I catch hackers in my free time.

Copenhagen, Denmark
Joined October 2012
2026 #honeypot development loop: Glutton TCP/UDP payloads onto websocket into agent. Agent identifies protocol from port and magic bytes. If known, identify next protocol stage. Agent implements next protocol stage. Deploy patched Glutton. Repeat.
27
In case you missed it, in October, we released version 1.0.0 of the #ICS #honeypot Conpot. More details on what went into the release are in the blog post: honeynet.org/2026/09/20/conp…
1
168
The Honeynet Project Workshop 2024 is a month away! We're looking forward to three days of talks and trainings in 🇩🇰 Copenhagen. 😃 Join our T-Pot 101 session, held by the creators of the leading all-in-one honeypot platform. 🎉 denmark2024.honeynet.org/
10
11
1,585
The Honeynet Project Workshop is approaching fast! Take a look at the updated agenda with the first confirmed talks and trainings denmark2024.honeynet.org/pro… #honeynet2024 #Copenhagen
5
13
2,023
Lukas Rist retweeted
✨finally carved out time to polish a weekend project! meet Galah 🦜: an llm-powered web honeypot using the @OpenAI api. stay tuned for a blog post diving into the 3 months of data collected from a gcp deployment in early 2023. github.com/0x4D31/galah @ProjectHoneynet
3
35
1
124
13,560
Lukas Rist retweeted
My publisher agreed, and now the ePub with the first six chapters of WOHPE is available here: invece.org/wohpe_EN_six_chap… The book so far oddly predicted certain ethical/social issues we are seeing. I hope you'll enjoy it.
9
1
29
7,379
Do those RDP scans ever led to anything? Seems to be propagating as they originate from random IP ranges (tendency for Asia). My #honeypot gets stuck after the first response: ochi.mushmush.org/events/14c…
2
150
We release 1.0 of our low interaction, server-side #honeypot Glutton. Detailed blog post @ProjectHoneynet : honeynet.org/2023/09/23/glut…
6
1
14
2,802
Lukas Rist retweeted
I just got Blink performing twice as fast as Qemu, while reducing Blink's size to 157kb. What makes Blink so tiny and fast is it uses a printf-style DSL for x86/aarch64 JIT code generation. Beta testers wanted. github.com/jart/blink
13
120
5
844
137,239
We just helped @RedBull launch their new global marketing campaign. It's surprisingly honest.
163
1,595
201
6,572
mitmproxy 9.0.1 is out. Our binaries now ship with OpenSSL 3.0.7 (CVE-2022-3602, CVE-2022-3786), everyone should upgrade! 😃
1
12
1
28
Lukas Rist retweeted
New stuff in Starting Up Security... Endpoint Security: Intuition around the Mudge Disclosures magoo.medium.com/endpoint-se…
1
5
2
15
Seeing a sudden increase of Bittorrent protocol connections on port 55107 hitting my Glutton sensor. Seems to be APNIC looking for something. #honeypot #security
Quick blog on how to install #Glutton #honeypot in the cloud. Playing with t-pot is alright, but you miss the little insights that you get by working with one honeypot at a time :) stratosphereips.org/blog/202…
5
30
92
Et Voila! 🎉 After ~2 years in the making, I'm finally releasing it to the public. Pure-Go, general-purpose SSH server built by standing on the shoulders of the giants: @caddyserver, @gliderlabs , and #golang. caffeinatedwonders.com/2022/…
2
31
2
103
Want to work on fuzzing at Intel? We are building a new team! jobs.intel.com/ShowJob/id/33…
16
46
Everybody: I am leaving Reuters after the most productive and satisfying decade of my career. I have been very lucky to work at such a decent, collegial and industrious place with wide reach and no bias. If you have appreciated my work, please read and/or RT this THREAD.
108
306
87
1,365