android security

Linus Tech Tips warns against cheap Android TV boxes, many of which ship with preinstalled malware. It looks at several boxes and suggests safer alternatives such as Chromecast and Nvidia Shield.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

A UC Berkeley CS 161 lecture by Nicholas Weaver on cryptocurrency and blockchains, covering how they work and the case against them. It is aimed at a computer security course audience.

The Lock Picking Lawyer tests the supposedly unpickable lock designs built by the Stuff Made Here channel. He looks for bypasses and weaknesses in the novel anti-picking mechanisms.

Quentin Perret of Google gives a technical deep dive into protected KVM (pKVM) on Arm64, a confidential computing approach for CPUs without hardware extensions. It explains how the nVHE hypervisor manages stage-2 MMU access control to protect guest memory.

Benn Jordan details security vulnerabilities in Flock Safety license-plate-reading cameras and how easily they can be compromised. It includes citations from security researchers and discussion of police surveillance.

Louis Rossmann explains why he stopped using GrapheneOS, describing his interactions with its lead developer Daniel Micay. It includes chat logs shown in the video.

An AdaCore webinar in which NVIDIA engineers explain why and how they adopted Ada and SPARK for security-critical firmware. It covers the business case and the engineering experience of the transition.

A long Techlore video documenting what it presents as hostile conduct by GrapheneOS leadership and community members, including lead developer Daniel Micay, toward CalyxOS and others.

A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.

Jake Archibald argues that URLs are nearly impossible for humans to interpret, especially for security. He walks through what browsers do about it, including highlighting the registrable domain, and floats a possible better design.

Sal Mercogliano of What's Going on With Shipping? discusses a debate between the Center for Maritime Strategy and the Heritage Foundation over whether the Jones Act helps or harms American shipping and national security.

Daniel Stenberg's keynote at FrOSCon 2025 on AI slop attacks on the curl project, with examples of bogus AI-generated security reports. He discusses the toll on maintainers and why various countermeasures don't fit the project.

Veritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.

LockPickingLawyer examines a challenge involving a tamper-sealed Abus lock and shows how the tamper seal can be defeated.

SANS ICS Security's parody video of the HyperEncabulator, a spoof of the Turbo Encabulator technobabble videos.

A DEF CON 29 talk by Richard Henderson about encoding the EICAR antivirus test string into QR codes and barcodes and scanning them at real systems. Many systems that do not expect such input misbehave or collapse, including a parking garage system.

Engineer Stuff Made Here builds two new supposedly unpickable locks with different designs and sends them to the Lock Picking Lawyer to see whether they can be defeated. The video covers the novel anti-picking mechanisms.

Nicholas Carlini of Anthropic talks at [un]prompted 2026 about how adversaries could misuse current LLMs for attacks. He shows recent models finding zero-day vulnerabilities in heavily tested software, including a SQL injection in Ghost.

Deviant Ollam gives a long talk on risk and preparedness: get a lawyer, passport, locksmith and other resources before you need them. It covers practical steps to build defenses against serious problems in life.

Marques Brownlee explains why iMessage's blue and green bubbles matter, covering the technical, commercial and social side of Apple's messaging lock-in. It also discusses RCS and what could be done about it.

A LockPickingLawyer video in which a locksmith claims his videos are fake and challenges him; he responds by picking the lock. It is a short, typical LPL demonstration.

A Milwaukee vlogger follows teenagers known as the Kia Boys who steal Kia and Hyundai cars after a security flaw went viral on social media. The film includes interviews with participants.

Eric Parker connects a fresh Windows XP machine to the internet in 2024 to see how quickly it gets infected with malware. He documents the dangers of running an unpatched legacy OS online.

A WSJ investigation by Joanna Stern into iPhone thieves who watch victims enter their passcode, then use it to lock them out of Apple accounts and drain bank and payment apps. It explains how the thefts work and how to protect yourself.

Part one of Capt. Grace Hopper's 1982 NSA lecture on the future of data, hardware, software and people. It includes her humor, her nanosecond demonstration and views on scaling and resisting old ways of doing things.

Andrej Karpathy gives a one-hour general-audience introduction to large language models, covering what they are, how they are trained, comparisons to operating systems, and security challenges such as jailbreaks.

RealLifeLore explains with maps why Russia invaded Ukraine, focusing on energy resources, security buffers, Black Sea access and Crimea's strategic value.

Benn Jordan explains how Flock Safety's license plate cameras log and share vehicle locations, and explores how adversarial AI can defeat them. It covers weak security and the surveillance risks of private police-camera networks.

Bellingcat's publication of the recorded call in which Alexey Navalny, posing as a security aide, gets FSB officer Konstantin Kudryavtsev to describe the operation to poison him. It has English subtitles.

A DEF CON 30 talk by Sam Bent, a former darknet vendor, on operational security when using Tor and the darknet. He applies the hacker mindset to staying anonymous and avoiding capture.

Lord David Willetts argues at the Royal Institution that the post-war baby boomers gained wealth and security at the expense of younger generations. He draws on his book The Pinch, covering housing, wealth and social policy in the UK.

Luke Wagner of Fastly explains what a WebAssembly component is, how it relates to familiar concepts, and what the Component Model enables. It emphasizes security, composability and modularity.

Permaculture instructor Andrew Millison travels with the UN World Food Programme to Niger to see land recovery within the Great Green Wall, where rainwater harvesting is boosting food security and restoring the ecosystem.

Benn Jordan concludes his Flock trilogy, filmed on a publicly deployed Flock Safety camera, covering a leak of camera feeds reported by 404 Media. He shows the cameras' capabilities, including panning to track people.

Louis Rossmann explains why NYC commercial landlords keep storefronts vacant rather than lowering rents. He points to commercial mortgage-backed security loan terms and inflated property valuations.

Afroman's music video for a song about police damaging his door, built from home security footage of an officers' raid on his house.

Mark Russinovich's closing keynote at Rust Nation UK on Microsoft's adoption of Rust, covering security gains, integration challenges, performance results and lessons learned.

Scam-baiter Jim Browning explains how he fell for a phishing email and ended up deleting his own YouTube channel. He walks through the circumstances and prior incidents that made the scam convincing.