mle
@whyli.me
Trying to leave things better than I found them, including the Internet • runner • security research @ Censys 🧡 she/her • @mle@infosec.exchange
Pinned
I’m Emily, and I study ✨weird things on the Internet. Mostly things that shouldn’t be, but are—either through malicious intent or misconfig.
I love botnets and malicious email, but have recently focused on Internet-connected industrial control systems.
Excited to see new + familiar faces here!
I love botnets and malicious email, but have recently focused on Internet-connected industrial control systems.
Excited to see new + familiar faces here!
Reposted by mle
Censys has spotted a phishing campaign targeting crypto-wallet owners that misunderstood how the robots.txt file works and thought that by adding the phishing pages to the file, security scanners would not be able to see and detect them.
censys.com/blog/disallo...
censys.com/blog/disallo...
September 30, 2025 at 10:43 AM
Censys has spotted a phishing campaign targeting crypto-wallet owners that misunderstood how the robots.txt file works and thought that by adding the phishing pages to the file, security scanners would not be able to see and detect them.
censys.com/blog/disallo...
censys.com/blog/disallo...
Appreciate @carolinenihill.bsky.social taking the time to chat with me and Mark about what he best described as, "a once-in-a-lifetime cool find." 🐉
Always more work to do around securing critical infrastructure, but little by little, we can keep chipping away.
www.itbrew.com/stories/2025...
Always more work to do around securing critical infrastructure, but little by little, we can keep chipping away.
www.itbrew.com/stories/2025...
A cybersecurity firm uncovered hundreds of exposed national water facilities
Software company Censys found 400 web-based HMIs for US water facilities exposed online.
www.itbrew.com
June 12, 2025 at 2:06 PM
Appreciate @carolinenihill.bsky.social taking the time to chat with me and Mark about what he best described as, "a once-in-a-lifetime cool find." 🐉
Always more work to do around securing critical infrastructure, but little by little, we can keep chipping away.
www.itbrew.com/stories/2025...
Always more work to do around securing critical infrastructure, but little by little, we can keep chipping away.
www.itbrew.com/stories/2025...
Great explainer about why tracking "Salt Typhoon" feels like trying to find a needle in a haystack, when there may or may not even be needles in said haystack
Thoughts concerning "what (really) is 'Salt Typhoon'" and the danger of "TA A, also known as TA B" statements without detail, explaination, or background:
pylos.co/2025/06/11/a...
pylos.co/2025/06/11/a...
Attribution With A Pinch of Salt (Typhoon)
Salt Typhoon first emerged in the public consciousness with media reporting in late 2024. The previously unknown (or overlooked) threat actor was quickly linked to widespread intrusions in major US…
pylos.co
June 11, 2025 at 8:34 PM
Great explainer about why tracking "Salt Typhoon" feels like trying to find a needle in a haystack, when there may or may not even be needles in said haystack
Reposted by mle
It is 100% carrying water for the opposition to participate in this collective delusion that Dems for some reason need to answer for every teen who throws a rock rather than hold the Trump admin accountable for intentionally creating chaos and breaking the law to stoke violence.
They are in charge.
They are in charge.
June 11, 2025 at 12:44 AM
It is 100% carrying water for the opposition to participate in this collective delusion that Dems for some reason need to answer for every teen who throws a rock rather than hold the Trump admin accountable for intentionally creating chaos and breaking the law to stoke violence.
They are in charge.
They are in charge.
Cool highlight of the water HMI exposure research we dropped last week in @zackwhittaker.com's This Week In Security newsletter. In a world of gloomy stories (security and otherwise), it's nice to have research make it to The Happy Corner!
June 9, 2025 at 1:43 PM
Cool highlight of the water HMI exposure research we dropped last week in @zackwhittaker.com's This Week In Security newsletter. In a world of gloomy stories (security and otherwise), it's nice to have research make it to The Happy Corner!
This remediation effort is incredible, and I still almost can't believe it. After initial discovery + notification in Oct, as of our most recent scan in May, we see fewer than 6% of these systems still in an insecure state.
I hope other agencies and vendors take note–there's much to learn here.
I hope other agencies and vendors take note–there's much to learn here.
In October 2024, Censys researchers discovered ~400 U.S. water facility web-based HMIs exposed online. Within a month of sharing data with the EPA and the vendor, 58% of systems were protected. Read more here: censys.com/blog/turning...
Turning Off the (Information) Flow: Working With the EPA to Secure Hundreds of Exposed Water HMIs
censys.com
June 6, 2025 at 11:54 AM
This remediation effort is incredible, and I still almost can't believe it. After initial discovery + notification in Oct, as of our most recent scan in May, we see fewer than 6% of these systems still in an insecure state.
