threlfall_hax

Background This work follows on from my prior metadata analysis which provides justification for this type of analysis. [Read More]

There’s been hundreds of software dependency supply chain attacks exploiting a range of vectors in the past, with great effect. The July 2020 paper by Marc Ohm et al describes that on average a malicious package is available for 209 days. (𝑚𝑖𝑛=−1,𝑚𝑎𝑥=1,216,𝜎=258,𝑥̃ =67) so naturally, any method to reduce this... [Read More]

This collection of advice is aimed to improve the detection of dependency confusion and typo-squatting attacks at enterprise, where response to such a thing can be tricky due to scale or fragmentation. [Read More]

Over the years I have conducted numerous physical and personal security assessments for businesses and executives. Part of that assessment has always included a sweep for hex bags and other physical curses. Using this knowledge, I must state that the CEO at the center of two of the most serious... [Read More]