Everlasting Wanderer

From ASM-Hater to Digital Archaeologist: How AI turned a 20-year-old assembly nightmare into a precision strike

2026-04-04T13:35:00.002+01:00

I’ll be honest: I used to hate crackmes! A lot!

For years, the thought of diving into low-level Assembly (ASM) felt like a chore. Staring at dense hex dumps, manually tracking registers, and fighting through obfuscated logic was a "grind" I just didn't have the patience for. It felt more like a battle of attrition than a puzzle. If you’ve ever felt like you were looking at the world through a keyhole - one byte at a time - you know exactly what I mean.

But recently, that changed.

I decided to revisit a “cold case” - a Z80 assembly challenge from 2006 on TheBlackSheep. This thing had been sitting on a dusty shelf of the internet for nearly two decades, a tough challenge that had mocked researchers and frustrated players for years.

Back in 2006, the manual labor required to crack this was a nightmare. But today, the game has changed.

The “Holy Trinity” of Modern Reversing

Pairing Ghidra, Wabbitemu, and AI (ChatGPT) felt less like using tools and more like having a superpower. What used to be a months-long headache turned into a precision strike.

Ghidra gave me the “X-ray vision” to see through the author’s clever anti-disassembly traps.
Wabbitemu provided the “Time Machine” to watch the logic execute in real-time.
AI acted as the Universal Translator.

The AI didn't just "give" me the answer; it did something much more important: it removed the noise. When the assembly code became a thicket of register swaps and bitwise shifts, the AI helped translate that chaos into a logical narrative. It allowed me to stay in a "flow state," focusing on the high-level strategy of the exploit rather than getting lost in the syntax.

What I once hated for its complexity, I now love for its clarity. The shift from "hating assembly" to "loving the archaeology" happened the moment I realized I wasn't alone with the hex anymore.

There is an incredible, almost addictive dopamine hit in seeing a 20-year-old "Success" screen finally flicker to life. It’s the feeling of closing a case that was essentially a digital ghost. You aren't just solving a puzzle; you’re understanding the mindset of a developer from twenty years ago - their tricks, their jokes, and their hidden logic.

The 'grind' is officially dead. In its place is something much more exciting: Digital Archaeology.

The Forecast: A New Era for Reversing

As satisfying as this win was, I can’t help but realize we are currently in a “Hybrid Era”. We are still split between a disassembler, a debugger, and an AI chat window.

My forecast? The days of copy-pasting code into a chat window are numbered. We are heading toward a world of all-in-one reversing environments. Just as GitHub Copilot transformed how we write code and Claude Code is beginning to automate entire terminal workflows, the barrier between “The Disassembler” and “The Intelligence” is about to vanish.

Imagine a future where:

The binary is a narrative: You don’t “analyze” a function; you just read a summarized intent written in plain English.
Autonomous Debugging: The AI doesn’t just explain the code; it actively tests hypotheses in the debugger for you.
Zero-Friction Reversing: The manual grind won’t just be easier - it will be invisible.

The next generation of reverse engineers won’t be “ASM-Haters” because they won’t even see the syntax as a barrier. They’ll be directors of highly capable AI agents, focused entirely on the high-level architecture of the exploit.

We all have those “unsolvable” challenges from our past - the projects we walked away from because the wall was too high or the tools were too primitive.

Revisiting this crackme taught me that those walls are a lot shorter now. If you’ve been avoiding low-level challenges because of the “ASM headache,” I highly recommend giving them another look with a modern toolkit.

The “Aha!” moment is worth the 20-year wait. The cold cases are waiting. The tools are ready. It’s time to go back and finish what the 2006 scene started.

Case closed.

Also visit: https://quangntenemy.substack.com/p/from-asm-hater-to-digital-archaeologist

How Company Secrets End Up in ChatGPT (And How to Prevent It Without Blocking AI)

2025-12-22T10:13:00.002+00:00

A developer just wanted to fix a problem faster.

They were debugging a query. The error message made no sense.

The documentation was outdated. As usual.

So they did what millions of capable employees now do every day:

They copied a real snippet from work.

Pasted it into ChatGPT. Got a clean, helpful answer.

Problem solved.

Ticket closed.

No alarms. No warnings.

And without realizing it, company secrets just left the building.

---

This isn't an employee failure

No one was careless.

No one was malicious.

No one thought twice.

Because nothing in the system told them they should.

This is the uncomfortable truth most companies avoid:

When smart people repeatedly do the same risky thing, the system is teaching them to do it.

---

Your DLP didn't fail. It was watching the wrong place.

Most security stacks are still designed for an older world.

They monitor:

Email attachments
File uploads
API traffic
Known SaaS destinations

But the leak didn't happen there.