I hope other agencies and vendors take note–there's much to learn here.
I hope other agencies and vendors take note–there's much to learn here.
Reposted by mle
Trend Micro recently uncovered a campaign abusing TikTok to distribute malware via AI-generated videos, tricking users into installing infostealers. Using IOCs provided by Trend Micro, we found more related infrastructure, including a newer bulletproof service provider: censys.com/blog/tiktok-...
TikTok and Malware
censys.com
May 27, 2025 at 6:18 PM
Trend Micro recently uncovered a campaign abusing TikTok to distribute malware via AI-generated videos, tricking users into installing infostealers. Using IOCs provided by Trend Micro, we found more related infrastructure, including a newer bulletproof service provider: censys.com/blog/tiktok-...
Reposted by mle
Check out our new @citizenlab.ca report today on Paragon! We got a tip from a collaborator, used it to map out Paragon's infrastructure, and shared with Meta. WhatsApp was able to capture & burn a zero-click, and sent out notifications to targets citizenlab.ca/2025/03/a-fi...
Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations - The Citizen Lab
In our first investigation into Israel-based spyware company, Paragon Solutions, we begin to untangle multiple threads connected to the proliferation of Paragon's mercenary spyware operations across t...
citizenlab.ca
March 19, 2025 at 6:08 PM
Check out our new @citizenlab.ca report today on Paragon! We got a tip from a collaborator, used it to map out Paragon's infrastructure, and shared with Meta. WhatsApp was able to capture & burn a zero-click, and sent out notifications to targets citizenlab.ca/2025/03/a-fi...
This from @semi-rad.com was exactly what I needed to read when it hit my inbox this morning so sharing it in case it helps you, too.
semi-rad.com/2025/02/remi...
semi-rad.com/2025/02/remi...
Reminder To Touch Grass – Semi-Rad.com
semi-rad.com
February 21, 2025 at 1:09 PM
This from @semi-rad.com was exactly what I needed to read when it hit my inbox this morning so sharing it in case it helps you, too.
semi-rad.com/2025/02/remi...
semi-rad.com/2025/02/remi...
apparently I've been at Censys for 3 years today.
...how has it only been 3 years? I feel like I've lived entire lifetimes in the past 3 years but also I just had my first day and blinked and now I'm here.
...how has it only been 3 years? I feel like I've lived entire lifetimes in the past 3 years but also I just had my first day and blinked and now I'm here.
January 10, 2025 at 3:53 PM
apparently I've been at Censys for 3 years today.
...how has it only been 3 years? I feel like I've lived entire lifetimes in the past 3 years but also I just had my first day and blinked and now I'm here.
...how has it only been 3 years? I feel like I've lived entire lifetimes in the past 3 years but also I just had my first day and blinked and now I'm here.
Reposted by mle
Waymo is peak American innovation. With way less money they could have built a reliable public transport network, but instead someone was like "what if we could find a way for empty vehicles to contribute to traffic too? There's no reason we can't have more cars on the road than there are drivers"
December 30, 2024 at 10:15 PM
Waymo is peak American innovation. With way less money they could have built a reliable public transport network, but instead someone was like "what if we could find a way for empty vehicles to contribute to traffic too? There's no reason we can't have more cars on the road than there are drivers"
Listening to a running podcast and after a good discussion of how shorter distance speed translates to ultras, we’re talking about NotebookLM. I hate it here.
December 29, 2024 at 1:51 PM
Listening to a running podcast and after a good discussion of how shorter distance speed translates to ultras, we’re talking about NotebookLM. I hate it here.
This was a really strange year for me and #running. For the first quarter of 2024, I had no idea if I could even do it anymore. I wrote about the emotional roller coaster here:
whyli.me/blog/2024-ye...
#ultrarunning
whyli.me/blog/2024-ye...
#ultrarunning
The year of the rebuild
For better or worse, I’ll remember 2024 as the year of the rebuild.
Following an exhilarating distance PR of 57 miles at a 12 hour looped course race in fall 2023, I set my alarm for 3am ET on New Yea...
whyli.me
December 26, 2024 at 4:43 PM
This was a really strange year for me and #running. For the first quarter of 2024, I had no idea if I could even do it anymore. I wrote about the emotional roller coaster here:
whyli.me/blog/2024-ye...
#ultrarunning
whyli.me/blog/2024-ye...
#ultrarunning
Reposted by mle
Yesterday I combined my love of #running + #coffee via a chill, social 13.1mi tour of 3 different Perc Coffee locations around ATL. Had a different shot at each location (miles 0, 5, and 9) and chased the finish with an iced coffee.
And yes, I slept just fine if you’re wondering 😆
And yes, I slept just fine if you’re wondering 😆
December 16, 2024 at 6:59 PM
As a self-proclaimed "data person," this hit hard. Domain expertise is not just helpful, but critical to climbing to the highest levels of an analytics or data career.
