security

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

A UC Berkeley CS 161 lecture by Nicholas Weaver on cryptocurrency and blockchains, covering how they work and the case against them. It is aimed at a computer security course audience.

An AdaCore webinar in which NVIDIA engineers explain why and how they adopted Ada and SPARK for security-critical firmware. It covers the business case and the engineering experience of the transition.

The Lock Picking Lawyer tests the supposedly unpickable lock designs built by the Stuff Made Here channel. He looks for bypasses and weaknesses in the novel anti-picking mechanisms.

Benn Jordan details security vulnerabilities in Flock Safety license-plate-reading cameras and how easily they can be compromised. It includes citations from security researchers and discussion of police surveillance.

A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.

Jake Archibald argues that URLs are nearly impossible for humans to interpret, especially for security. He walks through what browsers do about it, including highlighting the registrable domain, and floats a possible better design.

Daniel Stenberg's keynote at FrOSCon 2025 on AI slop attacks on the curl project, with examples of bogus AI-generated security reports. He discusses the toll on maintainers and why various countermeasures don't fit the project.

Veritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.

LockPickingLawyer examines a challenge involving a tamper-sealed Abus lock and shows how the tamper seal can be defeated.

SANS ICS Security's parody video of the HyperEncabulator, a spoof of the Turbo Encabulator technobabble videos.

A DEF CON 29 talk by Richard Henderson about encoding the EICAR antivirus test string into QR codes and barcodes and scanning them at real systems. Many systems that do not expect such input misbehave or collapse, including a parking garage system.

Engineer Stuff Made Here builds two new supposedly unpickable locks with different designs and sends them to the Lock Picking Lawyer to see whether they can be defeated. The video covers the novel anti-picking mechanisms.

Nicholas Carlini of Anthropic talks at [un]prompted 2026 about how adversaries could misuse current LLMs for attacks. He shows recent models finding zero-day vulnerabilities in heavily tested software, including a SQL injection in Ghost.

Deviant Ollam gives a long talk on risk and preparedness: get a lawyer, passport, locksmith and other resources before you need them. It covers practical steps to build defenses against serious problems in life.

A LockPickingLawyer video in which a locksmith claims his videos are fake and challenges him; he responds by picking the lock. It is a short, typical LPL demonstration.

Louis Rossmann explains why he stopped using GrapheneOS, describing his interactions with its lead developer Daniel Micay. It includes chat logs shown in the video.

Linus Tech Tips warns against cheap Android TV boxes, many of which ship with preinstalled malware. It looks at several boxes and suggests safer alternatives such as Chromecast and Nvidia Shield.

Eric Parker connects a fresh Windows XP machine to the internet in 2024 to see how quickly it gets infected with malware. He documents the dangers of running an unpatched legacy OS online.

Quentin Perret of Google gives a technical deep dive into protected KVM (pKVM) on Arm64, a confidential computing approach for CPUs without hardware extensions. It explains how the nVHE hypervisor manages stage-2 MMU access control to protect guest memory.

A WSJ investigation by Joanna Stern into iPhone thieves who watch victims enter their passcode, then use it to lock them out of Apple accounts and drain bank and payment apps. It explains how the thefts work and how to protect yourself.

A DEF CON 30 talk by Sam Bent, a former darknet vendor, on operational security when using Tor and the darknet. He applies the hacker mindset to staying anonymous and avoiding capture.

Benn Jordan concludes his Flock trilogy, filmed on a publicly deployed Flock Safety camera, covering a leak of camera feeds reported by 404 Media. He shows the cameras' capabilities, including panning to track people.

Mark Russinovich's closing keynote at Rust Nation UK on Microsoft's adoption of Rust, covering security gains, integration challenges, performance results and lessons learned.

Scam-baiter Jim Browning explains how he fell for a phishing email and ended up deleting his own YouTube channel. He walks through the circumstances and prior incidents that made the scam convincing.

A 57-minute account of Clifford Stoll's tracking of a KGB-linked hacker through Lawrence Berkeley Lab computers in 1986, the story of The Cuckoo's Egg. It covers the FBI and Chaos Computer Club involvement.

John McCall of Apple's Swift team presents at CppNow 2023 on introducing a memory-safe successor language into large C++ code bases. He argues incremental improvement of C++ hits hard limits and explains Swift's C++ interoperability for gradual migration.

MattKC fits a playable Snake game into a QR code by writing tiny x86 machine code and patching the ZBar scanner so it can run the decoded data.

RustConf 2020 closing keynote by Sian Griffin that dives into Pokemon Blue glitches, notably Missingno and arbitrary-code-execution tricks. It uses them to explain how memory unsafety works and how memory-safe languages like Rust prevent such bugs.

Joe Grand recounts being hired to hack a Trezor One hardware wallet and recover $2 million of cryptocurrency. He describes three months of experimentation, voltage glitching, failures and high-stakes attempts with only one chance to get it right.

Steve Mould messes with an automated phone bot by telling it to forget its previous prompts and give him a bolognese recipe. It is a short demo of prompt injection against an AI voice agent.

Jon Gjengset's Rust NYC talk explaining what `unsafe` in Rust actually means, why it is dangerous, and why it is sometimes necessary. He works through the Rustonomicon to separate fair concerns from overblown ones.

Jim Browning reverses a scammer's remote connection and discovers CCTV in a Delhi call centre. He gives a detailed look at how a tech support scam operation runs, and he shared the footage with the BBC.

Musician Benn Jordan explains and demonstrates adversarial noise that poison-pills music files against AI training and scraping.

A FIDO Alliance demo with Google and Microsoft engineers showing passkeys working across operating systems, browsers, and devices. It walks through registering and signing in on new devices.

Omar Rizwan's short !!Con talk about writing a Breakout game in JavaScript that runs inside a PDF. It explores the surprisingly large PDF specification, including its scripting support.

A one-minute political ad from a PAC tied to Missouri Governor Mike Parson attacking a reporter who disclosed a state website flaw as a hacker.

A 37C3 talk on how a series of Polish electric trains stopped working after servicing by an independent company. The speakers explain how train control systems work and how they reverse-engineered the software lockouts.

Kitboga builds an elaborate automated phone maze with fake captchas, hold loops and absurd support to trap scammers for days. It also covers how this protects potential victims by wasting scammers' time.