@Lemonitup

Principal Security Engineer @ Red Threat https://xitter.cf/t.co/qGxQnY0KNq

 Oklahoma, USA
redthreatsec.com
Joined November 2014
  • Tweets317
  • Following294
  • Followers856
48Media
Doom on a traffic light controller.
2
1
89
❗ Most Impactful System ❗ WINNER: @Lemonitup: bypassing authentication prompts on an Intelight X-1 traffic control system 🚦 RUNNER UP: SeongJoon Cho & Dongheyon Oh, @LabsSsd: exposing security flaws in the D-Link DSR-250 VPN Router 🌐
1
2
4
413
Replying to @DistrictCon @seeinglogic @InterruptLabs @vigilant_labs @Bugcrowd @ex0dus_0x @Ninja3047_ @annatea16 @maxpl0it @LabsSsd
1️⃣2️⃣ Intelight X-1 – Grand Central Hack The Planet 🚦🌎 @RedThreat successfully demo’d how to bypass the authentication prompt on an Intelight X-1 traffic control system - leading to full access to make any changes you want on the controller.
1
4
5
1,412
Friendly reminder: You can actually buy industrial hardware like crane controllers online and test them for security vulnerabilities. This version allows you to capture and replay button presses.
1
1
8
516
Help me, Obi-Wan Kenobi. I'm afraid Princess Leia has been turned to the Dark Side.
2
220
The worst part about Responsible Disclosure is the “Responsible” part. I want to share my findings now, but I guess I’ll wait until the patch drops! COMPLETELY unrelated, the top song for the day is “It’s getting hot in here”
4
153
Dropping 0 days in elevators
1
180
Are you ready to play a game, @defcon? Our 1st Clue Hunt clue is ready for you. Winners get the challenge coin that screws into the custom badge completing a circuit and lighting it up. @evantobac and I can’t wait to meet the winners! The game starts now.
Rachel Tobac
@RachelTobac9 Aug 2024
Our @socialproofsec @defcon Clue Hunt is starting tomorrow & it’s bigger than ever before! Our 1st clue & Keymasters will be at @sec_defcon starting Friday (you get the 1st clue in line) Teaser of prizes below — our challenge coin completes a circuit on our badge, lighting it up!
2
12
2
60
57,524
In this episode of The Phillip Wylie Show, @PhillipWylie's guest is Andrew Lemon (@Lemonitup). youtu.be/2oVTO_yItJA
1
3
4
640
My research on Traffic Control Systems is live!
Lorenzo Franceschi-Bicchierai@lorenzofb18 Jul 2024
NEW: A researcher found traffic light controllers on the internet with no authentication at all, potentially allowing hackers to create traffic jams. Researcher says that company who make the devices threatened legal action instead of working to fix. techcrunch.com/2024/07/18/ha…

Hackers could create traffic jams thanks to flaw in traffic light controller, researcher says |...

A security researcher found that some traffic lights controllers are exposed on the internet and could be manipulated.

techcrunch.com
4
5
24
1,931
Does anyone have a big list of all the security conferences, maybe a website or twitter account?
1
3
364
23 lever nuts later and I have a working controller.
6
340
Got a new controller in the mail today now I just have to figure out how to power it up.
1
5
281
If you thought the response from the vendor was lame, wait until you see how easy the “exploit” is.
3
3
86
4,981
I received my first cease and desist for responsibly disclosing a critical vulnerability that gives a remote unauthenticated attacker full access to modify a traffic controller and change stoplights. Does this make me a Security Researcher now?
209
305
85
5,030
668,924
First time I've seen a threat actor leveraging keyemu in the wild. Can't wait to try it on a pentest. Turns out the technique was released years ago in this github repo: github.com/panhavad/undetect…
2
7
1,836
These Spotify made for you playlist are getting pretty good!
1
1
3
1,378
Anyone know the SLA time on a P1 for @Fortinet I’ve called 4 times this morning and keep getting told they’ll call back later.
2
1,029
I probably should have checked the weather forecast before driving 4 hours.
1
4
950
Tired of just grabbing a screenshot after compromising a crestron unit on a pentest? Introducing party mode, a surefire way to spice up your debrief meeting. Finish your presentation. Hit the button and moonwalk out the door. gist.github.com/LemonSec/b62…
2
5
764
Load more