Remote
K. Reid Wightman 
🌻 
@reverseics@infosec.exchange
mastodon 4.8.0-alpha.3+glitchTinker, Sailor, Biker, Hi
I do industrial security research for a living, mostly looking for #vulnerabilities in all of the wrong places. I like reverse engineering how PLC logic systems function under the hood, learning how safety instrument protocols work, and figuring out what malicious threat groups are doing and can do with access to such systems. A long time ago, I invented the term 'foreverday' to describe unfixable vulnerabilities.
Occasionally I analyze #industrial #malware, too, and on very rare occasions encounter threat groups that actually write malicious logic to do the vile things that I like to learn about.
I work for a little startup in the space called Dragos. In my spare time I enjoy long distance #bicycling, #sailing, and doting on our #pets.
I used to have an account on 
, however I haven't used it in a while and you should no longer assume that it's under my control.
Trying not to be one of the 80% that can be moved in either direction.
108 Followers
417 Following
50 Posts
Joined October 28, 2022
Location:
Des Moines, IA, USA, Planet Earth, second spiral arm around Sagittarius A
Pronouns:
he/him or they/them
Security Level:
Currently clean on opsec
This makes me giggle in ways that are difficult to describe. #startrek #startrektng https://www.youtube.com/watch?v=XPuFItRTxdw
If your PLC had its password set by a hacktivist, you might be tempted to get your hands on some sketchy password reset/password retrieval software for it.
We looked at one of those a bit ago and while it did what it said (retrieved the password using an undisclosed bug in the plc comms protocol) it also came with some C2 software. You wanted malware with your PLC password retrieval, right?
I mention this as a piece of software that I've been hunting for, which claims to retrieve passwords from PLCs recently impacted in these water treatment breaches, just showed up on VT for the first time this morning.
It is protected with vmprotect and looks fairly sketchy. Still trying to analyze it but stay frosty. You don't want to be a double victim in all this...
Replying to
And we solved the mystery of wet surge strip: the skylight is leaking when it rains. Occasional water drops fall out of the corner of the trim, right where the surge strip used to be. Hilarity...
i wish summer was longer. #sailing
Replying to
@cR0w@infosec.exchange if anything exists it may be in disa stig documents?
impromptu 90 mile ride today. i didnt really plan it, just kinda kept going…
Replying to
Update: it turns out network switches have a lifespan. After many link-down/link-up cycles, I have replaced the switch and have a reliable network again.
The old switch was just over 18 years old. RIP you glorious piece of hardware, I shall send you to valhalla (electronics recycler, with a clear label saying that the switch does not work reliably).
cc @jfslowik@infosec.exchange casey says I needed to share this with you.
Replying to
@DaveMWilburn@infosec.exchange @Nonya_Bidniss@infosec.exchange Just so you know, this toot is how I learned of Sam's passing ("Oh that's funny. Oh no, did Sam pass away? googles him").
And I really think that a story like this is the best way to learn about someone's demise. RIP Sam Neill.
I went to a really nice tech talk at SecDSM last night. It was on PLC insecurity, how to build a trainer kit for building your own simple process control experiment with an HMI, etc. https://github.com/oniskin/PLC-Trainer-Kit is the writeup, and Oren even posts little videos on how to get started.
One of the neater things was showing a modern functioning arp poison attack to blind operators (thanks to no integrity in the control systems protocols). I liked Oren's approach, which let you specify which registers get what values for read operations.
I wrote a tool of my own a while ago but it is pretty limited (just records a 10 second 'tape loop' where it then replays responses, seen here: https://github.com/reidmefirst/modbus-vcr ). Hopefully Oren publishes his soon...
Replying to
@krypt3ia@infosec.exchange he doesn't eat lettuce...
Dang. RIP Vlad Chaloupka (aka Vlad the Astrophysicist). I never knew the guy, but that Peter Mulvey tune tells me we would have gotten along just fine. https://obituaries.seattletimes.com/obituary/vladimir-chaloupka-1093895849
Replying to
@da_667@infosec.exchange @Dio9sys@haunted.computer I read the first sentence and immediately thought "hit him with a splash attack". which is also in my vocabulary.
it'll be funny if we get old and dementia-like and mutter this stuff in a nursing home.
Replying to
@Dio9sys@haunted.computer +1 for homestar. I do often say "corn chips are no place for a mighty warrior!" when I have nachos...
Replying to
@Dio9sys@haunted.computer there is a whole channel dedicated to this subject in one of the discord I'm on. Hotel rooms are all weird when you think about them too much.
Replying to on mastodon.social
@Viss@mastodon.social @jalefkowit@hachyderm.io Lincoln Logs: The Saga Begins
Replying to on tech.lgbt
@krishean@tech.lgbt Shush ;-).
Replying to
@krishean@tech.lgbt I'm an old man. Layers are confusing to me.
Replying to
@krishean@tech.lgbt yeaaaah...that's why I did that, it was totally on purpose!
Replying to
@hrbrmstr@mastodon.social @DaveMWilburn@infosec.exchange heh. it was a loop. the photo was about 50 miles in. we have a couple of massive bicycle trail systems here…
Replying to
@itisiboller@infosec.exchange It's a "get out of evidence free" card.
Occam's Cyber: If Cyber is a competing theory for an event, then it must have been Cyber.
