Information Security *

Have you ever hidden something inside a PNG? A basic way to securely hide something inside an image. And all in your favorite JavaScript!

A lot of security conversations still start with a familiar question:

EV charging platforms look familiar at first: APIs, cloud infrastructure, mobile apps, CI/CD, Kubernetes, telemetry, admin tools, and billing-adjacent logic. But the risk model is different. A weakness in authorization, release governance, device identity, or observability can affect not only data, but also charging sessions, stations, firmware, fleet operations, and recovery workflows.

This article explains how to approach EVSE as a Product Security problem, not just an AppSec problem.

На прошлой неделе исследователи «Лаборатории Касперского» опубликовали разбор свежей кампании по распространению вредоносного ПО в Steam Workshop, встроенной в игровую платформу Steam мастерской для обмена пользовательским контентом. Для заражения пользователей злоумышленники используют программу Wallpaper Engine — это платная утилита для создания кастомных обоев рабочего стола. Возможности программы достаточно широки — от анимации и воспроизведения видео до запуска приложений. Именно этой особенностью и воспользовались организаторы атаки.

Исследователи наблюдали два варианта распространения вредоносного ПО под видом анимированных обоев. В самом простом варианте жертве доставлялся архив, внутри которого содержались и обещанные обои, и вредоносные файлы. Чуть более сложный метод предполагал распространение в уже запароленном архиве. К нему был приложен скрипт, который распаковывал архив и запускал вредоносную нагрузку автоматически. Обои публиковались в Steam Workshop с конца 2025 года. Авторы отчета обнаружили десятки вредоносных обоев, причем некоторые из них имели десятки тысяч скачиваний. Результат установки такого ПО ожидаемый: кража учетной записи Steam, установка вымогателя-шифровальщика и запуск криптомайнера.

Malicious code was injected into four Laravel-Lang projects, presumably stealing credentials from the devices on which it was run.

Popular projects were affected: Lang, Actions, Attributes, and HTTP Statuses.

The incident concerns not only Laravel...

I've run both platforms in a real production environment — 600+ users, 50+ SaaS platforms, an international software company with distributed teams across multiple timezones. This isn't a vendor comparison page. This is what I actually experienced running both, migrating between them, and managing the transition in parallel.

The question "JumpCloud or Okta?" comes up constantly in IT communities. It almost always gets the same frustrating non-answer: "it depends." That's technically true — but let me break down exactly what it depends on, and why.

In Part II we saw that an API key is essentially a long, secret password your software shows to a server. It works, but it has a hidden cost: every time the key is used, the server must look it up in a database to find out what the key is allowed to do, whether it has expired, and whether it has been switched off. A JSON Web Token (JWT) removes that lookup by carrying all of that information inside the token itself. This article explains the problem JWT solves and shows where it sits in the larger story of web authentication.

Part I covered Basic Authentication — sending a username and password with every request. Part II covered API keys — replacing that reusable password with a single opaque secret string that identifies an application rather than a person.

In early 2026, one new law and one far‑reaching legislative initiative are expected to seriously affect digital freedoms in the EU. The first allows police to collect biometric data and target individuals; the second aims to put all metadata into one box and then use AI to run investigations. Naturally, both laws were adopted under the mantra of protecting democratic values, rights, and freedoms. Xeovo has examined the sprawling regulatory texts and explains what exactly Members of the European Parliament are aiming at.

C++ has trapped itself in an evolutionary dead end due to backward compatibility and UB, and the only realistic successor capable of displacing it in large codebases will be a transpiler that generates C++ and enables gradual, low-risk adoption.

Это перевод на английский язык статьи моей статьи Ахиллесова пята C++ и будущая р̶е̶ эволюция

Analyzing a Denuvo bypass approach based on virtualization (Resident Evil: Requiem).

This article serves more or so to analyze this bypass approach and how to circumvent it on Denuvo’s side.

In November, 2025 Russia-based web host Media Land was sanctioned by several countries as a bulletproof service — the one hackers relied on to launch DDoS attacks and attack businesses in the United States and in allied countries. “Bulletproof” may refer to a VPN as well, as it usually means abuse resistant and private. Xeovo explains how genuinely reliable anonymous VPNs and hostings differ from bulletproof services — and why the real bulletproof operators are often not those who call themselves that.

Hey, Habr! Ivan Glinkin is here again, head of the hardware research group from the Bastion team. 

