Avoiding the Death Spiral Wide RAID stripes are often used by administrators to maximise usable storage for a number of spindles. For a number of reasons, RAID-Z deployments with large strip widths, ten or larger, are subject to low resilver performance. Resilvering a full vdev means reading from any healthy
In a time full of ransomware as well as Advanced persistent Thread (APT) incidents the importance of detecting those attacking groups has become increasingly important. Some years ago the best tools/techniques for security incident detection and response included a SIEM-system filled with logs from IPS/IDS systems, proxies, firewalls,
This article series will be a summary of about a decade of unpublished research I am trying to organize and share. Not all of it is current, as newer hardware is harder to inspect and reverse. However, much of it is still relevant. The first post below is an introduction
A couple of years ago I participated in a red-team exercise with a company involved in hardware R&D. The company had a very strict password policy, and every computer had a randomized local adminsitrator account password and local SMB server disabled. We managed to gain access to one
This blog post is an in-depth dive into the security features of the Intel/Windows platform boot process. In this post I’ll explain the startup process through security focused lenses, next post we’ll dive into several known attacks and how there were handled by Intel and Microsoft. My
A while ago, I’ve been working on a very large codebase that consisted of a few million lines of code. Large systems are usually a big mess and this one was no exception. Since this is a rather common problem in software engineering, I thought the internet would be
Proof of concept …for a C# binary that When executed… * Executes an encrypted payload in memory without drops (In this example, the payload just displays a MessageBox) * All variable names are obfuscated using unreadable characters * All strings are runtime encrypted with a simple 8-bit xor * Very hard to analyze when
I love when my current problem can be solved with a state machine. They’re fun to design and implement, and I have high confidence about correctness. They tend to: 1. Present minimal, tidy interfaces 2. Require few, fixed resources 3. Hold no opinions about input and output 4. Have
In his classic paper How to Build a Highly Available System Using Consensus Butler Lampson laid out a pattern that’s become very popular in the design of large-scale highly-available systems. Consensus is used to deal with unusual situations like host failures (Lampson says reserved for emergencies), and leases (time-limited
For several reasons, emulation has always fascinated me. A program that executes other programs sounds like such a cool concept. It really feels like you’re getting your money’s worth out of writing it! Beyond that, it definitely feels like you’re building a computer within software. I really
In what’s a novel supply chain attack, a security researcher managed to breach over 35 major companies’ internal systems, including that of Microsoft, Apple, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber, and achieve remote code execution. The technique, called dependency confusion or a substitution attack, takes advantage of the
This is an excellent piece found here. Detailing production grade tooling and real world scenarios. – Mozilla has been fuzzing Firefox and its underlying components for a while. It has proven to be one of the most efficient ways to identify quality and security issues. In general, we apply fuzzing on
