“No, that’s my neighbor, Bobby. I live at 502, but you have to write 501 on the package or the mail carrier brings it to the wrong house. He has a problem.”

ICS is fun. This blog covers the problem:
blog.softwaretoolbox.com/topserver-mo...

(H/T to Reid Wightman for inspiring this post)

(2/2)

Other questions I'm exploring:

How much does AI know about ICS protocols?

Does AI truly lower the barrier for entry? If not, is that an AI limitation or am I just "holding it wrong"?

Is it shortening my development time? Or solving some problems but creating new ones for a net-zero benefit?
2/2

MinusOne, a deobfuscation engine for scripting languages: github.com/airbus-ce...

EPIC Erebus for PCIe and DMA attack research: www.crowdsupply.com/...
3/3

Here are a few of the projects I enjoyed learning about this time around:

Thorium Malware Pipeline: github.com/cisagov/t...

CTADL Static Taint Analysis Tool: github.com/sandialab...
2/3

I couldn’t think of a picture, so here’s an image from an old show that probably planted the seed for me to become a malware analyst.

I enjoyed it, but I’ll readily admit, it’s not for everyone.

I learned about it reading Orange’s write up in Phrack72: phrack.org/issues/72...

And the blog post it references here by Orange and Splitline: devco.re/blog/2025/0...

Both of these are excellent write ups and great reads if you’re into vulnerability research, CTFs, or hacker history.
3/3

Orange and Splitline discovered they could abuse this feature to turn a soft hyphen into a normal one and bypass a 2012 PHP argument injection patch to leak data and potential RCE.

It’s a fascinating attack surface and a case study on how benign OS features can become unexpected attack vectors.
2/3