Repeat after me: switches are computers running software that may be vulnerable. If you've ever been in one of my classes you already know this. #HardwareHacking Cisco Warns of Actively Exploited SNMP Vuln Allowing RCE or DoS in IOS Software share.google/W7KPY69grqZ1...

Come join me at SANS Cyber Defense Initiative in Washington DC and learn about security controls for critical infrastructure. We'll have a blast!

My UV glasses to harden my clear fingernail polish w/ UV light. The polish insulates and tacks down the small wires I soldered. RP2040 with a 1.28" color LCD display. No good place to grab 3.3V volts except directly on the voltage regulator output pin. :( #HardwareHacking

Power failure: If you don't work in critcal infrstructure you may not know that most large generators require power from the electric grid to start. Learn which power sources can "blackstart" if the grid is down. youtu.be/22T9-oknmLM?...

New #HardwareHacking technique shows high performance mice can be used as microphones. --- Mic-E-Mouse technique harnesses mouse sensors, converts acoustic vibrations into speech | Tom's Hardware share.google/6bnLg3D3xlAv...

Timing side channel attack in OPENSSL CVE-2025-9231, Moderate-severity affecting SM2 64-bit ARM. A timing side-channel that could allow recovery of private keys through precise timing measurements. Remote exploitation remains theoretical but possible securityaffairs.com/182845/secur...

Intel and AMD agree, in cybersecurity #HardwareHacking always wins. ------ Intel and AMD trusted enclaves, a foundation for network security, fall to physical attacks - Ars Technica share.google/8iN6bXswxIp1...

"This security issue could allow potential attackers to gain complete and persistent control of both the BMC system and the main server OS," New Supermicro BMC flaws can create persistent backdoors #HardwareHacking share.google/xrqGNVc2W5S9...

I be hopin’ all ye scallywags enjoyed Talk Like a Pirate Day, one o’ me most beloved holidays. Fear not, fer next year the dread pirate Roberts may once again, set sail across the cyber-seas, an’ school the landlubbers in the art o’ industrial cybersecurity! Yaarrrr!

Hardware hacking warnings Exclusive: US warns hidden radios may be embedded in solar-powered highway infrastructure | Reuters share.google/kXscXIl4eGqV...

‘Unrestrained’ Chinese Cyberattackers May Have Stolen Data From Almost Every American - The New York Times share.google/K23WgUmY7smX...

What a fantastic talk by such an amazing speaker: me. :) youtu.be/Vd_aFOGeE2o?... #S4x25

Industrial control system hacking #ICShacking Pro-Russian hackers blamed for water dam sabotage in Norway share.google/PC8tl4Zk9L7V...

An attacker with physical access to a user's laptop can pry it open and directly access the USH board over USB bypassing Windows login security. #HardwareHacking www.bleepingcomputer.com/news/securit...

"Technical Challenges include firmware vulnerabilities. Ensuring the integrity and secure update of inverter based generation firmware, which could lead to grid instability if compromised." -Ingrid Rayo Innovative Resiliency #NewNERCrequirements #HardwareHacking #EnergySec

Presenting at an Energy Security conference this week in Disneyland Anaheim CA. :) #WorkingRemote #ImaLuckyGuy #EnergySec

We learned a lot and had fun doing it in the SCADA security class in Washington D.C. So much so the class wanted a picture. It was really nice teaching such an engaged group. #ICSsecurity

Here are the second place winners, the "colton_bonding" team, in my SCADA security class in D.C. The first place winners were a live online team and not pictured, the "IndustrialShieldUnit" team. #SANSics410

I'm excited to be presenting the keynote address tomorrow at the Virginia Cybersecurity Education conference in Richmond. vacybereducon25.sched.com

See my talk tonight (Friday) from D.C. live online here: We'll discuss how timing side-channel attacks work (against a keypad safe), and how to use Pulseview (the wireshark of hardware hacking) with a $15 logic analyzer to accomplish this. www.sans.org/webcasts/key...

Found him! #whereswaldo

If you’re shaping the next generation of cybersecurity pros—from K-12 to higher ed—you won’t want to miss the Virginia Cybersecurity Education Conference! There will be an AMAZING keynote speaker there. Me! :) sites.google.com/vt.edu/vacyb... @VaCyberRange @SANSInstitute @SANSICS

Just caught this guy in the background trying to copy my pose. #FlexOff #DisneySelfie #GastonWho #StillTheRealDeal

"The shortfall is not about technical capability, but related to the different approaches the two nations have taken to attracting and training hackers" www.darkreading.com/cyber-risk/u...

Starting my conference workshop at the SANS ICS security conference. There were a lot more people that wanted to participate than we expected, about 120. We had a really good time and people got to take home a hardware hacking tool that they programmed. #HardwareHacking

#HardwareHacking 10 out of 10

Join me at EnergySec's Security Summit, bring your laptop and you'll get a microcontroller to program and keep. We're going to have a Hacking good time!

"There is nothing more permanent than a temporary firewall rule" -Austin Scott ​Dragos, Inc. ​SANS ICS Summit

Automating the SANS ICS 5 Critical Controls (for Free*) [using AI] By Mike Holcomb SANS ICS Summit @mikeholcomb.bsky.social

To patch or not to patch. "Not patching is safer... until there is a security incident." -Michak Karolak SANS ICS Summit

Jimmy Wylie gives us 3 key criteria for defining ICS Malware 1. ICS capable 2. Ability for adverse affects on O.T. environments 3. Intent of the tool. SANS ICS Summit @mayahustle.bsky.social

David Worthington reminds us that the focus of the ICS company is Safety, and Producing Your Product, not cyber security. Cyber security is only useful as it supports those. SANS ICS Summit SANS Institute

AI is an arms race, I'd recommend erring on the side of caution on implementation in the power grid. #AndyBochman SANS ICS Summit @SANSICS

We had a great time in Baltimore in the SANS wireless pen testing class (SEC617)! Here is the winning team for the class CTF. #HackingFun

Vibe coding harshes my mellow.

This red-bellied woodpecker must really like my woodpecker food. He certainly has a bill full of it. #HappyLittleThings

#HardwareHacking "If you've been exploited previously, upgrading your firmware will NOT remove the SSH backdoor." www.bleepingcomputer.com/news/securit...

#HardwareHacking Starlink olegkutkov.me/2025/05/22/h...

Ready to defend the critical infrastructure of Gotham City with the caped crusaders. — at Warner Bros. World Yas Island, Abu Dhabi.

My feathered companion this morning in Abu Dhabi, a Myna bird. They are know for their intelligence and vocal abilities. I think they are interesting to look at.

I'll be teaching SCADA security essentials at perhaps my favorite hotel in the entire world, the Contemporary at Walt Disney World. We will have a great time! Join me. Get there early to attend the SANS ICS summit and my workshop on malicious hardware there. #ICS410

:( www.wired.com/story/cfpb-q...

"One of the first actions intruders take is to search for documents with the keywords "insurance" and "policy." Then the ransom more than doubles on average." Is insurance financing ransomware? #DontFinanceAttacks www.theregister.com/2025/04/16/d...

Join me at the Orlando ICS summit. The free workshop programming a microcontroller attack tool. #HardwareHacking www.linkedin.com/posts/sans-i...

Interested in Wireless attack and defense, including Wifi, Bluetooth, RFID, Software Defined Radio (SDR) and more. Join me for SEC617 in Baltimore. We're going to have a great time! #HardwareHacking

Six weeks later and most of my coding is actually collaborating with Gemini 2.5 in Cursor. It's not vibe coding, but it's not what I've done for the past decades of writing software. Big changes are here and it makes me nervous, and excited.