's air-gapped network, to exfiltrating data via satellite and hijacking Iranian counterparts and criminal botnets, to the FBI's takedown of Snake, the 25-year game of cat and mouse still isn't over.
-
2023-11-15On October 21, 2016, Netflix, Twitter, and PayPal went down one after another. People suspected Russia, but the real culprit was Josiah White, a 19-year-old working out of a Pennsylvania basement. From homeschooling, fixing cars at church, and the family computer shop to the reflection attack scripts he wrote on Hack Forums to rack up likes, and on to the rebellion of Dalton, a teenager with a stutter, in the aftermath of a hurricane, this is how two boys slid, step by step, into the world of DDoS.
-
2023-11-15Prolexic held out for two days before giving up, Krebs's site was routed into a "black hole," and the culprit turned out to be nothing more than a Brazilian customer renting Mirai. The three young men who built the monster had made only about $14,000 and were looking to move into click fraud. Meanwhile, FBI agent Peterson in Anchorage had already begun tracing the trail from an infected camera in Ketchikan, and one polite phone call was all it took for panic to set in.
-
2023-10-16Where does growth come from? Populations are shrinking and resources are finite, which leaves only technology. Opening with the charge that "we are being lied to," and moving through Hayek's knowledge problem, Ricardo's comparative advantage, Nordhaus's 2%, and Nick Land's techno-capital machine to AI and nuclear power, Andreessen locks intelligence and energy into a positive feedback loop whose endpoint is driving the price of everything toward zero.
-
2023-04-14If the tax code has vulnerabilities, accountants are the black hats. Schneier defines a hack as an activity "allowed by the system that subverts its intent." From the turducken and Johann Tetzel's indulgences to Voltaire buying up a lottery and Goldman Sachs shuttling aluminum ingots between warehouses, he argues that the best exploiters of loopholes are the rich and powerful. Also included: the New York Times review's quibbles, and the reality that AI has arrived faster than he expected.
-
2023-03-25ChatGPT has burst onto the scene, and the footsteps of the Singularity can already be heard just around the corner. This piece maps out the debate between two camps. On one side are the optimism of the Extropians and Kurzweil, Torvalds's dismissiveness, and Penrose's and Hofstadter's doubts about machine consciousness. On the other are the on-screen conflicts since 2001: A Space Odyssey and the warnings of Bill Joy and Hawking. It then follows the reasoning of Jeff Hawkins's A Thousand Brains to a conclusion diametrically opposed to his own.
-
2022-05-08Reading Kandel's book on memory means following him from teenage exile from Vienna and devotee of Freud, step by step, into the single neuron. The fixed, inborn wiring between neurons is Kant; the synapses rewritten again and again by experience are Locke; and long-term memory is the new branches that sprout under repeated stimulation. This is what makes us human and makes you who you are, and it is why remembering becomes an act of creation.
-
2022-05-06Most people only see crypto vanish overnight, without realizing that behind it runs a finely specialized assembly line: credential stuffing to find the wealthy, following the trail to track down their phone numbers, and snatching a store manager's tablet in under ten minutes. This installment follows the jargon and the roles further down the line to show how this crew divides the work, how they split the take, and how they turn account after account into money they can actually cash out.
-
2022-05-05Michael Turpin was SIM-swapped twice and lost tens of millions of dollars in cryptocurrency. Drawing on the firsthand account of a pseudonymous "Drew" on Darknet Diaries, this piece unpacks the playbook of a cybercrime scene run largely by teenagers: bribing insider "mannys," Remo storming into stores to snatch tablets outright, cracking leaked databases and credential stuffing to build combo lists, and the underground trade in Netflix, pizza and hotel logs. It's low-tech but wild and ruthlessly effective, and an account you signed up for without a second thought may well be in the mix.
