#164 Mike Grover - How Hacking Tools Are Changing Cyber Warfare

Mike Grover is a security researcher, InfoSec expert, and the creator of the infamous O. MG Cable. He gained prominence in 2019 when he showcased his malicious USB cable prototype at DEF CON, capable of recording keystrokes and executing remote commands. Grover's O. MG Cable looks identical to a regular charging cable, but contains a tiny implant that creates a Wi-Fi hotspot, allowing attackers to access the connected device from up to 300 feet away. Since its inception, Grover has refined the O. MG Cable design, making it indistinguishable from normal USB cables and expanding its capabilities. The latest iteration includes features such as geofencing, self-destruct mechanisms, and support for various connector types including Lightning and USB-C. Grover's work aims to raise awareness about hardware security risks while providing tools for red teams and security researchers to test and improve organizational defenses. Shawn Ryan Show Sponsors: https://ROKA.com | Use Code SRS https://ExpressVPN.com/SRS https://ZipRecruiter.com/SRS https://RocketMoney.com/SRS https://prizepicks.onelink.me/LME0/SRS https://ShawnLikesGold.com | 855-936-GOLD #goldcopartner https://americanfinancing.net/srs NMLS 182334, nmlsconsumeraccess.org. Call 866-781-8900 for details about credit costs and terms. Mike Grover Links: Website - https://o.mg.lol/ X - https://x.com/_MG_ LinkedIn - linkedin.com/in/mgrover Please leave us a review on Apple & Spotify Podcasts. Vigilance Elite/Shawn Ryan Links: Website | Patreon | TikTok | Instagram | Download Learn more about your ad choices. Visit podcastchoices.com/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:01Speaker 00

  This episode is brought to you by Michelob Ultra. Good times mean competitions between you and your friends. Like seeing who can throw some pigskin the farthest or rush the field the fastest. Winner gets an ultra because it's not just a superior light beer. It's also giving fans superior access to their favorite sporting events. Superior is worth playing for. Visit michelobultra.com/superioraccess to enter. Enjoy responsibly. Copyright 2026 Anheuser Busch InBev Michelob Ultra Beer, St. Louis, Missouri.

• 0:30Speaker 01

  College football is back. So Hilton called to me, the superstition concierge, to make your fan rituals a reality. Need a room to match your lucky number? We got you. Want to make sure our team doesn't wash your lucky jersey? Oh, that smells lucky. Hilton's unmatched hospitality can keep up with any superstition. Even a marching band wake up call at 5:55 in 55 seconds. Hit it! When you need a team that will do whatever it takes on game day, it matters where you stay. Hilton, for the stay.

• 1:05Speaker 02

  Mike Grover, welcome to the show, man.

• 1:07Speaker 03

  Thanks. Thanks for having me, dude.

• 1:09Speaker 02

  We just knocked out one of the most fascinating everyday carry pop pocket dumps I've ever seen. And, uh, and the fact that you designed all that hardware is just astounding. It's awesome.

• 1:23Speaker 03

  Thank you.

• 1:23Speaker 02

  So we got connected through mutual friend Bryce Case Jr.

• 1:28Speaker 03

  Yeah.

• 1:29Speaker 02

  And, uh, thank you, Bryce. And, um, man, we've been trying to make this happen for, I think, a year.

• 1:37Speaker 03

  Yeah.

• 1:37Speaker 02

  Over a year.

• 1:38Speaker 03

  Yeah, over a year now.

• 1:39Speaker 02

  So, yeah, because I interviewed, he was our, he was last year's Thanksgiving episode.

• 1:44Speaker 03

  Yep.

• 1:45Speaker 02

  And, uh, we got connected right after he told me about the OMG cable.

• 1:49Speaker 03

  Yeah.

• 1:49Speaker 02

  You developed and, uh, we'll get into that, but...

• 1:54Speaker 02

  Real quick, let me uh, let me, let me kick it off with an intro here.

• 1:58Speaker 03

  Sweet.

• 1:59Speaker 02

  So, Mike Grover, AKA MG. You're a hacker, red teamer, entrepreneur, artist, security researcher, and educator. You work for Fortune 500 companies, conducting red team operations to test and enhance their security. You design and build covert hardware implants that bypass and challenge computer security. You also run a business that manufactures and sells your hardware designs, which are now used by countless companies and governments to strengthen their own security. The most well-known hardware design is the OMG cable, a malicious USB cable. You're also a husband and a father.

• 2:42Speaker 02

  And I'm sure I'm missing a whole slew of stuff, but uh, at least that paints the picture.

• 2:47Speaker 03

  Thanks, man.

• 2:47Speaker 02

  But um, you know, I want to do a life story on you. You know, some of the, some of the things that you have developed, um, and then probably go down some rabbit holes with cybersecurity, maybe, I love knowing what China and Russia are up to, if you have any insight into that. But um, but before we start anything, uh, everybody gets a gift, so.

• 3:14Speaker 03

  Alright.

• 3:20Speaker 03

  Gummies.

• 3:21Speaker 02

  They're John's lead gummy bears. So, made right here in the USA, legal in all 50 states.

• 3:27Speaker 03

  Alright.

• 3:28Speaker 02

  So uh, you know, I know you guys got some fun gummies out there in California, but this is just candy.

• 3:33Speaker 03

  I'm gonna eat some now, man. These are...

• 3:36Speaker 02

  Go right ahead.

• 3:38Speaker 03

  Want some?

• 3:39Speaker 02

  Yeah, I'll take some of those. Thank you.

• 3:45Speaker 03

  I'll see if I can not eat these by the end of the show.

• 3:48Speaker 02

  Good luck.

• 3:54Speaker 03

  Nice. Those are good.

• 3:57Speaker 02

  Not bad, huh?

• 3:58Speaker 03

  Yeah.

• 3:59Speaker 02

  But, um,

• 4:02Speaker 02

  sorry, I'm gonna talk with my mouth full.

• 4:07Speaker 02

  Mike, I got a, so I got a Patreon account. It's a subscription account. It's, um, they were a major, we were just talking about before, you know, right before we kicked this off about starting businesses and how this started in my attic and we're both entrepreneurs and, and, um, so, developed Patreon very early on. Uh, they, they have been the key component to how I've built my business. Um, and a lot of them have been here since the very beginning. So one of the things that I do is I, I give them the opportunity to ask each and every guest a question. And so this is from somebody anonymous. What's the simplest trick hackers use that 99% of people still fall for every day?

• 4:53Speaker 03

  Asking. Just ask them, ask them for access. Uh, granted, you gotta kinda cloak it a little bit, but you pretend to be somebody you're not and, uh, for instance, like, I'm, I'm your IT department. I'm your HR. You call them up, you email them and you say, "I need you to do a thing real quick." And that process will generally have them maybe, uh, entering their password, for instance. Except it's into something you control. And at that point, you've got their password. It's, that is a method that is still heavily used and constantly works.

• 5:34Speaker 02

  No kidding. That actually happened to us here.

• 5:37Speaker 03

  Oh, yeah.

• 5:38Speaker 02

  Yep.

• 5:38Speaker 03

  Yep.

• 5:39Speaker 02

  We had to have Brian Montgomery, uh, jump in and save the day. But, um, yeah, it was, uh, I, we got an email saying,

• 5:49Speaker 02

  We want you to be on this podcast.

• 5:51Speaker 03

  Yep.

• 5:51Speaker 02

  And I thought it was bullshit. Uh, we had a staff member that, that uh, kinda like pushed me to do this and of course, everything was in a rush and um, boom. We saw that, then my guy, they got into our Facebook and almost hacked everything.

• 6:08Speaker 03

  Yep.

• 6:08Speaker 02

  Took it all. And uh, and Ryan was able to uh, jump in and save the day kinda last minute there. So.

• 6:15Speaker 03

  Nice.

• 6:15Speaker 02

  Thank you, Ryan. But uh, what, it, what else? What's another one though?

• 6:25Speaker 03

  I mean, that is, that is like the go-to, right? Like, I mean, you can walk into a building, but why do that when you can just ask from halfway across the world, right?

• 6:34Speaker 02

  Yeah.

• 6:34Speaker 03

  Like, I mean, most, most companies, you'll still be able to walk in and do all that stuff. It's just not worth the risk unless they've got that level of security kind of locked down where it's like, okay, you can ask anybody in the company for their password. They can give it to you, but you can't do anything with it because you know, we've got like two-factor turned on or stuff like that. Different security controls and detections that suddenly requires physical access to, you know, you have to take more risks to do that. And that's, it's a lot more skill, a lot more work to make happen.

• 7:03Speaker 02

  Interesting, interesting. Well, you know, I had a little chat with Bryce uh, before, before he got here today and uh, we were talking and by the way, have you ever seen, have you ever seen that video of him at the Dead Mouse concert? He's, he's up there, he's rapping and falls off the stage. I gotta roll this clip. You've seen this, right?

• 7:25Speaker 03

  I, I believe so, yeah, yeah.

• 7:26Speaker 02

  I gotta roll the clip. It's hilarious.

• 7:38Speaker 02

  He brought something up that wasn't in your outline.

• 7:42Speaker 03

  Oh shit.

• 7:43Speaker 02

  And uh, so, might be a little uncomfortable, but I gotta ask it. And uh, and I think it's a good question because it sets the stage for the entire interview and everything we're gonna, we're gonna talk about. But he says, in case he chickens out.

• 8:00Speaker 02

  Ask Mike about his design being so good that they were copied by the most well-known hacker of all time, Kevin Midnick, also known as Condor. So, I gotta hear about this, man.

• 8:15Speaker 03

  Oh, okay.

• 8:16Speaker 02

  Is this the OMG cable?

• 8:18Speaker 03

  Uh, predecessor, right? So, I had been doing lots of designs of malicious cables, right? And I had some really early proof of concept, just to, just to show it's possible. No wireless connection, really tiny payload capability, you know, a few dozen, maybe a hundred keystrokes, right? Really limits what you can do. It's really slow. I mean, we're not, we're not hitting that thousand keystroke per second thing, or maybe, maybe a dozen. Really slow, right? But it's like, it worked, right? Can't remotely update it, can't do anything, but it worked. I want to show the world, because you know, hacker, you want to share the information and stuff and work with other people. I, I didn't see it as like a product, it was just more like a project, more like art, like, hey, cool,

• 9:01Speaker 03

  look at this thing. And, yeah, he, he reached out, wanted to, uh, kind of collaborate and, you know, have me, you know, build one for him. And I started on that process, but, uh, we didn't, I, I didn't have enough time to complete it with his, his work constraints as well, because he didn't have time and stuff. And eventually what happened, I, I didn't know about it, but he went to, uh, someone else and said, "Make this for me."

• 9:24Speaker 02

  And, um... Oh shit.

• 9:26Speaker 03

  Yeah. It was, it was not, like, I didn't know about it until it came out. And then the thing is, it, it, it wasn't very good. And I was just like, dude, first of all, it was not very good. This sucks. I wish, like, you know, making this a proper product at all. So, I was like, hey, if you, you know, had the resources, like, fucking, I could have used that. Um, because I was just doing this on the side, right? But, we have, um, you know, solved things since then, you know? I think there's certain levels of communication and misunderstandings. So, I don't want to be like, ah, he's, he's the worst, but, you know, uh, lessons learned as well, of like, you know, if, if it's something you can turn into a product, maybe, um... Wait until it's ready, you know, things like that. Um, which is exactly what I did with the OMG cable, right?

• 10:11Speaker 03

  That, that, that's where it's like thousands of times better.

• 10:14Speaker 02

  I mean, is, uh, enraging as I'm sure that was, it's also pretty flattering that, uh,

• 10:19Speaker 03

  Oh, yeah.

• 10:19Speaker 02

  You know, the, is he really like the world's most renowned hacker?

• 10:24Speaker 03

  I mean, well, so RIP, he's no longer around.

• 10:27Speaker 02

  Oh, really?

• 10:28Speaker 03

  Yeah, exactly. But, uh, yeah, the, the way he would be introduced, um, I like, I, oh, but it was always the world's most famous hackers, the, uh, the tagline that was used.

• 10:39Speaker 02

  What made him so famous?

• 10:41Speaker 03

  Uh, so, well, he, uh, God, need a refresher on this, but basically he had, uh, gotten the attention of the FBI and they were hunting him down, uh, for getting into various places. A lot of social engineering tricks and stuff like that. And, uh, kind of a cat and mouse game. There's a movie called Takedown, right? So, good movie, check it out. Um, but he, uh, you know, went to prison then and was pretty unfairly treated. There was a whole Free Kevin movement where, you know, they were doing, I think they put him in like solitary or something because they thought he could like whistle into the phones and like launch ICBMs or some shit like.

• 11:22Speaker 02

  Oh, my God.

• 11:24Speaker 03

  This is like back, back when everybody's like, oh my God, hackers, just evil wizards. It's still like that today, but it was much worse back then. They, they had no idea what was even possible. Um, so, yeah, I, like, he was held for much longer. I don't think, yeah, I, I, I don't want to misspeak here because I don't remember the particulars, but he, uh, was held for a very long time, pretty unfairly. Eventually got out and, uh, then went into infosec as like a profession, uh, using that.

