ericlaw talks about security, the web, and software in general
Attackers are adept at using new technologies to enhance their attacks. Earlier this afternoon, for example, I got call from “American Express” suggesting that I needed to “verify a transaction.” The caller used a robotic voice similar to the one used by American Express’ automated systems, and only obvious signals that it was a scam Continue reading "Attack Technique: AI Clones"
I’ve shared the stories behind the Fiddler Web Debugger a fair bit over the years, in the Fiddler Book, in a talk at the CodeMash conference in 2015, and on this blog. It features prominently in my to-be-completed (some day?) memoir, and I’ve enjoyed telling Fiddler stories to folks who ask over the years. (I’ve Continue reading "Fiddler in 2026"
It started innocently enough. I saw a tweet about a new product offering from one of my favorite companies, Cloudflare. Neat! I clicked through to the site and there it is: And huzzah!, my preferred handle, @ericlaw is still available. I’d better hurry to claim it before someone else gets it! Since I’m already a Continue reading "Web Security is Too Hard"
When a user attempts to run a file with elevated privilege, Windows will show a User Account Control elevation prompt that asks whether the user trusts the file to run. For a regular file, the user will see a prompt like this: For a file signed by a certificate in the Untrusted Certificates store, elevation Continue reading "Authenticode and UAC"
When a device first joins a network, the upstream network hardware has full control over its traffic and can allow/block any packets sent from the device from reaching the Internet. Many public networks (typically Wi-Fi, but sometimes wired), located in hotels, coffee shops, mass transit, schools, etc. require that the user accept Terms of Use Continue reading "Attack Techniques: Fake Captive…
Microsoft Defender for Endpoint is a paid security product that extends Microsoft Defender Antivirus (included for free in Windows) with enterprise capabilities, including a full EDR product that reports security telemetry into a security operations center (SOC). Some recently-retired Microsoft employees have been surprised to discover that their personal PCs that had previously been used Continue…
This document contains some thoughts about the storage and comparison of URLs, common operations crucial to the correct function of security software like Microsoft SmartScreen. Importantly, URLs are also displayed on security surfaces to enable the user to make a decision based on their contents. Eight years ago, I wrote the Guidelines for URL Display. Continue reading "Guidelines for URL Storage…
Back in 2022, I brought home a new 2023 Nissan Leaf S and I’ve had a blast driving it since. In hindsight, it was one of my best purchases in a long time– it’s super fun to drive, and other than tires/alignment it has required zero maintenance (not even refilling the wiper fluid!) in the Continue reading "Driving (Large) Electric"
Today marks my 25th anniversary of full-time work in tech. June 18, 2001 – My third “New Employee Orientation” at Microsoft, starting my full-time employment after University. I worked on the Office Online PM team for three years before moving to the Internet Explorer Networking and Security teams for 8 more, eventually leading a team Continue reading "A Quarter Century in Tech"
In the past, I’ve explained how security products combine sensors and throttles with threat intelligence to protect users and devices from attack. I’ve also outlined how the evolution of software, including increased complexity and a focus on privacy, have made it harder than ever for sensors and throttles to function effectively, leading to security and Continue reading "Participatory Extensible…