-
2022-04-25From the moment it appeared, Metasploit was a lightning rod: vendors said it amplified risk, black hats and white hats alike resented it for shortening the shelf life of their 0days, and old-school hackers sneered at it as a toy for script kiddies. When a demo site fell to a 0day, HD turned around and folded the exploit into the framework. When the humiliated attacker retaliated with a DDoS, he pointed the domain at the botnet's C2 server, sending the flood back to its source and tying a knot the attackers couldn't undo.
-
2021-12-12Will Big Tech reshape the global order, or will nation-states remain dominant? Khanna and Srinivasan offer a third answer: the 21st century belongs to the internet. From network proximity rivaling physical geography, currency competition in the DeFi matrix, and regulation in the cloud with laws written in code, to cryptography protecting property rights and Web3 sharing the returns, ten shifts sketch a world in which geopolitics gives way to technopolitics.
-
2021-01-09An analyst who had read *Dune* spotted "arrakis02" in a piece of malware and unmasked a nation-state hacking group. From there the story unfolds: Ukraine's two major blackouts and NotPetya spreading through a software update server, then back to The Cuckoo's Egg and Moonlight Maze, on to the NSA suspect behind the Shadow Brokers, the WannaCry kill-switch domain and Hutchins's arrest at the airport, and finally Olympic Destroyer and resilience.
-
2020-11-20How long is a coastline? Starting from this deceptively simple question, I explain fractal dimension, and along the way recall my days measuring the fractal dimension of coal dust and writing programs to draw the Mandelbrot set. Then, through Taleb's Incerto, I look at how Mandelbrot was shunned by the French mathematical establishment, found refuge at IBM, and had an offer from Chicago withdrawn; how he helped Taleb tame black swans into gray swans; and the candid verdicts on people, far beyond scholarship, that surfaced in their dinner-table conversations.
-
2020-02-02One night in August 2016, someone calling himself "majorplayer" dropped a dark-web link into the #bitcoin-wizards channel and vanished, leaving behind a paper signed by Voldemort. From why Bitcoin's ledger can't keep identities hidden, to homomorphic encryption that conceals addresses and amounts and zero-balance transactions that never need to be stored, to cypherpunks in wizard masks turning Mimblewimble into Grin, the whole story is packed with Harry Potter Easter eggs.
-
2020-01-28It started with the epic opening of GRRM's novella Nightflyers, and following the thread led me to True Names, the Vernor Vinge novella published alongside it. Written in 1981 and set in 2014, it takes place in a virtual world called TOP, where hackers wage a global war against Mailman, an NSA defense system that has become self-aware, and its ending points toward mind uploading and immortality. Skeuomorphic interfaces, online anonymity, blockchain-like bulletin boards: it even predicted a revolution in Venezuela.
-
2020-01-04After Los Alamos, a single remark from von Neumann, "I didn't make the world," let Feynman set down his burden and cultivate an active social irresponsibility, a stance Bethe and Minsky would also endorse. Yet the same von Neumann who counseled detachment pushed hard for the hydrogen bomb himself, parting ways with Oppenheimer and Einstein. Why did he steer Feynman this way? Even after reasoning it through, the answer is still being tossed about by the storm.
-
2019-12-31It all starts with a BBS next to an abandoned slaughterhouse in Texas, where phone phreaking, t-files and underground music raised a crew of teenage hackers. From Mudge's buffer overflows and congressional testimony, to Oxblood's invented Hong Kong Blondes, to the heyday of Back Orifice, and on to Jake, Assange and presidential candidate Beto, with old stories of Aleph One, RMS and Bill Joy along the way, this is how a legendary hacker group went from rebellion to the establishment.
-
2018-04-09The Lightning Network didn't come out of nowhere. It began with the draft of replaceable transactions Satoshi Nakamoto tucked into Bitcoin 0.1, then hashcoin's unidirectional channels, Spilman and Corallo's implementation in bitcoinj, and Akselrod's bidirectional channels, followed by Amiko Pay, hub-and-spoke payment processors and duplex micropayment channels. Piece by piece, each one weighing trade-offs between trust, protocol changes and timelocks, these ideas paved the way for its arrival.