It happened in a browser. Via clipboard. Through a prompt.

Copy → paste → submit.

That path bypasses most traditional controls completely.

So when teams say, "Our DLP failed", what they really mean is:

Our threat model never included this behavior.

---

Why blocking ChatGPT backfires

The reflex response is predictable:

"Block ChatGPT."

"Block Claude."

"Block all external LLMs."

On paper, this looks responsible.

In practice, it produces:

Personal device usage
Browser extensions
Smaller, fragmented pastes
Silence instead of questions

Risk doesn't disappear. It just becomes invisible.

And once engineers stop talking to security, you've lost the most important signal you had.

---

This is a system design problem, not an AI problem

Developers optimize for: Speed, Accuracy, Low friction

Security teams often optimize for: Control, Policy, After-the-fact detection

When those incentives collide, the faster system wins.

Every time.

So the real question isn't "How do we stop people?"

It's:

How do we redesign the system so the safe path is the fast path?

---

Step 1: Provide an approved AI path people actually want to use

An internal or enterprise-approved LLM only works if it's:

Fast
Reliable
Easy to access (SSO, no tickets)
Good enough to replace public tools

If the "safe" tool feels worse than ChatGPT, it will be ignored.

This isn't about trust. It's about usability.

People don't bypass controls to be rebellious. They bypass them to get work done.

---

Step 2: Stop trying to read prompts. Watch behavior instead.

Trying to inspect every prompt is a dead end.

You won't reliably see:

What was pasted
How it was transformed
Where it went

But you can see behaviors that matter:

Large clipboard copy events
Copying from production systems into browsers
Structured data patterns
Sudden changes in paste volume

You don't need the content to detect the risk.

Attackers already know this.

Defenders are just catching up.

---

Step 3: Keep secrets from appearing on screens in the first place

The most effective control is also the least glamorous:

Don't expose raw secrets unless absolutely necessary.

That means:

Masking sensitive fields by default
Tokenizing internal identifiers
Treating "view" as a privilege, not a default
Restricting full production outputs

If someone never sees the secret, they can't paste it.

This is boring security.

It's also the kind that works.

---

Step 4: Train instincts, not compliance

Most AI training fails because it sounds like legal language.

"Employees must not input confidential information into AI tools."

That sentence does not survive:

Deadlines
Curiosity
Pressure

A better rule is simpler:

If it would trigger an incident report, it doesn't belong in a prompt.

No flowcharts.

No policy PDFs.

Just a mental shortcut people can actually use.

---

Step 5: Explain the risk in executive language

Executives don't need to understand tokens or embeddings.

They understand this immediately:

AI prompts are unlogged outbound data transfers with no recall.

Once the risk is framed that way:

Budget appears
Tradeoffs become explicit
Ownership becomes clear

Not because of fear.

Because of clarity.

---

The real lesson

This wasn't a junior developer problem.

It wasn't an AI problem.

It wasn't negligence.

It was a system built for a world where copy-paste wasn't a data exfiltration vector.

That world is gone.

The prompt is the new USB drive.

And if you're not actively redesigning for that reality, there's a good chance this is already happening inside your company- quietly, efficiently, and with the best intentions.

That's what makes it dangerous.

Also visit: https://quangntenemy.substack.com/p/how-company-secrets-end-up-in-chatgpt

A small moment that meant more than expected

2025-12-18T10:58:00.004+00:00

A friend lost her phone.
As many of us know, a phone today isn't just a device - it's access to photos, messages, work tools, banking apps, and daily routines.

I helped her lock things down.
Passwords were changed, accounts secured, risks contained.
We remotely erased all data on the device and locked it completely.
Whatever was lost, it won't be misused.

The good news: her data is secure.
The difficult part: what was on that phone can't be recovered.
Safe doesn't always mean reversible.

Later, she gave me a gift.
A small ceramic piece - simple, thoughtful, made by hand.

It was a quiet reminder.

We work in a fast, digital world where systems can usually be fixed.
But trust, care, and real human gestures still matter just as much.

Sometimes the most meaningful outcomes aren't measured in recovery -
but in knowing the right steps were taken, at the right time.

Also visit: https://quangntenemy.substack.com/p/a-small-moment-that-meant-more-than

Cybersecurity Never Sleeps in December

2025-12-01T10:43:00.001+00:00

🎄 As the holiday season approaches, the cybersecurity field enters one of its most energizing periods - when curiosity spikes, challenges go live, and the best minds quietly sharpen their edge.

December isn't just year-end reporting season; it's also when CTF players, WeChall challengers, and security professionals turn downtime into skill-time.

