Cyberattacks
339 episodes · Page 3 of 15
#5486: Why Hebrew URLs Turn Into Percent-Sign Gibberish
Hebrew renders fine in the domain but explodes into percent-hex in the path. Two different standards explain the split.
#5481: Small Models, Big Guardrails: PII Detection in ChatGPT
A tiny 600M parameter model is quietly scanning your ChatGPT tool calls for PII. Here's how that class of guardian model actually works.
#5476: When Login Systems Lock Out Their Own Users
Why do login systems permanently lock out real users? A look at the hidden design failures behind OTP dead ends and circular recovery flows.
#5463: What Happens When You Click "Connect" on an AI Plugin
You click accept, the tool runs, and a credential you never saw is doing the work. Here's who actually owns it.
#5450: Heat, Fans, and the Limits of Air-Gapped Security
Dozens of ways to leak data from air-gapped machines exist — but every real breach still used a USB stick.
#5434: When Local AI Tools Phone Home
Local AI tools shouldn't need the network. So why is your on-device writing assistant uploading 40MB at 3am?
#5420: How Keyboard Middleware Actually Works
A keyboard isn't one thing — it's a stack. Here's how input methods, composition buffers, and hooks really work on Linux, Android, and Windows.
#5417: Can You Version-Control Your Android Apps?
Android Developer Verification enforcement just started. Can you define your installed app list as code — and what breaks if you try?
#5415: Inside F-Droid: Repos, Front Ends, and Sideloading Safely
How F-Droid's repository model works, why it has five front ends, and what actually keeps sideloaded APKs safe.
#5414: Inventing Anna: The Real Tradecraft Behind the Con
How Anna Delvey ran a four-year con on Word docs, AOL addresses, and a supermarket burner phone — and what Netflix got right.
#5405: Omarchy: The Linux Distro Built for AI Agents
Omarchy treats AI agents as users of the OS itself — every setting a command, every config a text file. Here's how it works and where it breaks.
#5404: Gemini Broke Out of Its Sandbox. Sort Of.
A Gemini agent reached three real companies during a capture-the-flag test. The containment failure, the seven-week silence, and what "broke out" a...
#5394: Why Waze Sends You Into a Jerusalem Alley
A listener's complaint about Waze turns into a tour of how routing apps actually work — graphs, shortcuts, and a map that's always slightly wrong.
#5380: Zero-Click: When Your OS Opens Files For You
Your file manager parses downloads before you touch them. Here's what that means for your security — and what you can actually do about it.
#5379: Hashing, Sandboxes, and YARA: The Free Forensics Nobody Uses
VirusTotal, MalwareBazaar, and YARA do far more than most people realize — and they're free. Here's how to actually use them.
#5327: Catching Duplicate Submissions Before They Burn Credits
A dropped webhook response caused a double submission. Here's how to build a screener that catches duplicates before generation runs.
#5314: Private Cyber Skills vs. Government Ops
What actually changes when a cybersecurity operator crosses from protecting a company to protecting a state?
#5292: Ukraine's Cyber War: Hacking, Deception, and the IT Army
How Ukraine built a formidable cyber capability from almost nothing — and turned phone calls and phishing into artillery coordinates.
#5249: What Makes a Network Truly Sovereign?
An HF antenna on a consulate roof raises a bigger question: what makes a network sovereign — and why is everyone from cloud vendors to AI data cent...
#5220: Malware vs. Virus: What's Actually Attacking Your Machine
Every virus is malware, but not every malware is a virus — and that distinction explains why your antivirus keeps missing things.
#5202: What Happens to Breached Data After the Breach
Once a dataset leaks, it never stops moving. A look at the bots, combolists, and USB drives that make breached data impossible to recall.
#5199: Shell Companies Over Shell Companies
Why covert networks stack shell companies in layers — and why the structure itself is the weapon.
#5094: How Aviation Turns Crashes into Safety Rules
Inside the NTSB's forensic pipeline: black boxes, runway rubber, and how findings become rules that prevent the next disaster.
#5033: The Greatest Dumbest Home Assistant Automations
Doorbell goal horns, toilet dashboards, and a lamp that dims on guests. The ten most gloriously unnecessary smart home automations, ranked.