Blog on srdusr

Defending Yourself With What You Know About Attackers

Fri, 24 Jul 2026 00:00:00 +0000

The attacks I read about for work are not reserved for interesting targets. The same credential stuffing, the same phishing, the same stolen device: they arrive at ordinary people every day, and knowing how they work is only an advantage if you turn it around and point it at your own life.

A stolen laptop is what made me start writing any of this down. What follows is what I actually do, in the order the effort pays back.

Testing Yourself Beats Re-Reading

Sat, 16 May 2026 00:00:00 +0000

Trying to recall something strengthens the memory of it more than reading it again does. Re-reading notes feels productive because the material feels familiar, but familiarity is not the same as the ability to produce the answer under exam conditions. The feeling of fluency while reading is the trap.

Why it holds

Memory is strengthened by the effort of retrieval, not by exposure. Each time you pull a fact out of memory without looking, you make the next retrieval easier and more durable. Reading provides no such effort; it lets you recognise the material without ever producing it, and recognition is not what an exam tests. A past paper done under time is retrieval practice; re-reading the chapter is not.

A Note Is Worth What It Links To

Wed, 29 Apr 2026 00:00:00 +0000

An isolated note is a fact you have to remember exists in order to find it. A linked note is reachable from everything near it in meaning. The value of a knowledge base is not the number of notes; it is the number of useful connections between them.

Why it holds

Retrieval is the whole point of an external memory, and you retrieve by association, not by recalling a filename. A note linked from three related notes surfaces whenever you work on any of them. A note linked from nothing surfaces only if you already remember it, which defeats the reason for writing it down. So the link, with a sentence saying why the two ideas connect, carries more of the long-term value than the note body does.

Encryption Gives Confidentiality, Not Integrity

Fri, 27 Feb 2026 00:00:00 +0000

Encrypting data hides it. It does not prove the data was not changed. These are two different properties, and assuming the first provides the second is the root of a whole class of real vulnerabilities.

Why it holds

A cipher maps plaintext to ciphertext so an eavesdropper cannot read it. Nothing in that mapping detects tampering with the ciphertext. In CBC mode an attacker can flip bits and, given feedback on whether the result decrypts to valid padding, recover and forge plaintext without the key. That is the padding oracle attack, and it exists precisely because the system checked confidentiality but never integrity.

Thorough Enumeration Beats Clever Exploitation

Tue, 02 Dec 2025 00:00:00 +0000

More machines fall to finding the thing that was already there than to a clever exploit. When a box is stuck, the fix is almost always to enumerate harder, not to reach for a more advanced technique. The winning path was usually visible at hour one and dismissed.

Why it holds

An exploit needs a target, and finding the target is enumeration. A service on a high port, a virtual host that only answers to its name, a comment in the page source, a readable share: each is a foothold that no exploit skill substitutes for. Enumeration also compounds. Every credential and hostname found sends you back to enumerate something new, so the surface grows as you work.

Vulnerabilities Cluster at Trust Boundaries

Fri, 14 Nov 2025 00:00:00 +0000

A trust boundary is any point where data crosses from a less-trusted context into a more-trusted one: user input into a query, a request into a privileged process, one tenant’s data into another’s view. Almost every vulnerability class is a failure to re-establish trust at such a crossing.

Why it holds

Injection is untrusted input crossing into an interpreter without being made safe for it: SQL injection into a database, command injection into a shell, template injection into a template engine, cross-site scripting into another user’s browser. Authorisation bugs are a principal crossing into data it should not reach. Even privilege escalation, whether through a SUID binary or a potato attack, is a low-trust process crossing into a high-trust one. Naming the boundary tells you what defence is missing: encode for the destination context, or check the right to cross.