the grugq
medium.com/@thegrugq · Personal blog · on HN since 2015
The grugq, an independent security researcher, writes about operational security, intelligence, and how activists and travelers can protect themselves.
What HN saysHN commenters cite it for its analysis of nation-state cyber conflict and for its correction of bad travel security advice.
89HN people shared it
37linked it in comments
84stories submitted
935story points
2 years agolast shared
2015people per year2026
Most-shared posts
- 1Tor and its Discontents11 people · 12 points · first shared 2016 · 1 comments on HN
- 2Stop Fabricating Travel Security Advice8 people · 130 points · first shared 2017 · 87 comments on HN
- 3Why Telegram is insecure (2015)6 people · 232 points · first shared 2015 · 246 comments on HN
- 4Cyberpower crushes coup5 people · 139 points · first shared 2016 · 49 comments on HN
- 5Twitter Activist Security4 people · 172 points · first shared 2017 · 37 comments on HN
- 6Pnyetya: Yet Another Ransomware Outbreak4 people · 9 points · first shared 2017 · discussion on HN
- 7Signals, Intelligence4 people · 8 points · first shared 2015 · discussion on HN
- 8Secured Android Smartphone: Brief Spec and Overview3 people · 8 points · first shared 2019 · 1 comments on HN
- 9Cyber Terrorists Can’t Cyber3 people · 6 points · first shared 2016 · discussion on HN
- 10Operational Security of WhatsApp (on iOS)3 people · 4 points · first shared 2016 · discussion on HN
- 11The Great Cyber Game: Commentary3 people · 2 points · first shared 2016 · discussion on HN
- 12Mind Games3 people · 2 points · first shared 2016 · discussion on HN
- 13Homepage3 people · first shared 2016
- 14Why the NSA Dump Isn't from an Insider2 people · 107 points · first shared 2016 · 38 comments on HN
- 15Dark Net Trap2 people · 10 points · first shared 2017 · discussion on HN
What HN people wrote when they linked it
wolf550e · 2017-11-13
Presumably, a traitor within the NSA or a contractor.
See: https://medium.com/@thegrugq/the-great-cyber-game-commentary-3f821f0db…
smokescreentech · 2017-09-20
Great post. Honeypots behind the firewall are also a great way to pick up lateral movement and privilege escalation.
There's a ton of useful open-source tooling one can play with in the space. Here's a list:
- https://www.smokescreen.io/practical-honeypots-a-list-of-open-source-d…
Most of the projects are also small enough that you can easily contribute back to them especially in terms of reducing the ability to fingerprint the honeypots.
Somewhat timely, The Grugq just wrote up a nice article on Counterintelligence for Cyber Defence:
- https://medium.com/@thegrugq/counterintelligence-for-cyber-defence-97d…
chowell · 2017-04-09
He expands in his Medium post from last year, here: https://medium.com/@thegrugq/the-great-cyber-game-commentary-2-33c9b79…
DyslexicAtheist · 2017-02-27
this is worth reading then https://medium.com/@thegrugq/stop-fabricating-travel-security-advice-3…
EDIT (what to do): https://twitter.com/thegrugq/status/829855684636274688
armitron · 2017-01-25
> I've been using Firefox for years without any problems and find it much better (just as fast, more privacy-minded) than chrome.
Then you must not value security at all.
Firefox is by far the worst of the modern browsers in how easy it's to exploit. Don't listen to me, listen to the experts [1] [2] [3]
I would go as far as to say that if Firefox is your main browser, odds are you're owned by multiple parties, and I don't mean nation states. This can not be fixed by iterative improvements, Firefox needs to die. By far the best thing you can do for your online peace of mind is to switch to Chromium/Chrome or (on Windows only) Edge.
