Recent content on Etienne's Website
Note: these are my personal thoughts about a collective work over several years that continues without me, so it only represents my subjective views and not Echap or other Echap members’ view or opinions. This article openly talks about intimate partner violence and tech abuse. 
 Six years ago, we gathered with a few friends after a tech conference and talked once again about the fact…
What happened in the world 
 
 The US government has published a new National Security Strategy that espouses the racist great replacement theory and supports European far-right parties. 
 The Burkina Faso Junta has restored the death penalty 
 U.S. authorities announced that they plan to look at the past five year history of social media for foreign tourists . 
 Amnesty…
There is a lot going on these days, so here are my notes for both weeks 48 & 49. 
 What happened in the world 
 
 The situation is still horrible in Palestine, Amnesty International said that Israel is still committing genocide in Gaza , this Forensic Architecture visualization shows the current situation with the new yellow line in the middle of the Gaza Strip . In the meantime,…
What happened in the world 
 
 Shamefully, Trump received Saudi Arabia’s Mohammed bin Salman at the White House. He even criticized Jamal Khashoggi and said that MBS knew nothing of his killing, contradicting his own intelligence agencies . 
 Israel kills top Hezbollah official in first attack on Beirut in months . 
 Human Rights Watch published a report on Israel’s forced…
What happened in the world 
 
 Oxfam has published a piece about the awful consequences of the cut of US Aid . 
 As expected, the Trump administration is cutting taxes to wealthy people . I saw this really good meme turning on Mastodon : 
 
 
 
 
 
 
 
 
 Source: @redsad@ohai.social on Mastodon
 
 
 
 
 

 
 This good…
What happened in the world 
 
 The big news of the week is the election of Zohran Mamdani as Mayor of New York City. Beyond his socialist politics going back to economic issues rarely addressed in large cities, seeing someone so bold and following the campaign has been fascinating (not even mentioning his hip-hop songs ). 
 The Sudanese RSF militia agrees to a ceasefire . 
 Two…
So much is happening these days, the world is burning and tech companies are throwing oil on it, which means that these weekly notes are getting longer and longer. 
 What happened in the world 
 
 Despite the ceasefire, Israel continues attacks around the region while NGOs are demanding Israel to allow aid into Gaza . 
 This week has seen a dramatic escalation in Sudan with the…
What happened in the world 
 
 Another week and the ceasefire in Gaza seems to hold, but in the meantime, the Israeli parliament pushed a law to annex the West Bank while violence by settlers against Palestinians is increasing. 
 In a grand media show where we saw people crying for him, Nicolas Sarkozy became the first president of the 5th Republic to be jailed for corruption. 
…
What happened in the world 
 
 For now, the ceasefire in Gaza seems to hold even with multiple deadly strikes by IDF . 
 Following Gen-Z protests in Madagascar, an army colonel led a coup and is the new Madagascar’s president . 
 Support to Palestine has been criminalized in many countries, especially Germany and now UN experts urge Germany to halt criminalization and police…
Another week in the world and we are finally seeing a ceasefire in Gaza! 
 What happened in the world 
 
 Finally, finally, finally, there is a ceasefire in Gaza! It seems that the ceasefire agreement between Israel and the Hamas is going to hold under US pressure, and that hostages in Gaza and Palestinian prisoners and detainees in Israel are going to be released tomorrow . This is…
Second week writing weekly notes, I find interesting to anticipate these notes as I see myself reflecting more on what is newsworthy among my readings during the week. I also really appreciated having some people I know reacting to them on Mastodon <3. 
 What happened in the world 
 