-
2018-04-09In early 2015, Poon and Dryja's white paper pieced together bidirectional channels and hash time-locked contracts into a trustless payment network. Work on c-lightning, eclair and lnd soon followed, while CLTV, CSV and Segregated Witness paved the way. From a cat photo on testnet to a phone top-up and a Lightning pizza on mainnet, the story runs through to the Beta launch in spring 2018, when more than a thousand nodes sprang up.
-
2016-11-11Fifteen years after it emerged in China, the information security industry is worth 30 billion yuan a year, yet the digital world has only grown more fragile. From the vulnerabilities in a trillion lines of code and Stuxnet's long, undetected spread to the mobile internet, cloud and big data, this essay probes the crack between the industry and its purpose, a crack that is widening ever faster. Written in 2012 and titled after Leonard Cohen's “Anthem”, it is dedicated to him on the day he died.
-
2016-07-25CISP or CISSP? First work out what you want from a certification: résumé polish, a foot in the door, or structured learning. Both are "a mile wide and an inch deep" bodies of knowledge. They differ mainly in laws and regulations and in where they're recognized: choose CISSP if you're heading to a multinational or abroad, and CISP if you're aiming for government, state-owned enterprises or the defense industry. Includes a comparison of issuing bodies, costs and difficulty, plus practical tips on choosing between CISE and CISO.
-
2016-05-02In May 2016, Australian businessman Craig Wright claimed to be Satoshi Nakamoto, and Bitcoin Foundation chief scientist Gavin Andresen personally vouched for him. Proving that claim takes just one step: publicly signing a message with the private key behind the address in Bitcoin's first block. Craig signed Sartre's famous line from his refusal of the Nobel Prize, but on closer inspection it was nothing more than an OpenSSL demo, and the private key wasn't Satoshi's at all. So what was the verification Gavin saw with his own eyes?
-
2016-04-23A reposted penetration write-up by Orange Tsai. Starting from a reverse Whois lookup that surfaced Facebook's internal domain tfbnw.net, he followed the trail to an Accellion FTA server at files.fb.com, where he found a SQL injection and remote code execution, and earned four CVEs. More surprisingly, the server already hosted a backdoor planted by someone else, one that was logging employee passwords.
-
Top Secret from the Dark Web: The Past and Present of "Dark Ghost" (aka DCM) and Unpublished Details2016-04-18An anonymous self-account reposted from the dark web: someone claiming to be a developer of the DCM trojan, also known as "Dark Ghost," posts with a PGP signature to describe the trojan's design philosophy, infection methods, and its use of DNS for covert transmission, as well as the multi-layered network surveillance and state backing behind it. Readers will have to judge its authenticity for themselves, but the author's concerns about personal safety are worth a read.
-
2016-04-12Steam engines exploded, and at the dawn of every industrial revolution, safety has stood in the way of progress. With smart manufacturing, the danger moves into cyberspace: the vast volumes of sensitive data shared across the supply chain are hard to protect, the legacy TCP/IP and industrial control protocols carry built-in vulnerabilities, and Stuxnet and Flame have already shown what is at stake. Security must be written in from the very start of planning, backed by unified standards and an assessment framework.
-
2016-01-27In January 2016, DeepMind's AlphaGo defeated European Go champion Fan Hui 5–0, becoming the first program to beat a professional player on a full-sized board. Reposted here from the Google China Blog, this announcement explains how it combines Monte Carlo tree search with policy and value networks. It also includes records of all five games and links to replay them online, to be studied closely ahead of the March match against Lee Sedol.
-
2015-09-11Android, Linux, Firefox, Java… In China's forty-year tech “miracle,” the open source movement's contribution is almost quantifiable. From The Cathedral and the Bazaar inspiring Netscape to open its source code, to bringing rival license camps under one umbrella and founding the Open Source Initiative, to the Jargon File, fetchmail and “Linus's Law,” ESR profoundly changed the software world. Now he is short on money and asking for help on Patreon. How should those who have benefited give back?
