Security Blog

Deep-dive on the cellebrite-payload_feb2024.tar archive — post-exploitation persistence, SSL/TLS interception via SPKI bypass, and binary analysis of the installer ELF.

How WSL + SOCKS5 (and Tor) can tunnel traffic out of an isolated endpoint — silently, without triggering any Defender Advanced Hunting logs.

Microsoft silently patched the WSL/SOCKS5 bypass. Conditional access, web content filtering, and Tor-based evasion remain open. MSRC has not responded.

Slide deck from the bSides Copenhagen 2023 presentation on MDE device isolation bypass techniques.

Full technical breakdown of a live campaign: spoofed sender, base64-encoded client-side payload, live NETS card validation, and the attacker's own exposed RDP server.

Kernel tuning, entropy hardening, zRAM with zstd, and thermal monitoring — taking the Handsome UZ801 from Android-remnant to rock-solid Linux micro-server.

Step-by-step dist-upgrade guide from Debian 12 to 13 on the 4G LTE WiFi Modem, including ADB re-enablement via USB gadget service.

Smartphones som mobilt kontor: risici ved BYOD, jailbreak, ukontrollerede apps og manglende sikkerhedstræning i virksomheder.

Gennemgang af IrDA, R/F-radiokommunikation og Bluetooth — sikkerhedsrisici og anbefalinger til virksomheder.

How I ported Metasploit to Sailfish OS — including a script automating the shrinking of the Rapid7 tarball with versioned auto-download.

Easy-to-use Tor hidden service setup and a QML app to control Tor status — built for Sailfish OS.

Simplified UI for wireshark (frontend for t-shark) — built for Sailfish OS.