Information security

Hack Time, Habr!

The other day, I came across a high-profile investigation by Dmytro Tarasenko (aka iTaysonLab).

He was the one who decompiled the APK of the new 'Telega' app, identified links to the VK and Catogram infrastructure, and published the details on the BruhCollective Telegram channel.

My colleagues uncovered many alarming facts, but as someone who loves to dig into the guts of applications, I wanted to go further, confirm their findings, and find what dynamic analysis missed.

I decided to conduct a full static analysis of the APK, deobfuscating the code to create the most complete and technically supported picture possible.
What is really hiding behind the promises of an 'improved' Telegram?

Let's take a look.

Spoiler: it's not secure, not private, but it's damn interesting. Let's go!

It's been two years since I posted a video and a post about how I recovered my friend's Telegram account using JavaScript. Since then, I've helped over a hundred people regain access to their accounts. Then the method stopped working

I decided to gather the important security aspects of your Telegram account in one place.

My second article—an analysis of MAX's network requests and why this analysis is my biggest disappointment! I certainly didn't expect this, but I described everything as it is.

This weekend was all about 'Connection Reset.' While news channels vaguely reported that 'users are complaining about outages,' we were in chats and on test servers trying to understand the physics of the process.

Hello everyone, in this article I will explain how many people manage to bypass whitelists, and what the root of the problem is. If you are a 'newbie' and don't want to bother with all the setup, at the <a href="#services"> end of the article</a> I've listed services that are mentioned in discussions.

Direct connect VLESS + Reality to Europe (Amsterdam, Germany, Finland) is being shaped for almost everyone. TSPU has mastered a new tactic: they don't terminate the session via RST, but simply 'freeze' it. As soon as the data volume in a single TCP session exceeds 15-20 KB, packets stop arriving. The connection hangs until the client times out.

In a changing network infrastructure, mobile internet users face questions: what resources remain available, and what does this look like on a technical level? This material is the result of a practical study using standard network analysis tools.

No speculation—only measurements, numbers, and technical facts.

Hello everyone!

I, at my own risk, decided to install MAX and see what happens after installation. My research will result in at least 2 articles.

This is the first article. In it, I will compare the permissions requested by the MAX app for Android with the permissions requested by Telegram and WhatsApp.

In 2025, internet censorship in Russia, China, and Iran has reached an unprecedented level. Traditional VPN protocols like OpenVPN and even WireGuard are detected and blocked by Deep Packet Inspection (DPI) systems in seconds. Enter VLESS — a lightweight protocol that is becoming the last working solution for bypassing modern censorship.

This article explains how VLESS works on a technical level, why it is so effective at evading detection, and shares real-world experience of building a VPN service in Russia's hostile environment.

A VPN is a technology for a secure connection to a remote computer or network, and for most users, it's simply a safe way to use the internet in public Wi-Fi zones.

In this article, we will look at four ways to create your own VPN. Let's start with the simplest option, which is manageable even for novice PC users.

For many, November 28, 2025, began with complaints about WhatsApp. Some users are unable to send or receive text messages and media files, and when attempting a voice or video call, the client hangs indefinitely on the 'Connecting' status before dropping the call.

Telecom operators (MegaFon, Beeline) are reporting normal network operations. And technically, they aren't lying: connectivity exists, and Meta's IP addresses are (mostly) accessible. The problem lies deeper—at the level of L7 filtering by TSPU.

> As of April 10, 2024,
> three months later,
> this article has been blocked by Roskomnadzor (RKN)
> within the territory of the Russian Federation.
> It has also been removed from the web archive archive.org.
> The article on Habr remains accessible from IP addresses in other countries.
> Yes, now to read about VPNs, you need a VPN.

Against the backdrop of last year’s escalation of censorship in Russia, the articles by MiraclePTR were a breath of freedom for many Russian-speaking IT folks. I want to open the door to free information a bit wider and invite “non-techies” (“dummies”) who want to spin up a personal proxy server to bypass censorship but feel lost in the flood of information or got stopped by a confusing technical error.

In this article I’ve described a universal solution that provides transparent access to the global internet bypassing censorship, uses cutting-edge traffic obfuscation, doesn’t depend on the will of a single corporation, and most importantly has ample “safety margin” against interference from censors.

This article is aimed at “dummies” unfamiliar with the subject area. However, people “in the know” may also find something useful (for example, a slightly simpler setup for proxying via CloudFlare without having to run nginx on a VPS).

If you still don’t have a personal proxy to bypass censorship—this is your sign.

This guide covers how to set up OpenClaw (formerly Clawdbot) on your local machine and, most importantly, how to secure it so strangers can’t access your computer. If you are ready, then let’s get started! :)

What if a trusted application in your Microsoft Teams could silently access your most sensitive information? I found a flaw in the single-sign-on (SSO) mechanism that makes this possible.

Investing in Application Security (AppSec) and DevSecOps is no longer optional; it's a strategic imperative. However, securing budget and justifying these initiatives requires moving beyond fear and speaking the language of business: Return on Investment (ROI).

This guide provides a structured framework for calculating the costs and benefits of embedding security into your software development lifecycle (SDLC). By understanding and applying concepts like Total Cost of Ownership (TCO), Lifecycle Cost Analysis (LCCA), and Return on Security Investment (ROSI), you can build a compelling financial case, guide your security strategy, and prove tangible value to stakeholders.

The Problem: Traditional phishing emails are relatively easy to spot. AI-generated ones are not.

python.

While researching malware used by attacker groups, we came across a series of unusual attacks that used GitHub repositories to store malicious files and victim data. These campaigns appear targeted rather than large-scale, and it seems the attackers relied heavily on AI during development. The earliest activity we traced was in September 2024, and the most recent in April 2025.

Our Threat Intelligence team investigates complex attacks featuring novel persistence and data collection methods and unique infrastructures. Sometimes we find simple two-line scripts, and other times we run into "bombs" that trigger dozens of different payloads at once. But it's pretty rare for us to come across such long chains of really simple AI-written scripts that still work, tied together in a way that clearly wasn't random. Think of this as an APT-style attack implemented at the "script kiddie" level (a derogatory term in hacker culture for those who rely on scripts or programs written by others).

My name is Ilya and I’m a Core Developer at Bright Security. In Bright we work on a DAST (Dynamic Application Security Testing) solution that helps development teams find and fix vulnerabilities early, straight from CI/CD. My own path began in full-stack engineering, but almost a decade of shipping production code drew me ever deeper into application security. In this article I’m explaining key approaches on what SAML actually is and how we detect it in Bright using DAST.

For people familiar with the term DPI (Deep Packet Inspection), it often carries an unpleasant association: blocking, regulators, censorship, tightening controls. In reality, DPI is simply the name of a technology whose essence lies in the deep analysis of network traffic. Deep traffic analysis involves identifying protocols, extracting the most significant fields and metadata, classifying internet services, and analyzing the nature of network flows. I will explain how such solutions work in this article.

Proxy servers have long become an integral part of the modern network. They are used to enhance anonymity, bypass blocks, balance loads, and control traffic. However, not everyone understands that there is a fundamental difference between HTTP(S) proxies and SOCKS proxies. In this article, I will attempt to examine in detail the technical aspects of both types, review their advantages and limitations, and provide examples of configuration and usage – though this part is more of an elective (optional, if you will, but I really feel like including it).