Also some excellent thoughts about being "very good" vs "on another level" in this post.
benn.substack.com/p/is-this-a-...
Also some excellent thoughts about being "very good" vs "on another level" in this post.
benn.substack.com/p/is-this-a-...
Is this a career?
The trouble with “working in data.”
benn.substack.com
December 16, 2024 at 4:53 PM
As a self-proclaimed "data person," this hit hard. Domain expertise is not just helpful, but critical to climbing to the highest levels of an analytics or data career.
Also some excellent thoughts about being "very good" vs "on another level" in this post.
benn.substack.com/p/is-this-a-...
Also some excellent thoughts about being "very good" vs "on another level" in this post.
benn.substack.com/p/is-this-a-...
CISA + EPA just released guidance for mitigating Internet-exposed HMIs and much is what you might expect: Remove from Internet if possible, use non-default pw, segment network, etc.
But I am perplexed to see "geofencing" recommended as a mitigation strategy in 2024.
www.cisa.gov/sites/defaul...
But I am perplexed to see "geofencing" recommended as a mitigation strategy in 2024.
www.cisa.gov/sites/defaul...
www.cisa.gov
December 13, 2024 at 6:55 PM
CISA + EPA just released guidance for mitigating Internet-exposed HMIs and much is what you might expect: Remove from Internet if possible, use non-default pw, segment network, etc.
But I am perplexed to see "geofencing" recommended as a mitigation strategy in 2024.
www.cisa.gov/sites/defaul...
But I am perplexed to see "geofencing" recommended as a mitigation strategy in 2024.
www.cisa.gov/sites/defaul...
Reposted by mle
one of my reporting guidelines is "if you can't be first, be more accurate"
December 11, 2024 at 9:41 PM
one of my reporting guidelines is "if you can't be first, be more accurate"
"Women just aren't really that interested in tech, that's why they leave the industry." 🫥
December 6, 2024 at 5:38 PM
"Women just aren't really that interested in tech, that's why they leave the industry." 🫥
Reposted by mle
We released Censeye today, an open source CLI tool that makes it dramatically easier to pivot and find related assets when threat hunting on Censys instead of manually checking for potential identifying characteristics like an SSH host key. github.com/Censys-Resea...
November 27, 2024 at 5:05 PM
We released Censeye today, an open source CLI tool that makes it dramatically easier to pivot and find related assets when threat hunting on Censys instead of manually checking for potential identifying characteristics like an SSH host key. github.com/Censys-Resea...
Reposted by mle
This is a story a lot of reporters have been chasing:
Starting in 2015, a massive cyberespionage campaign targeted some of America's most prominent environmentalists.
Now, we can reveal that the FBI has been probing whether a longtime Exxon lobbyist was involved.
www.reuters.com/business/ene...
Starting in 2015, a massive cyberespionage campaign targeted some of America's most prominent environmentalists.
Now, we can reveal that the FBI has been probing whether a longtime Exxon lobbyist was involved.
www.reuters.com/business/ene...
Exclusive: Exxon lobbyist investigated over hack-and-leak of environmentalist emails, sources say
The FBI has been investigating a longtime Exxon Mobil consultant over the contractor's alleged role in a hack-and-leak operation that targeted hundreds of the oil company’s biggest critics, according to three people familiar with the matter.
www.reuters.com
November 27, 2024 at 5:34 PM
This is a story a lot of reporters have been chasing:
Starting in 2015, a massive cyberespionage campaign targeted some of America's most prominent environmentalists.
Now, we can reveal that the FBI has been probing whether a longtime Exxon lobbyist was involved.
www.reuters.com/business/ene...
Starting in 2015, a massive cyberespionage campaign targeted some of America's most prominent environmentalists.
Now, we can reveal that the FBI has been probing whether a longtime Exxon lobbyist was involved.
www.reuters.com/business/ene...
You can be the most technically excellent researcher or engineer in the world, but if you can't effectively communicate your ideas to people who don't have your skillset, you won't get very far.
According to 220 of you, communication is cybersecurity’s secret sauce. 🎙️ Bridging tech to business, navigating Slack + generational gaps—it’s the skill shaping careers.
From Help Desk to CISO: How Communication Shapes Security Success | GreyNoise Blog
Effective communication is the most undervalued skill in cybersecurity, according to a Storm⚡️Watch podcast poll. Experts share insights on bridging technical complexity with business needs, using emo...
www.greynoise.io
November 27, 2024 at 2:55 PM
You can be the most technically excellent researcher or engineer in the world, but if you can't effectively communicate your ideas to people who don't have your skillset, you won't get very far.