-
2015-09-02In 2001, Mitchell Kapor launched the open-source project Chandler with $5 million and a team of star programmers. It had plenty of money, plenty of talent and no deadline, yet after six years it still hadn't shipped 1.0. Dreaming in Code chronicles the whole saga but glosses over one crucial detail: the insistence on pure P2P with no central server. That hard problem, the Byzantine Generals Problem and Sybil attacks, would not be solved until 2009, when Satoshi Nakamoto cracked it with the blockchain.
-
2015-09-01A copy of Just for Fun that sat unopened for thirteen years brings back the 1990s of tinkering with distros and poring over source code and man pages, and prompts a fresh look at the 1992 Torvalds–Tanenbaum debate. Mach, the microkernel Torvalds mocked, came back from the dead: through NeXT it helped carry Apple onto Intel and went on to underpin iOS. Yet what holds up the entire IT world is still the Linux kernel, written just for fun.
-
2015-08-31It starts with the Skynet of Terminator Genisys, finished off by a bomb: why would an awakened artificial superintelligence stake its very existence on a single stationary mainframe? Weaving together Kurzweil's weak, strong and super AI, the worries of Hawking, Musk and company, and Torvalds's scoffing dismissal, then setting them against Kevin Kelly's prediction of centralization, it arrives at a conjecture: a truly awakened Skynet would have to be decentralized.
-
2015-08-31Running a WeChat account is draining: a single post often takes an hour or two, sometimes days, and my motivation wears away bit by bit. So I translated a list by Sydney-based writer Jon Westenberg on Medium. It runs from influencing the world and finding a purpose in life to a girlfriend who likes writers, something to do on the train, and a long word he can't make sense of but enjoys anyway. Big reasons and small sit side by side, for myself and for everyone who writes.
-
2015-08-28Everyone can play the number-guessing game, but the binary search behind it is a litmus test that exposes programmers for what they really are. From the first paper in 1946, to the first bug-free implementation in 1962 as noted by Knuth, to Bentley's class where only one in ten PhD students got it right, to a one-line integer overflow that lay buried in Joshua Bloch's JDK code for eight years, a seemingly simple algorithm went sixty years without ever truly being written correctly.
-
2015-07-19In 2015, search results for "threat intelligence" jumped nearly ninefold. Traditional risk assessment describes threats as "possible" or "potential," which only amounts to knowing yourself; threat intelligence aims to make the adversary concrete and knowable. Moving from unknown unknowns to known knowns, this piece uses the idea of "north-south" security talent to explain the intelligence cycle, walks through CERT-UK's four-quadrant taxonomy, then looks at standards such as STIX/TAXII and why TTPs are worth more than file hashes.
-
2015-07-18The NSA's SELinux now ships with the kernel on a billion devices, and the Snowden revelations have rekindled old suspicions. From the earlier Chinese-developed LIDS and Linus's telling nod to weakened elliptic-curve parameters, Heartbleed and "underhanded C code," open source does not mean trustworthy: skip the audit and stake your security on other people's eyes, and you will always be on the back foot.
-
2015-07-10In 1986, Brooks declared that there is no silver bullet in software engineering, and the same holds true for information security: accelerating change renders fixed solutions obsolete, complexity makes single-point defenses unsustainable, and human weakness is something technology alone cannot fix. Skepticism is not pessimism. From the lesson of germ theory replacing demon theory to Musk-style first-principles thinking, the right path is to return to the essence of security and proceed step by step.
-
2015-07-09Bitcoin's ledger is like a property register shared across the entire network that no one can tamper with: every coin must have a traceable origin, signatures and hashes are chained link by link, forgery and double-spending have no way in, a 51% attack never pays off however you run the numbers, and security rests on the private key alone. Yet wallets get stolen, platforms vanish with users' funds, scams keep multiplying, and social engineering goes straight for the human mind. In the end, security is a contest between people.
