Research, methodology, and the occasional insight into why security fails when attackers don't follow the rules.
I asked one question: does anything verify that a privilege drop actually happened? The answer broke everything I thought I knew about Unix security. nginx workers keep root. OpenSSH's 8-step verification is defeated. The kernel checks once, then walks away.
Read postTwo years of research. 98% of antivirus engines failed the same test. A vulnerability class from 2004 still works. Format destruction defeated the rest. Zombie ZIP and Veriduct. Different mechanics. Same principle: detection depends on structure, and structure is optional.
Read postWhat the loader reads is not what the tools parse. The gap between them is attack surface. I built a tool that asks a simple question: which bytes does Windows actually need to execute this binary?
Read postWindows security is fully documented. So are detection rules. That's a solvable constraint system. Z3 finds privilege escalation paths that weren't explicitly programmed. The logic was always there. Latent in the design.
Read postWhat if the constraint "must load model to train it" was assumed rather than required? A mathematical reformulation of gradient descent enables full-weight training on a gaming PC. The tradeoff: what takes hours on a cluster takes weeks on consumer hardware.
Read postWhat if the malware never existed? Every byte of the "shellcode" is Microsoft's code—we just control which bytes execute and in what order. No injection. No private memory. Just addresses pointing into signed DLLs.
Read postOver the years, I've seen the same pattern repeat: a slick demo page, a "try 5 times free" limit, and a JavaScript bundle that contains the entire enforcement logic. The door is locked, but the lock is on your side.
Read postSolidity immutables aren't storage. They're bytecode. If those values contain valid EVM opcodes starting with JUMPDEST, they become executable. The attack passes Etherscan verification and evades standard audits.
Read postIn a world of epic battles and escalating arms races, Tom Bombadil was the anomaly. The Ring had no power over him. I believe security has become too much like the War of the Ring: a frantic, escalating arms race of "power against power."
Read post