Replying to
@pburka@toot.cat yeah, that'll be fun I think! I also made the mistake (?) of setting some nmea2000 alarms, such as 'loss of autopilot'. A lot of times I unplug the tillerpilot when I'm getting close to the marina since it is just in the way, which makes everything start beeping. I'm hesitant to remove the alarm though: if I ever sail overnight or am otherwise not on deck, it would be nice if things start beeping if a fuse blows or something else goofy happens.
Replying to
@Viss@mastodon.social oh wonderful! now to figure out an appropriate mounting spot…
Replying to
@DaveMWilburn@infosec.exchange Duluth is somehow getting perfect weather. I could do with a little more wind I s'pose but since I'm mostly parked at the dock this week in order to work I don't mind that much. But yeah sunny, not too hot, it's a great little city to consider for a climate change refugee destination.
Replying to
@Viss@mastodon.social my most important question: does it function as a local only device if i block outbound network access? given it’s you i suspect that the answer is ‘yes’ but i still have to ask ;).
Replying to
@wdormann@infosec.exchange I sprinkled "granulated bobcat urine" around our vegetable garden this year. I put it in quotes because I am guessing it is just from normal cats or something.
I reapply every time it rains. It seems to be helping. Although for some reason squirrels still really go after our eggplants. They do the same thing as your deer: rip the eggplant off, with a single bite mark, and leave the unripe eggplant on the ground because they taste too bitter I guess.
It's not like I need my garden vegetables, but garden tomatoes really are the best thing ever. I always think of this comic as I consider taking more drastic measures. https://pbfcomics.com/comics/billy-the-bunny/
Replying to
@gsuberland@chaos.social Or perhaps a descern.
Replying to
@DaveMWilburn@infosec.exchange also this friday is an overnight race up the lake. so far the forecast looks pretty nice, first leg will be beating, then reaching, then running. as it should be.
the funniest thing about sailing is that I now pay attention to wind forecasts for driving. like if I wait to drive home until sunday morning, I'll have a nice tailwind and will burn less gasoline driving to Iowa. so i might just do that...
When worlds collide:
I bought an AIS (Automatic Identification System) transponder for my sailboat. If you don't know what these are, they are a doohickey that transmits your boat GPS position, speed and direction (among other bits of data like name and boat size and stuff). It's how sites like marinetraffic.com get populated with live ship position feeds. It also lets you set up computers on your boat to warn you if you are on a collision course with another boat that has AIS. For example. Very helpful during fog, at night, or when people do people things like fall asleep.
Anyway transponders are interesting. When you buy them, you have to provide the seller with your boat's MMSI (Maritime Mobile Service Identity). The seller then configures the radio with the MMSI before giving you the radio.
If you want to change the MMSI later, say because you bought a new boat and want to move your thousand dollar radio to it, you have to beg and plead (and probably pay) to get a special unlock code from the manufacturer. Sometimes you actually have to mail the radio back to the manufacturer to get it reset with the new MMSI. I did a little sleuthing and RE and figured out that the unlock code for my radio is derived using a pretty simple algorithm. So when it comes time to get a new boat, I can Do It Myself thankfully.
Perhaps not surprisingly, DOT and FCC get really cranky about people talking about AIS transponder resets in too much detail. They don't want such knowledge to become well known or understood for fear of people changing their own transponder MMSI to someone else's I guess? It's odd though, considering the protocol is plaintext and you can implement it easily with a cheap SDR (see for example: https://jeremyclark.ca/wp/nav/rtl-sdr-for-ais/ ) . The protections against transponder resets seem like security theater.
Anywho, will be interesting to play with AIS on the Big Lake in the coming weeks. It really was neat to crew on a friend's boat during a big race (~19 boats), as most of the race boats out of Duluth have transponders. And thankfully I could pull the trigger on this even though I know my boat is not my forever-boat. It's nice to know that this quite expensive radio will be usable in the new boat, whatever it might be.
I remember listening to Joshua Johnson on 1A, and I never put it together that he's the same guy reading the news for The Onion News Network (under the name Dwight Richmond). What a strange and fun planet we live on sometimes...
https://www.pbs.org/newshour/show/what-political-satire-can-reveal-about-the-strength-of-a-democracy?utm_medium=activitypub
Replying to
@krypt3ia@infosec.exchange He could tell us how to fix the postal service too...
in my infosec-based magic system, fae are beings with very subtle control of time, who are also all somewhere on the autism spectrum. you can make deals to get things done in the past but you wont understand the true interpretation and repurcussions until years after the change.
and your true name is a fursona.
so basically it is just infosec.
Finally a reasonable answer to 'why the iran war': https://www.youtube.com/watch?v=vey4Rnid1QU
Replying to
@gsuberland@chaos.social 🦀
how do we convince john mastodon to implement it here?
Replying to on mastodon.social
@Viss@mastodon.social @krypt3ia@infosec.exchange dare to dream…
Replying to
@tychotithonus@infosec.exchange also amusing that the weather alert was issued at 2am and they sent the email at 8am.
I suppose if it is something like an air quality warning or heat warning then no big deal, it would be 'funny' (as in useless) if they sent a tornado warning 6 hours late though...
I just discovered @dotdotslash_bot@infosec.exchange and it is worth a follow if you enjoy #directorytraversalmemes (and also enjoy reading about new CVEs that are CWE-22 or CWE-22-adjacent).