[1] https://twitter.com/thegrugq/status/803693249789509632
[2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
[3] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack…
fjarlq · 2016-12-18
Interesting analysis by @thegrugq:
https://medium.com/@thegrugq/the-great-cyber-game-commentary-3f821f0db…
lorenzhs · 2016-11-15
Security people recommend Signal a lot (e.g. https://medium.com/@thegrugq/signal-intelligence-free-for-all-5993c2f7… Snowden uses it and repeatedly recommended it: https://twitter.com/Snowden/status/661313394906161152, ...). Personally, I use it all the time and it's nice. Most of the initial problems have been sorted out, so I encourage anyone who's had trouble with it before to try it out again.
It has text (one-on-one and groups) and voice calls. Things that could use improvement: group management, switching to a new device. It doesn't have some of the features some people like (stickers and whatnot), but personally I don't care much about those. Video calls would also be nice.
rashkov · 2016-09-25
thegrugq just wrote a persuasive analysis of the calculus that intelligence agencies must go through with this kind of event. In short, the benefits of revealing that they're aware of the leak aren't worth it. All of the benefit is in passively monitoring what the adversary does with the information. You can find it here, it's quite interesting: https://medium.com/@thegrugq/mind-games-international-championship-cc1…
librexpr · 2017-01-26
And yet according to these sources[0][1], Firefox is back this year in Pwn2own. A quote from [1]:
> "Mozilla improved their security enough for us to warrant their re-inclusion in the contest," Gorenc said.
Firefox is fine. Like in every other browser, when security problems are found, they are fixed. There's a lot of work going into making Firefox a great and secure browser, and to call for abandoning it en masse is unwarranted IMO.
Edit: Heck, isn't it your own link[2] that claims that one of the security problems with Tor is their homogeny, that they all use the same browser and version? By that logic, abandoning Firefox is a bad move for overall security.
[0] https://blog.trendmicro.com/pwn2own-returns-for-2017-to-celebrate-10-y…
[1] http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linux-servers-…
[2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
gnfargbl · 2025-02-21
Border control agents in all countries -- including the US -- have fairly extensive powers to search your devices or deny you entry. I'm not sure this decision should change your calculus on that point.
See also https://medium.com/@thegrugq/stop-fabricating-travel-security-advice-3…
costco · 2023-09-15
This has been argued before: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
I think this is somewhat sarcastic but the article goes as far as saying "[Tor Browser Bundle] is the only reason that FireFox is a valuable target." Firefox has improved sandboxing now though I don't think it's as good as Chromium.
jolux · 2020-10-04
>And even if you don't, what are they going to do to a TLS connection?
You misunderstand me. Tor Browser is based on Firefox ESR, which means it lags with security updates: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
Tor itself is not what I was referring to, although it has its problems as well, mainly that it's extremely identifiable. Tor is not a good idea for most people to use full-time.
The rest of this doesn't really answer my question about Safari vs Firefox, and I'm pretty much uninterested in appeals to Tor Browser as something that should be universally adopted.
ryacko · 2019-08-09
I Googled for grugq, iCloud, and terrorist, and yielded the below link:
https://medium.com/@thegrugq/feeble-noise-pollution-627acb5931a2
>Farook destroyed his personal phone. The FBI wants access to his work phone. UPDATE: FBI locked themselves out of the iCloud account after it was seized.
>FBI already has huge amounts of data from the telco and Apple. This is almost certainly enough to rule out clear connection with any other terrorists.
>FBI is playing politics, very cynically and very adroitly.
SCHiM · 2019-06-23
I really like this take on this whole thing:
https://medium.com/@thegrugq/death-by-powerpoint-53472da3cd5
rrdharan · 2019-01-06
Author just edited it and added your post as a reference:
https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca669c869981…
...
+ 7 https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a by https://twitter.com/thegrugq
dang · 2019-01-06
Ok, we changed the URL above from https://gitlab.com/edu4rdshl/blog/blob/master/why-telegram-is-insecure… to https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a.
At present the OP is nearly blank anyhow.
maxerickson · 2018-02-21
The phone network can do that just by correlating traffic to devices, it doesn't need any help from the software running on those devices.