• 11:56Speaker 02

  And then tried to, uh, take your OMG cable.

• 12:00Speaker 03

  I mean, I, I guess, I guess he, he knew, knew it looked good, so.

• 12:04Speaker 02

  Hey.

• 12:04Speaker 03

  He's good at that.

• 12:05Speaker 02

  Hey, you got the, the world's most renowned hacker taking, uh, you know.

• 12:11Speaker 02

  Your stuff, that's uh, that's pretty cool.

• 12:13Speaker 03

  Yeah.

• 12:13Speaker 02

  You know, it sounds like everything worked out today, so.

• 12:16Speaker 03

  Oh yeah, definitely. He, and just for the record, he got a, he had a pretty unfair shake at uh, Life. Ended up, I think he got pancreatic cancer. And he died before his first kid was born, which is just fucking terrible.

• 12:28Speaker 02

  Man.

• 12:29Speaker 03

  Yeah, I've uh, I've since met up uh, with, with his wife and cleared the air, so.

• 12:34Speaker 02

  Good for you.

• 12:34Speaker 03

  We're good.

• 12:35Speaker 02

  Good for you, man. Well, let's get to you.

• 12:38Speaker 03

  Yeah.

• 12:38Speaker 02

  You know, like I said, I want to do a Life story. We gotta get into the OMG Cable stuff and all the other stuff that you're designing, some Red Team stuff. But actually, actually, in your, in your bio, I know what Red Team operations are.

• 12:50Speaker 03

  Yes.

• 12:51Speaker 02

  Red cell operations. But uh, could you explain that to the audience?

• 12:55Speaker 03

  Yeah, definitely. So, there's a lot of, it, it depends where we're talking about red teaming. Cause there's military red teaming, which I would love uh, for you to give me a couple of stories on. Cause I mean, I'm sitting in a room with a guy who probably knows that really well, way more than me, so. It'd be a little ridiculous for me to explain that to you. Um, but red teaming in terms of like corporate cybersecurity is a subset of pen testing. Pen testing is find the holes. Tell us the holes, right? I mean, that's cool, but it doesn't quite test how someone responds. I think there's this like, um, I think it's a Mike Tyson quote, where everybody has a plan till they get punched in the face, right?

• 13:37Speaker 02

  Mm-hmm.

• 13:37Speaker 03

  It's like, okay, well, maybe a little aggressive in context of cybersecurity, but uh, you know, how do you solve that? Like in boxing, you, you train, you get punched in the face, right? And then, well, okay, now it's not going to be new when it happens. So, you might have a plan, but are you going to execute on the plan? Are you gonna like miss some steps? Is motion going to get involved? And also, you know, I can find holes at different layers, but red teaming is going to be repeating exactly the entire chain. It's often called a kill chain, where it's you're connecting all of these different vulnerabilities to go from completely outside to completely to the crown jewels, take them out and succeed. And then you show how you did it after the fact.

• 14:22Speaker 02

  How'd you get into that?

• 14:23Speaker 03

  Uh, good question. So, kind of almost don't even know, but over the course of just life and.

• 14:32Speaker 03

  I started off as just helpdesk IT system admin where you learn a lot of things. And at the time, I didn't think it was very applicable. But like, those are all the systems and the nuances and like, just the weird compromises. You learn like, oh, I don't have enough budget, so I'm going to do it this way. Or you learn about the end users that you're supporting this helpdesk and all the problems they run into and, oh, they're running into like, policy that stops them from working. So they're going to do this. That's going to cause a degradation in security. But it's really common. You know that, having been in helpdesk and system admin. So you start to connect these things together and it becomes this really valuable bucket

• 15:13Speaker 03

  of information for, oh, how would I get into the company using that? And, you know, got really into security for a while. It's just, it's also a piece of that role. Like, you're going to run all the systems for IT. You got to keep them secure too, especially in small companies where you don't have dedicated security. It's like, no, you are the security. So you got to learn it that way, which requires you to think also, how does an attacker do it? You got to defend against that, right? So eventually, I just kind of got bored of doing IT and made the jump into security. Started learning, actually Bryce. So good connection on this as well.

• 15:54Speaker 03

  So I had known Bryce for a long time. And I think it was like 2013, first time I went to DEF CON, Hacker Security Conference, biggest one in the world, in Vegas, every year. And I decided, oh God, what was this? So there's these unrecorded talks they also do in certain areas. He was on stage, I think he was doing something with like Bitcoin at the time. And he had this like, telepresence robot on stage for a guy who was on house arrest. Like, he couldn't come, so he brought a telepresence robot to be like Bryce's partner on the stage. And it was just wild watching this. So I'm in the audience.

• 16:38Speaker 03

  I'm just like, oh yeah, Bryce, you know, buddy cracker. I know, like, I'm going to go see what he's doing. And then, you know, he gives the talk and after it's done, I'm like, hey, yo, what's up? Like, never met you before, but.

• 16:50Speaker 03

  From that point on, we kinda, you know, our relationship grew, got to know him a lot better, but he also DJs, as you know, and he was DJing for a guy called Fuzzy Knop, who, or sorry, flip that around. Fuzzy Knop was DJing for him, because he also MCs and sings songs, right? So he needs someone, you know, to play that. So Fuzzy Knop was DJing for him on a lot of his shows. So I met him, and, well, he is the one who had built out a red team for a new company. Not a new company, new red team for a company, large company, and he ended up pulling me over into that team.

• 17:29Speaker 02

  Oh, cool.

• 17:30Speaker 03

  Yeah.

• 17:31Speaker 02

  I love that guy, man.

• 17:32Speaker 03

  Price is great.

• 17:33Speaker 02

  Love that guy.

• 17:38Speaker 00

  This episode is brought to you by Michelob Ultra. Good times mean competitions between you and your friends, like seeing who can throw some pigskin the farthest, or rush the field the fastest. Winner gets an Ultra. Because it's not just a superior light beer, it's also giving fans superior access to their favorite sporting events. Superior is worth playing for. Visit michelobultra.com/superioraccess to enter. Enjoy responsibly. Copyright 2026 Anheuser Busch InBev Michelob Ultra Beer, St. Louis, Missouri.

• 18:14Speaker 00

  This episode is brought to you by Michelob Ultra. Good times mean competitions between you and your friends, like seeing who can throw some pigskin the farthest, or rush the field the fastest. Winner gets an Ultra. Because it's not just a superior light beer, it's also giving fans superior access to their favorite sporting events. Superior is worth playing for. Visit michelobultra.com/superioraccess to enter. Enjoy responsibly. Copyright 2026 Anheuser Busch InBev Michelob Ultra Beer, St. Louis, Missouri.

• 18:46Speaker 02

  Well, let's, um, took a little sidetrack there, but let's

• 18:49Speaker 03

  Yeah.

• 18:50Speaker 02

  get to you and, uh, let's get to your

• 18:52Speaker 03

  I'll let you get there eventually.

• 18:54Speaker 02

  Where'd you grow up?

• 18:56Speaker 03

  All right, so I grew up in Wisconsin.

• 19:00Speaker 02

  Brothers, sisters?

• 19:01Speaker 03

  Yeah, I got a younger sister, four years.

• 19:04Speaker 02

  You guys tight?

• 19:05Speaker 03

  Yeah, we, we don't keep in touch as much, both like, super busy. But, uh, we, we could definitely be a lot, a lot closer.

• 19:11Speaker 02

  Is she a hacker too?

• 19:13Speaker 03

  No, she, uh, culinary.

• 19:15Speaker 02

  Culinary?

• 19:15Speaker 03

  Yeah, picked that up from my dad as well. So my dad, um, yeah, so, uh, he was in the Navy as a corpsman for a while. I think it was like four years, submarine and stuff. Um, but medicine, both my parents in, in, in medicine, were in medicine. And, uh, they did a lot of DIY stuff. So they built their house from the ground up, designed it from the ground up. So I was in that, that kind of raw materials environment. Like, the house never actually fully got completed, which is actually kind of cool. Cause it's constant, like, tools, raw materials around, growing up. I thought that was an amazing experience. Uh, dude, I remember, uh, shoveling out the, uh, the house because it snowed before we got the roof on.

• 19:58Speaker 02

  No kidding?

• 19:59Speaker 03

  Yeah, it was pretty cool. I was, I was pretty young at that time. But it was still like, you know, impacting like, oh, look, you just, you can just do stuff, right? And like, that wasn't a profession, but they just picked it up, learned it, how to design it, built nearly everything. I think they didn't do, was the, the masonry for the basement. Cause, yeah, um, the trusses. And then they were rushed with the weather to get the drywall up. So they paid for, for that. Um, everything else they did by hand.

• 20:28Speaker 02

  Wow, wow.

• 20:30Speaker 03

  Pretty cool. So, but yeah, culinary, right? That's going back there. Um, yeah, he's really into, he, he was really into just cooking and, uh, really, really good at it. I, uh, both of my parents, uh, were doing, um, barbecue competitions for a while as well. They're just

• 20:51Speaker 02

  Jack and Bolt trade.

• 20:52Speaker 03

  Yeah, just get into it and go. And, uh, I think that was a pretty good learning experience. And obviously that had an impact on my sister, um, who got into culinary as well. And just did some, did some great, uh, great stuff there. I, I didn't pick that skill up.

• 21:07Speaker 02

  So what, what were you into as a kid?

• 21:09Speaker 03

  Oh, God, um.

• 21:12Speaker 03

  Definitely electronics-type stuff. So it just depends on the stage. Video games first, lots of video games.

• 21:20Speaker 02

  What video games? What platform?

• 21:23Speaker 03

  I guess it depends over time. So there was the console stuff like Nintendo, et cetera. So let's go all the way back. So Atari, and this is kind of like the first hardware hack, actually. My dad, so if you remember the Atari joysticks, it's a joystick and a single button, right? That's the whole controller. And we were playing the game Tank, right? You just move around like you're in a tank and you fire at stuff, right? My dad took some speaker wire, a tongue depressor medicine, right? And ran a button probably from Radio Shack and just taped it to a stick to the tongue depressor, ran the wires off and soldered it to the controller so that I could have access to my

• 22:07Speaker 03

  own little like button when I was like four or something. So I could fire the tank while he steered it around, right? I thought that was pretty cool and it kind of stuck with me, right? Like you modify stuff, like hack at stuff. So very simple, but you know, that was first video game, first hardware hack, right? That I was kind of exposed to. And yeah, spent lots of time on like Nintendo, Super Nintendo. Then I got into Quake. Quake was extremely impactful for me. That's where I went from, you know, consoles to the computer in the house that we had. You know, I used it for like encyclopedia, like you could chat with people online. Cool, but it's more just a tool, right? Then Quake.

• 22:50Speaker 03

  You gotta start learning things back when Quake came out, you know, this is late 90s, right? You gotta learn like how dial-up works, how to connect to other people so you could do multiplayer. Like that wasn't just like a button or two. You gotta learn stuff. And even running Quake, it's like, oh, you just don't launch it, you know, reboot the computer in DOS mode and stuff like that. So you're learning how a computer works, but that also kind of, that's where we get into hacking as well. That's kind of like the inflection point of a lot of things. Also, you know, Nine Inch Nails was built in that game. They did all the sound effects and you can see the Nine Inch Nails logo on the crates of nails as well if you look in there. But yeah, that was also kind of impactful for me with their stylistic stuff and the art.

• 23:33Speaker 02

  Damn, so you started the hacking stuff at like, how old were you? We were the same age.

• 23:39Speaker 03

  That was, that was high school.

• 23:42Speaker 02

  Atari was high school?

• 23:44Speaker 03

  No Atari, oh god, I don't, I don't even know when that was. Uh. Yeah, I mean, just really.

• 23:50Speaker 02

  It's like five or six?

• 23:52Speaker 03

  Yeah, I don't, I don't even know.

• 23:53Speaker 02

  Damn.

• 23:54Speaker 03

  It was eighties, like, oh, but yeah, Quake was high school.

• 23:58Speaker 02

  Right on, right on. So what? Well, let's fill in the gaps.

• 24:03Speaker 03

  Yeah.

• 24:03Speaker 02

  Were you into anything other than electronics, or was it always just electronics and? I shouldn't say just, was it always electronics?

• 24:10Speaker 03

  I mean, they, it's all connected in some way. Like, I was in cars as well, like, you know. Part of it was just like. Making the car continue to run, uh, but also, you know, like, let's, let's add sound systems to the cars and learn how that works, which is, you know, electronics in some way. Um, also got into water cooling, the computer to overclock it, but that required learning like.

• 24:33Speaker 02

  Water cooling?

• 24:34Speaker 03

  Yeah.

• 24:34Speaker 02

  Water.

• 24:36Speaker 03

  These days you can just buy a kit and install, right? Uh, but most computers are air cooled, like you got a little fan in there blowing out the heat, right? Um, if you overclock a computer, you can get a lot more power out of it, especially back in, you know, nineties, early two thousands. Uh, but it would dump a lot of heat, lots more heat, and air cooling couldn't keep up with that. So what you do? You take little, uh, water blocks, basically, like a little piece of copper, strap it to the processor, uh, the video card. And run water loops through it, kind of like a.

