Lemon

Principal Security Engineer @ Red Threat

[Lemon @Lemonitup]

@JackRhysider https://t.co/P9oDbqZngd

Traffic light hacking

[Lemon @Lemonitup]

@lucidic @usetraceix @Malwarebytes Fltmc unload the filter driver disables detection even with tamper protection on. Av still shows protected status

[Lemon @Lemonitup]

@offsectraining The “AI”

while true; do
read -p "Enter something: " user_input
echo "Try Harder"
done

[Lemon @Lemonitup]

@vxunderground 7. Just unload the filter drivers with fltmc unload. (Need admin) Bypassestamper and password protection, av still shows enabled and malware executes.

[Lemon @Lemonitup]

@WeaponOutfitter Circle bar is in the Linq

[Lemon @Lemonitup]

Doom on a traffic light controller.

[Lemon @Lemonitup]

@_nextjenn

[Lemon @Lemonitup]

@LisaForteUK https://t.co/aE3TNchpOd

[Denver Moore @thatdenverguyYT]

Huge viral tweet went out about a guy with severe pain and after months of doctors and no answers, some guy basically says "bro, just hang from a bar"

And the guy was cured

YouTube advice is like this sometimes and some of you guys refuse to do it

I say this with my whole heart, people who complicate youtube usually fail. They dig a hole and keep digging thinking there is some treasure chest at the bottom. The treasure chest is sitting on the grass already.

They got lost in the stats and panic when CTR is 7.2 instead of 7.3 while some 14 year old in Roblox just broke 100k and doesn't even know what the word analytics means

Seriously I work with a channel that just hit 300m views in a month and he doesn't look at analytics. Ever. Take a moment, think about that

The more I do youtube, the less I look at the stats. And I do a LOT of YouTube. Stats tell you whether you already failed or succeeded, but you didn't need the stats to tell you that.

A video that has 5% ctr right now could be 13% in the morning with triple views. A video with 50% APV could be 30% by midnight. And then 55% again in two weeks.

Make good videos, put them out, then let them find the right audience. If it gets views, you did it right. If not, you missed something. You need to develop the INSTINCT for what people want.

I go through so many coaching calls these days and we barely talk stats. I don't even need to see them. I can tell you pretty quickly what's happening and what you need to do about it.

But Denver, can't I go into the analytics now and see where I went wrong?

Sure, but you should already know before you even look. Because you are developing the instinct. You know what a good youtube video FEELS like.

Either your topic sucked, your thumbnail didn't represent in an interesting way, or you still aren't able to hold a wide audience with your presentation. And those analytics you're dissecting won't even be able to tell you much and lead people astray more than on the right track with confirmation bias and theories.

Don't get me wrong, stats aren't useless or anything. It's okay to test a new thumbnail and see if it hits, and I've got many extra views this way. It's okay to check retention graphs and see if there are moments you're losing a good chunk of the audience. But these are usually tiny little improvements whereas that time should be spent improving your instincts at those 3 things

- finding inherently interesting topic
- making or paying for a thumbnail that makes it even more interesting
- enjoyable, likeable presentation (this is one you and nobody else can really do it for you)

There is a reason MrBeast summed up all of his hours of podcasts and years of experience into "just make better videos"

Didn't get views? Video wasn't good enough

The best videos are on a topic people already care about (whether they personally know it yet or not), a pretty picture that makes it more interesting, and a good enjoyable friend to share it to them

To repeat:
- idea people are already interested in
- pretty picture that makes it even more interesting
- an enjoyable person to present it to them confidently

No I don't have an acronym or some fancy graph or picture that works well on Twitter engagement, that's overcomplicating it

Do those things, you'll get more views immediately

So... Bro, go hang from a bar

Whew this was a long one but hopefully a banger. To some, the puzzle pieces just clicked for years to come. To others, this may make no sense but hopefully at some point it will.

[Lemon @Lemonitup]

@vxunderground Let me Rule was my favorite because you could play ragtime music via the motherboard speaker.

[Lemon @Lemonitup]

@RachelTobac I was worried until I remembered I didn’t play Tennis. Still threw a few decks of cards into my bag for DEFCON!

[Lemon @Lemonitup]

@I_Am_Jakoby @zeifan I can’t believe this is just now taking off in popularity. I got this from a blog years and used it on pentest for years before making a video on it. https://t.co/DtwP9xDyEk

[Lemon @Lemonitup]

@awakecoding Snaplabs. Build out a default testing environment then snapshot it for easy rebuilds.

[Lemon @Lemonitup]

@plaverty9 @techspence @jsark983 Digital signage hacking. Had a rough few years when they removed cd drives from computers and I didn’t have a kinetic outlet for demonstrating access.

[Lemon @Lemonitup]

@deadvolvo I was in the same place when I started seeing top 1% THM on every LinkedIn headline. I found more fulfillment in building POCs like a malicious charging station or hacking hardware I bought of eBay. Those things also stand out on a resume more than CTFs.

[DistrictCon @DistrictCon]

❗ Most Impactful System ❗
WINNER: @Lemonitup: bypassing authentication prompts on an Intelight X-1 traffic control system 🚦

RUNNER UP: SeongJoon Cho & Dongheyon Oh, @LabsSsd: exposing security flaws in the D-Link DSR-250 VPN Router 🌐

[Lemon @Lemonitup]

@Uber your Safety team stopped responding to me about my driver swerving between lanes on the highway because he was trying to drive and play clash of clans. Any update?

[DistrictCon @DistrictCon]

@seeinglogic @InterruptLabs @vigilant_labs @Bugcrowd @ex0dus_0x @Ninja3047_ @annatea16 @maxpl0it @LabsSsd 1️⃣2️��� Intelight X-1 – Grand Central Hack The Planet 🚦🌎
@RedThreat successfully demo’d how to bypass the authentication prompt on an Intelight X-1 traffic control system - leading to full access to make any changes you want on the controller.

[Lemon @Lemonitup]

@techspence We have a default methodology for every assessment type of what to test and even in the event of a no findings test we still have a solid report with work to show. After that, engineers are free to hunt zero days or waste a whole day on a buffer overflow.

[Lemon @Lemonitup]

@LucasBotkin 4:20 fuel up with some green before hitting the Jiu Jitsu gym.

[Lemon @Lemonitup]

@HackingLZ With enough head gasket shims this might work but the lower compression negates any advantage gained from the longer stroke.