Authenticode and UAC 🔗
When a user attempts to run a file with elevated privilege, Windows will show a User Account Control elevation prompt that asks whether the user trust [...]
text/plain
Posts
Attack Techniques: Fake Captive Portals 🔗
When a device first joins a network, the upstream network hardware has full control over its traffic and can allow/block any packets sent from the dev [...]
Offboarding from Microsoft Defender for Endpoint 🔗
Microsoft Defender for Endpoint is a paid security product that extends Microsoft Defender Antivirus (included for free in Windows) with enterprise ca [...]
Guidelines for URL Storage and Comparison 🔗
This document contains some thoughts about the storage and comparison of URLs, common operations crucial to the correct function of security software [...]
Driving (Large) Electric 🔗
Back in 2022, I brought home a new 2023 Nissan Leaf S and I’ve had a blast driving it since. In hindsight, it was one of my best purchases in a long t [...]
A Quarter Century in Tech 🔗
Today marks my 25th anniversary of full-time work in tech. June 18, 2001 – My third “New Employee Orientation” at Microsoft, starting my full-time emp [...]
Participatory Extensible Security 🔗
In the past, I’ve explained how security products combine sensors and throttles with threat intelligence to protect users and devices from attack. I’v [...]
Spring 10Ks 🔗
After two solid half-marathons early this year, I was excited for the start of the 10K season to see whether I could keep improving my times. I had mi [...]
Cybersecurity Metaphors 🔗
Uneven Protection Attacks flow like water: if you have a hole in your defenses, attacks will flow through that hole. Unless they’re trying to win a pr [...]
Exploiting Vulnerable Drivers 🔗
Often, attackers will attempt to prevent security software from interfering with their attack chains by abusing a vulnerable driver to kill or otherwi [...]