Recent content in About Me on Houlton McGuinn
(Un)-fortunately, there’s no standardized Leetcode-esque interview process for security engineers 1 . There are a number of online resources for security engineer interview questions, but I found them to be too high level (explain encoding vs encryption vs hashing) compared to interviews I’ve been in. A lot didn’t have answers. I spent some time prepping when I switched jobs…
I built a prediction market bot in a few hours that ranked fourth in Manifold’s Platinum Sage Gremlins league for March . The bot has 10x’d it’s mana using nothing but free tools and simple LLM prompting over the last 2 months. Why prediction markets matter Prediction markets like Manifold let people “bet” on future events and reward accuracy. Metaculus and Manifold…
Vim apparently has built-in encryption features. From the vim man page : -x Use encryption when writing files. Will prompt for a crypt key. The vim docs also call out: There is never 100% safety. The encryption in Vim has not been tested for robustness. If you’ve ever struggled to exit vim, don’t even think about turning on the encryption – “when you reopen the file, Vim…
I’m starting open office hours to chat tech! While I especially enjoy helping students and folks getting started in software/security (having just been there myself), I’m happy to talk with anyone. Why should you sign up? I’d encourage you to sign up if you think you’d benefit in any way! Some things we can do: Chat about tech, software development, or security Mock…
I’m taking Giving What We Can’s Trial Pledge 🔷 to donate 10% of my income in 2025 to highly effective charities. Why I’m donating I’m choosing to donate 10% of my income, because: As someone in the global top 1% by income, I have an extraordinary opportunity to help others I can use my money to do tangible good I want to live in a world where people who can help others, do…
Summary I discovered a vulnerability allowing arbitrary command injection as root in Trane XL824, XL850, XL1050, and Pivot smart thermostats using a specially crafted filename. The vulnerability has existed since at least 2015 and requires physical access to the device via a USB drive. All affected devices will automatically update. CVE-2023-4212 was assigned to this vulnerability and the…
I’ve been using (neo)vim as my main IDE for the last several years. If you’re interested in my config, you can find it here . These are some tricks that I’ve picked up from using vim. Wrap lines Sometimes, I’ll write long-form content in vim (like this blog). It gets a lot easier to edit if you use: :set wrap To undo it: :set nowrap Visual block mode Deletion You can use…
Today I learned that revocable encryption exists! A cryptographic dead person’s switch Imagine 1) you want to encrypt some data so that it is released with no interaction from you in the future. Also, 2) you want to be able to cancel the release of the data at any point before the release. Can you do it? I built a version of this for my Privacy Preserving Technologies class with the caveat…
17. The CBC padding oracle This is the best-known attack on modern block-cipher cryptography. Combine your padding code and your CBC code to write two functions. The first function should select at random one of the following 10 strings: MDAwMDAwTm93IHRoYXQgdGhlIHBhcnR5IGlzIGp1bXBpbmc= MDAwMDAxV2l0aCB0aGUgYmFzcyBraWNrZWQgaW4gYW5kIHRoZSBWZWdhJ3MgYXJlIHB1bXBpbic=…
Continuing with Cryptopals , the second set focuses on block ciphers. These were a lot of fun! Trickier than the second set but also more useful and fun to work on! 9. Implement PKCS#7 Padding A block cipher transforms a fixed-sized block (usually 8 or 16 bytes) of plaintext into ciphertext. But we almost never want to transform a single block; we encrypt irregularly-sized messages. One way we…
Cryptopals is a set of cryptography challenges by the NCC Group. Maciej Ceglowski wrote a great blog about them here . They’ve been out for a while and I originally tried to work through them four years ago in high school. I got to about the second challenge and then was stumped. Now, four years and a CS degree later, I’m back at it! They’ve been a ton of fun to work on so far…
This one I think is really cool. Based off of Wandering Stars by Brian Fearn Modify it here!
This was the first piece of generative art I’ve made! Modify it here!
This was my final project for COMP 590: Privacy Enhancing Technologies . The code is available on Github . This browser does not support PDFs. Please download the PDF to view it: Download PDF .
I’ve been interested in astronomy and space since I was a kid, but never really did much with it. During my internship at Georgia Tech Research Institute , I learned to use a software-defined radio to investigate vulnerabilities in an IOT camera’s over-the-air communication protocol. Reading this post on using an SDR to detect pulsars inspired me. What else could you detect with one?…
I worked on this project during my internship at Georgia Tech Research Institute in their Embedded Systems Vulnerability Division . This browser does not support PDFs. Please download the PDF to view it: Download PDF .
During my internship at Georgia Tech Research Institute in their CIPHER lab , I was part of the team that placed second and won $10,000 for Track 1 at HackTheMachine 2021 . The challenge involved hacking a model of a ship that included a full bridge navigation suite and a fly-by-wire propulsion system , to accomplish arbitrary tasks like spoofing the ship’s location or taking control of the…
I worked on this project during my internship at Sandia National Laboratories . This browser does not support PDFs. Please download the PDF to view it: Download PDF .
it’s nice to meet you :) I’m Houlton McGuinn, a software engineer and security researcher. I work on product security at Harvey . I previously worked on product security at Character.AI and did all things security at Retool . I graduated from UNC Chapel Hill in December 2022. In my free time, I love indie movies, books, and art! I also enjoy reverse engineering IoT devices. If…
This is my collection of interesting corners of the internet. I’m particularly interested in security, computer science, astronomy, and AI, but you’ll find bits of everything here. Cryptography and security Blogs: Project Zero Key Material chompie at the bits Imperial Violet stef/blog Zachary Szewczyk Dhome Moments Filippo Valsorda Schneier on Security Trail of Bits Lars Hupel Papers…
Music The Band CAMINO The Maine Winnetka Bowling League COIN Matt Nathanson Make Out Monday Jukebox The Ghost Maude Latour The Wrecks Shows Scream Normal People Altered Carbon New Girl The Magicians Love Arrested Development Films The Big Sick Byzantium Brooklyn Edge of Seventeen Odd Thomas Haunt God Bless America Night Owls The Big Short Haunter In Your Eyes Keith Goon Stuck in Love Colonia Ex…