K. Reid Wightman  ðŸŒ»  

455 Followers
408 Following
6K Posts

Tinker, Sailor, Biker, Hi

I do industrial security research for a living, mostly looking for #vulnerabilities in all of the wrong places. I like reverse engineering how PLC logic systems function under the hood, learning how safety instrument protocols work, and figuring out what malicious threat groups are doing and can do with access to such systems. A long time ago, I invented the term 'foreverday' to describe unfixable vulnerabilities.

Occasionally I analyze #industrial #malware, too, and on very rare occasions encounter threat groups that actually write malicious logic to do the vile things that I like to learn about.

I work for a little startup in the space called Dragos. In my spare time I enjoy long distance #bicycling, #sailing, and doting on our #pets.

I used to have an account on , however I haven't used it in a while and you should no longer assume that it's under my control.

Trying not to be one of the 80% that can be moved in either direction.

LocationDes Moines, IA, USA, Planet Earth, second spiral arm around Sagittarius A
Pronounshe/him or they/them
Security LevelCurrently clean on opsec
Fairly certain that this is a psyop based on some actual espionage and if so it is bloody brilliant...
Oslo fox
a new zero-trust security appliance just dropped

ZionSiphon is an AI-generated, non-functional attempt at ICS malware. Malicious intent doesn't imply ability, and broken malware like this is a distraction when we have proven threats like VOLTZITE/Volt Typhoon out there hitting water utilities.:

https://www.dragos.com/blog/zionsiphon-ot-malware-analysis

#ICS #malware

ZionSiphon: Why This Malware Isn't A Credible ICS Threat

Dragos analyzed ZionSiphon and assessed it as non-functional OT malware. Here's why it poses no credible threat to dam desalination or critical infrastructure

Substack promoted Andrew Tate as their #1 "bestseller" last week. Cool company. Great leadership.

So I went ahead and made a browser extension.

Kill Yr Substack intercepts every Substack link (even on custom domains) and redirects it to `archive.is`.

Substack's numbers go down. You still get to read the thing tho.

https://jasoncosper.com/kill-yr-substack/

Kill Yr Substack

Jason Cosper
All we need is a SOC Triage Thursday shirt and an Incident Response Friday shirt and we'll be all set.
Found it
The folks at iTerm2 figured out a way to get arbitrary code execution as the result of cat <file>, which is... impressive?