About Me on Houlton McGuinn

Security Engineer Interview Questions & Answers

Thu, 22 May 2025 20:38:34 -0500

(Un)-fortunately, there’s no standardized Leetcode-esque interview process for security engineers ¹. There are a number of online resources for security engineer interview questions, but I found them to be too high level (explain encoding vs encryption vs hashing) compared to interviews I’ve been in. A lot didn’t have answers. I spent some time prepping when I switched jobs earlier this year, and this is my attempt to collate some interesting questions + answers all in one place!

Building a diamond Manifold prediction bot in a weekend

Tue, 01 Apr 2025 21:51:02 -0700

I built a prediction market bot in a few hours that ranked fourth in Manifold’s Platinum Sage Gremlins league for March. The bot has 10x’d it’s mana using nothing but free tools and simple LLM prompting over the last 2 months.

Why prediction markets matter

Prediction markets like Manifold let people “bet” on future events and reward accuracy. Metaculus and Manifold are two sites that offer play money, while Kalshi and Polymarket let you wager real money.

Vim has encryption? 😧

Fri, 10 Jan 2025 06:21:57 -0800

Vim apparently has built-in encryption features. From the vim man page:

-x Use encryption when writing files. Will prompt for a crypt key.

The vim docs also call out:

There is never 100% safety. The encryption in Vim has not been tested for robustness.

If you’ve ever struggled to exit vim, don’t even think about turning on the encryption – “when you reopen the file, Vim will ask for the key; if you enter the wrong key, Vim will ‘decrypt’ it to gibberish content. DO NOT SAVE such a gibberish buffer, or your data will be corrupted.”

I'm doing office hours

Thu, 09 Jan 2025 18:45:38 -0800

I’m starting open office hours to chat tech!

While I especially enjoy helping students and folks getting started in software/security (having just been there myself), I’m happy to talk with anyone.

I’d encourage you to sign up if you think you’d benefit in any way! Some things we can do:

Chat about tech, software development, or security
Mock technical interviews - security or coding
Discuss a project you’re working on - I can provide feedback on your code, architecture, or specific errors you’re hitting
Brainstorm project ideas or career directions - sometimes it helps to bounce ideas off someone who’s been there

Why do I have office hours?

I’ve had a number of students reach out to ask for advice or to do a mock interview. While I don’t think I have any insights that are particularly novel, I want to lower the friction of cold-DMing me and hope more people will take advantage. I’ve been helped by a ton of people and want to do the same.

Donating 10% 🔷

Tue, 31 Dec 2024 11:23:40 -0500

I’m taking Giving What We Can’s Trial Pledge 🔷 to donate 10% of my income in 2025 to highly effective charities.

Why I’m donating

I’m choosing to donate 10% of my income, because:

As someone in the global top 1% by income, I have an extraordinary opportunity to help others
I can use my money to do tangible good
I want to live in a world where people who can help others, do

Donating 10% is something I’ve thought about since college, but I delayed pulling the trigger because:

Finding a command injection vulnerability in my smart thermostat (CVE-2023-4212)

Tue, 22 Aug 2023 00:04:34 -0700

Summary

I discovered a vulnerability allowing arbitrary command injection as root in Trane XL824, XL850, XL1050, and Pivot smart thermostats using a specially crafted filename. The vulnerability has existed since at least 2015 and requires physical access to the device via a USB drive. All affected devices will automatically update.

CVE-2023-4212 was assigned to this vulnerability and the Cybersecurity and Infrastructure Agency (CISA) published an ICS advisory here. The CVSS score is 6.8 – CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Vim tricks

Sun, 02 Apr 2023 15:00:29 -0700

I’ve been using (neo)vim as my main IDE for the last several years. If you’re interested in my config, you can find it here. These are some tricks that I’ve picked up from using vim.

Wrap lines

Sometimes, I’ll write long-form content in vim (like this blog). It gets a lot easier to edit if you use:

:set wrap

To undo it:

:set nowrap

Visual block mode

Deletion

You can use Ctrl-v to enter visual block mode. This is useful when you want to delete several part of consecutive lines. For example, given the text:

Revocable encryption exists!

Sun, 12 Mar 2023 18:25:49 -0700

Today I learned that revocable encryption exists!

A cryptographic dead person’s switch

Imagine 1) you want to encrypt some data so that it is released with no interaction from you in the future. Also, 2) you want to be able to cancel the release of the data at any point before the release. Can you do it?

I built a version of this for my Privacy Preserving Technologies class with the caveat that you have to trust some threshold of servers to be honest. While a fun project, having to trust a threshold of the servers limits how useful it is. We want cryptographic guarantees for both of the above properties.

