Mike Gualtieri's posts on cybersecurity, Linux, Open Source Software, and electronics. https://www.mike-gualtieri.com/ Mike Gualtieri 2026-04-11T00:44:17.504Z https://www.mike-gualtieri.com/posts/2022-conference-talks/ 2023-01-06T00:00:00.000Z 2023-01-06T00:00:00.000Z

In 2022 I was honored to present at the SANS Pen Test HackFest Summit. Here is a recording shared of the event.

https://www.mike-gualtieri.com/posts/2021-conference-talks/ 2022-01-04T00:00:00.000Z 2022-01-04T00:00:00.000Z

I was fortunate to have been invited to present at two conferences in 2021! Here are recordings shared online for each event.

https://www.mike-gualtieri.com/posts/purple-team-tactics-simulating-supply-chain-attacks-with-dll-hijacking/ 2021-05-25T00:00:00.000Z 2021-05-25T00:00:00.000Z

This post details a method of creating a realistic synthetic supply chain attack, which can be conducted as part of a Purple Team exercise, using DLL hijacking to inject synthetic malware into an application.

https://www.mike-gualtieri.com/posts/2020-conference-talks/ 2021-05-22T00:00:00.000Z 2021-05-22T00:00:00.000Z

I was fortunate to have been invited to present two conference talks in 2020, and even better each talk was recorded and shared online by the event! Here are the shared recordings.

https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol/ 2020-06-26T00:00:00.000Z 2020-06-26T00:00:00.000Z

Live Off the Land in Windows and intercept NTLMv2 hashes! A new tool NTLMRawUnHide is introduced to extract NTLMv2 hashes from raw packet traces, and we learn more about the NTLMSSP protocol.

https://www.mike-gualtieri.com/posts/red-team-tradecraft-loading-encrypted-c-sharp-assemblies-in-memory/ 2020-01-31T00:00:00.000Z 2020-01-31T00:00:00.000Z

This post explores creating a simple C# dropper example that loads remotely hosted encrypted assemblies in memory.

https://www.mike-gualtieri.com/posts/hooking-linux-libraries-for-post-exploitation-fun/ 2020-01-13T00:00:00.000Z 2020-01-13T00:00:00.000Z

Explore Linux shared library hooking and process injection techniques using LD_PRELOAD to intercept passwords from htpasswd and PHP applications in memory.

https://www.mike-gualtieri.com/posts/finding-a-decade-old-flaw-in-gnu-mailutils/ 2019-11-20T00:00:00.000Z 2019-11-20T00:00:00.000Z

I recently discovered a Linux privilege escalation flaw dating back over 10 years in GNU Mailutils, a popular package self-described as

https://www.mike-gualtieri.com/posts/modifying-empire-to-evade-windows-defender/ 2019-02-26T00:00:00.000Z 2019-02-26T00:00:00.000Z

By tearing into the Empire code base, we can easily modify some key areas and bypass that pesky client-side antivirus.

https://www.mike-gualtieri.com/posts/fax-vulnerability-may-have-lasting-effects-for-small-businesses/ 2018-08-17T00:00:00.000Z 2018-08-17T00:00:00.000Z

Vulnerabilities in the fax protocol may rear it's ugly head for some time, especially for small-to-mid sized businesses; and especially for those that handle sensitive data.

https://www.mike-gualtieri.com/posts/multiple-flaws-uncovered-in-pydio-8/ 2018-07-23T00:00:00.000Z 2018-07-23T00:00:00.000Z

Security research uncovering multiple vulnerabilities in Pydio 8, including XSS, SSRF, and Remote Code Execution flaws. CVE-2018-1999016, CVE-2018-1999017, CVE-2018-1999018.

https://www.mike-gualtieri.com/posts/s3-buckets-now-with-both-leak-and-fill-vulnerability/ 2018-02-23T00:00:00.000Z 2018-02-23T00:00:00.000Z

Earlier this week I had the privilege of providing insight for a Bleeping Computer article about the impending time-bomb that is world-writable Amazon S3 buckets.

https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ 2018-02-06T00:00:00.000Z 2018-02-06T00:00:00.000Z

A method is detailed, dubbed CSS Exfil, which can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector.

https://www.mike-gualtieri.com/posts/model-radio-tower-using-555-timer-and-lego-bricks/ 2017-12-21T00:00:00.000Z 2017-12-21T00:00:00.000Z

Sometimes basic analog circuits are the best choice. This project uses a 555 timer to pulse lights on a model Lego radio antenna.