• 25:09Speaker 03

  Uh, I don't know how to better explain that, but, uh, it's like a little maze that the, uh, water would take. Through, through the channels on this block, and it would pull the heat out and you would dump it, and at the time. Uh, god, it was a Chevy Chevelle heater core that was just like the perfect size, and you could use that as a radiator with a larger fan on it. So instead of using the small fans that you'd find on like laptops or even desktops that, you know, maybe it's like that big. You have a fan that big, and it keeps it quieter while dumping heat, and you can just run these things really hot. And yeah, I, I had to learn how to make those things, right? So, you know, you get a pond pump from like a fish store, you get the Chevelle heater core.

• 25:51Speaker 03

  Get all the tubing wired together, but I had to mill out, and I didn't mill it, I drilled it. I used a drill press because I could not afford access to that. It was like a hundred dollar drill press at the time. You just do like cross drilling through all different directions, plug it up and get this cool spiral pattern where the water would go through it and pull heat out of all your devices. And you got to learn about things like corrosion, like you've got copper and brass and aluminum and like, you know, these things are going to start to corrode. So you learn, you know, the chemistry behind how to prevent that from happening because you don't want corrosion because then your computer's going to have water all over it when it leaks. Just for example, right?

• 26:32Speaker 02

  Wow. So you, you're like a jack of all trades.

• 26:36Speaker 03

  Yeah.

• 26:36Speaker 02

  You like taking stuff apart, putting it back together, figuring out how it works, how to fix things at a very young age and it just exploded.

• 26:44Speaker 03

  Yeah, yeah, basically.

• 26:45Speaker 02

  Into what you're doing now. How'd you get into hacking?

• 26:49Speaker 03

  Uh, so I'm going to put that on Quake as well. So you're playing online games, right? And you learn you can do like interesting things. You start controlling things in weird ways and it kind of escalates. You're like, wait a second. There, at the time, there was no, what we call like client side security or client side like integrity checking. Like the game files I had on my machine were unique to me. You know, like you would download them from, you know, the author, at this time we were actually installing it from CD drives. And you just, you know, expected to not mess with that, but nobody's stopping you. You can go and mess with the, uh, the player models, for instance. And you can like add

• 27:31Speaker 03

  a really large cross that goes like 10 feet above, below and all sides of this, this person, right? So now you can see them running around a corner because you know, this, this post is sticking out them and you see them coming from the corner. They don't know that, but you know, it was a good, good approach. Or a lot of dark spaces, right? Can't really see people in the dark. You're like, cool, I'm gonna add a fluorescent color to their skin. There they are, they're glowing in the dark, right? See-through walls, right? Like, you've got these textures that would go on the walls. And, you know, they're opaque, but they don't have to be. You just set them to transparent and suddenly you're seeing through the walls. And, you know, that type of stuff was... I had more fun like figuring out how to do it than actually doing it.

• 28:14Speaker 03

  But that kind of just opened the door of like, there's rules and there's expectations, but there's also not many people checking. Like, best way to kind of... God, I don't want to get like philosoph... Get into philosophy here, but there's this kind of beautiful, I think it's Jacques Brancier, who defines like police politics, right? As like, you got, you got a road, right? And it's painted. There's lines and everybody just obeys those, right? And he connects that back with politics of like, oh, you're told to vote and do all these things. It's like, okay, but like, what if you don't follow the paint on the road? What if you go off the road? If you get really close to the edge?

• 28:57Speaker 03

  Most people are, they see those lines, they're gonna get right in the center of the road because that's what you're supposed to do. It's like, what happens if you don't? That's, that's interesting to me. That's where weird things start to show up. Like unintended designs, unintended powers and capabilities, just unintended failures, unexpected failures. It's, it's really fascinating to play with that. Play on the edges, see how close you can get. And I guess, now that you make me kind of say this, that's probably a good descriptor for how I think about a lot of things, like art, everything across the board. Find, find, find the boundaries and what happens if you go on either side of it.

• 29:37Speaker 02

  Interesting, interesting. Did you, were you, uh, did you get involved in any of these like hacking type communities?

• 29:44Speaker 03

  Oh, yeah. So...

• 29:47Speaker 03

  Yeah, so like early, late, late 90s, more, more early 2000s. There's a lot of online communities. Some are big. I mean, I think the, the really big ones you would know of, uh, that most people know of rather like 4chan and like something awful, right? Big places that had like the bigger names at the time, but there were also much smaller, like specific topics, water cooling, right? There was a water cooling, there was a bunch of them, but you know, there would be water cooling communities where people just share their techniques and stuff, uh, so they could all just improve upon it. And, uh, yeah, there were also, you know, hacking themed ones. So Bryce and Digital Gangster was one of those. Uh, he was, that, that is one of the

• 30:30Speaker 03

  several communities I, I have, you know, known him from. And yeah, there's, this was also at the time where online space and meet space, uh, were very separate, right? Like, uh, like online dating, for instance, that was like, what? Uh, now it's like, that's all the kids do these days. Uh, it's really weird. Uh, but I met my wife from one of those online communities. Um, but eventually those, those worlds start to blend together when you spend more time in there and you're spending most of your time in there and just talking to these people. Eventually, I mean, it depends on the community, maybe not so much like

• 31:12Speaker 03

  Digital Gangster where it's like raw crime happening is maybe not the best, best idea to meet up, uh, for many reasons. But, you know, certain lesser criminal communities, uh, yeah, meet up with people and those worlds start to blur together. And, uh, it's a little bit different than the, you know, 2024 is where it's just, everything is just mixed together now.

• 31:36Speaker 02

  Yeah. How'd you meet your wife?

• 31:39Speaker 03

  Yeah. I mean, so, uh, we posted on some of, one of the, the communities out there. I think it was like from hardware overclocking. I, yeah, I can't remember exactly what it was, but, uh, we...

• 31:53Speaker 03

  I moved out to California. That's its own story we can go into, but when I moved out, I think it was like the first week. It's like, hey, anybody in this community, like around, wanna hang out, show me around town. She was one of those people. I was like, yeah. And yeah, I just kind of grew from there.

• 32:09Speaker 02

  Is she a hacker too?

• 32:10Speaker 03

  Uh, not a hacker per se, gamer, photography, art.

• 32:16Speaker 02

  Cool. How long you guys have been married?

• 32:20Speaker 03

  Hmm.

• 32:21Speaker 02

  Sorry to put you on the spot with that one.

• 32:23Speaker 03

  What year is it anymore?

• 32:27Speaker 03

  14 years? It's 2009. 15 years?

• 32:31Speaker 02

  2009.

• 32:32Speaker 03

  14. Yeah, so almost 15.

• 32:35Speaker 02

  15 years.

• 32:36Speaker 03

  Yeah, it's crazy.

• 32:37Speaker 02

  Yeah.

• 32:38Speaker 03

  I've known her since 2004, so.

• 32:39Speaker 02

  What's the, what do you think the secret to a successful marriage is?

• 32:44Speaker 03

  Oh, oh my God.

• 32:47Speaker 02

  Bet you weren't expecting that one.

• 32:48Speaker 03

  No, I was not expecting that one. I'm gonna have to think about that one, man. Um, I don't know, man, just, um.

• 32:56Speaker 03

  Cause I can connect this back with everything is just kind of understanding. I mean, humans are a mystery to me, but at the same time, there's so much complexity and it creates. It's like a.

• 33:11Speaker 03

  Everybody's different. Like, everybody wants to put everybody into a bucket. Like, there's, there's the us and there's the other, but like, humans are messy and complicated and unique. And understanding that helps a lot with everything, whether it's being in a marriage or attacking somebody to get into a company. It's like, yeah, same thing, right? Like, understanding, but, you know, very different motives and goals behind that one is just truly understanding the person and working with them. And, you know, the other is kind of the inverse of that.

• 33:44Speaker 02

  Right on, right on. Let's talk about, you know, some of the stuff that you did. Did you, what are some of the big hacks? Were you involved in any big hacks?

• 33:54Speaker 03

  Uh, not, not like hands on keeper. I'd like to watch those.

• 34:01Speaker 03

  I, so for most, most of my time, like any of that, the hacking stuff, that was me.

• 34:09Speaker 03

  I kind of viewed it as like entertainment. Like it wasn't like power, money, or anything like that for me. It's just like, let's just have some fun, right? Um, yeah, you can mess around. Like I would do stuff on like some of the communities as well. Like I knew the people who would run the servers. So you can mess around in there and like-

• 34:26Speaker 02

  What kind of stuff?

• 34:27Speaker 03

  I mean, okay, for, for instance, um,

• 34:32Speaker 03

  I gotta remember all the complexities here, but uh,

• 34:39Speaker 03

  this community was like very liberal with like temporary bans and stuff like that. So, you know, I got myself banned and I'm like, get around that, right? And then they could not get me banned in this, in this environment. Cause they, they had some add-ons that they were using for this, this V-Bolt. And I think it was V-Bolt and it might've been PHPBB. PHPBB. Anyway, one of the large platforms at the time just had a lot of plugins that just gave me raw write access to the database effectively. And, you know, I could post through that. And, you know, they, they had a lot of fun chasing me down in that situation. I'm just like, how are you still here? So very, you know, lighthearted, lighthearted in that instance.

• 35:24Speaker 03

  You know, they, they were, they were more interested in how it was done than like, oh, you're, you're breaking into my stuff. So, yeah.

• 35:33Speaker 02

  Right on, friend. Well, let's move into, we deserve, I don't know, you know, a whole lot about hacking.

• 35:41Speaker 03

  Yeah, yeah.

• 35:42Speaker 02

  You know, I would, I would love for you to expound on, you know, how you got into it. Or not how you got into it, but, but some of the things that you just found fascinating that, that, that kept you going all the way up until building your own hardware.

• 35:55Speaker 03

  Yeah, definitely. And actually, you know, going back into the, the youth for a little bit, uh, something probably important, I had a phase where I was really into magic, right? Sleight of hand, deception, that type of stuff. I think that was middle school, right? Actually, got my first taste of authority not being super ideal for me. Brought in a fake cigarette to middle school, right? And it's the, the peak of the dare, dare situation, right? Uh, it looked perfect. It looked like it was actively lit and you blow on it and like, you know, talc, I think powder came out, but it looked like smoke. Uh, that got confiscated. We got, friend and I got pulled down to the principal's office.

• 36:35Speaker 03

  Um, I don't know. I think I got suspended for not taking the situation seriously enough. How can you take this seriously? Like, it's fake cigarette, but I think my friend pointed out. Oh, yeah, that's right. They brought on the cops to test it because some of the talc powder came out. And they're like, that might be cocaine. And my friend made probably an unhelpful comment of like, that's not even how you would smoke cocaine.

• 37:02Speaker 03

  But, uh, yeah, um, anyway, sleight of hand, you know, that gets into like deception and the human aspect, which is often forgotten a lot in hacking. People are like, oh, yeah, it's just knowing computers really well. Definitely a huge piece, but like, it's people as well that have to be kind of like manipulated. You gotta understand them. You gotta convince them to do things, which is the most common way of getting into so many systems. You say, hey, like, I'm from your IT department. Let me in. And you gotta know how to make that sound legit. And, you know, if somebody is like, I don't know, like, okay, let's use some urgency to like, make them kind of panic a little bit where their decision making goes down. And they're panicking

• 37:46Speaker 03

  and they're like, oh, I just gotta do the thing, or, you know, I might get fired. This bad thing's gonna happen. Or, you know, there's, there's so many different like psychological triggers that come into play and create this misdirection. And you're like, oh, it's, it's, it's like sleight of hand for, you know, psychology, right? So you, you push people into different directions and you get them to, you know, reveal their password or run an application on their computer that just gives you access to everything. And that overlaps with the technical and the hardware and all these other things. And just, I guess, being a generalist, now that you make me think about it, it just allows you to kind of glue all of those things together. And I guess, yeah, uh, at the time,

• 38:28Speaker 03

  before I officially got into like paid security, I always thought that was a weakness of like, oh, I've never specialized in anything. I just like I couldn't possibly keep up with people who did specialize. And I mean, that is true. There's like every person I work with that specializes, he goes so far into just absolute wizardry that amazes me and I could never keep up and because I just cannot sit down and focus and be like, I'm going to do this thing. And that's all I'm going to do. I'm like, I get 80% of there and I want to go play with another thing, but yeah. It worked out. It's great for the entrepreneur type perspective as well. Where you're going to tackle all the things keeps you busy, right?

• 39:09Speaker 02

  Yeah. Yeah. Well, Mike, let's take a quick break.

• 39:13Speaker 03

  Yeah.

• 39:13Speaker 02

  And when we come back, I want to get into some of the hardware that, uh, that you, that you've made and

• 39:18Speaker 03

  Yeah, absolutely.

• 39:19Speaker 02

  And how that happened and who's using it, what governments, all that kind of good stuff.

• 39:24Speaker 03

  See what I can say.

• 39:30Speaker 00

  This episode is brought to you by Michelob Ultra. Good times mean competitions between you and your friends, like seeing who can throw some pigskin the farthest or rush the field the fastest winner gets an ultra because it's not just a superior like beer. It's also giving fans superior access to their favorite sporting events. Superior is worth playing for. Visit michelobultra.com slash superior access to enter. Enjoy responsibly. Copyright 2026 Anheuser Busch InBev Michelob Ultra Beer, St. Louis, Missouri.