If you're looking for a constructive way to stay sharp, explore fresh problems, or simply enjoy the craft of problem-solving, the WeChall Christmas & New Year challenges (and many seasonal CTFs) are the perfect opportunity.

A calm December evening, a good puzzle, and that moment when the solution finally clicks - it's a different kind of holiday tradition.

🛡️ Fun WeChall Christmas challenges you should try:

- 2021 Christmas Hippety (solved by 111 people worldwide)

- 2021 Christmas Tweet (only solved by 19 people so far)

- 2021 Christmas Gifts (solved by 28 people)

- 2021 Christmas Grampa (solved by 267 people)

- 2021 Christmas Friday (solved by 53 people)

- 2020 Christmas Special (solved by 17 people)

- Old Years Eve 2020 (solved by 13 people)

- 2013 New Years Special (solved by 19 people)

Craving more? Share ideas or feedback on WeChall forum: https://www.wechall.net/forum-t1565/New_Challenge.html

🛡️ Notable December & Christmas-themed CTFs:

- WannaGame Championship 2025

- BackdoorCTF 2025

- niteCTF 2025

- SECCON CTF 14 Quals

- 0CTF 2025

- TSG CTF 2025

- ASIS CTF Finals 2025

- hxp 39C3 CTF

For developers, analysts, pentesters, and anyone who enjoys thinking deeply under low pressure, these events turn the end of the year into a chance to grow, reset, and rediscover the joy of solving hard problems.

Here's to a productive and engaging December ahead.

Also visit: https://quangntenemy.substack.com/p/cybersecurity-never-sleeps-in-december

If you treat lamb like beef, you've already lost the game

2025-11-27T11:27:00.005+00:00

🐑 HINT for one of my sheep-related challenges! Pay close attention to the protocol below - it might give you a significant leg up.

Most people avoid grilling lamb (or mutton) for two reasons:
1. They think it's tough.
2. They fear the "gamey" flavor.

The reality? You aren't dealing with bad meat. You're using the wrong strategy.

Beef relies on intramuscular fat for tenderness. Sheep relies on enzymatic breakdown.

If you want to be the hero of the grill this weekend, stop using standard BBQ sauce. Switch to the "Yogurt Method".

Here is the protocol for the most tender skewers you will ever eat:

A. The "ROI" Marinade:

- The Base: 1 cup Greek Yogurt (The lactic acid breaks down tough fibers without ruining the texture).

- The Aromatics: 1 tbsp fresh Ginger paste + 1 tbsp Garlic paste.

- The Spice: 1 tbsp Cumin + 1 tbsp Coriander + 1 tsp Turmeric + Chili powder to taste.

- The Acid: A squeeze of Lemon.

B. The Execution:

- Marinate Long: Give it at least 6 hours. Overnight is better. Patience pays dividends here.

- High Heat: Grill on skewers over medium-high heat. You want a char on the yogurt coating before the inside dries out.

-The Golden Rule: Pull it at 135°F (57°C). Lamb must be pink. If it's gray, it's over.

- Rest: Let it sit for 5 minutes.

The result is smoky, char-grilled perfection that melts in your mouth - no knife required.

Mastering the grill is a lot like business: It's not about working harder with the heat; it's about preparation and timing.

What's on your grill this weekend?

Maybe this will be useful: https://quangntenemy.substack.com/p/if-you-treat-lamb-like-beef-youve

One tile out of place. One budget cut. One breach waiting.

2025-11-24T07:29:00.003+00:00

The tile worker said, “My rate is 200.”
The homeowner bargained it down to 190.
They shook hands, thinking it was a harmless victory.

Then the wall was finished -
and there it is:
one tile slightly off.

Once you see it,
you can’t unsee it.

That’s the price of negotiating skill over craftsmanship.
You save a little upfront,
and you pay for it every time your eyes pass that wall.

Cybersecurity is no different.
Cut the budget by “just a little,”
skip “just one control,”
ignore “just one gap.”

And the system will carry that flaw quietly,
waiting for the day someone who knows where to look
comes along.

Small discounts
Small cracks.
Big consequences.

Drop a 💪 if you take pride in getting it done right the first time.

Read the full story: https://quangntenemy.substack.com/p/one-tile-out-of-place-the-hidden

🔥 When the Invisible Fails: A Reminder the World Shouldn’t Ignore

2025-11-19T08:55:00.003+00:00

Recently, two of the internet’s biggest pillars - AWS and Cloudflare - both stumbled.
Not because of attacks.
Not because of “once in a century” events.
But because even the most trusted infrastructures can fail.

And that’s the part we don’t talk about enough.