https://www.mike-gualtieri.com/posts/move-over-s3-open-directory-indexes-continue-to-be-a-problem/ 2017-12-12T00:00:00.000Z 2017-12-12T00:00:00.000Z

Analysis of publicly accessible web server directories containing sensitive data, showing millions of exposed files indexed on Google beyond just S3 bucket misconfigurations.

https://www.mike-gualtieri.com/posts/001-xterm-can-talk-amazon-delivery/ 2017-11-30T00:00:00.000Z 2017-11-30T00:00:00.000Z

A tech-themed cartoon exploring the humorous side of smart home technology and Amazon's delivery ecosystem.

https://www.mike-gualtieri.com/posts/security-researchers-lose-a-favorite-dns-recon-tool-jan-2018/ 2017-11-16T00:00:00.000Z 2017-11-16T00:00:00.000Z

Scammers can now conceal their campaigns by utilizing a wildcard certificate, so the phishing sub-domain does not appear in the Certificate Transparency project.

https://www.mike-gualtieri.com/posts/krack-how-to-protect-yourself-on-a-flawed-network/ 2017-10-18T00:00:00.000Z 2017-10-18T00:00:00.000Z

KRACK underscores an important lesson. You can't trust your network. As soon as a packet leaves your computer or smartphone, assume always that it's being sniffed and manipulated.

https://www.mike-gualtieri.com/posts/ios-credential-phishing-flaw-not-limited-to-malicious-apps/ 2017-10-10T00:00:00.000Z 2017-10-10T00:00:00.000Z

While this isn't necessarily a direct flaw within iOS, the attack vector is subtle and I bet would fool many people.

https://www.mike-gualtieri.com/posts/equifax-sec-and-now-deloitte-organizations-must-employ-offensive-security/ 2017-09-26T00:00:00.000Z 2017-09-26T00:00:00.000Z

Offensive security is a school of thought, where a proactive approach is taken to computer security. While defensive measures are essential, an offensive security approach focuses on penetration testing and thinking like an attacker, with a goal of finding weaknesses in your own organization's systems and software.

https://www.mike-gualtieri.com/posts/equifax-redux-part-one-assume-you-are-already-compromised/ 2017-09-21T00:00:00.000Z 2017-09-21T00:00:00.000Z

I'm not going to speculate why a software package went unpatched.  It should have been patched - and swiftly - but what if the flaw was a so-called 0-day exploit without a patch?  Would Equifax still be held liable for such a massive breach?  The answer should be a resounding yes!

https://www.mike-gualtieri.com/posts/chaining-remote-web-vulnerabilities-to-abuse-lets-encrypt/ 2017-08-31T00:00:00.000Z 2017-08-31T00:00:00.000Z

Recently I started playing around with the ACME validation routine Let's Encrypt uses to verify domain ownership, suspecting that it may be abused to issue an SSL certificate to an attacker.

https://www.mike-gualtieri.com/posts/build-a-raspberry-pi-powered-arcade-machine/ 2014-02-13T00:00:00.000Z 2014-02-13T00:00:00.000Z

Complete guide to building a retro arcade machine powered by Raspberry Pi with MAME, including hardware setup, GPIO controls, and custom software configuration.

https://www.mike-gualtieri.com/posts/arduino-word-clock/ 2013-12-24T00:00:00.000Z 2013-12-24T00:00:00.000Z

Complete tutorial for building an Arduino word clock that displays time as sentences using LEDs, shift registers, and a real-time clock module.

https://www.mike-gualtieri.com/posts/new-website-makerf/ 2013-06-17T00:00:00.000Z 2013-06-17T00:00:00.000Z

If you are interested in radio and hobby electronics be sure to check out my new website makeRF.com!

https://www.mike-gualtieri.com/posts/hacking-my-house-1-5-when-lightning-rings/ 2013-05-22T00:00:00.000Z 2013-05-22T00:00:00.000Z

How I fixed my Arduino doorbell that randomly rang during thunderstorms by adding a simple filter circuit to eliminate electrical noise from lightning and appliances.

https://www.mike-gualtieri.com/posts/hacking-my-house-1-building-a-musical-arduino-doorbell/ 2013-03-27T00:00:00.000Z 2013-03-27T00:00:00.000Z

Building a custom Arduino doorbell that plays music using PWM, featuring circuit schematics, code, and an LM386 amplifier to replace boring ding-dong chimes.

https://www.mike-gualtieri.com/posts/moving-your-landline-to-google-voice/ 2012-06-13T00:00:00.000Z 2012-06-13T00:00:00.000Z

A step-by-step guide to porting your landline phone number to Google Voice using a prepaid cell phone as an intermediary.

