My cousin is raising money to go to the MLS Next Youth Showcase. You buy tasty popcorn, and the money funds the trip with an option to donate to teachers. Check it out and support a good cause! I just bought a bunch for our weekly board game meetup :) s.dgpopup.com/0o409evs/rp

Our DEF CON33 ICS Village talk is now on YouTube! @sam-hans0n.bsky.social and I share stories of malware we discovered while searching for ICS threats, and discuss our approach to assessing their reputation. Don't Cry Wolf: Evidence-Based Assessment of ICS Threats

In ICS, malware analysis can feel like archaeology. I started the week with a 13 year old sample and ended the week with @sam-hans0n.bsky.social pinging about an 18 years old sample. So, save your old Windows ISOs and VMs, you might need them!

Thanks to @cybrseccon.bsky.social / HOU.SEC.CON for having us last week. (and for a really unique speaker gift!) The conference has grown into a valuable industry event, and I'm looking forward to the next one! ICYMI, we posted resources from our talk here: gist.github.com/maya...

Well.. I can’t help but listen to this. 🤘It’s weird, and I like it. deathmeta.bandcamp.com/album/malware

The Difference Maker Awards are about contributions to the community, so they let the community decide. Voting ends on Wednesday, October 8. If you haven’t voted yet, please consider it! (I’m a finalist in the ICS category alongside some amazing industry leaders) www.sans.org/about/awards...

@xorhex.bsky.social Good work on this BinaryNinja plugin! It really came in handy the other day when I was trying to type and label some dynamic api resolution code. Someone in Binja’s slack recommended it. Rock on! github.com/xorhex/binja...

I was nominated for a SANS DMA - ICS/OT Practitioner of the Year, along with some impressive folks. Reverse engineering ICS malware is hard, but communicating the results is harder. Grateful to SANS for recognizing my work in this area. Link below. Voting ends on Oct. 8.

Earlier this year, I complained about how many hyphens there were in Unicode. It turns out a Soft Hyphen was abused last year in a creative PHP exploit. CVE-2024-4577 exploits Windows’ Best Fit character conversion feature that auto-converts certain Unicode characters to ASCII equivalents. 1/3

Oh hey, Hex-Rays released IDA 9.2. There are new Go features like support for multiple return values to annotate Go function calls correctly. Jump Anywhere is a nice usability improvement supplanting the need to remember 5 keyboard shortcuts. hex-rays.com/blog/id... #idapro #reverseengineering

This is a great story about Donald Knuth and Doug McIlroy participating in a literate programming exercise and a hilarious example of different perspectives in problem solving from godfathers of Computer Science. Original post: hachyderm.io/@mweagle/115...

Sam Hanson and I are speaking at @hou-sec-con.bsky.social on hunting for Python and Go ICS-related malware. You'll learn playbooks for these cases and hear stories about malware targeting ICS in the past year. The talk is on October 1st, at 1 p.m., Track 1. I hope you can make it! #ICS #OTSecurity

Just read up on the IDA Domain API updates from Hex Rays. This on top of idalib is a nice step forward in usability. Def recommend checking out the All Things IDA video. Looking forward to seeing the use case spotlights that they’ll be publishing. youtu.be/IaOucXb033Q #idapro #reverseengineering

My reading list for the rest of the year, inspired by DEFCON 33 and the starting chapters of the first book: - Microcontroller Exploits - Goodspeed - Hack to the Future - Crose - Hardware Hacker - bunnie - Hardware Hacking Handbook - Van Woudenberg + O’Flynn - Art of Mac Malware (Vol 1+2) - Wardle

Eesh.. I know #ArchLinux can be difficult for folks, but this seems uncalled for. I hope they figure out who’s behind it. www.zdnet.com/article/arch...

You want @hermit.sh on your team. If you know of anything, send it their way.

Poland stopped a cyberattack that could have cut water supply to a major city yesterday. Cyberattacks against water is a troubling trend. Access to clean water is fundamental, and these types of attacks are direct threats to public health and safety. #ICS #OTsecurity www.reuters.com/en/p...#ICS

Played “In the Footsteps of Marie Curie” tonight. More of a family game, light on the strategy, easy playing. Good one for folks just getting into independent #boardgames

I’m forcing myself to learn #BinaryNinja, and using an LLM to search through the user manual and learn the basics is a game changer. Questions about fonts, theming, basic shortcuts, and considerations coming from IDA all answered easily.

Like every other industry, criminals and state-backed groups have jumped on the AI bandwagon. I spent some time reading threat reports from Anthropic, Google, and Open AI. Here's some of what they found: - Malware and software dev in Python, C/C++, Go, Android (lang unspecified), and others. 1/3

GoResolver was already awesome. Now, they added string extraction and definition in IDA/Ghidra and RTTI parsing and application — two big Golang reversing pain paints. I can’t wait to try it out this week. Original post: infosec.exchange/@volexity/11...

My SANS ICS Summit talk on defining ICS Malware is up. In it, I use TRISIS to walkthrough how we decided on ICS-Capability, Malicious Intent, and Adverse Effects as primary criteria. If a whitepaper isn’t your jam, this is a great quick summary. youtu.be/692tcHFIS4o...

Quitting programming as a career right now because of LLMs would be like quitting carpentry as a career thanks to the invention of the table saw.

