Another full home router takeover
Vulnerability analysis and ROP chain exploitation of an unauthenticated remote code execution flaw in MIPS home routers, along with lessons learned using AI as an offensive research assistant.
Random Tech Stuff
AI did not change security. It changed the price of overlooking the obvious.
Why AI and agentic workflows do not make cybersecurity fundamentals obsolete, but rather raise the price of overlooking the obvious and fundamentally reshape vulnerability management.
Facebook (Meta) Gizmo - From Cardboard Prototypes to Secure Corporate Devices
The engineering story of Gizmo at Facebook (Meta): how a cardboard prototype with MinnowBoard and TPM 2.0 evolved into a hardened, securely provisioned corporate device fleet.
Lessons from an “Exemption Exam” CTF: Combining Ethical Hacking with Real-World Challenges
Lessons learned from conducting an ethical hacking "exemption exam" CTF for university students at Sapienza University of Rome, exploring LLM usage in CTFs, anti-cheating, and hands-on offensive security.
Exploiting heap-based buffer overflow - The One-Byte challenge
Deep-dive into GLibC 2.23 heap exploitation: leveraging a single-byte overflow with House of Orange.
Predicting CVSS Vectors with text embeddings and random forests
Exploring how text embeddings and Random Forest classifiers can predict CVSS vectors from CVE descriptions to alleviate NVD backlogs.
Undisclosed Home Routers Full Takeover
Vulnerability analysis of an unauthenticated remote code execution flaw in customer premises equipment (CPE) home routers.
Backups with Bup
Setting up fast, deduplicated, Git-based network backups across Mac and Linux systems using Bup and Docker.
Vulnerability Management Metrics
Practical framework and KPIs for measuring and scaling an enterprise vulnerability management program.
Stress and Burnout
Reflections on recognizing, managing, and preventing stress and burnout in tech engineering and management.