Blog

  •

    A DNS obfuscation technique proof of concept

    • General
    • by Jacob Riggs
    • 21-01-2024
    4.74 of 179 votes

    For my Deadswitch project, I've always been conscious of threat model and wanted to ensure the architecture employed a layered approach. One consideration was DNS tracking mitigations, and what I could do to help make efforts to identify customers more expensive to an adversary.One of the ways Deadswitch works is each customer is issued a uniquely generated subdomain that they

  • Discord saves deleted images to your filesystem

    • General
    • by Jacob Riggs
    • 08-05-2023
    4.58 of 118 votes

    This post outlines a security issue with Discord due to how it handles deletion records and localised caching for media posted in shared channels. The issue Media posted in Discord channels is written to the filesystem of every channel participant, even if that media is deleted from the channel immediately after being posted. It's important to note that this form

  • The mystery 50p coin I found

    • General
    • by Jacob Riggs
    • 13-09-2022
    4.61 of 125 votes

    Over 50 years ago a coin entered circulation. A coin that once belonged to a man named Sean Creamer. Engraved on the faces of this coin are the wordsThis once belonged to Sean Creamer 58 Henry St Limerick — worth £5 to me if returned Today this mystery coin resides with me, after what I suspect has been a very

  • Shark Tank success 'LARQ' sent me a free water bottle

    • General
    • by Jacob Riggs
    • 27-08-2022
    4.74 of 173 votes

    Last week I fell into the abyss of watching random YouTube videos and at one point landed on a video featuring LARQ, the highest valuation company to ever pitch on the popular US television show Shark Tank. The product line they were offering was simple – self-cleaning water bottles that use UV light to purify water. Intrigued to find out

  • UK ISPs prohibit ethical security research activities

    • General
    • by Jacob Riggs
    • 26-08-2022
    4.75 of 131 votes

    All major UK ISPs seem to stipulate contractual terms which specifically prohibit their customers from employing the use of their home broadband service for security testing activities, regardless of the lawful basis for those activities (such as when penetration testing and bug bounty engagements are authorised). Below are the relevant extracts I pulled from those associated policies. If you're a

  • FEATURED

    The Royal Mint sent me a limited edition gold coin

    • General
    • by Jacob Riggs
    • 25-07-2022
    4.85 of 163 votes

    For some voluntary cybersecurity related work I did, The Royal Mint sent me a limited edition 22 carat gold coin which commemorates the life and legacy of the great mathematician and codebreaker Alan Turing. This included bespoke packaging that contained a small 'Innovation in Science' series booklet detailing Turing's remarkable achievements, and featured one of his most famous quotes: We