• 40:05Speaker 00

  This episode is brought to you by Michelob Ultra. Good times mean competitions between you and your friends, like seeing who can throw some pigskin the farthest or rush the field the fastest winner gets an ultra because it's not just a superior like beer. It's also giving fans superior access to their favorite sporting events. Superior is worth playing for. Visit michelobultra.com slash superior access to enter. Enjoy responsibly. Copyright 2026 Anheuser Busch InBev Michelob Ultra Beer, St. Louis, Missouri.

• 40:37Speaker 02

  All right, Mike, we're back from the break. I missed a couple of things in our outline here, so I'm gonna have you pick it up with, we're always gonna start with 2600, whatever the hell that means.

• 40:48Speaker 03

  Oh, yeah, yeah, so, all the, the security stuff I was doing, um, the times I was, you know, doing help desk and stuff like that, security, for the most part, anything security connected, was a hobby, so, you know, even, even the overclocking, water cooling, I was hobby too, but, yeah, 2600 is, uh, you know, kind of a hackerzine, I think they're quarterly, um, just lots of people writing in to show, you know, tricks they've done, whether it's with payphones, you know, freaking, phone freaking.

• 41:20Speaker 02

  Wait, so what is 2600?

• 41:22Speaker 03

  It's a hackerzine, basically, you can, you can go-

• 41:24Speaker 02

  Like a magazine?

• 41:24Speaker 03

  Yeah, like a little magazine, you can, you can go to, like, Barnes and Nobles and get it.

• 41:28Speaker 02

  Okay.

• 41:29Speaker 03

  So, yeah.

• 41:29Speaker 02

  Wait, so what is it, is it a book?

• 41:31Speaker 03

  Uh, it's, uh, I think it's quarterly, where they will just publish a new set of, like, little, like, kind of articles written by different people, that talk about how to hack something, how they hacked something, uh, just cheats on systems, uh, just sometimes politics, just, you know, hacker-minded stuff, right?

• 41:50Speaker 02

  Gotcha.

• 41:51Speaker 03

  It's pretty cool, but, uh, that was also, when I first got into that, you know, phone freaking and stuff was more popular then, as well.

• 41:58Speaker 02

  What is that?

• 41:59Speaker 03

  Yeah, so, that's, that's hacking with phones, basically, so, this goes back way, way long ago, um, god, uh, I think the guy's name was Joy Bubbles, actually, deaf guy, or, sorry, not deaf, that wouldn't make any sense, blind, um, and he noticed that there were, like, tones on a phone, when, you know, connecting to overseas and stuff, like, this is way back when, you know, you just, you had, you had to pay long distance and stuff like that, right?

• 42:25Speaker 02

  Yeah.

• 42:26Speaker 03

  Phone calls cost a lot of money, but, he noticed they made, like, certain tones and stuff, so he, he had perfect pitch, and he would just whistle them back, and he noticed, like, the phone network would do stuff when you did that, so, yeah. This is what we call in-band signaling. When you can hear the signal, the other end, you know, there's the, like, the switch panel of the phone networks hear these tones. And it's like, you know, when you push, uh, numbers on the keypad and they make a tone, right? If you do it in a certain sequence, you know, it's like, oh, it hears that. There's other tones that the keypad doesn't make that tell it to do other things. It's where the 2600 comes from, actually 2600 hertz. Uh, I can't remember what that does, um, at the moment, but it would allow certain administrative

• 43:11Speaker 03

  type functions. And it's like routing around, like, oh, you paid and now you can go long distance or something like that, right?

• 43:17Speaker 02

  No shit? So, hold on, hold on. So, the, so it actually has nothing to do with the keys that you're pushing? It has to do with the tone that they're programmed to make?

• 43:26Speaker 03

  Yeah. I mean, at least at the time. Things have changed since then. But yeah, it was just the tones. You could literally whistle those tones or hum them or whatever. So, blue boxing was the other thing it's called. Uh, there's, there's many boxes, many colors, but blue boxing just replicated that. You could literally quickly dial a number or whatever you wanted to do, do the administrative codes, play it right into the mouthpiece, and it would dial and do all these things.

• 43:49Speaker 02

  Holy shit, I had no idea.

• 43:52Speaker 03

  Believe it or not, that's how Apple started. Um, WAS and Jobs made some of their first money selling blue boxes.

• 44:00Speaker 02

  What is a blue box?

• 44:02Speaker 03

  So, it's, it's the device that would allow you to more or less get free phone calls in the age of, you know, having to pay for long distance and stuff. Like, go to a payphone, just pull out your blue box, hold it up to the mouthpiece, press some buttons, make it do what you want, call whoever you want. Um, it was illegal at the time. I, oh, what was the, there was a magazine it got into by a guy named Cap'n Crunch at the time. He got that name because there is a whistle inside of the Cap'n Crunch cereal. That just happened to make that 2600 tone when you blow it. So he didn't have perfect pitch like Joey Bubbles did, but he had the whistle.

• 44:44Speaker 03

  So you just blow that on the phone, then you open up certain access with Cracker Jack. Not Cracker Jack, but Cap'n Crunch style toy, which is really cool. But yeah, you can electronically reproduce those sounds. And that's what they were doing with the blue box. And there was like red boxes and rainbow boxes. There was so many different boxes that would do different things that people would figure out. And they would share that with each other. And yeah, it was technically criminal, but a lot of people did it at the time. And yeah, Woz and Jobs took that money and started Apple with it.

• 45:20Speaker 02

  No kidding.

• 45:21Speaker 03

  It's pretty cool.

• 45:21Speaker 02

  I had no idea.

• 45:22Speaker 03

  Very cool. And Woz, I would love to meet that guy one time, but he's a great example of like the old school hacker that was way more about like mischief and just figuring out how things work. And not necessarily anything criminal.

• 45:37Speaker 02

  Interesting.

• 45:38Speaker 03

  Great, great example.

• 45:40Speaker 02

  Interesting. So you were working at this, at this magazine?

• 45:44Speaker 03

  Yeah, no, so I wasn't working there. I was just enjoying it and there were a lot of, lot of, uh, different cities would have like meetups. Like, hey, 2600 meetup. And you go and, you know, meet people that are into that stuff. Really tiny where I was from, so it didn't really go anywhere. But that, that was cool. It would get you into just more like, hey, here's other ways of hacking that you didn't know about. And it just gets you to think like, wait, if I can do that, if they did that, what, what else can you do? Like, let's, let's play. Like, it's just, it's all about exploration, experimentation, like, it is a frontier too. Like, there's just unexplored space. Like, what, what else can you do?

• 46:24Speaker 03

  And, um, yeah, I mean, outside of 2600, there's like, there's all the tools that people knew of the early online days, like Sub7 or Netbus.

• 46:34Speaker 02

  What's that?

• 46:34Speaker 03

  Kind of, kind of like a software Trojan, more or less. Basically, you get somebody to run it or you run it on their computer and it gives you a remote access. Right? You can fully control those machines over the internet. Right? Um, open up their, uh, the CD trays, close it up, just all kinds of wonky stuff that could be for pranks or it could be criminal. Um, God, okay.

• 47:00Speaker 03

  Reminds me of one of the ways we used it. So again, I was way more about just pranking and having fun. My friend in high school, her name was Heather.

• 47:11Speaker 03

  She was really into like

• 47:17Speaker 03

  just

• 47:20Speaker 03

  spiritual stuff and like, you know, she thought like spirits were in her house and stuff like that. It was a phase, right? But a friend and I had that running on our computer and you could play noises at the middle of the night and shit. And just like, it was terrible. It was so bad. And you know, the CD drives would open and just like, you know,

• 47:39Speaker 03

  she was terrified at the time, but later on thought it was funny. But yeah, for an example, right? Like you can just have fun. You can play with people. You don't, you don't have to actually straight up to crime. Crime, crime does occasionally pay though. So some people would get into that. How would they use it? For criminals? Yeah.

• 48:02Speaker 03

  God, this goes way back. We're, I mean, we're talking like 20 or 25 years ago. So I'm not a hundred percent remembering this, but it would have been, you can do like file system modification, stuff like that. So you can get access to cookies, you know, that'll contain like login information. You can just, you know, get into people's accounts, send mail as them. And like, so you know, spamming was a huge thing back then. I mean, this, this where Bryce has gotten a lot of reputation from, from those early days, spamming. My, my friend at the time paid for his first computer by spamming for a porn company, actually.

• 48:43Speaker 03

  Which is funny because he's cashing a check, sizable check for a porn company. And he's like, I don't know, he's probably like 14 or something at the time, getting like weird eyes from the bank.

• 48:55Speaker 03

  Um, so yeah, that happened, but um.

• 49:01Speaker 03

  What else? Yeah, I mean. Did you ever do any? Did you ever do anything illegal that's past the statute of limitations? So you can share. So a common misunderstanding about the statute of limitations is it's not just about the time in which has passed since you committed the crime. Depends on the crime, but many times the clock starts from discovery. Interesting. A common misconception that is good for a lot of hackers to realize. But, um, I mean, I'm sure, so the CFAA is Computer Fraud and Abuse Act. Literally any access to any electronic interface that is not explicitly allowed. That's a federal crime.

• 49:46Speaker 03

  So literally what I described, you know, getting onto my friend's computer, that's a federal crime, even though they're cool with it and all the stuff. Yeah. Gotcha. So literally any of those things can be heavily punished. Gotcha. So yeah, it's tricky, but. Well, let's get into your first job. Yeah, so first job, IT. Um, again, like, security was not really a huge thing for the most part. All that was side stuff, but you know, you still have to be conscious of, you know, secure design. Uh, my coworker was kind of my mentor at the time. He is, he was ex DOD, ex Navy.

• 50:30Speaker 03

  Uh, had a lot of fun stories, but also got me more into security. We actually did our first security presentation for the company, kind of using some classics here. So the movie Sneakers, a lot of amazing movie, still holds up today. If you haven't seen it, go watch Sneakers. It's awesome. Um, but they did a lot of like physical security stuff, like, you know, if the doors got the hinges on the inside, you can kick it open. It's on the outside, you know, then you get to do something different. But, um, what else? There's like the social engineering aspect where they wanted to get through like a front lobby attendant who had to like buzz them in. So they had someone else come in with like.

• 51:11Speaker 03

  I think it was like a delivery, like just creating a lot of stress. So one guy's like, yo, I got this delivery. Other guy's like, hey, I got my cake and my balloons. Can you just ring me up? And it just goes and escalates until he's like, ah, just pushes the button and gets in. Right? Of course, you know, he didn't have a cake or anything like that. The balloons were to cover the camera. And the cake was, I think it was like a briefcase of some hardware that he had to like infiltrate into the company. They would go attack things. Right? Great demo. We use that like, hey, here's some physical security things. Get you, get you to think about it. And catch me if you can. Another thing where it's, you know, social engineering was used. And believe it or not, that movie based on Frank Abagnale, most of the stuff he said is actually made up.

• 51:55Speaker 03

  It was like the con on the con. But anyway, uh, yeah, that was kind of a classic thing that still a lot of security presentations today will still use those. Anyway, uh, long story short, kind of got me into the idea of educating on security instead of just playing and having fun. And just the entertainment value is like, oh, you gotta actually teach people on like, you know, there's a responsibility here of like, teach people how to not fall victim. Also did some like live password cracking, like back in the day, people were using real terrible passwords. So just adding some extra characters and stuff. We were able to, you know, do password, password cracking just in the middle of this, this presentation of like, hey, this password you can get in 15 seconds.

• 52:40Speaker 03

  This one's going to take us 10 hours. In reality, that's

• 52:43Speaker 02

  How do you begin to crack a password?

• 52:45Speaker 03

  Uh, basically, I mean, there's a lot of different ways. The way we were doing it was just brute forcing, being able to have the ability to retry like word sets, like common password sets. You can just get those. There's, there's a lot of password lists, what we call them, that will, uh, when you're going to brute force and you just want to try them. Well, like, hey, we know these are the common passwords. We know these are passwords from leaked breaches and shove them all together. Good chance somebody's reusing that somewhere. Good approach. There's cryptography and stuff, but

• 53:16Speaker 02

  Do you use a password manager?

• 53:17Speaker 03

  Oh yeah, definitely. Highly recommended.

• 53:19Speaker 02

  Which one?

• 53:20Speaker 03

  Uh, one password's pretty good. Um, there's, there's different ones depending on what you need.

• 53:24Speaker 02

  Is Keeper any good?

• 53:26Speaker 03

  I haven't looked too heavily into that one.

• 53:27Speaker 02

  Okay.

• 53:28Speaker 03

  I know. I know somebody who's very into like that that space that speaks fairly highly of one password, but it's been a while. So I wouldn't want to be like, yeah, this is this is the one because that space is always changing. But

• 53:42Speaker 02

  What constitutes a good password?

• 53:45Speaker 03

  One that you don't know.

• 53:47Speaker 02

  So password manager.

