[/blogfolio]

The DTCs were U011D-87 U0418-86 U0102-00 U0233-00 U0146-00

    Modern vehicles are highly dependent on electronic control modules (ECMs) and body control modules (BCMs) to regulate and manage various systems, from engine performance to infotainment. When a module starts acting up, the symptoms can be erratic and misleading, making the diagnostic process a challenge.

    While diagnosing a 2020 Ford Explorer, initial testing focused on verifying the integrity of the ground connections. Using a Digital Volt Ohm Meter (DVOM), a continuity test confirmed that the grounds checked out as functional. However, this does not entirely rule out the possibility of an alternative circuit path occurring internally when the module is powered.

    This type of issue can be difficult to diagnose because electrical circuits behave differently under load compared to a static continuity check. A wire or connection might show continuity but still have excessive resistance or an unintended path when current flows. These intermittent or alternative pathways can cause modules to behave unpredictably. Given the complexity of tracking down such an issue, the decision was made to replace the module. The plan: replace and retest (R&R). If Diagnostic Trouble Codes (DTCs) persist after replacement, further investigation will focus on the wiring itself.

    Just as a security operations team might chase down erratic network behavior caused by a faulty switch or misconfigured device, automotive diagnostics requires a methodical approach to troubleshooting erroneous data. Computer systems—whether in a vehicle or in a security infrastructure—operate based on the basic principle that they will produce logical outputs when provided with accurate and locical inputs. However, when an input is corrupted or an internal process deviates from expected behavior (out of range), the entire system can exhibit unpredictable results.

    As vehicles become more connected and reliant on complex networks, diagnosing and resolving electrical issues will increasingly resemble the troubleshooting processes used in IT and cybersecurity. Whether it’s a network switch disrupting an enterprise or a faulty car module affecting driveability, the principles of diagnostics remain the same: methodical testing, elimination, and verification.

  • Feb, 2025

Goodbye public sector. It has been real

    Well. I can finally tell y'all what I did for work these last few years during 9ish-5ish. I was protecting the State of Illinois from cybersecurity threats through my efforts as a Cybersecurity Operations Analyst at The Office of the Illinois Attorney General Information Security Burearu (ISB).

    How it started

    ford-explorer-diag

    How we ended

    ford-explorer-diag

    My love and support goes to those protecting our country on the cyber frontlines. It has been real. I'll continue to grow.

  • Feb, 2025

Beware the Cybersecurity grifter

    Earlier today I read a LinkedIn post regarding an individual seeking to "break" into cybersecurity.

    First, there is no breaking into cyber. You either have a "cybersecurity mindset" or don't. You probably have been doing cyber all along and simply need to shift your perspective.

    Second, IF it looks cookie-cutter, asks for money, gives off urgency vibes, and/or tells you that you can do years of work in months... then it might be a scam. Even within the realm of cybersecurity people take advantage of others. Surprising right?! The grift is real and constantly appears across social media.


    Cybersecurity Grifter (noun)

    Plural: Cybersecurity Grifters

    A cybersecurity grifter is an individual or entity that falsely claims expertise in cybersecurity to exploit others for financial gain, professional recognition, or influence. These individuals often lack the requisite technical knowledge, certifications, or real-world experience but present themselves as industry experts through persuasive marketing, exaggerated credentials, or fear-based tactics.


    TLDRv1.0; DYOR (Do Your Own Research) and make sure the program you are commiting both time and money to is legit.

  • Feb, 2025

New Chapters

    [I]Decided to put a good amount of work into getting the lab in "lab" shape and rebuilding my Windows Domain lab. I have about a week to git-er-dun.

    Keep the questions coming. I'm open to free resume review and cyber career advice for new and transitioning professionals. Also, it's the year 2025, and I need to make a VERY SERIOUS effort to bring more diverse talent into this cybersecurity space. Stay tuned for FREE time and financial support opportunities.


    Car diagnosis randomness .::. I need to look further into the 'awd' module on my Explorer (L1MZ7P238A). Based on the DTCs and scantool data I pulled, I believe there exists an intermittent loss of communication. The DTCs were U011D-87 U0418-86 U0102-00 U0233-00 U0146-00. Attempting to clear codes works and codes return moments later. Research shows this failure is consistent with a loss of ground at the module itself (p46 blk/gry). The module is located underneath the driver side seat. I'll look into this ground and advise.

    ford-explorer-diag

    ford-explorer-diag

    ford-explorer-diag

  • Feb, 2025

Notes: Event ID stuff

    Event ID Category Description
    1102 Log Clearing Security log was cleared (possible tampering).
    4624 Logon Successful logon (tracks user activity).
    4625 Failed Logon Failed login attempt (brute force detection).
    4634 Logoff User logoff or session termination.
    4648 Explicit Credentials Logon attempt using explicit credentials (potential lateral movement).
    4672 Admin Logon Special privileges assigned at logon (privileged access).
    4688 Process Creation New process was created (malware execution tracking).
    4689 Process Termination A process was terminated.
    4697 Service Installation New service was installed (persistence mechanism).
    4698 Scheduled Task Created A new scheduled task was created (possible persistence).
    7034 Service Crash Service terminated unexpectedly (could indicate attack or crash exploit).
    4703 Privilege Use Privilege escalation detected.
    4719 Audit Policy Change Audit policy was changed (possible logging evasion).
    4720 User Account Created New user account created (potential unauthorized access).
    4722 User Enabled Previously disabled user account was enabled.
    4723 Password Change User attempted to change their password.
    4724 Admin Password Reset Administrator reset a user password (possible account takeover).
    4732 Group Membership Change User added to a privileged group (e.g., Administrators, Domain Admins).
    4738 User Account Change User account properties were modified.
    4740 Account Lockout Too many failed login attempts triggered account lockout.
    4768 Kerberos TGT Request Kerberos Ticket Granting Ticket (TGT) requested (used in pass-the-ticket attacks).
    4769 Kerberos Service Ticket Kerberos service ticket requested (potential lateral movement).
    4771 Kerberos Pre-auth Failure Kerberos pre-authentication failed (brute force or replay attack attempt).
    4776 NTLM Authentication NTLM authentication attempt (tracks NTLM hash usage).
    5140 Network Share Access Network share was accessed (data exfiltration risk).
    5145 File Share Access File share object accessed (data theft detection).
    5156 Firewall Connection Allowed Windows Firewall allowed a network connection.
    5158 WFP Filter Policy Change Windows Filtering Platform rule was modified (network evasion tactic).
    5379 Certificate Authentication Certificate authentication attempted (used in adversary-in-the-middle attacks).
    6416 Driver Loaded A driver was loaded (could indicate rootkit installation).
    7045 Service Installation A new service was installed (common persistence technique).
    8001 Windows Defender Detection Malware detected by Windows Defender.
    8050 Windows Defender Engine Failure Windows Defender engine failed to update (potential security misconfiguration).
    10100 Sysmon Process Creation Sysmon logged a new process creation (useful for process tracking).
    10101 Sysmon Network Connection Sysmon detected an outbound network connection.
  • Feb, 2025