 Another week watching Genocide continue in Gaza. All the boats of the Global Sumud Flotilla were…
Here we are, 10 months after I mentioned wanting to write weekly notes , I am finally adding that section to my website. I have really enjoyed reading weekly notes from friends like Julie Brillet or people I find interesting like Alexis Métaireau or Molly White in a different format, so I am going to try to add that to my routine. For me, it seems complementary to my (rare) blogging and social…
I recently attended an interesting talk about the challenge of identifying the timestamp of social media publications and this made me look more in depth at LinkedIn timestamps. 
 LinkedIn Timestamps 
 LinkedIn is quite frustrating in Open Source Investigations as it only provides a rough estimation of when a post or comment was published, like here just with a “1d” which means…
2025 is here and I have to acknowledge that this blog has been a bit abandoned lately. So now is a good time to bring some life back here and also a good time to reflect on 2024 and what’s next. 
 Reflecting on 2024 
 In many aspects, 2024 has been a rough year with so many crises in the world. Like many people, I have looked with horror at the genocide in Gaza and felt powerless to…
In November 2021, I did some testing to see how many US media were blocking European visitors to avoid complying with GDPR. To my surprise, most of them actually used the HTTP 451 code that was created in reference of Ray Bradbury’s Fahrenheit 451 novel. 
 
 Example of page blocked with HTTP 451 (Source: Wikipedia ) 
 
 

 I recently found a new list of over 5000 US…
January 2023, and once again the question of limiting access to porn websites for people under the legal majority age is back in the media. It is a question as old as the World Wide Web that is coming back every year with a different angle. In 2020, the French Parliament even passed a law (article 227-24 of the criminal code) forcing pornography websites to use age filtering more efficient than a…
I have been working and studying technology for over 10 years now, and the one thing I really love is discovering weird technical quirks you can find on Internet, and what they tell us about society. Things like how bad geolocation of IP addresses turned the life of a Kansas family into hell or how to track dictator’s aircraft from open flight information . 
 Among them, I discovered…
Stalkerwares are malware used in abusive relationships to spy on someone’s partner. I have talked quite a bit about it already, see my previous blog posts for more background information on stalkerware. 
 There are different ways to check if a stalkerware is installed on a phone. At Echap , we have written a guide to check for configuration settings on an Android phone (in French). We…
I am not sure what happened this year but it seems that Cobalt Strike is now the most used malware around the world, from APT41 to APT32 , even the last SolarWinds supply chain attack involved Cobalt Strike. Without relaunching the heated debate on publishing offensive tools, this blog post intends to summarize what an analyst needs to know about Cobalt Strike to quickly identify and analyze it…
I am republishing here the guide on using passive DNS and Whois data in investigation that I published earlier this year on the Amnesty Citizen Evidence Lab website . 
 
 Many disinformation or malware campaigns rely on a computer architecture based on several servers and domains, and even if they often try to hide the infrastructure, it has to be accessible online. Investigating these…
A few years ago, I wrote about Flexispy after the company got hacked and some data was released. It was the first time I encountered stalkerware in my work. Since then, I have had many discussions about this creepy market and more generally technology used in intimate partner violence (IPV) with researchers and activists. I think it is the right time to reflect on what we know about stalkerware…
Shellcodes are an interesting piece of software because they have to run with unusual constraints. They are also small enough to be used to learn new tools. I have been wanting to learn to use miasm for a long time (since I saw the first presentation at SSTIC some years ago), I finally used a few nights of confinement to learn that, here is a short summary. 
 Linux shellcode 
 Let’s…
TL;DR 
 New trends in targeted attacks against civil society in 2019 : 
 