• 53:48Speaker 03

  Exactly. So if you don't know your password, it should be unique per site. And as long as hell.

• 53:56Speaker 03

  And that means you're you're going to have to use your password manager to autofill that. Or, you know, copy. However, you're going to do it. You're going to need the password manager to feed that back. And login to the site. That combined with proper two factor is going to secure so much. When it comes to you being compromised by social engineering and phishing.

• 54:17Speaker 02

  Okay, that's good to know.

• 54:21Speaker 03

  Yep.

• 54:21Speaker 02

  Let's move on.

• 54:22Speaker 03

  Yeah, yeah. So.

• 54:25Speaker 03

  Yeah, after that job.

• 54:28Speaker 03

  I was kind of bored of Wisconsin. And my friend at the time, the the one who made the money spamming. He moved out to San Francisco a year earlier. And worked for a company called Long Now. They're the ones doing the 10,000 year clock. That a lot of people are associated with. I think Pezos is on there, but Stuart Brand.

• 54:49Speaker 02

  Hold on. What's the 10,000 year clock?

• 54:51Speaker 03

  Yeah, so it's this idea. I don't I don't think they've built it yet, but still working on it. But the idea is that they're they're going to put a clock, like an analog clock in a mountain that stays accurate for 10,000 years. It's it's good. It's really to get people to think really long term.

• 55:11Speaker 03

  And

• 55:12Speaker 02

  What do you mean?

• 55:13Speaker 03

  Just like, who's really, you know, it's it's hard for people to think more like like even like one election out of consequences, right?

• 55:20Speaker 02

  Yeah.

• 55:21Speaker 03

  Four years, 10 years. Maybe you think as far as your kids. Okay, cool. Well, how about 1,000 years? Or 10,000 years? Like, that just changes how you think about the future and what you do.

• 55:34Speaker 03

  What matters, what doesn't, and it's kind of, it's almost like a thinking prompt for people. It's like, nobody does it, like, start doing it. This was also, I think it was formed shortly after the Y2K bug, which was hilarious because, you know, computers started, a lot of the systems at the time were kind of birthed in the 70s. And, you know, they had two digits for the year, right? Like, the last two. So, you know, 78, 79, you know. Eventually, what happens when you get to 99 and it rolls over to 00? Is that 1900? Is that 2000? Oh, nor, neither did the computers, right? But people were only thinking, you know, a couple decades. That's enough, somebody's gonna rewrite my software. No, it's not, no, we're still using that software today. So that's where the Y2K bug came from.

• 56:19Speaker 03

  And it's like, cool, you needed to at least think, you know, 1,000 year scale. So you can have four digits of space for your years. That was, that was the entire Y2K bug. But I believe the, that was kind of around the same time that, okay, 1,000 years, what about 10,000? Probably where that came from.

• 56:36Speaker 02

  So, hold on, they wanna make a clock.

• 56:39Speaker 03

  Yeah.

• 56:40Speaker 02

  That's accurate for 10,000 years and put it, put it in a mountain?

• 56:44Speaker 03

  Yes, basically. The mountain, I think, is to keep it safe.

• 56:49Speaker 03

  They have to, like, keeping time for that period of time. Like, you can't use any other timekeeping system. Like, you know, atomic clocks and stuff like that aren't accurate over that time span. So you have to account for, like, orbit variation, shift in the poles of the earth and all of these other things. Like, they have a whole cam system that readjusts the calibration of where that clock will be in X years.

• 57:17Speaker 02

  Interesting.

• 57:18Speaker 03

  Over that span. It's absolutely crazy to, like, engineer with that in mind. It's like, nope, you don't, nobody thinks about, like, orbit variance over time of the earth or the poles shifting for the clocks they use. Like, it's just not a factor. But what if, what if you had to? I think it's really cool.

• 57:39Speaker 02

  Interesting.

• 57:39Speaker 03

  Yeah. So, yeah, my buddy got a job just doing system for them and web development. And it's like, hey, if you want, like, a few weeks on my couch, go for it. I'm like, you know what?

• 57:51Speaker 03

  I'm gonna take you up on that. I'm gonna use that to just move out there. I had no plan. I was just like, I brought three. No plan. No plan. I'm just like, I'm just gonna do it and figure it out. Um. Which I guess is a very red team approach, dude. It's like, you, you, you can't plan anything. You're just gonna move and figure out what's in your bag of tricks as you go, um, and work around the problems. But yeah, I'm like, I'm gonna bring three suitcases. Uh, I prioritized one of them, uh, was like my gaming system. Like I, a whole suitcase was dedicated to just a, a computer. Like, I don't know what I was thinking, but, uh, yeah, that was what, uh, 30% of my, uh, luggage when I moved out, uh, stayed out of the cash for a bit.

• 58:32Speaker 03

  Got some random odd jobs doing like audio QA testing and the stuff like that, just to make it. And, uh, eventually got into the game industry, doing submit, IT, help desk stuff. Um, and it just kind of grew from there. And yeah, I stayed there for like, I don't know, 15 years in the game industry, but on the side, being in San Francisco gave me a lot of unique perspectives. So first of all,

• 58:58Speaker 03

  Stuart Brand is kind of the guy that was running the show over at Long Now. Stuart Brand is one of the original people on like the hippie bus with like Timothy Leary and all this other stuff, right? They're doing runner, going around the country, doing the acid tests and stuff like that. But lots of just divergent thinking coming from that. And that was interesting just to kind of see, like, I didn't get that in Wisconsin. Um, this is also kind of where like, you know, the PC revolution came from that type of

• 59:28Speaker 03

  people, right? We're just diversion thinking. What can we do? What mischief can be made? All, all this, the stuff. Uh, the maker space, uh, Maker Faire was out there as well. So this is just, this is more like hands-on hardware hacking, not like security hacking, just like hobbyist hacking, like 3D printers. Let's just build some stuff. The kind of stuff you find at like Burning Man, right? Like the arts, where you start mixing all these things together. That, um, opened my eyes to just like different, different, uh, focuses and aesthetics. There's, um,

• 1:00:06Speaker 03

  Really good point to kind of deviate here. Something called BeamBots. Actually, I'm gonna pull up this laptop here to show you a picture because it makes way more sense when you see it.

• 1:00:18Speaker 02

  BeamBots?

• 1:00:18Speaker 03

  Yes, you're like, what?

• 1:00:22Speaker 03

  So BeamBots, B-E-A-M. Biology, electronics, aesthetics, mechanics. It's just a kind of a design philosophy around building little robots. So I just kind of had to show it because it, I don't know. You're probably picking up a bit of an insect vibe from this, I would assume, right? So it does a couple of things. First of all, there's no PCB on here. It's just free-form soldering. And all of these components, there's nothing extra for the aesthetics. It's all functional. So on the back, you've got a solar panel soaking up energy. This like thorax here, that's holding the charge from it. And then these, this is really cool.

• 1:01:06Speaker 03

  These are LEDs, but LEDs, when you shine light on them, actually emit a little bit of energy on the lines. Like a reverse solar panel, right? They're inefficient solar panel. But you can literally use them as eyes for this. So depending on what direction it's facing, it's gonna, one eye is gonna see more light than the other. That's where the light source is coming from. And there's a really tiny brain in the middle. It's literally four logic gates, which is tiny. Like, your phone has millions of logic gates in it, right? Like, a calculator. My cable has hundreds of thousands of logic gates. This thing, it's got four, okay?

• 1:01:47Speaker 02

  What is a logic? What do you call it? A logical?

• 1:01:49Speaker 03

  Logic gate. So basically, all computing comes down to the concept of binary, on or off. Like, think of it like a light switch, right? It's on or off. You can do math with that. Let's go through it real quick, actually. Like, we got three light switches, right?

• 1:02:09Speaker 02

  Yeah.

• 1:02:13Speaker 03

  Got to think which direction we're going here. So we got one on, two off. That can give us a one. Turn them all off, that's a zero, right? Easy. Now, we put two in the picture. You turn two on, you basically double the last one. So if two are on, that's going to be three. Basically, the first switch is the value of one or zero. The next one is two or zero. And then the next one will be four or zero. The next one is eight or zero. And that's binary math, right? Okay. And all decision making can kind of be based on this. So in this sense, it's very analog.

• 1:02:52Speaker 03

  But basically, this will eventually fill up and have enough energy charged that these four logic gates are suddenly making a decision. Like, this side's filled. Which eye is sensing the most light? And at that point, it's going to fire the opposing leg with all the energy it's gotten here to steer towards that. So you have this little bug-looking thing that walks, right? And it just constantly steers towards the light source. And to me, I thought that was really cool because A, it focuses on aesthetics, which is not super common.

• 1:03:32Speaker 03

  And B, it uses really cool hardware hacks, like I said, with the lights here. Normally, it's for emitting light, but no, you can reverse that and use it in an unintended way. And you can use really minimal logic to do what you want. And, you know, I've applied some of that to my cables as well. Not this specifically, just the mindset of like, you don't need 10 things in this cable. You can strip it down to one if you're really creative. Wow. That's how you shrink things. So that's kind of where that connects with, you know, like, hey, let's focus on aesthetics,

• 1:04:11Speaker 03

  but also minimizing and just using things in unintended ways to get more out of it. So that was...

• 1:04:23Speaker 03

  Kind of a good point in which it kind of just opened my eyes to also soldering in electronics, but also the art of it and all that. So yeah, BeamBots, that was a good pausing point for my many hobbies that I would pick up over time that eventually led into what would become the OMG Cable.

• 1:04:46Shawn Ryan?

  I know everybody out there has to be just as frustrated as I am when it comes to the BS and the rhetoric that the mainstream media continuously tries to force-feed us. And I also know how frustrating it can be to try to find some type of a reliable news source. It's getting really hard to find the truth and what's going on in the country and in the world. And so one thing we've done here at Sean Ryan Show is we are developing our newsletter. And the first contributor to the newsletter that we have is a woman, former CIA targeter. Some of you may know her as Sarah Adams, call sign Superbad. She's made two different appearances here on the Sean Ryan Show. And some of the stuff that

• 1:05:31Shawn Ryan?

  she has uncovered and broke on this show is just absolutely mind-blowing. And so I've asked her if she would contribute to the newsletter and give us a weekly intelligence brief. So it's going to be all things terrorists, how terrorists are coming up through the southern border, how they're entering the country, how they're traveling, what these different terrorist organizations throughout the world are up to. And here's the best part, the newsletter is actually free. We're not going to spam you. It's about one newsletter a week, maybe two, if we release two shows. The only other thing that's going to be in there besides the intel brief is if we have a new product or something like that. But

• 1:06:16Shawn Ryan?

  like I said, it's a free CIA intelligence brief. Sign up, link's in the description or in the comments. We'll see you in the newsletter.

• 1:06:28Speaker 02

  Let's move into Defense Distributed.

• 1:06:31Speaker 03

  Yeah, so I think this was about 2013. So first Defense Distributed, it's the company behind the Liberator, which is a 3D-printed gun, and also the Ghost Gunner, which is a mill, desktop mill, that you can mill out a lower receiver, AR-15 platforms, it was the first commonly.

• 1:06:53Speaker 02

  You're the one that did that?

• 1:06:55Speaker 03

  I did not, no. So I got very interested in that. That was done by Cody Wilson. He, so let's crack that whole topic open a little bit more. So I think it was 2013. There was a lot of experimentation in like the 3D printing space with like firearms, right? Cody introduced it to the world. He basically inflicted this idea upon like the public psyche in like this amazing way that just caught my attention in a couple ways. First, it's this approach of like, hey, we're gonna give this to the world in a way that is irrevocable.

• 1:07:38Speaker 03

  Like, going back to that, like the police politics concept I was mentioning, it's just like, okay, what if you create something? Like, there's voting and opinion having, but you create something and put it in the world, that, nothing can change that at that point. I just thought that was just amazing from like the political standpoint, regardless of what topic, or what opinion you may or may not have on firearms, the politics of it and the power of creation was amazing to me.

• 1:08:10Speaker 03

  And he did it with like a level of like art and bravado that was just like perfect for the delivery of this, and...

• 1:08:19Speaker 02

  So what you're saying is bringing something to the world that cannot be taken back? Like...

• 1:08:27Speaker 03

  Bitcoin. Yeah, great. Another great example of like, no opinion on that is going to change its existence. It exists. And like, if you're thinking about like, real politics and participating, like, creation is one of the most powerful things you can do. And that's what I kind of learned from watching that. But yeah, I decided like, hey, I want to know more what they're doing. And I've helped out with, you know, security and, you know, just computer stuff in general. Use what I had, like, hey, can I help to a lot of different places? Whether it's like Ninety Nails communities, just to get more insight of like, how the artistic process works there.

• 1:09:09Speaker 03

  Or in the case of Cody, just helping out with the security of that, just to kind of, you know, see how they work, you know, a bunch of anarchists getting together, building a company, and just, just, just the whole like, fight that they were in. It was very fascinating to me just to observe that. And that kind of stuck with me, both the creation, the power of creation, and the artistic approach they took to it. That was one of the things I kind of had in mind when I first created the OMG Cable. It's like, hey, at the time, I thought I was just going to open source this thing and put it out there.

