short notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
Review rings, refund-for-review clubs and brokered five-star ratings inflate trust on mainstream marketplaces and darknet markets alike. What enforcement actions and a decade of research say about how reputation gets manufactured, and how rings get caught.
A Snowflake proxy relays a censored user's WebRTC-wrapped traffic to a Tor bridge, and stops there. What running one involves, what it costs in bandwidth, where it fails, and why the Tor Project calls it the entry-level volunteer role.
Seconds of audio are enough to clone a voice, and documented cases — the HK$200 million Arup video-call fraud, family emergency scams with cloned relatives, business leaders targeted with a minister's cloned voice — show human ears and some biometric checks failing. Code words, callback discipline and bank-side verification still work.
Air-gapped machines still get infected. How data physically crosses an air gap - USB firmware tricks, acoustic and light covert channels, radio leakage from a USB port - anchored in Stuxnet and the Ben-Gurion research lineage, and what defenders do about it.
Joint #StopRansomware advisories double as a public record of how the ransomware economy runs: initial access brokers priced from $100 to $1 million, tiered affiliates, leak-site countdowns, and sanctions risk for anyone facilitating a payment. What the documents actually state, and why payments are falling anyway.
Onion slowness is mostly bought in advance: standing introduction circuits, descriptor lookups and rendezvous setup all land before the first byte. Where service-side latency actually goes, which torrc knobs move it, and why the single-hop mode trades location anonymity for speed.
A breach notice compresses weeks of forensics into a few careful sentences. The scope verbs, the password storage format and the gap between discovery and disclosure usually say more than the apology does.
A two-year campaign that once targeted crypto-wallet users has moved to security professionals, hiding a modular Electron loader in GitHub repositories that pose as Fscan parsers, scan automation and log-analysis tools. Dr.Web says more than 2,000 Windows systems are infected.
A v3 onion address is not random text: it is the base32 encoding of an ed25519 public key, a 2-byte SHA-3 checksum and a version byte. That construction makes addresses typo-resistant and self-authenticating - and it concentrates all risk in one private key file.
Genesis Market fell in April 2023, but the trade in stealer logs, databases and network access changed venues rather than stopped. Research from Flashpoint, Sekoia and Kaspersky traces a reseller economy now consolidating around forums like Rehub.
An intruder reached Crédit Mutuel Arkéa through a service provider's platform and used the bank's own account to move about EUR 118 million, a figure the bank will not confirm. The money left as ordinary bank transfers, was withdrawn as USDC and USDT at three exchanges, and partly ended in Monero.
DRAM holds its contents for seconds to minutes after power-off, longer when chilled, and full-disk encryption keys are usually among them. What the 2008 Princeton work showed, what modern memory scrambling does not fix, and the mitigations Tails actually ships.