 More attacks against smartphones, some attacks are using 0-days and we don’t know how to be effectively protected against them, but many attacks are using exploits against fixed bugs in Android 
 Phishing attacks bypassing 2 Factor Authentication solutions other than hardware keys are common now. We…
I have been doing a lot of Open-Source Intelligence (OSINT) lately, so to celebrate 2019, I decided to summarize a lot of tips and tricks I have learned in this guide. Of course, it is not the perfect guide (no guide is), but I hope it will help beginners to learn, and experienced OSINT hackers to discover new tricks 
 Methodology 
 The classic OSINT methodology you will find everywhere is…
TL;DR 
 Harpoon is a tool to automate threat intelligence and open source intelligence tasks. It is written in Python 3 and organised in plugins so the idea is to have one plugin per platform or task. The code is on Github , feel free to open issues and propose Pull Requests . 
 Install and config: 
 pip install git+ssh://git@github.com/Te-k/harpoon --process-dependency-links
 npm…
Analyzing PE files is a basic task in reverse engineering in order to understand their structure, look for anything interesting before going more in depth into the reverse engineering in itself. There are countless tools to do that, on Windows I use PeStudio , PEView and Resource Hacker . But most of the time I want to have a first view of the file before starting my Virtual Machine, so I was…
Last week, Google has added a new set of security features in Gmail called “Advanced Protection” , specifically for high-risk users. It was widely covered the media ( Wired , The Verge or Reuters ) and quickly started a debate about whether Google is the most secure email provider on the planet or if ProtonMail can compete . The main point here to me (and it has been said by many other…
Introduction : I started this blog post to explain the context of FlexiSpy leaks and show some information I have found during my analysis. This information is incomplete and there is still plenty analysis of source code or binaries to be done. I have uploaded the source code and binaries on github so that everyone can help with it. I will try to report in this articles the publications I have…
There are now more and more privacy abuse everywhere, so even though we feel it, it’s often hard to understand the daily privacy demolition. To help me, I started a list of privacy abuse cases here (likely out of date, I have considered only cases by commercial companies for now, if you see additional cases, poke me on Twitter ) 
 2016 
 
 2016/08/06 The Internet of Dildos Is…
Olà, 
 Some times ago, I have installed honeypot services on one of my servers, in order to see what happens in the real outside world. I especially installed the cowrie ssh honeypot which simulate a Linux shell and gather binaries that people want to install on the server (this tool is awesome, check here to install it). 
 Cowrie ssh 
 This honeypot is really fun, because it records…
Plop, 
 I have been reading many articles about Machine Learning recently, and it seems to be the new hype technology so I wanted to play a bit with these algorithms to better understand the principles behind it. If you don’t know machine learning, you should to read this awesome article or this one . This article was largely inspired by this one which analyze the Titanic data . 
…
Hi there! 
 I have recently looked different compromised websites on github, mostly using outdated Wordpress/Joomla/Drupal versions. In these cases, I often have to go through many different files to find the malicious one, whether added on the website or added to legitimate files. Here is a short summary of the different tools to detect them. 
 ClamAV 
 ClamAV is an open-source…
Here is a list of references regarding security topics and hacktivism: 
 Political Organizations 
 Here are several awesome organization regarding online freedom: 
 
 
 EFF : The Electronic Frontier Foundation fights for digital freedom in many different ways (legal fights, press review, development of technical tools…). See their website and their Twitter account . Here…
This page gathers some useful guides and resources on digital security. 
 
 
 
 
 
 
 
 Drawing by Matt Dixon
 
 
 
 
 

 General Digital Security Guides 
 The main resources on digital security are: 
 
 Surveillance Self-Defense by EFF is the main reference, it is available in 11 languages and well maintained. 
 Security…
I am Etienne “tek” Maynier, an activist, security analyst and researcher. 
 
 
 
 
 
 
 
 Drawing by _lila*
 
 
 
 
 

 I am currently working as a Technologist in the infosec team of Human Rights Watch to protect the organization against digital threats. 
 Previously, I cofounded and was an active member of Echap , a non…
You can contact me securely in the following ways: 
 
 
 
 
 
 
 
 Drawing by Matt Dixon
 
 
 
 
 

 
 By email: you can contact me at etienne AT maynier DOT eu, if possible using this public GPG key (Fingerprint 6861 626E B4A8 74F5 D794 ED0C 5FC6 A564 4D8A E276 ) or a protonmail account. 
 On Wire : @tekk 
 On…
Here are some personal projects I have been working on: 
 
 
 
 
 
 
 
 Drawing by Matt Dixon
 
 
 
 
 

 Tools 
 
 I am one of the developer and maintainer of the MVT Toolkit that allows to forensically analyze smartphones. 
 A database of Telegram Transparency data crowdsourced from the community (see raw data here ) 
…