• 1:09:50Speaker 03

  That ended up not making sense because it was really hard to make. You can't just DIY it. But, um, yeah, it was one of the motivators in my head at the time when I was first kind of putting it out in the world. So, yeah, one of the many things is just like, hey, this is a fixation. I want to know more and I'm just going to focus on it for a while. So, yeah, they're still doing their thing, still. So what did you do there? I just helped out with some security stuff. Like, I didn't have- What kind of security stuff? Uh, network and IT. I mean, every, every company's got to have that, right? So I'm like, hey, you know, you're probably a small shop, probably don't have the level of security and understanding for your systems, but I don't know, maybe I can help.

• 1:10:34Speaker 03

  So I just helped out and it allowed me to get more insight into how they run things and just, just more exposure to like, how, how the artist works, right? Because that, that allows me to just kind of figure out.

• 1:10:53Speaker 03

  There's a lot of things I would experiment with, but I never found like my medium, right? Like as an artist, right? Like I've gotten into music, you know, I'm not that great with music, you know? Visual arts, not that great with that.

• 1:11:05Speaker 02

  I mean, 3D printing is everywhere now.

• 1:11:07Speaker 03

  Yeah.

• 1:11:07Speaker 02

  You know, and so you were at the forefront of this? You were on the, I mean...

• 1:11:11Speaker 03

  So I wasn't doing anything besides like the security for them. It's just, just kind of, even if I didn't do any work for them, just that.

• 1:11:20Speaker 02

  Just being a small part of it.

• 1:11:22Speaker 03

  Yeah, exactly. But even just seeing it happen would have been enough for me to kind of kickstart some things. It's another...

• 1:11:30Speaker 02

  How did that come across your radar?

• 1:11:31Speaker 03

  I mean, it was everywhere at the time. It was like in Wired and all these other places. Like 3D printed gun, you know, firing, like it's, everyone can print a gun now, like regardless of laws. And that's, you know, that was kind of the message going around in the press. This was also kind of another pivotal time when the NSA Ant catalog. So Snowden happened around the same time. This is often incorrectly misattributed to him, but there were a lot of leaks that happened around that time, both with and without Snowden, that kind of opened my eyes to the level of games and just technology happening in computing.

• 1:12:15Speaker 03

  Yeah, I mean, I already knew a decent amount of it, but the Ant catalog, man, that had, it was just like, you know, when you're growing up and there's like the spy tools in the back of the magazine on disappearing ink and, you know, all those things. This was like that on crack, dude. It was like, they had a malicious cable in there. This, when was it? It was leaked in 2013.

• 1:12:43Speaker 03

  The catalog was dated 2008 and they were announcing in 2009, they would have these cottonmouth cables available for, you know, purchase to their ecosystem of, you know, whoever they sell to in the NSA. Um, the price on those, I think it was a minimum order quantity of 50 with a $20,000 per cable price tag. It's like, wow, amazing. But, you know, it had all these electronics inside, a radio inside and that, that was cool. Um, and actually, yeah, pull this up again.

• 1:13:30Speaker 03

  Cottonmouth, that's, this, this is the page out of the catalog where it shows, uh, it's really chunky cable, like really, really thick hood, but they, they sandwiched a whole bunch of different PCBs inside of this thing. And, you know, that's stuck in my head, obviously.

• 1:13:49Speaker 02

  So what does that do?

• 1:13:50Speaker 03

  They weren't super specific about the exact capabilities, but, you know, it had a radio, it had some ability to manipulate USB. I, I mean, I would, based on all of my reading in here, it's the, the latest generation OMG cable is basically a dead match to its capabilities, um, from what can be deciphered from this page. So, all the way down to like covert exfiltration and stuff like that.

• 1:14:19Speaker 02

  What were they using it for?

• 1:14:21Speaker 03

  Ah, it's a good question.

• 1:14:23Speaker 02

  What's the thing? What does the sheet say?

• 1:14:25Speaker 03

  Um, it doesn't, it just, it just, it's more of a capabilities thing, like getting through and breaking security effectively. So I, I mean, I would imagine this gets implanted into spaces that are higher security. Like, you know, if you can't just walk in and do stuff, or if you can't do the easy things, you're going to start having to use these types of tools to get into a place, have somebody plant a cable, and then you've got remote access. They, they, there were a lot of other tools in this space.

• 1:14:59Speaker 03

  Like implanted video cables that you would implant on a monitor. So you could remotely read what's being displayed on the monitor. Lots of cool tricks like that. Some, some were long range, some were short range, but all kinds of crazy spy gear that would allow impressive capabilities that very few people in the private civilian space even consider defending against.

• 1:15:27Speaker 02

  Interesting.

• 1:15:28Speaker 03

  Yeah.

• 1:15:29Speaker 02

  So what is the Ant catalog?

• 1:15:31Speaker 03

  Yeah, I forget the, if, if there was ever a mention of what Ant stands for, but it was just this leaked catalog with all of the different.

• 1:15:41Speaker 02

  It was a leaked catalog?

• 1:15:42Speaker 03

  Yeah, somebody leaked it. It's, a lot of people say it was from Snowden, but like if you actually trace it back, it wasn't. It was never at least attributed to Snowden. Yeah, that just came out and you get to look at the amazing spy gear that is out there.

• 1:16:00Speaker 02

  What's some other stuff that caught your eye?

• 1:16:02Speaker 03

  Um, definitely those, those video cables. I'm trying to remember all the different things. If you can pull it up actually, but yeah, you, you want to pull it up right now? I can pull it up on the internet.

• 1:16:12Speaker 02

  Pull it up?

• 1:16:13Speaker 03

  Sweet. All right, cool. So yeah, let's go through just a few of the pages of the Ant catalog. I haven't done this in a while, so.

• 1:16:22Speaker 02

  Right on.

• 1:16:23Speaker 03

  Rusty. But yeah, so let's look at just the hardware stuff. We got, let's see, what is this? This is a short to medium range implant for RF transceiver. It was, uh, this is a component that adds RF to one of the other pieces they have in here, which they call a digital core, to provide a complete implant. So it's kind of like a customizable, build your own, what kind of implant do you need? They put this into various pieces of hardware. There's actually, I think it's over here. Here's kind of another implant, they call this the Lux Rabbit. It's a hardware implant designed specifically for Dell Power Edge servers, like a specific one.

• 1:17:08Speaker 03

  Hooks to, it's called a JTAG debugging interface. Basically, a lot of hardware has like a debugging interface. If you get access to that electrically, you do a whole bunch of stuff. You can implant things at a really low level on that machine. They give you all kinds of access, right? Give you lots of data. So if you've got an implant that goes into there and hooks up to it, you've got like permanent access. Similar to the, like I was describing with the USB cable, with that covert exfiltration mechanism. But this is baked into the machine. So I would imagine the way this happens is during mailing interdiction. So, you know, Dell ships a server over to the customer, right?

• 1:17:53Speaker 03

  And our government knows this is happening. They grab it in the mail, crack it open, put one of these inside, close it back up, send it off to the intended target. And now they've got long-term access inside there. Even if they wipe everything, like down to the hard drives, put new hard drives in, you can still get right back in. They would have to crack everything open and look at all the hardware to find this type of stuff. Really cool, really cool type of implants.

• 1:18:19Speaker 02

  Wow. And there's no way to know that?

• 1:18:22Speaker 03

  I mean, there are ways, but yeah. Yeah, you gotta know what you're looking for, basically.

• 1:18:27Speaker 02

  Do you worry about that stuff at all?

• 1:18:29Speaker 03

  I mean, it depends. Like, I, me personally, no. I know the types of targets that this is destined for. And like, you know, I, I'm not one of those targets.

• 1:18:46Speaker 02

  What kind of targets is that?

• 1:18:47Speaker 03

  I mean, well, I mean, the Israeli pager situation. Great example of like,

• 1:18:54Speaker 03

  Do I worry about my pager exploding? Like, I'm not Hezbollah, so, no, I'm not worried. Just for example, just to put a very pointed, like, answer to a very current topic. For instance, right? Now, there are certainly lots of gray area. We've seen lots of gray area where it's like, wait, you're doing surveillance on US citizens? And like, that generally isn't happening, like, with hardware implants and stuff like that, that's access to telcos, internet providers, and, yeah, that's... I operate very openly, so it's not, you know, I'm a little less concerned, but it's

• 1:19:38Speaker 03

  more of a political and philosophical, like, you know, when nobody's got privacy, it changes society in ways that aren't very good. That's where I'm more worried.

• 1:19:49Speaker 02

  How often do you think the US was used on its own citizens?

• 1:19:52Speaker 03

  I mean, this specifically? Like, I would suspect-

• 1:19:55Speaker 02

  These types of things?

• 1:19:56Speaker 03

  Um, well, hardware implants, let's go with hardware. I don't know how often hardware implants would be used, that tends to be super-targeted. Like, and super-target also generally, I would assume, I would hope, means significant more legislative, kind of, not legislative, legal oversight, where, you know, you're getting the warrants and all these other things. Whereas these really wide net things, which hardware's much harder to make wide net. Wide nets where you can collect all the things because you've got access to telco, phone, internet-type providers, and you're just slurping everything up. Yeah, everybody would then be pulled into that. That's the kind of stuff that Snowden showed, right? That's a different story.

• 1:20:39Speaker 03

  That's, everybody's get pulled into that one way or the other type problems that occur.

• 1:20:48Speaker 03

  So I do you have to worry about people getting, you know, breaking into your network and just causing problems in your life? I don't, that's a, that's a complicated topic. Like it's more privacy invasion at that point. And it's like, yeah, what are we worrying about? Are we worrying about our personal safety, our personal freedoms? Society as a whole and the health of it, if they, you know, and a free press. I guess, yeah, it's, it's a very large, complicated topic.

• 1:21:16Speaker 02

  Do you think China's putting this stuff into the electronics that we're buying from them?

• 1:21:20Speaker 03

  Um, I mean, not like in the sense of like consumer levels. I mean, it, it depends, right? Like.

• 1:21:28Speaker 02

  Could it be accessed from that far away?

• 1:21:31Speaker 03

  If they wanted to, anyone, if anybody wanted to do that, yes. But the thing is doing it to just like off the shelf consumer stuff is a lot harder to do in terms of hardware implants. If you wanted to do it that way, that's where we get more into the software level, like software backdoors, which we've seen in things like cryptography, right? Um, you know, it's posited that a lot of cryptography backdoors were put in by cooperation with like the NSA, for example. A little rusty on this stuff, but basically that becomes very valuable when you're slurping up all the internet data and a lot of that's encrypted. But if you know how to quickly break the encryption, well, now you can see the contents. And that's where that comes in.

• 1:22:16Speaker 03

  And yeah, it's.

• 1:22:19Speaker 02

  I mean, a lot of people say that that kind of hardware is installed into our power grid.

• 1:22:25Speaker 03

  Um, yeah.

• 1:22:29Speaker 03

  Depends, I would say. Well, God, I have forgotten, I think, I think China makes a lot of our like power transceivers and stuff, but.

• 1:22:38Speaker 02

  Make a ton of it.

• 1:22:39Speaker 03

  I honestly, from what I've seen and the people I've talked to that work in all this stuff. I don't think physical implants are quite needed. Like, things are just not secure remotely, like externally. Like, you don't want to... Literally, I think it was yesterday, maybe. I don't know. It's something that news that has come over the last few weeks, where our own government is saying, everyone... I think it was actually to their own government employees, to use Signal, use iMessage, use encrypted chat. Do not use text messages because China has... They're just in all of the telco systems right now,

• 1:23:22Speaker 03

  which means they wouldn't be able to read the text messages, right? They didn't need hardware implants that I know of to do this. Maybe they did that to get in. But now they're in that system, right? Like, I mean, I've helped in environments that a foreign adversary had gotten into, and it took a bunch of time to evict them and find where they are. And it was done all remotely, right? Like, there's... A lot of this stuff doesn't require, like, the James Bond-type hardware to get in.

• 1:23:51Speaker 02

  Interesting.

• 1:23:52Speaker 03

  Yeah, that's a tricky topic.

• 1:23:54Speaker 02

  Interesting. Do you worry about it?

• 1:23:59Speaker 03

  I mean, there's so many things to worry about, though. Like, yes, kind of.

• 1:24:08Speaker 03

  There's... Once you've seen enough, like, horror shows, though, you're like, wow, wow, everything's just broken. And society as a whole, it's amazing that it operates. Just the levels of trust. Like, one person is all it takes. Enough well-placed, like, damage. And whether it's security or just electrical power grids, all these things, there's... All of it can just tip over, right? With just enough of a push. And, like, everything's that way. It's not just security.

• 1:24:43Speaker 03

  Yeah, so I don't know, I kind of just lump it all together of like, this is a really good experiment for humanity. I mean, humans have been, what, on this planet for, some say, 300,000 years, right? Like, we're living in the best time. There's, I don't think there's a single person alive today who would be like, "Yeah, bring me back at random more than 100 years ago." Sign me up. Like, that's, that's, that's not a good, the odds are not good, right? Like, we're the most comfortable we've been, most well-off, on average, across the Earth in this last 100 years. And, you know, it's a good experiment, and things are volatile. I mean, that's kind of the consequence of freedom, too, right?

