Wellington

just a guy in cybersecurity | likes ctfs & board games | he/him
GREM | MS in CS from @CarnegieMellon | @SandiaLabs @CISAgov
thoughts are my own

[Wellington @_wklee]

@HefrPidge Thanks! I was waiting eagerly for the past year for this reply :)

[Wellington @_wklee]

Hey @HefrPidge! Are you at liberty to tell me what malware you analyzed that led you to create challenge 6 in this year’s Flare-On?

[Wellington @_wklee]

@f0wlsec @vxunderground What do you look like LOL or should I just go around yelling the password in this hotel

[Wellington @_wklee]

I helped write and name this awesome tool with a talented team!

[CISA Cyber @CISACyber]

📢 Check out @CISAgov’s 🆕 Untitled Goose Tool developed in partnership w/ @SandiaLabs. It helps IT pros detect potentially malicious activity while conducting hunt & incident response in various Microsoft cloud services. Learn more: https://t.co/MNOBRGgSWS

[Wellington @_wklee]

help i'm scared
#ChatGPT

[Wellington @_wklee]

Had a lot of fun playing Wingspan Asia’s flock mode for the first time in almost a year since playtesting it with @elizhargrave! Looking forward to the launch party next week!

[Wellington @_wklee]

@mayahustle How to get into ICS malware analysis, setting up a sandbox specific for ICS malware.

[Wellington @_wklee]

@huettenhain In the end, your solution for 8 helped me find my error in my original RC4 key calculation.. I was adding the last command to the hash calculation when the program omits it from the string append!

[Wellington @_wklee]

@huettenhain Yep! It was a scapy DNS server sending commands in the order given by FLARE15.c xor'd with 248. It takes like 30 minutes to run against the "unfixed" binary due to all of the exception handling slowing down the run.

[Wellington @_wklee]

Thanks @nickharbour and @Mandiant for another awesome #flareon9 ! Just barely finished on the very last day. Had to leave #CYBERWARCON a bit early to reverse all night. Until next year!

[Wellington @_wklee]

@elizhargrave Really awesome to see the resulting look after play testing it almost a year ago! Such gorgeous box art.

[Wellington @_wklee]

@nickharbour Are you ready @0xdf_ ?

[Wellington @_wklee]

Hey @vmray, when do you anticipate STIX 2.1 output on your roadmap?

[Wellington @_wklee]

@agowa338 @0xdf_ @PayPal Yes, I’m referring to the fact that the PayPal invoice has the billing department email. Unsure if that’s just a user-filled description or if somehow they’ve typosquatted a PayPal email.

[Wellington @_wklee]

@0xdf_ @PayPal Interesting. Quite curious about that billing department email though.

[Wellington @_wklee]

@AzuleOnyx @kipko85 @hacks4pancakes I haven't looked into 301V/L but I'm one of the instructors for DOE Cyberfire's Malware Course. The event has an OT component taught by some colleagues of mine from INL (who also built 301V/L). It's also a free event. Feel free to DM me if you're interested!

[Wellington @_wklee]

@AzuleOnyx @hacks4pancakes Out of curiosity, what CISA course are you referring to specifically?

[Wellington @_wklee]

@_JohnHammond Just going to drop this here.. https://t.co/u18O0Ep4Lj