https://www.mike-gualtieri.com/posts/in-memoriam-steve-jobs/ 2011-10-05T00:00:00.000Z 2011-10-05T00:00:00.000Z

Remembering Steve Jobs and his legacy of design excellence, including the story of how rounded corners made their way into software.

https://www.mike-gualtieri.com/posts/facebook-facial-recognition-tool-is-good-for-online-privacy/ 2011-06-10T00:00:00.000Z 2011-06-10T00:00:00.000Z

The scary part about Facebook is the part I'm not in control of, my Facebook Friends. Unfortunately, there is little I can do when friends share my personal information or pictures online.

https://www.mike-gualtieri.com/posts/android-could-overtake-windows-in-2016/ 2011-02-03T00:00:00.000Z 2011-02-03T00:00:00.000Z

This model looks a bit more realistic, with total smartphone and PC sales in 2016 looking reasonable. 2016 is also the year where Android could surpass the Windows PC.

https://www.mike-gualtieri.com/posts/the-path-to-ubiquitous-desktop-linux/ 2011-01-12T00:00:00.000Z 2011-01-12T00:00:00.000Z

Envisioning a future where smartphones and tablets running Linux replace traditional desktop computers by interfacing with dumb terminals at work and home.

https://www.mike-gualtieri.com/posts/oh-no-papa-smurf/ 2010-12-17T00:00:00.000Z 2010-12-17T00:00:00.000Z

The problem with devices like the iPad is the same problem with the PC. They aren't designed for children, which can lead to usage issues.

https://www.mike-gualtieri.com/posts/windows-phone-7-terrible-ux/ 2010-10-15T00:00:00.000Z 2010-10-15T00:00:00.000Z

A critical look at Windows Phone 7's poor user experience design, including cut-off text, inefficient screen usage, and excessive swiping requirements.

https://www.mike-gualtieri.com/posts/open-marketplace-is-not-open-source/ 2010-10-06T00:00:00.000Z 2010-10-06T00:00:00.000Z

Clarifying the difference between Android's open marketplace and open source software, and why security concerns about Android stem from closed source apps, not the OS itself.

https://www.mike-gualtieri.com/posts/rockmite-qrp-rig/ 2010-09-15T00:00:00.000Z 2010-09-15T00:00:00.000Z

The Rockmite is a low power (QRP) shortwave transceiver (combination receiver and transmitter) that can send morse code (CW) on a variety of frequencies.

https://www.mike-gualtieri.com/posts/what-the-lag-youtube/ 2010-09-10T00:00:00.000Z 2010-09-10T00:00:00.000Z

Am I the only person in the world who is unsatisfied with the major lag while playing YouTube video's this past week?

https://www.mike-gualtieri.com/posts/browser-focus-on-usability/ 2010-08-18T00:00:00.000Z 2010-08-18T00:00:00.000Z

If browsers standardized on one rendering engine, engineers could pour their innovations into one experience that is fast and renders exactly the same on all screens.

https://www.mike-gualtieri.com/posts/android-iphone-oss-code-review/ 2010-08-11T00:00:00.000Z 2010-08-11T00:00:00.000Z

Android, iPhone, and Open Source Code Review - Summer is the season for security conferences, and one hot topic making news is the (in)security of smartphones.

https://www.mike-gualtieri.com/posts/fvwm/ 2010-08-07T00:00:00.000Z 2010-08-07T00:00:00.000Z

A highly customizable FVWM window manager configuration for Linux, built for power users seeking ultimate desktop configurability.

https://www.mike-gualtieri.com/posts/linux-screenshots/ 2010-08-07T00:00:00.000Z 2010-08-07T00:00:00.000Z

A visual journey through the evolution of Linux desktop environments from KDE in 2001 to modern configurations, showcasing the customization possibilities.

https://www.mike-gualtieri.com/posts/kiddix/ 2010-08-07T00:00:00.000Z 2010-08-07T00:00:00.000Z

A family-friendly Linux-based operating system designed specifically for children, providing a safe, friendly, and fun computing environment.

https://www.mike-gualtieri.com/posts/splitsplat/ 2010-08-07T00:00:00.000Z 2010-08-07T00:00:00.000Z

An iPhone game developed in 2009 featuring a pigeon controlled by accelerometer, created during the iPhone app gold rush era.

https://www.mike-gualtieri.com/posts/welcome-to-my-updated-homepage/ 2010-08-06T00:00:00.000Z 2010-08-06T00:00:00.000Z

Mike Gualtieri: Homepage - Welcome To My Updated Homepage! I finally found some time to redesign my personal homepage, which has been in desperate need of an update.