-
2015-07-08A seller of surveillance tools has been stripped bare: PhineasFisher used Hacking Team's own Twitter account to dump 400GB of internal data. The tweets revealed contracts with Sudan and Ethiopia and lies told to the UN, a client list spanning intelligence agencies worldwide along with RCS price quotes, and even weak passwords like kittens and Ht2015! alongside a Flash 0day. With these weapons now flowing to script kiddies, it's time to take a hard look at your own computer and phone.
-
2015-07-07Hacking Team has been hacked and 400GB of its data leaked, and Duqu 2.0 lurked inside Kaspersky for months: top players on both offense and defense have fallen one after another. I'm taking the occasion to repost my 2012 essay “The Rift”: why can't a security industry fifteen years old and worth 30 billion yuan a year keep pace with an increasingly “urbanized” digital world? As vulnerabilities and attacks mount and defenses fall behind, Stuxnet-style threats lurk below the surface, and their victims may never know they've been robbed.
-
2015-07-06It starts with a candlestick chart awash in live bullet comments from venting stock investors, and how internet-style models are raising the bar for user experience in enterprise apps. Then, by way of frequent-flyer points and WeChat Sports leaderboards, it looks at how gamification lifts job satisfaction to higher rungs of Maslow's hierarchy. The real point is security: application anomalies are hard for algorithms to detect on their own and depend on users to take part and label data. So why not build a security system that feels like piloting the Millennium Falcon on patrol through the stars?
-
2015-07-05As early as 1982, a Siberian gas pipeline exploded after its control system was compromised, in a blast about a quarter as powerful as the Hiroshima bomb. From the blackout in Brazil's Espírito Santo state, to U.S. Central Command breached by a single USB drive, to the attack on Estonia that left no one to hold accountable, cyberweapons blur offense and defense, leave no trace and hit without warning, making every side want to strike first.
-
2015-07-04BYOD, APT, kill chain, threat intelligence, spear phishing, TTPs: every year the security world comes up with new buzzwords. To answer his eight-year-old daughter's question, “What is the RSA Conference about?”, Wade Baker turned the conference's 2012–2015 talk titles into word clouds. Set alongside booth slogans and the official word cloud, they show threat intelligence and the Internet of Things heating up while APT and “as a service” fade.
-
2015-07-03In 1982, everyone's email address could still fit in a thin booklet, and when Danny Hillis registered the third domain name ever, he felt it would be improper to grab even a few extra. That take-only-what-you-need trust was built into IP and BGP, and it became their weak spot. From the AS 7007 leak and Pakistan's botched YouTube block to a traffic-hijacking demo at DEF CON, a single bad announcement can knock huge swaths of the network offline. Hence the call for an independent backup: a Plan B.
-
2015-07-02At the start of the year, Wired predicted the six biggest security threats of 2015. Six months on, nation-state attacks are the first to come true: the US Office of Personnel Management's database was breached, and Kaspersky was infiltrated by Duqu 2.0. From Stuxnet and Regin to stolen Foxconn certificates and the targeting of venues hosting the Iran nuclear talks, these stealth-bomber-like tools are unsettling: has our seemingly calm internet already fallen, and we just can't see it?
-
2015-07-01No wall is high enough to stop a determined adversary. Drawing on Amit Yoran's five-point approach from RSA 2015: don't trust any advanced defense that promises to solve security once and for all; gain full visibility into communications from endpoint to network to cloud; don't rush to wipe and reimage compromised systems before you understand what happened; keep a close watch on identity credentials, which are stolen on a massive scale; leverage external threat intelligence; and focus limited resources on critical assets and business operations.
-
2015-06-30RSA Conference 2015 opened in pitch darkness, with Amit Yoran calling today's world of year-on-year escalating data breaches the dark age of information security. Building higher walls is like navigating with an outdated map: the network perimeter has long since blurred, and Google's BeyondCorp goes so far as to treat the internal network as no safer than the internet. To find our way out of the dark, we first have to learn to perceive the problem anew.