"A flash drive with a combination lock," "a flash drive with hardware encryption," "an encrypted USB drive," and finally, the proper term — "Cryptographic Module". An encrypted USB flash drive goes by many names, but the core concept remains the same.

The purpose of such a device is to protect sensitive information from unauthorized access at both the software and hardware levels through encryption, anti-tampering mechanisms, and various other safeguards. But are these secure USB drives really as reliable as they're made out to be, or is it all just smoke and mirrors? 

We decided to look past the marketing claims and conduct our own investigation, attempting to crack several of these devices using hardware reverse engineering. We attempted to extract data, identify the encryption algorithms used, physically open the drives, and read their memory chips.

The results were quite interesting. Read on for the details.

This article is not about Puppeteer being a bad tool. Puppeteer is excellent. And competent TLS fingerprinting will bypass most defenses. But there is a class of tasks where even a perfect network stack won't save you — because detection has long since landed at the level of rendering engine behavior. Let's take a look at how Cloudflare and Akamai expose you through WebGL and Canvas, and why “clean” code no longer works.

Yesterday I wrote about the graphical shell Launcher for GoodbyeDPI, which allows you to intuitively use the GoodbyeDPI solution from ValdikSS to solve the problem of YouTube throttling and the unavailability of a number of sites in Russia. Everything was fine, but these were solutions only for Windows. In the comments, the main questions were about what to do with Android, Linux, and Mac, and why not in the source code. Alas, the repressions of the RKN (Roskomnadzor) force the Habr administration to censor articles, I am forbidden from making changes to yesterday's article, and the link itself is only available outside of Russia, so I am explaining about Android, Linux, and Mac here, with links to the source code.

So, for Android there are a lot of projects, I liked Release ByeDPI 1.0.0 · dovecoteescapee/ByeDPIAndroid · GitHub. For Mac and Linux I would install https://github.com/xvzc/SpoofDPI/releases. All in source code.

ByeDPI for Android is an application that runs a local VPN service to bypass DPI (Deep Packet Inspection) and censorship. A SOCKS5 proxy ByeDPI is launched locally on your device and all traffic is redirected through it.

In this guide, we will install the v2rayA package on OpenWRT using the stable 23.05.0. A router with at least 128 MB of RAM (256 is preferable) and more than 16 MB of storage is recommended (the installation takes about 30 MB of storage)

v2rayA is a simple-to-use and powerful client focused on Linux. Despite its name, the current version uses xray-core, although it's also possible to use v2ray-core. It has a web interface for managing settings and importing configurations and subscriptions. It supports everything that xray-core supports:

Shadowsocks (incl. 2022), ShadowsocksR, Trojan, Vless (including XTLS-Reality, XHTTP), Vmess, Juicity, Tuic

The guide will include:

1. Installation from the repository

2. Configuring v2rayA and bypassing blocks using Re:filter, Antifilter GeoIP, Geosite

Wireshark is a widely used tool for capturing and analyzing network traffic, actively used for both educational purposes and for troubleshooting computer or network issues. Wireshark works with almost all OSI model protocols, has a user-friendly interface, and a convenient data filtering system. In addition, the program is cross-platform and supports the following operating systems: Windows, Linux, Mac OS X, Solaris, FreeBSD, NetBSD, OpenBSD.

With the rise of privacy threats and constant internet restrictions, using a VPN has become the norm for many users. However, behind the simplicity of connecting lie technical features that can significantly impact

the user experience. One of the key factors is the choice of VPN protocol, which determines the speed, stability, and security level of the connection.

This article will provide a detailed breakdown of the most popular VPN protocols, their features, advantages, and disadvantages, and will also offer examples of how to use each of them.

By the way, I took all the pictures from those, you know, the internets, but I analyzed and explained them myself, just for you :)

It's been two years since I posted a video and a post about how I recovered my friend's Telegram account using JavaScript. Since then, I've helped over a hundred people regain access to their accounts. Then the method stopped working

I decided to gather the important security aspects of your Telegram account in one place.

My second article—an analysis of MAX's network requests and why this analysis is my biggest disappointment! I certainly didn't expect this, but I described everything as it is.

This weekend was all about 'Connection Reset.' While news channels vaguely reported that 'users are complaining about outages,' we were in chats and on test servers trying to understand the physics of the process.

Friends, today I want to share a story that made me believe in miracles for half an hour. And at the same time, I'll break down a new scam scheme that showed me that criminals are evolving too.