This is the write-up of a talk I gave at PasswordsCon, which runs as a track inside BSides Las Vegas. It was my first time in Vegas and my first talk at a conference that size, so if the recording has me talking slightly too fast, that is why. The short version: attackers are starting to throw passwords at login systems that were never meant to work, and that breaks an assumption a lot of defensive tooling is quietly built on. ...
Disclaimer: The examples below are anonymised and aggregated across multiple engagements. The goal is to highlight recurring patterns, not embarrass any specific organisation. Security Theatre: Field Notes from the Inside The Scene Most environments I assess are not wide open. They have firewalls, policies, and controls that look sensible on a slide deck. The same weaknesses keep showing up anyway. Security gets implemented as a compliance checklist rather than an adversarial system. ...
1. Why This Camera? I came across this cheap IPC camera on a local marketplace here in South Africa. The price was perfect to mess around with the device and potentially break it. The device cost around R300, or roughly $10. My goal with this device was to go from zero to one hundred in terms of how I document findings, while also looking at every nook and cranny I could reasonably reach. ...
A complete guide to ProbeDeck, a single-container, self-hosted platform that runs network probes from your own vantage points, turns them into monitors with alerts and incidents, and shows it all on a dashboard, a public status page, and across multiple geographic agents.
Two devices off the same shelf, two completely different threat models. A cheap XiongMai-based IP camera that waves you through at every layer, versus a TP-Link VIGI NVR that makes you fight for every inch and still keeps its secrets in hardware.
I’ve written about the home lab at a high level already. The firewall got glossed over in a paragraph and that’s never quite sat right with me, because OPNsense is doing most of the work that stops the home lab from becoming somebody else’s problem. This post walks through the config as it currently runs. Not a tutorial. Not a clean-slate build guide. Just what’s actually on the box, what each piece is doing, and which of the “this looks clever” choices turned out to be worth it. ...
I finally got around to putting a honeypot on the public side of my home connection. I wasn’t trying to catch APTs. I wanted to see what hits a random residential IP when nothing is hiding it. This is a notes post about standing it up, how it’s contained, and what actually showed up in the logs after a month. Why bother Most threat intelligence I read describes the internet as a battlefield. Every unpatched device is five minutes from compromise. Every IP gets 30,000 probes a day. The numbers are usually correct. They aren’t useful unless you can map them to what your environment looks like. ...
I’ve started digging into RF, meaning anything noisy in the air that my SDR can see. This is a quick log of the first sessions using an RTL-SDR (cheap, RX-only) and a HackRF One (wider bandwidth, TX-capable, which stays off outside a legal setup). This isn’t a decoding write-up. The goal for now is observation: watch the spectrum, log activity, and build something useful. The kit RTL-SDR (RTL2832U + R820T): cheap receive, wide community support, good for learning. HackRF One: wider tuning range, bigger bandwidth, better lab potential. Antennas matter more than most people want to admit. A random wire will pick something up, but it’ll also mislead you. ...
Home Lab Overview: Alecto and Friends I’ve always enjoyed tinkering with operating systems and finding ways they improve day-to-day life. I’m not a cloud hater. Cloud services are useful and I still use them. I self-host because it’s fun. With most SaaS tools, you’re limited by design choices you had no part in. My biggest self-hosted system is a Plex machine. I watch what I want, how I want, for roughly the cost of electricity. There’s also been a serious learning component: networking, security, general IT practice. That alone has made it worth running. ...