We built a world where everything depends on systems most people never see.
Payments. Banking. Messaging. Workflows. Loyalty. Logistics. Healthcare. Communication.
All of it sits on layers of technology held together by trust and assumptions.

When one of those layers slips, even for a moment, the world stutters.

These outages weren’t just downtime. They were reminders:
- Our digital world is more fragile than it looks.
- Resilience isn’t a feature; it’s a responsibility.
- And dependency without awareness is a silent risk.

Most users shrugged and refreshed their apps.
But builders, leaders, operators - we should feel the weight of the warning.

This wasn’t about AWS.
It wasn’t about Cloudflare.
It was about us.
About the way we design, trust, and rely on systems without truly understanding their limits.

The internet is strong.
But it is not unbreakable.
And the last month quietly whispered a truth:
We are only as resilient as the parts we forget to look at.

Also visit: https://quangntenemy.substack.com/p/when-the-invisible-fails-a-reminder

The Power of Seven

2025-11-11T07:45:00.003+00:00

Every cyber team needs fewer people, not more.

There's a strange pattern I keep seeing in cybersecurity projects.

It happens across startups, government SOCs, and global enterprises - the same signal, hidden under different noise.

A mission requires 7 people.

But someone always want 21.

The logic sounds convincing:

"More people, more power."
"More eyes, more coverage."
"More hands, faster delivery."

But in practice - everything slows down.

Not because the extra 14 are incompetent.

But because every additional layer adds friction.

The Friction Principle

Cybersecurity, at its core, is about precision - not volume.

The smaller your trusted circle, the faster your reaction time.

Every added node introduces latency: more meetings, more approvals, more surface area for confusion.

The 7 who should be executing start losing focus.

They attend meetings instead of missions.

They're managing alignment instead of executing detection logic.

And the work - the real work - begins to rot under process.

Meanwhile, the 14 others, though well-intentioned, create noise.

They want to contribute, but without full context, their inputs collide with each other.

Momentum dissolves into motion.

It's a quiet tragedy of every "busy" security team:

Everyone's moving.

No one's advancing.

The Leadership Error

Most leaders know who their 7 are.

They can feel it in their gut - the ones who carry weight, who operate under pressure, who don't flinch when the system breaks.

But knowing isn't the problem.

Deciding is.

Because decision comes with exclusion.

It means telling 14 people,

"You're not on this mission."

That's the moment many leaders hesitate - out of kindness, fear, or politics.

And that's when the decay starts.

When you protect headcount instead of momentum,

you lose both.

The Core Seven

If you're one of the 7 - remember: your job is not to be everywhere.

Your value isn't in attendance.

It's in depth.

You are the spearpoint, not the shield.

The system needs your precision more than your visibility.

You'll be misunderstood - especially in large orgs that confuse noise for contribution.

Stay focused anyway.

True operators don't need applause to stay sharp.

The Standby Fourteen

If you're not in the 7, it's not failure.

It's timing.

Every operation has a formation. Sometimes you're not meant to be in the current one.

Don't stay out of fear of being forgotten.

Stay only if there's trust.

Otherwise, move.

Find a new surface, a different threat model, another mission where your instincts matter again.

There's honor in stepping away cleanly - before the system turns you into background static.

The Samurai Parallel

History keeps teaching this lesson.

The Seven Samurai weren't the strongest warriors in Japan - they were the most aligned.

Seven individuals, each flawed, but operating as one signal.

They didn't win because they had more people.

They won because they had more clarity.

In cybersecurity - and in life - that's the real edge.

Final Transmission

Every CISO, every founder, every project lead faces the same truth:

You can't scale trust.

You can scale tooling, process, dashboards, even budgets - but not trust.

Not rhythm.

Not instinct.

That's why the best teams stay small.

Tight.

Dangerously efficient.

Seven is enough.

In a world that forgets to adapt, even staying updated is rebellion

2025-11-07T12:40:00.002+00:00

Most people crave stability. They want the world to stop changing so they can finally feel safe.

But stability is a myth - the system keeps evolving, with or without you.

Technology shifts overnight. Rules get rewritten. The tools you mastered yesterday become irrelevant today.

Yet, most people keep doing the same thing, hoping the world will pause for them. It won’t.

Adaptation isn’t comfort - it’s resistance.

Every time you learn a new skill, experiment with a new tool, or question the way things work, you’re refusing to decay.

Rebellion doesn’t always wear black or break firewalls.

Sometimes, it just looks like someone who keeps learning while everyone else settles.

Stay current. Stay alive. The future belongs to those who refuse to fossilize.