If the target use case was people that could reasonably do the job of limiting the information just the use of their devices leaked, it might matter. But the target use case is replacing SMS and the like, so it really doesn't matter (except that people want to pretend that the use case is something other than replacing SMS).
https://medium.com/@thegrugq/signal-intelligence-free-for-all-5993c2f7…
grugq · 2017-11-26
Fully laid out and explained here: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
walterbell · 2017-11-25
The grugq (Nov 20) on campaign information security: https://medium.com/@thegrugq/campaign-information-security-ff6ac49966e…
ryanlol · 2017-11-19
https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
You really just want to use Chrome/Chromium.
cvwright · 2017-09-26
First, you're not wrong about Signal being insufficient against nation state adversaries. The Grugq has a nice talk about opsec that I can't seem to find atm. He sums up the issues with Signal nicely in a Medium article. [1]
That said, this particular development is a lot more than a puppy. It's at least a full grown, happy, friendly Golden Retriever who's already house trained and knows how to fetch your slippers.
They've removed one of the biggest remaining weaknesses of their system, where they still required the users to "just trust" them. That's pretty cool, especially for the vast majority of us whose primary adversaries are smaller or profit-driven.
[1] https://medium.com/@thegrugq/signal-intelligence-free-for-all-5993c2f7…
StreamBright · 2017-09-26
Those articles are stupid though. You are just marking yourself for even more trouble with wiping your devices prior to entering the US, essentially making sure they got a reason to inspect you more.
https://medium.com/@thegrugq/stop-fabricating-travel-security-advice-3…
jdenning · 2017-07-20
Apparently, he leaked the email address in an early email sent to site users. It contained his real first name and birth year, and he used the address on several other sites.
When he was busted he was logged in to the site, and had several passwords/keys stored in plaintext on his machine.
Multiple OpSec failures.
Good analysis here: https://medium.com/@thegrugq/dark-net-trap-545ae5dd8476
PeterisP · 2017-06-28
It doesn't seem that getting ransoms was the actual goal of this malware, it seems rather like plausible deniability.
This is a good description of some details https://medium.com/@thegrugq/pnyetya-yet-another-ransomware-outbreak-5… - it rather looks like a targeted attack to do chaos+damage to Ukraine.
shallot_router · 2017-06-28
I don't have time to list everyone, but a few off-hand:
For crypto, Matt Green: https://twitter.com/matthew_d_green https://blog.cryptographyengineering.com/
For cybercrime, Brian Krebs (though I would call him an investigative journalist rather than an expert): https://krebsonsecurity.com/
For intelligence/counterintelligence/OPSEC, thegrugq: https://twitter.com/thegrugq https://medium.com/@thegrugq
A few of these can occasionally be biased when there's a political edge to something, but some others I trust: Moxie Marlinspike, Daniel Bernstein, Dan Kaminsky, Rob Graham, Thomas Ptacek, Michał Zalewski, @SwiftOnSecurity (semi-parody account, but trustworthy info), Tavis Ormandy
mr_overalls · 2017-06-13
As the grugq has pointed out, incentives are not currently aligned properly to produce secure industrial systems:
"Firstly, a lot of infrastructure and data is in civilian hands. The people and organizations responsible for securing things are not the ones responsible for retaliating against attacks. They can’t do it anyway because they lack the resources, capability, and legal authority to do so.
As for investing in securing their systems, there is no regulatory requirement to do so. Indeed, for a board of directors, I’ve seen it suggested that they have a fiduciary duty to shareholders not to bear the cost burden of securing critical national infrastructure. It’s not their business to directly bear the costs of defending the nation, that’s what the nation state is for in the first place!"
https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b7280
nooneyouknow · 2017-05-06
This should not come as a surprise to anyone who has been paying attention to recent elections... well, anywhere.
Relevant: https://medium.com/@thegrugq/dont-info-op-until-you-see-the-whites-of-…
r721 · 2017-04-01
WillyOnWheels · 2017-03-07
I am nearly convinced by The Grugq's summary:
https://medium.com/@thegrugq/the-russian-way-of-cyberwar-edb9d52b4876#…
"Alternating Competing Hypothesis"