I spent a couple months arguing with Claude and Copilot while building FrostyGoop variants for DNP3 (and Modbus), keeping detailed notes on what worked and what didn't. At S4, I’ll share my honest assessment of these tools and how they might lower barriers to ICS malware dev. See you in Miami!

Finally sharing what’s been under wraps for months. Adam Foster and I tore into HID SEOS to build the first open-source implementation for Proxmark3. This is our Black Hat Asia 2025 story → www.youtube.com/watch?v=mnhG... #RFIDHacking #SEOS #CyberSecurity

We have a job opening in our Community Defense Program (CDP) which gives small utilities free access to the Dragos Platform. This opening is a chance to do some truly meaningful work for the community. Job Description: job-boards.greenhous... CDP Description: www.dragos.com/commu...

Had a great time presenting at LSU this week on hunting and analyzing Go and Python malware samples while hunting for ICS malware. For those who couldn't make it, you can catch a recording of this talk from Hou.Sec.Con last month with @sam-hans0n.bsky.social www.youtube.com/watc...

A lot of folks have reached out about Socket’s recent report on a supply chain attack using malicious NuGet packages to target Siemens S7 protocol and other PLCs. This is not a supply chain attack in the traditional sense. 1/6

Learning Modbus is basically this conversation: “I live at 502 Westport Ave.” “Sweet, I’m sending you a package.” “Wait! If you talk to the mail carrier, my address is 501 Westport Ave.” “Oh. So, you live at 501 Westport?” (1/2)

I'm speaking at S4x26 on creating a FrostyGoop-style tool using AI. This experiment has been a good avenue for tackling a few questions I've had about AI-enabled software development. Most importantly, just how easy is it? I'm excited to share what I learn come February! 1/2

I had a great experience at #FTSCon on Monday. Both the speakers and the audience are such high caliber that an interesting discussion can be had at any point during the day. The information presented is useful for folks in any technical aspect of cybersecurity, not just DFIR folks. 1/3

MacOS 26 really kills the T2 Intel Macs. It's technically compatible, but the experience is a drag, especially just after boot with all the indexing. I'm going to put a T2 Linux distro on this thing, and hope it improves the experience. I refuse to throw away a computer that's barely 5 years old.

My cousin is raising money to go to the MLS Next Youth Showcase. You buy tasty popcorn, and the money funds the trip with an option to donate to teachers. Check it out and support a good cause! I just bought a bunch for our weekly board game meetup :) s.dgpopup.com/0o409evs/rp

Our DEF CON33 ICS Village talk is now on YouTube! @sam-hans0n.bsky.social and I share stories of malware we discovered while searching for ICS threats, and discuss our approach to assessing their reputation. Don't Cry Wolf: Evidence-Based Assessment of ICS Threats

In ICS, malware analysis can feel like archaeology. I started the week with a 13 year old sample and ended the week with @sam-hans0n.bsky.social pinging about an 18 years old sample. So, save your old Windows ISOs and VMs, you might need them!

Thanks to @cybrseccon.bsky.social / HOU.SEC.CON for having us last week. (and for a really unique speaker gift!) The conference has grown into a valuable industry event, and I'm looking forward to the next one! ICYMI, we posted resources from our talk here: gist.github.com/maya...

Well.. I can’t help but listen to this. 🤘It’s weird, and I like it. deathmeta.bandcamp.com/album/malware

The Difference Maker Awards are about contributions to the community, so they let the community decide. Voting ends on Wednesday, October 8. If you haven’t voted yet, please consider it! (I’m a finalist in the ICS category alongside some amazing industry leaders) www.sans.org/about/awards...

@xorhex.bsky.social Good work on this BinaryNinja plugin! It really came in handy the other day when I was trying to type and label some dynamic api resolution code. Someone in Binja’s slack recommended it. Rock on! github.com/xorhex/binja...

I was nominated for a SANS DMA - ICS/OT Practitioner of the Year, along with some impressive folks. Reverse engineering ICS malware is hard, but communicating the results is harder. Grateful to SANS for recognizing my work in this area. Link below. Voting ends on Oct. 8.

Earlier this year, I complained about how many hyphens there were in Unicode. It turns out a Soft Hyphen was abused last year in a creative PHP exploit. CVE-2024-4577 exploits Windows’ Best Fit character conversion feature that auto-converts certain Unicode characters to ASCII equivalents. 1/3

Oh hey, Hex-Rays released IDA 9.2. There are new Go features like support for multiple return values to annotate Go function calls correctly. Jump Anywhere is a nice usability improvement supplanting the need to remember 5 keyboard shortcuts. hex-rays.com/blog/id... #idapro #reverseengineering

This is a great story about Donald Knuth and Doug McIlroy participating in a literate programming exercise and a hilarious example of different perspectives in problem solving from godfathers of Computer Science. Original post: hachyderm.io/@mweagle/115...

Sam Hanson and I are speaking at @hou-sec-con.bsky.social on hunting for Python and Go ICS-related malware. You'll learn playbooks for these cases and hear stories about malware targeting ICS in the past year. The talk is on October 1st, at 1 p.m., Track 1. I hope you can make it! #ICS #OTSecurity

Just read up on the IDA Domain API updates from Hex Rays. This on top of idalib is a nice step forward in usability. Def recommend checking out the All Things IDA video. Looking forward to seeing the use case spotlights that they’ll be publishing. youtu.be/IaOucXb033Q #idapro #reverseengineering

My reading list for the rest of the year, inspired by DEFCON 33 and the starting chapters of the first book: - Microcontroller Exploits - Goodspeed - Hack to the Future - Crose - Hardware Hacker - bunnie - Hardware Hacking Handbook - Van Woudenberg + O’Flynn - Art of Mac Malware (Vol 1+2) - Wardle

Eesh.. I know #ArchLinux can be difficult for folks, but this seems uncalled for. I hope they figure out who’s behind it. www.zdnet.com/article/arch...