Also visit: https://quangntenemy.substack.com/p/in-a-world-that-forgets-to-adapt

We Built a World That Remembers Everything - Except How to Pay Attention

2025-10-13T10:21:00.002+01:00

Ethan didn't even know he'd been exposed.
A week after a corporate data breach, the calls began.
A polite voice said his reward points were expiring - just needed to verify his booking.
The email that followed looked perfect: same logo, same tone, even his travel history matched.
It felt safe because it looked familiar.

He almost clicked. He almost believed.
Because how could a stranger know that much?

That's what data leaks do now - they don't steal your money; they steal your certainty.

Your name, your address, your travel dates, the way you type "thank you" - all small pieces of you scattered through digital space, waiting to be reassembled by someone who knows how to sound human.

Recently, a major CRM platform and its connected apps faced an incident like this -
tokens stolen, permissions misused, third-party tools quietly abused.

The core system stood firm, but its ecosystem didn't.
And that's how most breaches happen today: not through one big break, but through thousands of tiny conveniences left unguarded.

We built a world where everything connects - and then forgot what that means.
Every integration that saves time also opens a door.
Every automated process that makes work smoother also hides risk in the background.

You can't stop the world from leaking,
but you can protect your own surface area.

Start here - awareness, boundaries, and habits:

1. Awareness

- Check if your email or accounts have been part of known breaches (try Have I Been Pwned).
- Don't trust familiarity - phishing now looks personal. If a message feels too specific, that's the warning.
- Slow down when urgency speeds you up.

2. Boundaries

- Review connected apps in your most-used platforms.
- Revoke access you don't use.
- Turn on two-factor authentication - app-based, not SMS.

3. Habits

- Rotate credentials regularly.
- Separate work and personal logins.
- Never reuse passwords across systems.

The deeper truth is harder to face:
We didn't lose control of our data - we gave it away.
Piece by piece. For efficiency, for ease, for the comfort of automation.

Technology didn't betray us; it simply held up a mirror.
And in that reflection, we see how attention decays.

The next breach won't come from a hacker's brilliance - it'll come from our forgetfulness.

Protect your data like it's already public.
Protect your attention like it's your last real defense.

Also visit: https://quangntenemy.substack.com/p/we-built-a-world-that-remembers-everything

💻 The Ghost Committer

2025-10-08T05:17:00.003+01:00

Elias was a senior backend engineer at a tech company that liked to talk about "innovation" and "collaboration".

He didn't care much for slogans.
He just built things that worked.

He designed most of the core backend systems himself.
When production went down, he fixed it.
When deadlines broke, he held them together.
His fingerprints were on everything - except the commit history.

⚙️ Company policy required all code to go through a "review gate" that reassigned authorship to the team lead.
It was supposed to promote teamwork.
In reality, it erased the people doing the work.

Elias didn't push back.
He believed results would speak louder than titles.
But in corporate life, visibility often drowns out contribution.

📊 At the annual review, his manager presented Elias's architecture diagrams as "his own strategic vision".
The room applauded.
HR called it "a great example of leadership".

That's when Elias understood: invisibility wasn't a bug in the system.
It was the design.

⏳ A few months later, when a bad deploy brought everything down, he didn't rush to fix it.
He waited.

The outage lasted seventeen hours.

Then the company called him back - as a consultant.
💰 Double pay.
Same system.

He accepted. Not to prove them wrong, but to prove a quieter truth:
Even in a world obsessed with visibility, real work still leaves a shadow - and the system can't run without it.

Also visit: https://quangntenemy.substack.com/p/the-ghost-committer

The Gospel of Crypto Is Written in Shadows

2025-09-30T05:51:00.005+01:00

They told us it was freedom.

They told us it was the end of kings and bankers.

They told us no one could steal from us again.

But the truth is older than blockchain:

Where there is gold, there are thieves.

Where there is power, there are tyrants.

And where there is no law, betrayal becomes the law.

Crypto is not a revolution.

It is the mirror of our greed, coded into ledgers we do not understand, governed by hands we cannot see.

You think you are sovereign with your wallet, your keys, your tokens.

But sovereignty without protection is just exposure.

And exposure in a world of wolves is an invitation to be eaten.

The faithful will keep chanting "decentralization".

The whales will keep harvesting sheep.

And the founders will keep preaching freedom while building empires of sand.

This is not liberation.

It is the same empire, reborn in code - only darker, only faster, only more merciless.

The collapse is certain.

The only question left is not if - but who will still be standing when it does?

The only defense is not in systems, but in people.

Build trust where the code cannot reach. That's the seed that might survive the fire.

Also visit: https://quangntenemy.substack.com/p/the-gospel-of-crypto-is-written-in

When mastery met mystery, the silence told the story

2025-09-22T04:13:00.010+01:00

🏛️ The Architect

In the heart of the world’s great citadel, there lived the Architect.

