https://tomek.st/en/blog/ Technical articles: IT, cybersecurity and digital forensics. en Sun, 27 Sep 2026 15:47:19 GMT https://tomek.st/en/blog/become-ethical-hacker/ https://tomek.st/en/blog/become-ethical-hacker/ Become an ethical hacker without crossing legal boundaries: learn networks, Linux, logs, safe labs, documentation and testing with explicit authorisation. Sun, 27 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/online-safety-for-children/ https://tomek.st/en/blog/online-safety-for-children/ A practical online-safety plan for children and parents: accounts, privacy, games, messages, scams, reporting and what to do after an incident. Sun, 27 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/opsec-secure-environment/ https://tomek.st/en/blog/opsec-secure-environment/ Build practical OPSEC without promises of invisibility: threat modelling, separated identities, secure devices, appropriate network paths and account recovery. Sun, 27 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/ai-voice-invoice-fraud/ https://tomek.st/en/blog/ai-voice-invoice-fraud/ BEC, a changed supplier bank account, and a cloned voice exploit the same gap: an urgent instruction moves outside the normal payment process. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/alert-to-task-automation/ https://tomek.st/en/blog/alert-to-task-automation/ Practical SecOps automation starts with complete input, an owner, and a decision trail — not a bot that closes incidents by itself. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/facebook-friend-scam/ https://tomek.st/en/blog/facebook-friend-scam/ A Facebook friend scam often starts with an urgent payment request from a taken-over account. A BLIK code sent in Messenger can be cashed out at once. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/fake-payment-gate-olx/ https://tomek.st/en/blog/fake-payment-gate-olx/ An OLX or Marketplace scam can use a real ad and a fake page to “receive the money”. Logging into a bank is not how you collect payment for a parcel. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/home-router-security/ https://tomek.st/en/blog/home-router-security/ Factory router settings are a starting point, not complete protection. Review updates, admin access, Wi-Fi, WPS, guests, IoT, and internet-facing access. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/internet-facing-rdp/ https://tomek.st/en/blog/internet-facing-rdp/ A public RDP port increases attack surface. Safer access starts with closing exposure, using a gateway or VPN, MFA, and useful logs. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/isolation-in-security/ https://tomek.st/en/blog/isolation-in-security/ Why isolation matters: the account, the host, the backup, and the admin path fail separately. Otherwise a laptop compromise is an environment compromise. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/lost-phone-first-hour/ https://tomek.st/en/blog/lost-phone-first-hour/ What to do in the first hour after a phone is lost or stolen: lock, locate, protect the SIM, contact the bank, and decide about remote erase. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/network-segmentation/ https://tomek.st/en/blog/network-segmentation/ A VLAN with no rule between them is still one network. Segmentation is the list of who is allowed to talk to whom. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/passkeys-security-keys/ https://tomek.st/en/blog/passkeys-security-keys/ How a passkey differs from a password, SMS code, and authenticator code — and how to switch without losing account access. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/ransomware-first-hour/ https://tomek.st/en/blog/ransomware-first-hour/ How to contain ransomware, preserve evidence, and keep an honest timeline before you know the full scope of the incident. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/ransomware-resistant-backup/ https://tomek.st/en/blog/ransomware-resistant-backup/ A ransomware-resistant backup needs a boundary: separate credentials, offline or immutable versions, retention, and regular restore tests. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/remote-support-scam/ https://tomek.st/en/blog/remote-support-scam/ An AnyDesk or TeamViewer scam starts with a call from “the bank”, remote-desktop software and a hidden transfer. Where to stop and what to do next. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/second-channel-before-a-code/ https://tomek.st/en/blog/second-channel-before-a-code/ A request for a BLIK code, a text-message code, or a bank password needs a check by another phone call, or inside the ad itself. Urgency in the chat does not replace that. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/session-theft/ https://tomek.st/en/blog/session-theft/ How a browser session works, what an infostealer takes, and why incident recovery includes signing out devices, not only changing a password. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/spf-dkim-dmarc/ https://tomek.st/en/blog/spf-dkim-dmarc/ SPF, DKIM, and DMARC reduce domain spoofing, but each proves something different and none of them ends phishing. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/tor-whonix-qubes/ https://tomek.st/en/blog/tor-whonix-qubes/ Tor hides the path of a connection from any single relay. Whonix on Qubes OS puts a workstation behind a gateway that runs Tor. That is a layout, not a cloak. Sat, 26 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/ai-kali-mcp-pentest/ https://tomek.st/en/blog/ai-kali-mcp-pentest/ Kali plus a local model plus MCP can run tools and read the output. That is not a pentest without skill. Without written consent or your own lab it is illegal scanning. Fri, 18 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/dmde-hdd-odzyskiwanie/ https://tomek.st/en/blog/dmde-hdd-odzyskiwanie/ DMDE on an HDD image can be routine. On an SSD the same Recycle Bin click goes through FTL and TRIM. The difference is the media, not a better program. Thu, 17 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/czlowiek-od-gotowki/ https://tomek.st/en/blog/czlowiek-od-gotowki/ A reportage about cash, the chain, and a substitute for trust. Invisibility on the internet is one of the most oversold ideas there is. Sun, 13 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/l1-alert-first-note/ https://tomek.st/en/blog/l1-alert-first-note/ A lab alert is not an incident. A note with host, time and the next question beats a dashboard screenshot. Sun, 13 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/soc-l1-home-lab-architecture/ https://tomek.st/en/blog/soc-l1-home-lab-architecture/ A light L1 lab: host, two endpoints, a collector. The data path matters more than the tool pile. Sat, 12 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/wazuh-siem-basics/ https://tomek.st/en/blog/wazuh-siem-basics/ From an endpoint log to an alert you can keep or close. Wazuh in a lab, not on a slide. Sat, 12 Sep 2026 00:00:00 GMT https://tomek.st/en/blog/windows-event-logs-for-soc/ https://tomek.st/en/blog/windows-event-logs-for-soc/ Source and context beat a memorised number. Security, process, PowerShell — if audit is even on. Sat, 12 Sep 2026 00:00:00 GMT