Cryptopals Set 3: Block & stream crypto

Wed, 28 Dec 2022 10:15:11 -0500

17. The CBC padding oracle

This is the best-known attack on modern block-cipher cryptography.

Combine your padding code and your CBC code to write two functions.

The first function should select at random one of the following 10 strings:
MDAwMDAwTm93IHRoYXQgdGhlIHBhcnR5IGlzIGp1bXBpbmc=
MDAwMDAxV2l0aCB0aGUgYmFzcyBraWNrZWQgaW4gYW5kIHRoZSBWZWdhJ3MgYXJlIHB1bXBpbic=
MDAwMDAyUXVpY2sgdG8gdGhlIHBvaW50LCB0byB0aGUgcG9pbnQsIG5vIGZha2luZw==
MDAwMDAzQ29va2luZyBNQydzIGxpa2UgYSBwb3VuZCBvZiBiYWNvbg==
MDAwMDA0QnVybmluZyAnZW0sIGlmIHlvdSBhaW4ndCBxdWljayBhbmQgbmltYmxl
MDAwMDA1SSBnbyBjcmF6eSB3aGVuIEkgaGVhciBhIGN5bWJhbA==
MDAwMDA2QW5kIGEgaGlnaCBoYXQgd2l0aCBhIHNvdXBlZCB1cCB0ZW1wbw==
MDAwMDA3SSdtIG9uIGEgcm9sbCwgaXQncyB0aW1lIHRvIGdvIHNvbG8=
MDAwMDA4b2xsaW4nIGluIG15IGZpdmUgcG9pbnQgb2g=
MDAwMDA5aXRoIG15IHJhZy10b3AgZG93biBzbyBteSBoYWlyIGNhbiBibG93
… generate a random AES key (which it should save for all future encryptions), pad the string out to the 16-byte AES block size and CBC-encrypt it under that key, providing the caller the ciphertext and IV.

Cryptopals Set 2: Block crypto

Fri, 23 Dec 2022 00:00:08 -0500

Continuing with Cryptopals, the second set focuses on block ciphers. These were a lot of fun! Trickier than the second set but also more useful and fun to work on!

9. Implement PKCS#7 Padding

A block cipher transforms a fixed-sized block (usually 8 or 16 bytes) of plaintext into ciphertext. But we almost never want to transform a single block; we encrypt irregularly-sized messages.

One way we account for irregularly-sized messages is by padding, creating a plaintext that is an even multiple of the blocksize. The most popular padding scheme is called PKCS#7.

Cryptopals Set 1: Basics

Wed, 21 Dec 2022 13:12:35 -0500

Cryptopals is a set of cryptography challenges by the NCC Group. Maciej Ceglowski wrote a great blog about them here. They’ve been out for a while and I originally tried to work through them four years ago in high school. I got to about the second challenge and then was stumped. Now, four years and a CS degree later, I’m back at it! They’ve been a ton of fun to work on so far and definitely challenging. I’ve “known” academically a lot of the attacks covered but implementing them is a different story.

Gravity Lights

Sat, 11 Jun 2022 21:26:51 -0500

This one I think is really cool. Based off of Wandering Stars by Brian Fearn

Modify it here!

Colorful Shapes

Sat, 11 Jun 2022 19:26:51 -0500

This was the first piece of generative art I’ve made!

Modify it here!

A Cryptographic Dead Person's Switch

Fri, 27 May 2022 00:02:50 -0800

This was my final project for COMP 590: Privacy Enhancing Technologies. The code is available on Github.

This browser does not support PDFs. Please download the PDF to view it: Download PDF.

Automated Backyard Hydrogen Line Astronomy

Sun, 02 Jan 2022 23:19:26 -0500

I’ve been interested in astronomy and space since I was a kid, but never really did much with it. During my internship at Georgia Tech Research Institute, I learned to use a software-defined radio to investigate vulnerabilities in an IOT camera’s over-the-air communication protocol. Reading this post on using an SDR to detect pulsars inspired me. What else could you detect with one? Being interested in both astronomy and SDRs, this project naturally followed.

Reverse Engineering Wyze IoT Cameras

Thu, 10 Jun 2021 05:51:05 -0800

I worked on this project during my internship at Georgia Tech Research Institute in their Embedded Systems Vulnerability Division.

This browser does not support PDFs. Please download the PDF to view it: Download PDF.

Breaking the Bridge: Winning $10,000 at HackTheMachine 2021

Fri, 26 Feb 2021 22:14:54 -0800

During my internship at Georgia Tech Research Institute in their CIPHER lab, I was part of the team that placed second and won $10,000 for Track 1 at HackTheMachine 2021.