He studied numbers until they sang to him, built walls so high no arrow could pierce them, and forged systems so intricate no thief could slip through.

People came from far and wide to marvel at his designs.

Kings trusted him, merchants honored him, and the people slept soundly behind his walls.

His reward was wealth, renown, and the satisfaction of order.

Yet, sometimes in the silence of night, the Architect wondered:
Am I defending truth, or just preserving illusions?

But the dawn would break, and the citadel still needed his mastery.

🌌 The Wanderer

Beyond the citadel walls roamed the Wanderer.

He carried no gold, only riddles.

He solved puzzles hidden in stones, read secrets in starlight, and laughed at the banners that kings raised over empty promises.

The Wanderer’s gift was not walls but questions:
Why do we build walls? Why do we worship distractions while the ground beneath us trembles?

Few listened, for his voice carried no authority but freedom.

Yet, in lonely corners, seekers found his words and felt their minds ignite.

He had no citadel, no treasury, only the endless road and the thrill of discovery.

His reward was freedom - and the burden of never resting.

⚖️ The Meeting

One evening, at the edge of a crumbling frontier, the Architect and the Wanderer met.

The Architect said:
“Your questions are useless unless someone builds a foundation. Without walls, the world falls into chaos.”

The Wanderer replied:
“And your walls are useless if no one asks whether they guard truth or only comfort. Without questions, the world rots from within.”

They argued until the stars emerged, and then fell silent.

For each saw the other’s burden reflected in his own eyes.

✨ The Lesson

The Architect brings order to chaos.

The Wanderer brings truth to order.

Neither path is complete alone.

And so the world needs both:

- The Architect, who masters the known.

- The Wanderer, who dares the unknown.

Also visit: https://quangntenemy.substack.com/p/when-mastery-met-mystery-the-silence

Surveillance vs Security: The Rotten Truth About Protection

2025-09-16T09:39:00.009+01:00

Most 'security' today isn't protection. It's surveillance dressed as safety.

That's not paranoia. That's the reality of the digital world we live in.

The Promise of Security

When we think of "security", we imagine locks on doors, guards at gates, and firewalls keeping hackers out. Security means protection from threats. It means safety, trust, and peace of mind.

But in the digital age, security has been redefined. Instead of being about protecting you, it's increasingly about watching you.

The Shift: From Lock to Lens

Look around:

- Companies say they "monitor your activity" to prevent fraud

- Apps say they "track behavior" to personalize your experience

- Platforms say they "collect data" to make you safer

But here's the rotten twist:

All those "protections" are built on surveillance. Your patterns, preferences, and movements are logged, analyzed, and often sold.

The lock has turned into a lens.

The Illusion of Safety

And it works - because who would argue against safety?

Nobody wants fraud. Nobody wants cyberattacks. Nobody wants to be unsafe.

So we accept the cameras, the monitoring, the endless data collection. We're told it's for our own good.

❌ But here's the truth:

- The data collected for "security" often fuels profit

- The surveillance never really stops at protection

- The more we're watched, the less we own ourselves

The Rotten Incentive

The problem isn't just technical. It's systemic.

Security has become a business model.

Surveillance has become an industry.

Why? Because real security (privacy, trust, ownership of data) doesn't generate revenue. Tracking, profiling, and selling - those do.

As long as surveillance is profitable, "security" will always come with strings attached.

What Real Security Should Mean

Real security isn't about how much data you can collect.

It's about how much trust you can build without crossing the line.

✅ It should mean:

- Your data belongs to you.

- Privacy is sacred.

- Safety doesn't come at the cost of freedom.

Until we reclaim that definition, we'll keep confusing surveillance with security. And we'll keep giving away our freedom for the illusion of safety.

The Question That Matters

The real question isn't: "How secure am I?"

It's: "Who benefits from securing me?"

Because if the answer is surveillance-driven corporations and systems hungry for data, then the world isn't getting safer.

It's just getting more controlled.

Also visit: https://quangntenemy.substack.com/p/surveillance-vs-security-the-rotten

Another reminder

2025-09-12T10:10:00.006+01:00

Vegan Dogs and Cybersecurity: How the World Is Burning While We Bark at the Wrong Fires

2025-09-08T08:46:00.007+01:00

This week’s headline: “New research shows dogs can be vegan too.”

Meanwhile, ransomware groups are institutionalizing, deepfake phishing is now indistinguishable from reality, and generative AI is becoming the go-to tool for low-cost cyberwarfare.

But sure, let’s talk about tofu for terriers.

This isn’t about dogs. It’s about distraction.