You want @hermit.sh on your team. If you know of anything, send it their way.

Poland stopped a cyberattack that could have cut water supply to a major city yesterday. Cyberattacks against water is a troubling trend. Access to clean water is fundamental, and these types of attacks are direct threats to public health and safety. #ICS #OTsecurity www.reuters.com/en/p...#ICS

Played “In the Footsteps of Marie Curie” tonight. More of a family game, light on the strategy, easy playing. Good one for folks just getting into independent #boardgames

I’m forcing myself to learn #BinaryNinja, and using an LLM to search through the user manual and learn the basics is a game changer. Questions about fonts, theming, basic shortcuts, and considerations coming from IDA all answered easily.

Like every other industry, criminals and state-backed groups have jumped on the AI bandwagon. I spent some time reading threat reports from Anthropic, Google, and Open AI. Here's some of what they found: - Malware and software dev in Python, C/C++, Go, Android (lang unspecified), and others. 1/3

GoResolver was already awesome. Now, they added string extraction and definition in IDA/Ghidra and RTTI parsing and application — two big Golang reversing pain paints. I can’t wait to try it out this week. Original post: infosec.exchange/@volexity/11...

My SANS ICS Summit talk on defining ICS Malware is up. In it, I use TRISIS to walkthrough how we decided on ICS-Capability, Malicious Intent, and Adverse Effects as primary criteria. If a whitepaper isn’t your jam, this is a great quick summary. youtu.be/692tcHFIS4o...

Quitting programming as a career right now because of LLMs would be like quitting carpentry as a career thanks to the invention of the table saw.

Cat’s out of the bag. Sam Hanson and I are speaking at HOU.SEC.CON. on hunting and analyzing OT-related Golang and Python binaries. Andrew is covering memory-only malware detection with Volatility3. The agenda this year is fantastic. Check it out!

My talk from Volatility's From The Source 2024 is up. In it, I describe some of the major ICS Malware events and what they can teach us about ICS Malware Analysis as a field. It's a fun talk, and a great conference. The con is happening again in October. Check it out! youtu.be/C5Ev2XDIqqY...

Revive! I’m not sure how to categorize this game. Like a worker placement/deck building hybrid that feels like tile placement. Despite how complicated it looks, it’s not hard to learn how to play, and it allows many types of strategies. High replay value I think.

Matt Pahl and I are doing a webinar on defining ICS Malware, its distinction from IT threats, and how we search for it using different OT detection strategies. It's a follow-up to the ICS Malware definition work. Hope to see you there! Registration link: hub.dragos.com/webin...

Busy Week! Grateful to SANS ICS for hosting my talk on ICS Malware. It was a great experience. We released our whitepaper on the subject ( www.dragos.com/resou... ). We also got word that my talk with Sam Hanson on assessing ICS threats was accepted at Defcon ICS village. Hope to see you there!

We've been working on this one for a while, so I'm excited to finally share our whitepaper on defining ICS Malware. In it, we describe how Dragos identifies and differentiates ICS Malware using three properties: ICS-capability, Malicious Intent, and Adverse Effects. http://www.dragos.co...

I almost quit computer science today because I found out there are ELEVEN hyphen chars in UTF-8, including a SOFT HYPHEN (0xC2 0xAD) which is a "discretionary hyphen" OR "an invisible format character indicating a possible hyphenation location" I didn't know UTF-8 believed in quantum hyphenation.

It's tough to kick habits from starting out on Intel assembly. I was emulating some ARM firmware, and I kept forgetting that ARM allows ops like: MOV PC, R12, or MOVNE PC, LR where PC is the destination. So, the code transfers kept surprising me, like riding in a taxi with an aggressive driver.

Saw this quote in WIRED: “[DOGE] aims to migrate all SSA systems off COBOL … onto a more modern replacement like Java ...” It struck me that I didn’t consider Java modern either. So I looked up language ages. Haskell, Python, and Ruby are def more modern than Java. Nope! 1/2

I haven't felt this level of anxiety at work in a while.

Hell yeah! Check out the latest tmp.Out. Lots of great articles on ELF and Linux Rootkits. Even has its own mixtape!

We heard you needed some more time, so we wanted to let you cook. We decided to push the Phrack 72 CFP deadline back until June 15th. Stay tuned for upcoming Phrack events. Print this flyer out and give it to someone IRL!!

Reverse Engineering Podcast crossover episode 😃

Apparently we aren't going to talk about LockBit as a threat anymore. https://www.theguardian.com/us-news/2025/feb/28/trump-russia-hacking-cyber-security Good going "cybersecurity isn't political" chucklenuts. You're cooked. We're cooked.

Barrage: a game where you take on the role of an international corporation competing for hydroelectric dominance. Tried the Automa mode. Automa: 112, Me: 99. 😞

I asked an AI tool to help me brainstorm talk titles based on the contents of the abstract I planned on submitting. It came back with 5 options. One of them was a word for word copy of a talk title from a presentation given last year … by me. Super helpful.

How do you all keep up with your favorite local businesses without Instagram or FB? All the discourse surrounding the incoming administration and Meta’s response got me thinking about what purpose their products serve in my day to day, and I think local business and restaurant news is the main one.

It’s the hardest thing for me to start a writing project. Each time, I fight with procrastination and cope with the anxiety that comes with making an idea real. 1/2