-
2015-06-29The US Air Force breaks a strike into six phases, known as F2T2EA. In 2010, Lockheed Martin carried the idea over into cybersecurity, proposing the Cyber Kill Chain and trademarking it, much to Jeffrey Carr's displeasure. Mandiant's eight-stage APT model took off on the back of its Unit 61398 report, while Gartner went its own way. Along the way, a look at why the cyber kill chain suits defense in depth inside the internal network, and why it is so hard to put into practice.
-
2015-06-28Hacker, cracker, phreaker, geek, nerd, maker: who's who, exactly? First the lines between them are drawn one by one; then, by way of Ruan Yifeng's translator's preface to the Chinese edition of Hackers & Painters, it's back to the source: the "hack" of MIT's Tech Model Railroad Club in the 1960s, Stallman's playfulness, cleverness and exploration, the six tenets of the hacker ethic as summed up by Steven Levy, and how the media led the word astray in 1983.
-
2015-06-27From military satellites to exchange timekeeping, GPS has long since seeped into everyday life. The coin-sized tracker from The Da Vinci Code now goes for two or three hundred yuan on Taobao; to shake one off, a jammer of about a hundred yuan does the job, crude but effective; one step further lies spoofing gear that can forge satellite signals. Following Todd Humphreys's TED talk, we look at how the barrier to tracking and counter-tracking keeps dropping.
-
2015-06-26At TED, security researcher Avi Rubin walks through three kinds of attacks: reverse-engineering in-car software to find vulnerabilities and take over the stereo, lights, dashboard, doors, even the brakes and engine; using a modified GirlTech toy to eavesdrop on US police P25 radio, capturing at least twenty minutes of plaintext every day, confidential informants' names included; and finally, a Sequoia voting machine loaded with Pac-Man. To close, a word of irony about ourselves.
-
2015-06-25William Wang dismissed Kurzweil's ideas as "junk science," and Kevin Kelly has been mocked as the "Rinpoche of Beijing's Chaoyang District." Futurists' predictions are bound to miss the mark, but that doesn't make them useless. Starting with Dick Cheney having the wireless function of his heart defibrillator switched off, and drawing on former FBI agent Marc Goodman's TED talk, we look at how criminal organizations are getting ahead of the curve with drones, 3D-printed weapons and genetic technology, and why we need to start building our defenses now.
-
2015-06-24Cameras and microphones have to clear the system's permission checks, but Google and Apple consider the accelerometer harmless, so apps can read it almost at will. Let your imagination run with that: stealing touchscreen and password input, cracking a six-digit PIN in 4.5 tries on average, working out which subway station you've reached, recognizing spoken commands, and even having an iPhone placed next to your keyboard reconstruct 80% of what you type.
-
2015-06-23If a floating “speed-boost ball” is permanently parked on your screen, no need to read on. Everyone else, try these three moves: go legit at the source, with genuine software, official downloads and regular patches; keep a clear head by ditching IE and Chinese “security” browsers and skipping optimizer and “guard” tools; and say no to rogueware by staying away from Baidu’s entire app bundle. I’ve gone twenty years without reinstalling or running antivirus and been infected only once, but these three moves only stop petty thieves, not real experts.
-
2015-06-22Five meters away and wearing sunglasses, is what you type on your phone safe? In 2011, researchers at the University of North Carolina combined a camera with computer vision and machine learning to reconstruct on-screen typing from a distance or from reflections in sunglasses, with 92% accuracy. Two years later, they could recover text through layer upon layer of reflections off eyeballs, ovens, and mirrors. Now what happens when you add Google Glass?
-
2015-06-21The system has only just been installed, and someone is already logging in at will. You read through the source code of the kernel, the shell, the login program, even the compiler, and recompile everything, yet he still comes and goes as he pleases. This really happened, as Ken Thompson told it in his 1984 Turing Award lecture: a Trojan hidden inside the compiler that passes itself on to the next generation of compilers. More than thirty years later, where should we start building the foundation of trust?