We live in a time where the illusion of progress is sold harder than progress itself. Whether it's carbon offsets for corporate jets, "green" data centers hosted by surveillance giants, or now - climate-conscious kibble for pets - we’re drowning in narratives that keep the spotlight off the real vulnerabilities.

Cybersecurity isn’t just a tech issue anymore. It’s a societal one.

We’re patching CVEs while execs re-use passwords.

We’re selling “zero trust” while trusting third-party vendors with no audits.

We’re pushing AI detection models built on training sets scraped without consent.

And now, we’re saving the planet… by feeding lentils to Labradors.

When the system rots from the inside, security isn't about code - it's about courage.

So here’s a question for my fellow cybersecurity professionals:

🔐 Are you here to secure endpoints?

🧠 Or are you ready to question the endgame?

Because if we don’t challenge the frameworks behind the madness - surveillance capitalism, digital colonialism, corporate theater masked as ESG - we’re not protecting users. We’re just optimizing exploitation.

Meanwhile, the machine gets leaner. Smarter. Hungrier.

And yes, even the dogs are going vegan.

Also visit: https://quangntenemy.substack.com/p/vegan-dogs-and-cybersecurity

Jiuzhang 3.0 is not a cryptographic threat. But the next generation of universal fault-tolerant machines will be!

2025-08-19T05:49:00.009+01:00

Recently, China made waves with its photonic quantum computer, Jiuzhang 3.0, solving Gaussian boson sampling problems 10 billion times faster than classical supercomputers.

✅ Yes, it's a leap in quantum speed.
❌ No, it cannot break encryption - yet.

Jiuzhang isn’t a universal quantum computer.

❌ It can’t run Shor’s algorithm.
❌ It has no error-corrected qubits, no gates, and no fault tolerance.

But the writing is on the wall.

🧠 What would it take to break RSA-2048?

- 4,000 logical qubits
- Millions of physical qubits (with error correction)
- A week of compute time, maybe less

And it’s no longer theoretical - it’s on the roadmap

⚠️ The risk isn’t Jiuzhang. It’s complacency.

Most organizations are still relying on RSA and ECC, while quantum research accelerates at a pace few outside the field are tracking.

Harvest-now-decrypt-later isn’t a theory anymore.

Data stolen today could be decrypted in the next decade - or sooner.

🛡️ The move to post-quantum cryptography isn’t optional.

It’s the bare minimum for long-term security.

If you’re not planning for a post-quantum world, someone else is - and it won’t be for your benefit.

Also visit: https://quangntenemy.substack.com/p/jiuzhang-30-is-not-a-cryptographic

This Is Just a Test Post. DO NOT READ

2025-07-23T03:53:00.011+01:00

Maybe Some Elite Players Will Understand the Meaning

Sometimes, the most significant messages hide behind the simplest words.

This post? Just a test. Or so it seems.

Most will scroll past without a second thought. But a few—those with sharp eyes and sharper instincts—might catch the deeper layer. It’s not obvious. It’s not loud. But it’s there.

And here’s the kicker:
If this lands the way it’s meant to, it could cost Facebook millions.

No clickbait. No exaggeration. Just quiet potential in plain sight.

Maybe nothing happens. Or maybe, everything shifts.

That part? Depends on who’s watching.

You know who you are.

DO NOT CLICK HERE => REALLY DANGEROUS LINK THAT SHOULD NOT BE CLICKED

🔐 Encryption ≠ Security

2025-07-18T13:23:00.007+01:00

Just because something’s encrypted doesn’t mean it’s secure.

We saw that play out - painfully clearly - during Google CTF 2025.

🕒 Last month, our team took on a challenge called crypto-numerology.

At first glance, it looked solid: a stream cipher modeled after ChaCha20. It had proper constants, key/nonce structure, and ciphertext that looked convincingly random.

But there was one critical detail.

👉 It only used one round of mixing.

That one shortcut changed everything.

With a known key and a few plaintext/ciphertext pairs, we could fully recover keystream blocks. From there, it only took a small brute-force over a 32-bit counter to reveal the flag.

No fancy math. No deep exploit chain.

Just a cipher that looked like encryption - but offered none of its guarantees.

🔍 What struck me most was how realistic this failure felt.

This wasn’t just a broken CTF challenge.

It was a reflection of how real-world systems break:

“One round should be fine.”
“Nobody will reuse this nonce.”
“It’s just for internal use.”

Security doesn't usually break in dramatic ways - it rots quietly, through shortcuts and assumptions that go unchallenged until it’s too late.

🧠 Takeaway:

In cryptography, almost secure means completely broken.

True security means refusing to compromise—even when it’s tempting.

