Field notes · Index18 entriesRSS ↗
Deep-dives on the technical decisions behind my work.
Engine systems, security pipelines, audio synthesis, game design reviews, incident investigations. Some technical posts are detailed enough that I could rebuild the project from them, and that's the point!
Showing 9 of 18 ·Security
Clear filterField notes · Index
- 18SecurityN° 18Security4 min
Where a bad update stops: update integrity for offline, regulated devices
A device with no internet still has to take updates, and every one of them is a chance to run code nobody approved. Six ways an update can go wrong, one way it goes right, and the station on the route that catches each failure. A generic pattern, not any vendor's implementation.4 min - 17SecurityN° 17Security10 min
The fleet that does not exist: a Play Store listing, a 3-week-old CNPJ, and the robotaxi Ponzi aimed at Brazil
Taxinexo sells Brazilian users a share of an autonomous taxi fleet that drives itself around New York and pays 90% a month. The fleet is a sprite sheet, the rides are a cron job, and the company behind it is a 3-week-old electronics retailer in a virtual office on Avenida Paulista. The evidence, the arithmetic, and the collapse timeline. Findings and reasoning, not a takedown guide.10 min - 15SecurityN° 15Security18 min
Capabilities over signatures: the design behind a .blend inspector, and the provenance layer that sidesteps the fight
The technical companion to The weight of a hyphen. Two questions you can ask of a file that runs itself, what will it do and who made it, decompose into a detection problem you can only draw and a provenance problem you can win. The capability model that keeps a static inspector from drowning in false positives, the four-move evasion arms race and the four answers, and the signing math that makes a pirated copy fail by arithmetic. Architecture and decisions, not source.18 min - 14SecurityN° 14Security16 min
The weight of a hyphen: a lookalike domain, a self-running file, and the inspector I built to catch it
A friend's Blender community was bleeding Discord accounts, and one of his domains had started serving malware. The domain was never his, the attack rode a single missing hyphen, and the real leak was a thousand endpoints. The investigation, the file format that runs itself, and the tool I built so Blender stops asking you to trust blind. Narrative and decisions, not a playbook.16 min - 13SecurityN° 13Security31 min
Calibration as infrastructure: building a detonation lab
Six stages, four tensions, and the engineering decisions that determine whether a detonation lab earns its keep. How specimens enter, deploy, detonate, are observed, are analysed, and are archived, with notes on the tradeoffs that recur at every stage and the boring parts that compound over years. Architecture and decisions, not code. Engineering register, not academic.31 min - 11SecurityN° 11Security41 min
Below the burn line: the architecture of operator infrastructure
Three tiers, four attribution surfaces, and the analyst posture they are all calibrated against. Why operator infrastructure decomposes into long-haul, redirector, and staging tiers, what discipline each tier requires across DNS, TLS, behavioural, and financial surfaces, and how the operator's own workstation becomes the single point of correlation that none of the tier discipline addresses. Architecture and decisions, not configuration. Methodology, not playbook.41 min - 8SecurityN° 8Security34 min
Building the inverse: the design decisions behind a three-layer dropper
The same architecture from the other direction. Why a layered .NET dropper has three layers and not two or four, what each layer is solving for, and which defender assumptions the design quietly presupposes. A composite reference design drawn from the artefact dissected in Three layers deep and adjacent commodity infostealer campaigns through 2024 and 2025. Architecture and decisions, not source. Companion to the reverse-engineering writeup.34 min - 7SecurityN° 7Security21 min
Three layers deep: reverse-engineering a .NET RAT dropper
Three layers down into a 1.1 MB junk-padded batch script: from cmd.exe macro obfuscation through a PowerShell shellcode loader to a Donut-packed implant living inside explorer.exe. The dropper hides its payload steganographically in 3,500 lines of comments, renames powershell.exe to evade name-based detection, and uses a 7-byte memory marker for cross-reboot idempotence. Companion to the incident writeup.21 min - 6SecurityN° 6Security14 min
The cutest trap on the internet: weaponizing Google's child-safety system as a kill switch
A fake Minecraft launcher infected my friend α's machine on a Tuesday evening. By morning, an operator had used the stolen access to upload triggering content to α's Google account, log out, and let the platform's own automated child-safety detector erase the witness. The malware is the carrier; the kill switch is the story. The technical reverse-engineering lives in the companion post.14 min