I find it that i'm more productive with a 'battle station' that is free from any type of clutter or disorganization. The older I get the less stuff I have on my desk. I wonder what the psychology behind that is. Once Spring comes around I usually incorporate some greenery.
Chances are pretty good that i'll be at Burbsec this Thursday, 3-27-25, if you see something [me] - say something.
Modern vehicles are highly dependent on electronic control modules (ECMs) and body control modules (BCMs) to regulate and manage various systems, from engine performance to infotainment. When a module starts acting up, the symptoms can be erratic and misleading, making the diagnostic process a challenge.
While diagnosing a 2020 Ford Explorer, initial testing focused on verifying the integrity of the ground connections. Using a Digital Volt Ohm Meter (DVOM), a continuity test confirmed that the grounds checked out as functional. However, this does not entirely rule out the possibility of an alternative circuit path occurring internally when the module is powered.
This type of issue can be difficult to diagnose because electrical circuits behave differently under load compared to a static continuity check. A wire or connection might show continuity but still have excessive resistance or an unintended path when current flows. These intermittent or alternative pathways can cause modules to behave unpredictably. Given the complexity of tracking down such an issue, the decision was made to replace the module. The plan: replace and retest (R&R). If Diagnostic Trouble Codes (DTCs) persist after replacement, further investigation will focus on the wiring itself.
Just as a security operations team might chase down erratic network behavior caused by a faulty switch or misconfigured device, automotive diagnostics requires a methodical approach to troubleshooting erroneous data. Computer systems—whether in a vehicle or in a security infrastructure—operate based on the basic principle that they will produce logical outputs when provided with accurate and locical inputs. However, when an input is corrupted or an internal process deviates from expected behavior (out of range), the entire system can exhibit unpredictable results.
As vehicles become more connected and reliant on complex networks, diagnosing and resolving electrical issues will increasingly resemble the troubleshooting processes used in IT and cybersecurity. Whether it’s a network switch disrupting an enterprise or a faulty car module affecting driveability, the principles of diagnostics remain the same: methodical testing, elimination, and verification.
Well. I can finally tell y'all what I did for work these last few years during 9ish-5ish. I was protecting the State of Illinois from cybersecurity threats through my efforts as a Cybersecurity Operations Analyst at The Office of the Illinois Attorney General Information Security Burearu (ISB).
How it started
How we ended
My love and support goes to those protecting our country on the cyber frontlines. It has been real. I'll continue to grow.
Earlier today I read a LinkedIn post regarding an individual seeking to "break" into cybersecurity.
First, there is no breaking into cyber. You either have a "cybersecurity mindset" or don't. You probably have been doing cyber all along and simply need to shift your perspective.
Second, IF it looks cookie-cutter, asks for money, gives off urgency vibes, and/or tells you that you can do years of work in months... then it might be a scam. Even within the realm of cybersecurity people take advantage of others. Surprising right?! The grift is real and constantly appears across social media.
Cybersecurity Grifter (noun)
Plural: Cybersecurity Grifters
A cybersecurity grifter is an individual or entity that falsely claims expertise in cybersecurity to exploit others for financial gain, professional recognition, or influence. These individuals often lack the requisite technical knowledge, certifications, or real-world experience but present themselves as industry experts through persuasive marketing, exaggerated credentials, or fear-based tactics.
[I]Decided to put a good amount of work into getting the lab in "lab" shape and rebuilding my Windows Domain lab. I have about a week to git-er-dun.
Keep the questions coming. I'm open to free resume review and cyber career advice for new and transitioning professionals. Also, it's the year 2025, and I need to make a VERY SERIOUS effort to bring more diverse talent into this cybersecurity space. Stay tuned for FREE time and financial support opportunities.
Car diagnosis randomness .::. I need to look further into the 'awd' module on my Explorer (L1MZ7P238A). Based on the DTCs and scantool data I pulled, I believe there exists an intermittent loss of communication. The DTCs were U011D-87 U0418-86 U0102-00 U0233-00 U0146-00. Attempting to clear codes works and codes return moments later. Research shows this failure is consistent with a loss of ground at the module itself (p46 blk/gry). The module is located underneath the driver side seat. I'll look into this ground and advise.
Event ID | Category | Description |
---|---|---|
1102 | Log Clearing | Security log was cleared (possible tampering). |
4624 | Logon | Successful logon (tracks user activity). |
4625 | Failed Logon | Failed login attempt (brute force detection). |
4634 | Logoff | User logoff or session termination. |
4648 | Explicit Credentials | Logon attempt using explicit credentials (potential lateral movement). |
4672 | Admin Logon | Special privileges assigned at logon (privileged access). |
4688 | Process Creation | New process was created (malware execution tracking). |
4689 | Process Termination | A process was terminated. |
4697 | Service Installation | New service was installed (persistence mechanism). |
4698 | Scheduled Task Created | A new scheduled task was created (possible persistence). |
7034 | Service Crash | Service terminated unexpectedly (could indicate attack or crash exploit). |
4703 | Privilege Use | Privilege escalation detected. |
4719 | Audit Policy Change | Audit policy was changed (possible logging evasion). |
4720 | User Account Created | New user account created (potential unauthorized access). |
4722 | User Enabled | Previously disabled user account was enabled. |
4723 | Password Change | User attempted to change their password. |
4724 | Admin Password Reset | Administrator reset a user password (possible account takeover). |
4732 | Group Membership Change | User added to a privileged group (e.g., Administrators, Domain Admins). |
4738 | User Account Change | User account properties were modified. |
4740 | Account Lockout | Too many failed login attempts triggered account lockout. |
4768 | Kerberos TGT Request | Kerberos Ticket Granting Ticket (TGT) requested (used in pass-the-ticket attacks). |
4769 | Kerberos Service Ticket | Kerberos service ticket requested (potential lateral movement). |
4771 | Kerberos Pre-auth Failure | Kerberos pre-authentication failed (brute force or replay attack attempt). |
4776 | NTLM Authentication | NTLM authentication attempt (tracks NTLM hash usage). |
5140 | Network Share Access | Network share was accessed (data exfiltration risk). |
5145 | File Share Access | File share object accessed (data theft detection). |
5156 | Firewall Connection Allowed | Windows Firewall allowed a network connection. |
5158 | WFP Filter Policy Change | Windows Filtering Platform rule was modified (network evasion tactic). |
5379 | Certificate Authentication | Certificate authentication attempted (used in adversary-in-the-middle attacks). |
6416 | Driver Loaded | A driver was loaded (could indicate rootkit installation). |
7045 | Service Installation | A new service was installed (common persistence technique). |
8001 | Windows Defender Detection | Malware detected by Windows Defender. |
8050 | Windows Defender Engine Failure | Windows Defender engine failed to update (potential security misconfiguration). |
10100 | Sysmon Process Creation | Sysmon logged a new process creation (useful for process tracking). |
10101 | Sysmon Network Connection | Sysmon detected an outbound network connection. |