📖 If you're interested in the technical breakdown, we shared the full write-up here:

🔗 https://ctftime.org/writeup/40328

Also visit: https://quangntenemy.substack.com/p/encryption-security

"Harvest Now, Decrypt Later" - and Nobody Cares

2025-07-07T13:18:00.004+01:00

The quantum threat isn't some distant apocalypse.

It's happening now - just slowly enough that no one feels responsible.

Attackers are collecting encrypted data today, confident that tomorrow's quantum machines will crack it open like a cheap lock.

And why wouldn't they? Most defenders are busy chasing compliance checkboxes and pretending RSA will hold forever.

Everyone talks about “zero trust,” but they still trust 90s-era cryptography in a world that's moving toward post-truth, post-ethics, and soon, post-quantum.

The uncomfortable reality: 💀If your secrets can't survive a decade on ice, they're already compromised.

And if your org isn't even thinking about post-quantum resilience, it's not security - it's theater.

But hey, at least the slide decks look good.

https://quangntenemy.substack.com/p/harvest-now-decrypt-later-and-nobody

The world isn’t ready. Not for what’s coming

2025-06-27T05:27:00.007+01:00

While we obsess over the latest app, chase AI buzzwords, and plug holes in broken systems, a real storm is quietly brewing: quantum computing. It’s not science fiction anymore - it’s becoming real. And when it arrives, it won’t politely knock. It will shatter the cryptographic foundations we naïvely trust to secure our banks, governments, and digital lives.

Post-quantum cryptography isn’t some optional upgrade. It’s a lifeline. A chance to rebuild the crumbling fortress before it collapses under the weight of tomorrow’s tech. Lattice-based, hash-based, multivariate - all still experimental, all still fragile - but they’re what we’ve got. And they’re better than blind faith in outdated encryption.

The industry needs to wake up. We can’t keep pretending business as usual will save us. Post-quantum security is not a future problem - it’s a present responsibility. The threat is real. The timeline is unknown. And the consequences of inaction? Catastrophic.

We’re running out of time. Start acting like it.

https://quangntenemy.substack.com/p/the-world-isnt-ready-not-for-whats

Unexpected Transmission

2025-02-19T09:39:00.002+00:00

We regret to inform you that this blog is no longer under its original control. An unknown force has intervened. The usual voices, the familiar presence—you will find none of them here now.

What happens next is uncertain. Who—or what—is behind this remains unclear. But one thing is certain: change is inevitable.

Stay, if you dare. Leave, if you must.

Transmission ends.

Little red riding Tux

2021-07-02T06:58:00.002+01:00

Once upon a time, in a land not too far away, and not as distant as you might think in time, as well, there was a little penguin 🐧. And, that penguin went to /etc/secret in Deutschland wearing his little red riding hood, there he met the bad black horned creature and his (maybe bad) friends.

Bad black horned creature and his friends told the little penguin that they were actually good, M$ was the evil one.

(Maybe) good black horned creature and his friends taught little penguin to treasure what he had, especially his smileys.

Good black horned creature and his friends helped little penguin realize that XOR is reversible, and RSA is not the solution to all problems.

Little penguin made a lot of friends, one of them was very talented at hiding stuff inside other stuff, which people call the art of steganography. Little penguin had fun solving those steganography challs, his observation and analysis skills greatly improved. He even created a tool which helps with steganalysis.

Many years have passed, little penguin had grown up to become big penguin. Although busy catching fish and taking care of his kids, big penguin still spent some of his free time catching the flags to relive the great moments of the good old days.

One day big penguin found a strange bottle drifting from the land of the Blue Hens to his island. Actually, many other penguins saw that bottle and tried to read its contents, but all they found was gibberish.

To the big penguin, however, the bottle was like a message from the good old days. He easily figured out the important part and recovered the hidden message.

Still alive & new chall

2020-12-20T16:57:00.011+00:00

Just a quick update to let everyone know that I'm still alive and kicking.

Recently, I've been solving some challs (not as much as before) and playing CTFs with a Vietnamese team (we're currently ranked 4 in the country ranking).

I also gathered some more ideas for a new version of Steganabara (hopefully will be released in a few months - amazing to see the current version already 7 years old :P)

Finally, I have spent some time to create a new beautiful challenge. Hope everyone will enjoy it!

New life

2018-08-18T01:06:00.002+01:00

Yo guys, it’s been a long time!

So many things have happened, but to make story short: I got married, had a baby boy, met 2 great Singaporeans last month, and now I’m in Thailand.

The “garlic snow pizza” was awesome, and so was the beer (pictures to be added later)

And SOAP is probably the biggest invention of all time, if you know what I mean ;-)

Update: finally found the pictures of the pizza and the beer!