Cybersecurity

I once had a smart lock begin acting strangely after an "automatic" firmware update: intermittent reboots, slower response, and a few unrelated access logs that didn't make sense. I didn't panic — I grabbed a spare Raspberry Pi, isolated the device, and treated the update as potential malware. Over a long evening of testing and reversing, I developed a repeatable workflow that lets you quarantine suspicious firmware updates from a smart lock...

Read more...

I’ve spent a lot of time integrating LLMs and ChatGPT plugins into internal workflows, and one thing quickly became clear: treating plugins like ordinary web integrations is a recipe for leaked credentials and unexpected exfiltration. In this piece I’ll walk you through a practical, threat‑aware approach to enabling ChatGPT (or other LLM) plugins so they can access internal knowledgebases without exposing secrets. I’ll include...

Read more...

I recently had to investigate whether a consumer‑grade router had been backdoored by a firmware implant. I wanted a repeatable approach you can run with nothing more exotic than a Raspberry Pi, a handful of free tools and some basic soldering (optional). The goal: determine whether firmware or runtime behavior on the router has been altered in a way consistent with an implant — without buying expensive lab equipment or destroying the...

Read more...

I recently spent a weekend auditing a couple of consumer VPN setups—one based on WireGuard, one using the ProtonVPN client—to answer the question I get a lot: "How can I check a VPN for leaks and hidden telemetry without becoming a reverse‑engineering expert?" I wanted something practical you can reproduce with open tools and a modest amount of time. Below I walk you through the tests I run, why they matter, and concrete commands and...

Read more...

I want to share a practical, hands‑on approach I use to detect supply‑chain tampering in npm packages before anything reaches CI deploys. Over the years I’ve combined small, free tools and reproducible‑build practices to make a fast, local gate that catches the most common and stealthiest tricks attackers use — malicious postinstall scripts, rogue tarballs, or silently altered published code. Below I walk through the mindset, the...

Read more...

I recently spent a week building a cheap, repeatable workflow to detect malicious firmware implants on consumer routers using nothing more than a Raspberry Pi and free tools. If you manage home networks, small office gear, or test client devices, this is a practical way to get visibility into whether a router’s firmware has been tampered with without buying an expensive hardware analyzer. Below I walk through the signals I look for, the tools...

Read more...

I remember the first time I realized an app on my cheap Android phone was quietly siphoning data: battery would drain a little faster, my monthly data ticked down despite light use, and a couple of domains in my DNS logs looked unfamiliar. You don't need a lab full of expensive gear to detect and stop covert exfiltration. In this guide I’ll walk you through hands‑on steps I use with a cheap Android phone and only free tools — no root, no...

Read more...

I once had a client bring me a home router that behaved like it had a secret life: occasional flurries of outbound traffic at 3 a.m., DNS responses that sometimes led to odd domains, and a slightly sluggish web UI. The vendor image looked normal and the firmware version matched what the vendor published. That’s the kind of situation where you start suspecting a stealthy firmware implant — code that survives reboots, hides from casual...

Read more...

I get asked all the time: “Can I keep a cheap Android phone and still get security updates?” and “How do I turn that phone into something safe enough for private messaging?” I’ve tested budget handsets, refurbished Pixels and mid‑range A-series devices for Roctoken Co, and there are sensible, practical choices you can make without spending a fortune. Below I walk through which budget Android phones still receive updates, what to...

Read more...

I recently set up a new smart home hub and, like many of you, I wanted to plug in my Ring cameras and a handful of Google Nest devices as quickly as possible. The excitement of a unified dashboard is real—but so is the risk. Lateral network attacks, where a compromised device hops across your local network to access other devices or sensitive data, are a very plausible threat in a mixed-vendor environment. Below I walk through what I check in...

Read more...