• 1:25:25Speaker 03

  Like, it's, the people gotta, gotta maintain it.

• 1:25:30Speaker 02

  What text messaging app do you use?

• 1:25:32Speaker 03

  I like Signal. Signal's great.

• 1:25:34Speaker 02

  You know, there's a lot of rumors that the CIA created Signal.

• 1:25:36Speaker 03

  I'm sure they did. I mean, so, the, I think they helped fund it, actually, but they helped fund a lot of things, our government, in many ways. But, I mean, Signal is an amazing tool if you're an agent as well. Like, you're gonna be overseas, in hostile environments, and you need to communicate. How are you gonna do that securely? Are you gonna use a secure tool that stands out like a giant red flag because nobody else is using it? Probably not the greatest thing. It's like, "Hi, I'm an agent. I don't know what you're saying, but there's an agent right there," right? Like, I mean, obviously, there's answers to that and stuff, but it's valuable as like, "Oh, that's just the tool everybody uses."

• 1:26:16Speaker 03

  Signal, and everybody's got that, right? Like, that's, that's valuable. Um, you know, obviously, there's always trade-offs, right? It's like, it can be used for bad, it can be used for good, and, you know, who's bad and who's good and who's perspectives.

• 1:26:30Speaker 02

  Yeah. I mean, that's how we communicate via Signal.

• 1:26:33Speaker 03

  Yeah, yeah, exactly.

• 1:26:34Speaker 02

  Is that how you communicate with everybody?

• 1:26:35Speaker 03

  A lot of people, yeah. I mean, I'll meet them where they're at, right? Like, my manufacturers and stuff don't use Signal. They've got different governments over them and things like that, that, uh... Yeah, it's interesting. So yeah, whatever you use, I'll meet you there. But contextually, it matters like, okay, I'm on this platform, which can be seen by these adversaries. Cool. Noted. I'll make sure I keep that in mind, which is kind of the whole point of like, the psychology, when you know you're being watched, changes how you behave in ways that can be negative.

• 1:27:16Speaker 03

  Like, if you're always being watched by somebody, what does that make you? How does that make you behave?

• 1:27:23Speaker 02

  Different.

• 1:27:23Speaker 03

  So, yeah, yeah, I mean, there's lots of other, other cool things in this catalog, like, oh, reflectors. So this is for picking up audio. This is standard audio bugs, right? Like, spying on what's happening in the room. What else we got? Lots of cellular-based stuff. Now, this is like 10 years old at this point, so a lot of this stuff is well-known. Really tiny implant. So this is, this is like a, probably a VGA cable here, or like an older monitor, which made more sense back in 2008. Really tiny implant into that cable,

• 1:28:08Speaker 03

  tapped to one of the color signals, and it would allow somebody to kind of energize it with like a radio pointed at it, more or less, and then receive the signal bouncing back with the video signal encoded in the bounce. So then you'd be able to see what's on their screen.

• 1:28:29Speaker 02

  Wow.

• 1:28:30Speaker 03

  Really cool stuff, right?

• 1:28:31Speaker 02

  What do you think was in the spy balloon that was traversing the?

• 1:28:34Speaker 03

  I don't know. I haven't studied those well enough, but I mean, there's a lot of amateurs that just do that. Like, it's, they'll just set up a balloon and it's kind of like the ham radio space, kind of in a way where they're just like, oh, you know, we can track it. There it goes. It goes around.

• 1:28:51Speaker 02

  Let me rephrase that question. What could have been? What could it have been?

• 1:28:54Speaker 03

  I mean, I don't, I don't know, man. There's, that's probably outside of my skillset and awareness and research, but I mean, it could be used like a balloon. I mean, I'd probably, probably be using a drone more. Uh, cause the problem with balloons is that they're much more higher altitude, which causes problems for a lot of electronic circuitry because it gets really cold and stops functioning. Also, you know, you've got power that you gotta deal with. So the best you can get is battery. That's not gonna, batteries also start to fail at that, that level of cold, right? So you need special batteries, something to keep it warm, which means more energy. So you're getting it from solar power, probably.

• 1:29:37Speaker 03

  This is really low power stuff, right? Like, I don't know. I may, maybe just the value of how does someone respond to putting something in their awareness?

• 1:29:48Speaker 02

  Yeah.

• 1:29:48Speaker 03

  Which is absolutely a thing, right? How does someone respond? Which, I don't know, it was similar to the drones that are popping up and they're just like, I don't know where that's coming from. New Jersey had one recently, but there's lots of like drones in the sky. I'm like, I don't, I don't know what that is, but I would love to find out. And is it collecting data or is it just seeing how people respond to unknown, unreported drones in the sky?

• 1:30:12Speaker 02

  Yeah.

• 1:30:12Speaker 03

  Uh, for, you know, tactical knowledge in the future.

• 1:30:15Speaker 02

  All right, Mike, let's get into some of the stuff that you make. I know you have exploding hard drives. You got the, the OMG cable. You're, you're making all kinds of just crazy wazoo wizardry gadgets that I am just fascinated with. And, um, so where, where did this kind of start? Did it start with the exploding hard drive, uh, USB drives?

• 1:30:37Speaker 03

  Yeah. I mean, kinda like I'd always been tinkering with things like, like those beam bots, right? Um, but yeah, so I think it was on Twitter or something. I saw just a picture of somebody with a USB drive. The shell was open and there was just like a firecracker sitting inside of it. No idea if it worked or not, but I'm just like, everybody has like the same visceral response to seeing that. Like, oh shit. Exploding thunder. And I'm like, you know, it'd be cool as if it was worse. So USB rubber ducky, got to explain what that is first for this to make sense. My now business partner Hack Five invented the USB rubber ducky, I don't know, like 15 years ago now, something like that.

• 1:31:18Speaker 03

  It does the same basic keystroke injection that I had demoed with the cable, right? Where you plug it in, it types something really fast, whatever you want to control a computer, or whatever you want, right? I wanted one of those that also exploded. So first thing I had to do is if you open up a rubber ducky, there's not much space in there. It's all electronics. I'm like, okay, how can I shrink this really tiny so I have space for something that goes boom? So I spent a lot of time playing with that, right? Now, I didn't recreate a rubber ducky exactly. Like, it's a really, really limited version, like a 200 keystrokes, really slow, done, right? That's it.

• 1:32:03Speaker 03

  Really hard to use, but it was tiny. And I shrunk it, and shrunk it, shrunk it, shrunk it, and it's just, I don't know, I think it was like 8 by 10 millimeters when I was done, like a pill, basically. That left the rest of the thumb drive empty, that I could hook up a little mini detonator, and you know, some, maybe a firecracker or two, and a bunch of confetti. And I rigged this up to a keystroke injection payload that opens a browser to animation of a Jack in the Box, and he's cranking it, right? On the screen, except it goes for awkwardly long amount of time to build up tension. And it's going, it's going.

• 1:32:41Speaker 02

  That's what shows up on the screen?

• 1:32:43Speaker 03

  Uh huh. So you're watching that, and then, pop! The drive blows up, confetti goes everywhere. And I'm like, yeah, that was cool. I just viewed that as fun.

• 1:32:54Speaker 02

  Yeah.

• 1:32:55Speaker 03

  Another type of art or something like that. Put it out on the internet, and it was like, that's crazy. A lot of people asked me to sell that. Now, no, that's a terrible idea for so many reasons, liability, et cetera. When you put something into the world that can be used negatively, it's always worth gaming out, like, how bad can it go, and can you prevent some of it? Which I've done a lot with the cable. But in this case, it was just something I wanted to put out there. But, now, at that point, I had a really tiny ducky, right? That I could... Maybe I could put it in other things. And eventually, I got the idea, probably like doing my IT job, looking on Amazon for spare parts for hardware and stuff.

• 1:33:38Speaker 03

  I noticed there were like USB cable repair ends and boots. I'm like, wait, what? Can I just get those? You know, at the time, I didn't know much about manufacturing, right? Got some of those and realized there was enough space in them for the cables and this really tiny, you know, fake ducky, right? Shove it in there and I get the very first proof of concept of a malicious USB cable. Um, yeah, I put that out and, you know, I already told the story about that one where, you know, it gets out there and a lot of people like it and a lot of people wanted it. Uh, I think almost a year goes by before I'm like, you know what? I could make that way better. Like, that's, that was a toy.

• 1:34:22Speaker 03

  Like, this is like a cool gimmick to show, like a very basic prank, barely even worked for that. What would, what would a proper tool look like? And, you know, I was getting way more into like the concept of I want to do red teaming as well, so I'm combining those things. And, yeah, like, okay, well, I need Wi-Fi, I need remote control to update payloads after it's already in play, because the idea is you can either deploy a cable, like physically get inside, or you could just leave it in somebody's bag, leave it, just leave it around and eventually, you know, people are gonna take a cable sometimes and they'll bring it in with them. Yeah. To the secure space. Like, cool, I didn't have to even go in. Great.

• 1:35:03Speaker 03

  Um, which creates some interesting legal problems, which we can get into, that I've also solved. Um, but, uh, that, yeah, that kind of is just how it kept evolving. And then at that point, it's like, okay, this is a real tool. At the time, I was thinking I should do this in a way that I just make it open source and everyone could make their own. Are we still talking about the USB? Yeah, the USB cable. Okay. And that's, uh, I, I thought about that, right? Like, I was prototyping this cable, this new one, like, on, on a desktop mill for cutting PCBs, right? Like, I was pushing the limits on this machine where you can mill a PCB. So the PCB, actually, I got a little problem with this.

• 1:35:50Speaker 03

  So a PCB, like here is, here's a complete product. This is a Raspberry Pi, right? When I say PCB, I'm talking about just the green part here.

• 1:35:59Speaker 02

  Oh, good.

• 1:36:00Speaker 03

  That's just, it's basically a fiberglass and epoxy with a thin layer of copper on it that gets turned into traces and that connects all of these components. The black thing there, that's a component. And all the little things you see on there, they're soldered on. It's components with copper traces connecting them together electrically, right?

• 1:36:19Speaker 02

  Oh, good.

• 1:36:20Speaker 03

  So I used a mill to kind of cut out the copper traces. And I would assemble in my garage, lots of different test versions of what this cable could look like. And I got the idea, you know, kind of going back to the Defense Distributed concept, where, oh, open source is this, people can make it on a desktop mill, go that direction. What I learned over the eight, 12 months of revising and revising is it's really hard to do this. Like DIY was just not in the cards. Nobody was going to be able to do this. I'm like, okay, well, let's throw out the DIY.

• 1:37:03Speaker 03

  I can just turn up the complexity. There's PCBs with two layers, like copper on each side, right? That's the common one. Those are, I can make those in my garage, but okay, what if I want eight layers or something like that? That like, that gets really expensive. We're talking every time I want to do a run of an eight-layer PCB, six-layer PCB is a minimum $1,000.

• 1:37:26Speaker 02

  Okay.

• 1:37:26Speaker 03

  Like I have to send that off to a factory. They're using lasers and all kinds of crazy X-ray inspection and stuff to do this. So I'm like, okay, if I can use that, how far can I go? And that kind of is how I evolved into making a more and more and more complex cable that is like the latest generation OMG cable. It does all of these different things. And yeah.

• 1:37:51Speaker 02

  Very interesting, very interesting. So, so how did you go, so you went from the exploding USB?

• 1:37:59Speaker 03

  Yeah.

• 1:37:59Speaker 02

  To the, to the, what do you call it? What do you call the USB?

• 1:38:05Speaker 03

  The exploding USB?

• 1:38:06Speaker 02

  The other one.

• 1:38:07Speaker 03

  The OMG cable?

• 1:38:09Speaker 02

  Yes.

• 1:38:10Speaker 03

  Yeah, I just OMG cable.

• 1:38:11Speaker 02

  But there was a hard drive, there was a USB cable to do with the OMG.

• 1:38:14Speaker 03

  Oh yeah, so yeah, I guess I just kind of call it like, uh, early prototype tests. Uh, I was, I was referring into it, I kind of at the time as like bad USB cable, which is not an accurate description. It was more of a nod to some, uh, research at the time that was called bad USB. That's where you would take an actual thumb drive. There's a, there's a few old, old thumb drives that you could take and reprogram the controller on it. And actually do keystroke injection, among many other things. It could, it was also a worm that would replicate to other thumb drives you would plug in. Cool concept, but.

• 1:38:49Speaker 02

  What was the first product you took to market?

• 1:38:52Speaker 03

  Uh, OMG cable, definitely.

• 1:38:54Speaker 02

  The OMG cable?

• 1:38:55Speaker 03

  Uh, so here's the thing, is I was making a lot of these things, like for like personal use, but I would also kind of sell it to friends and stuff, you know? It's kind of like the, the back alleys of DEF CON type situation, like.

• 1:39:07Speaker 02

  Cool.

• 1:39:07Speaker 03

  I wasn't advertising this, but it's like, uh, if you know, if you know me, I know you, I'll, I'll give you some of these things.

• 1:39:13Speaker 02

  Gotcha.