Cat’s out of the bag. Sam Hanson and I are speaking at HOU.SEC.CON. on hunting and analyzing OT-related Golang and Python binaries. Andrew is covering memory-only malware detection with Volatility3. The agenda this year is fantastic. Check it out!

My talk from Volatility's From The Source 2024 is up. In it, I describe some of the major ICS Malware events and what they can teach us about ICS Malware Analysis as a field. It's a fun talk, and a great conference. The con is happening again in October. Check it out! youtu.be/C5Ev2XDIqqY...

Revive! I’m not sure how to categorize this game. Like a worker placement/deck building hybrid that feels like tile placement. Despite how complicated it looks, it’s not hard to learn how to play, and it allows many types of strategies. High replay value I think.

Matt Pahl and I are doing a webinar on defining ICS Malware, its distinction from IT threats, and how we search for it using different OT detection strategies. It's a follow-up to the ICS Malware definition work. Hope to see you there! Registration link: hub.dragos.com/webin...

Busy Week! Grateful to SANS ICS for hosting my talk on ICS Malware. It was a great experience. We released our whitepaper on the subject ( www.dragos.com/resou... ). We also got word that my talk with Sam Hanson on assessing ICS threats was accepted at Defcon ICS village. Hope to see you there!

We've been working on this one for a while, so I'm excited to finally share our whitepaper on defining ICS Malware. In it, we describe how Dragos identifies and differentiates ICS Malware using three properties: ICS-capability, Malicious Intent, and Adverse Effects. http://www.dragos.co...

I almost quit computer science today because I found out there are ELEVEN hyphen chars in UTF-8, including a SOFT HYPHEN (0xC2 0xAD) which is a "discretionary hyphen" OR "an invisible format character indicating a possible hyphenation location" I didn't know UTF-8 believed in quantum hyphenation.

It's tough to kick habits from starting out on Intel assembly. I was emulating some ARM firmware, and I kept forgetting that ARM allows ops like: MOV PC, R12, or MOVNE PC, LR where PC is the destination. So, the code transfers kept surprising me, like riding in a taxi with an aggressive driver.

Saw this quote in WIRED: “[DOGE] aims to migrate all SSA systems off COBOL … onto a more modern replacement like Java ...” It struck me that I didn’t consider Java modern either. So I looked up language ages. Haskell, Python, and Ruby are def more modern than Java. Nope! 1/2

I haven't felt this level of anxiety at work in a while.

Hell yeah! Check out the latest tmp.Out. Lots of great articles on ELF and Linux Rootkits. Even has its own mixtape!

We heard you needed some more time, so we wanted to let you cook. We decided to push the Phrack 72 CFP deadline back until June 15th. Stay tuned for upcoming Phrack events. Print this flyer out and give it to someone IRL!!

Reverse Engineering Podcast crossover episode 😃

Apparently we aren't going to talk about LockBit as a threat anymore. https://www.theguardian.com/us-news/2025/feb/28/trump-russia-hacking-cyber-security Good going "cybersecurity isn't political" chucklenuts. You're cooked. We're cooked.

Barrage: a game where you take on the role of an international corporation competing for hydroelectric dominance. Tried the Automa mode. Automa: 112, Me: 99. 😞

I asked an AI tool to help me brainstorm talk titles based on the contents of the abstract I planned on submitting. It came back with 5 options. One of them was a word for word copy of a talk title from a presentation given last year … by me. Super helpful.

How do you all keep up with your favorite local businesses without Instagram or FB? All the discourse surrounding the incoming administration and Meta’s response got me thinking about what purpose their products serve in my day to day, and I think local business and restaurant news is the main one.

It’s the hardest thing for me to start a writing project. Each time, I fight with procrastination and cope with the anxiety that comes with making an idea real. 1/2

"What radicalized you?" Hospitals, schools, libraries, SLTT govs getting disrupted. My sister impacted by ransomware *four different times*, disrupting her work and life. Watching criminals get away with it for so long. I wrote about why we need to change our thinking. www.rusi.org/explore-our-...

Who knew the Philipinnes USPS office was so darn pushy! You'd better put me on payroll if you expect me to do this much work to infect myself. (+63 is Philipinnes, the link is malicious, please don't fall for this)

It's crazy how weird people are with alcohol. If someone offers me cocaine I can just be like "no thanks" and that's it. But with alcohol I have to lead with an excuse or I'm spending the next 20 minutes getting quizzed on if I'm an ex-alcoholic, Mormon, or suffering from a chronic health condition.

Picked this up on a whim at PAX, and played it as soon as we got back. Delightful game, and easy to travel with: Sosig by Joking Hazard

I was an audience member for a few rounds of Underwater Cities (Rio Grande Games) that my buddy taught at #paxunplugged It’s a fun engine building/resource management game. Can be a lot to keep track of near the end, but that’s a small quibble.

How do I turn this into a #ransomware analogy? #paxunplugged

I finally updated my profile to use my domain malware.re as the bsky account name. Some fun resources of mine: blog.malware.re class.malware.re

Trying again 😬

After over a year, we’re finally attempting the last Frosthaven scenario! (I promise.. eventually I’ll post infosec content. But right now it’s Board Games and Corgis)