The challenge involved hacking a model of a ship that included a full bridge navigation suite and a fly-by-wire propulsion system, to accomplish arbitrary tasks like spoofing the ship’s location or taking control of the rudder.

There’s a cool walkthrough of the testbed on Youtube that shows what we worked with.

Robohunter: a Machine Learning Framework for Batch Analytics

Sat, 01 Aug 2020 05:57:43 -0800

I worked on this project during my internship at Sandia National Laboratories.

This browser does not support PDFs. Please download the PDF to view it: Download PDF.

About Me

Mon, 01 Jan 0001 00:00:00 +0000

it’s nice to meet you :)

I’m Houlton McGuinn, a software engineer and security researcher. I work on product security at Harvey. I previously worked on product security at Character.AI and did all things security at Retool.

I graduated from UNC Chapel Hill in December 2022. In my free time, I love indie movies, books, and art! I also enjoy reverse engineering IoT devices.

If you’re reading this I’d love to chat! Feel free to reach out at houlton.mcguinn@gmail.com. I also do office hours.

Things I Like

Mon, 01 Jan 0001 00:00:00 +0000

Music

The Band CAMINO
The Maine
Winnetka Bowling League
COIN
Matt Nathanson
Make Out Monday
Jukebox The Ghost
Maude Latour
The Wrecks

Shows

Scream
Normal People
Altered Carbon
New Girl
The Magicians
Love
Arrested Development

Films

The Big Sick
Byzantium
Brooklyn
Edge of Seventeen
Odd Thomas
Haunt
God Bless America
Night Owls
The Big Short
Haunter
In Your Eyes
Keith
Goon
Stuck in Love
Colonia
Ex Machina
Mr. Right
What If
Hot Fuzz
Nightcrawler
Heathers
Midsommar
Moonrise Kingdom
Wildflower
Sleeping with Other People
Adult World
Better Living through Chemistry
Lord of the Rings
The Spectacular Now
Tucker and Dale vs Evil
White Bird in a Blizzard
Cloud Atlas
Hot Summer Nights
Never goin’ Back
Thoroughbreds
Lady Bird
Eighth Grade
Love, Rosie
Nick & Norah’s Infinite Playlist
Scott Pilgrim vs The World
Once Upon a Time in Hollywood
Everything Everywhere All at Once

About Me on Houlton McGuinn

Security Engineer Interview Questions & Answers

Building a diamond Manifold prediction bot in a weekend

Why prediction markets matter

Vim has encryption? 😧

I'm doing office hours

Why do I have office hours?

Donating 10% 🔷

Why I’m donating

Finding a command injection vulnerability in my smart thermostat (CVE-2023-4212)

Summary

Vim tricks

Wrap lines

Visual block mode

Deletion

Revocable encryption exists!

A cryptographic dead person’s switch

Cryptopals Set 3: Block & stream crypto

17. The CBC padding oracle

Cryptopals Set 2: Block crypto

9. Implement PKCS#7 Padding

Cryptopals Set 1: Basics

Gravity Lights

Colorful Shapes

A Cryptographic Dead Person's Switch

Automated Backyard Hydrogen Line Astronomy

Reverse Engineering Wyze IoT Cameras

Breaking the Bridge: Winning $10,000 at HackTheMachine 2021

Robohunter: a Machine Learning Framework for Batch Analytics

About Me

it’s nice to meet you :)

Links

Cryptography and security

Things I Like

Music

Shows

Films

About Me on Houlton McGuinn

Security Engineer Interview Questions & Answers

Building a diamond Manifold prediction bot in a weekend

Why prediction markets matter

Vim has encryption? 😧

I'm doing office hours

Why should you sign up?

Why do I have office hours?

Donating 10% 🔷

Why I’m donating

Finding a command injection vulnerability in my smart thermostat (CVE-2023-4212)

Summary

Vim tricks

Wrap lines

Visual block mode

Deletion

Revocable encryption exists!

A cryptographic dead person’s switch

Cryptopals Set 3: Block & stream crypto

17. The CBC padding oracle

Cryptopals Set 2: Block crypto

9. Implement PKCS#7 Padding

Cryptopals Set 1: Basics

Gravity Lights

Colorful Shapes

A Cryptographic Dead Person's Switch

Automated Backyard Hydrogen Line Astronomy

Reverse Engineering Wyze IoT Cameras

Breaking the Bridge: Winning $10,000 at HackTheMachine 2021

Robohunter: a Machine Learning Framework for Batch Analytics

About Me

it’s nice to meet you :)

Links

Cryptography and security

Things I Like

Music

Shows

Films