• 1:39:13Speaker 03

  Um, but it became clear, like, I, I had to start scaling up. Like, the first batch of prototype OMG cables, I think it was, uh, 2019, I brought as many as I could. They, they took me, oh, I, it was like eight or 16 hours per cable. And 50% of them were failures because like, that, that, which is terrible. Like, when you make something, uh, like an electronic product, usually you get like 95, 99% yields, which means, you know, 1 to 5% are failures that you throw away. Uh, these things were so hard to self-assemble that I was throwing away 50% of what I made. So that automatically doubles the amount of time invested to make a cable.

• 1:39:58Speaker 03

  So, you know, I'm doing like 16-ish hours per cable to make them.

• 1:40:02Speaker 02

  Wow, 16 hours of cable?

• 1:40:05Speaker 03

  Silly. So, yeah, I was kind of hitting my limit of like what I could accomplish with the time I had. And it's like, you know what? I need to learn how to like delegate this outsource manufacturing assembly. Cause I was also doing this like hand placing things. You go to an assembler. So there's a couple of steps here. So I'm going to run you through basically the manufacturing pipeline that I slowly learned is important here. But first hack five, it's really important to mention hack five here. So USB rubber ducky already mentioned, you know, that's Darren, Darren Kitchen is founder of hack five. He, you know, that was his, his baby invented about 15 years ago.

• 1:40:46Speaker 03

  He's got so many other things like the land turtle, the wifi pineapple, just packets.

• 1:40:53Speaker 02

  What are these?

• 1:40:53Speaker 03

  They're similar to the ant.

• 1:40:55Speaker 02

  What's the land turtle?

• 1:40:56Speaker 03

  Exactly. Right. So all of these are different kind of like hardware implants or hardware tools for. They're multi-purpose, but often used for offensive security. So like the land turtle is like a network implant that can control a computer, but also like sniff up a network data or just do malicious network stuff.

• 1:41:18Speaker 03

  What else? Wifi pineapple. This is a little box antennas on it that allows you to do network attacks, right? Really cool stuff.

• 1:41:27Speaker 02

  Network what?

• 1:41:28Speaker 03

  Network based, so wifi attacks, like you could break into wifi. You can, they call them like man in the middle concept. I like to refer to it as mischief in the middle. But basically, you know, you've got your device here and like the wireless access point here, right? They're talking, but you bring in a wifi pineapple and it can kind of intercept in between two. There's so many different ways you can do this. There's no one single way. It's lots of wifi based tooling. Another example, it's not so much relevant these days, but. You know, when you connect to like your free wifi access points, coffee shops and stuff.

• 1:42:10Speaker 03

  Your phone remembers that typically you've told, you've told it to remember that usually. So next time your range is going to automatically connect, right? The Wi-Fi pen and apple, for instance, can say, guess what? I'm that Wi-Fi too, right? So if I pull up one right here and put it next to you or just anywhere, you know, you happen to be, your phone's gonna be like, oh, that, I know that Wi-Fi. Let me connect to it, right? So that type of stuff, there's just so many different attacks that I couldn't possibly run through all of them. But that, just as an example, like, there's so many different approaches to security. Like, we think about computers and you're like, plug in USB in, but yeah, there's, there's other things. There's the network, there's the wireless, there's near field communication with like

• 1:42:55Speaker 03

  badges and things like that. Totally, totally different tools, totally different specialties and focuses. Like, the badge readers, you don't think of as computer security for the most part. It's just building access, right? But that's all one whole thing.

• 1:43:12Speaker 02

  Interesting.

• 1:43:13Speaker 03

  When you're doing proper, complete security awareness and testing.

• 1:43:16Speaker 02

  Well, let's take a quick break.

• 1:43:18Speaker 03

  Yeah.

• 1:43:18Speaker 02

  When we come back, I want to get into what is the actual OMG cable?

• 1:43:22Speaker 03

  Oh, yeah. Good point.

• 1:43:24Speaker 02

  Perfect.

• 1:43:28Speaker 01

  College football is back. So Hilton called to me, the superstition concierge, to make your fan rituals a reality. Need a room to match your lucky number? We got you. Want to make sure our team doesn't wash your lucky jersey? Oh, that smells lucky. Hilton's unmatched hospitality can keep up with any superstition. Even a marching band wake up call at 5:55 and 55 seconds. Hit it! When you need a team that will do whatever it takes on game day, it matters where you stay. Hilton, for the stay.

• 1:43:58Speaker 05

  This episode is brought to you by Born in Roma Fragrances by Valentino Beauty, the iconic fragrance duo. Donna Born in Roma Eau de Parfum is a feminine fragrance featuring juicy black currant, central jasmine, woody cashmerin, and warm vanilla. Its masculine counterpart, Wommo Born in Roma Eau de Toilette, has notes of fresh violet leaf, aromatic sage, green vetiver, spicy ginger, and mineral salt. Shop at Macy's.com.

• 1:44:37Speaker 02

  Alright Mike, we're back from the break. We're talking about the OMG cable, but you know, we need to, I want you to discuss and talk about exactly what it is that the OMG cable does and show us an example. And for those that are listening, if you go to Mike's, Everyday Carry does a phenomenal job at actually showing what it does, real time, on computers, on phones. It's fascinating. But go ahead and give us the, you know, show us what it is and walk us through what exactly it does.

• 1:45:12Speaker 03

  Yeah, definitely. Let's pull one up. Visual. There's a good one. So OMG cable, right? Looks exactly like one of the many USB cables you've got. And if it doesn't, I got a whole bunch more here to guarantee it does.

• 1:45:32Speaker 02

  Sure, yeah. Hold that. Oh, let me see that. Yeah, so it's got a whole, a whole line of them.

• 1:45:40Speaker 03

  Yep.

• 1:45:41Speaker 02

  And I got the complete set.

• 1:45:43Speaker 03

  Yeah, you did.

• 1:45:44Speaker 02

  Watch out. But yeah, so what is, so each one of these fit a different phone or, and/or USB drive?

• 1:45:52Speaker 03

  Yeah, I mean, so basically, think about like-

• 1:45:54Speaker 02

  I should say.

• 1:45:55Speaker 03

  Yeah, I mean, think about all the different, uh, and it's, think of it as camouflage, basically. It's like, what's the environment? Do they use white cables? Do they use USB-A, USB-C? Is it a Mac shop? Cool, they're gonna have lightning on one end, maybe, if they got the older phones. If it's newer phones, cool, and USB-C. And it's really about blending in to fit what's already in place, so you could swap it out, or you can do other things. There's a lot of different approaches and techniques you can have when you have a device that is physically invisible.

• 1:46:31Speaker 02

  Mm-hmm.

• 1:46:32Speaker 03

  And it's just hiding in plain sight. So that's, that's the physical aspect of it. And that took me a huge amount of time of shrinking down the components, which I will describe in just a second. But shrinking it down is, it just took absurd amounts of time, just designing the PCB that goes in here, and then beyond that, just the entire process of integrating the PCB into a cable. That just took like a year, basically.

• 1:46:57Speaker 02

  Well, before we get into how you manufactured it- Let's talk about what it does.

• 1:47:02Speaker 03

  Yeah, exactly. So the PCB inside of here, what it does is when you plug it into a it's primarily targeting laptops and desktops. Um, it's got a PCB that will wirelessly kind of light up and it'll connect back to you. There's so many different ways you can configure it, but this wireless connection allows a remote connection into the cable. Get a full web UI in your web browser, right? Whether it's on your phone or laptop. Can even connect out to the internet and you can connect to this thing from anywhere, anywhere on earth if you, if you do it that way. What's, what's it do though? You got control of this wirelessly.

• 1:47:40Speaker 02

  When you, when you say it can connect to the internet, does it? Does it bypass passwords?

• 1:47:45Speaker 03

  No, um, you still got to have like a wireless network. It can connect to or, or you bring one in. Like if I, if I opened the, my phone right now and looked at all the wireless networks, I bet there's probably one in there I could connect to. If not, like, are you going to notice like a free coffee shop wifi nearby?

• 1:48:03Speaker 02

  No.

• 1:48:04Speaker 03

  For instance, right? There's the flexibility is the name of the game with this. There's no one way to use it. There's so many ways because in a red team scenario, you don't know what you're up against and you're going to need some options to circumvent.

• 1:48:16Speaker 02

  Hmm.

• 1:48:17Speaker 03

  But yeah, still, what does it even do? Really, you're connected to it, but um, it primarily emulates a keyboard. Says, I'm a keyboard and it types really fast. So what does that do? Literally anything I could do sitting at the computer at the keyboard. See, yeah. So whether that's implanting malware or whatever it may be, right? That's, that's kind of the, the basic functionality of it. But I mean, it's not it. Um, USB cables can often connect a keyboard to a computer. You're sitting at a desk. Swap out that cable and this can now intercept the keystrokes, which is really good.

• 1:49:00Speaker 03

  Uh, just like one classic use case is. If the machine is locked, I mean, you can type all you want, but you're at a lock screen. You need to get past the lock screen. What do you need to get past the lock screen? You need the password, right? How do you get the password? There are a lot of ways. I mean, you could call up the person and effectively ask them for it by saying, "I'm IT," or something like that. But if you're deployed between a keyboard, you can just pull it right off the lines. They're gonna type that password every single time they log into the computer. You remotely see that, you rebuild a new payload that maybe when they go to lunch in the evening, when you know they're not at the machine anymore, it's just gonna type in that password, automatically unlock the machine,

• 1:49:43Speaker 03

  and then do all the nefarious things you want it to at that point.

• 1:49:47Speaker 02

  So you just have full access to the computer?

• 1:49:51Speaker 03

  Yeah, at that point, yeah.

• 1:49:52Speaker 02

  You can see everything, you can access anything, so long as you capture the password from the keystrokes?

• 1:49:59Speaker 03

  Yes, not so much seeing, not, well, there's a lot of, it depends, right?

• 1:50:03Speaker 02

  Is it like a screen share, like that team viewer thing?

• 1:50:06Speaker 03

  Not, not, not at this stage. So at this stage, we're just blindly sending keystrokes in, right? So as long as you know, you know, what OS it is, or something like that, that's, that's, that's all you need on a desktop. Like, I know if I had command space, it's gonna open up Spotlight on a Mac, and I can open up Chrome, and then go to the address bar, do some things, right? For example, like, that's a very repeatable series of keystrokes, and you can do them really fast, once you know it, just for an example.

• 1:50:36Speaker 02

  Okay, alright.

• 1:50:37Speaker 03

  So that's, that's the basics of the very core functionality. And then you combine that with key logging, and suddenly, you're, you're getting a bigger picture here. But there's also other-

• 1:50:49Speaker 02

  Hold on, I wanna go down-

• 1:50:50Speaker 03

  Yeah, yeah, totally.

• 1:50:51Speaker 02

  I'm a, I'm a dummy with a shit.

• 1:50:53Speaker 03

  Yeah, let's go deep.

• 1:50:54Speaker 02

  So, yeah, so what would you, so now, I didn't even understand that, to be honest, when we did the EDC pocket dump. So basically, you're, so when that little window, you said there'll be a window that might pop up for-

• 1:51:07Speaker 03

  Oh yeah, so you see a little window blink, right? That's basically your terminal, in that case. There's, there's a lot of things I could do. But in that case, on that, I think it was, uh-

• 1:51:17Speaker 02

  So you could put some type of a Trojan horse or something in there.

• 1:51:22Speaker 03

  Yep.

• 1:51:23Speaker 02

  And implanted in the computer like very.

• 1:51:25Speaker 03

  Exactly, right.

• 1:51:27Speaker 02

  Through a series of keystrokes.

• 1:51:29Speaker 03

  Exactly. And then if you detect the Trojan on there and you remove it, and the cable's still in play, which it's designed to be, just put it right back on.

• 1:51:39Speaker 02

  No shit.

• 1:51:40Speaker 03

  Which is absolutely a thing that has happened with a bunch of my customers that they have told me that, you know, they did an engagement with a very high-profile client. We can go into these types of things, but that reinfection vector is exactly what they used.

• 1:51:54Speaker 02

  Do you prompt it, or does it just automatically do it when you put it in the computer?

• 1:51:58Speaker 03

  Either or. So all about flexibility. So you can program this a couple of different ways. So what I showed was me remotely connecting to it and I hit go. But this can be configured that when it powers up, when it gets plugged in, it powers up. It can immediately run a payload. It can wait a series of, you know, however long you want and then run a payload.

• 1:52:19Speaker 02

  Is the payload the actual keystroke?

• 1:52:22Speaker 03

  Yeah, exactly. So when I say payload, it's the key, the series of keystrokes that gets run.

• 1:52:27Speaker 02

  And the malware or the Trojan horse or whatever?

• 1:52:30Speaker 03

  You can. There's ways of typing out, like if you've got like a small executable that you want to transfer over, there's a couple of ways to do that. Like you just use the keystrokes to download it, right? You can download stuff from like the terminal, for instance, or I could use Chrome and download it there and go to the Downloads folder and open it up there.

• 1:52:48Speaker 02

  Through keystrokes?

• 1:52:49Speaker 03

  Yep. I can navigate everything with keystrokes.

• 1:52:51Speaker 02

  So you could, I have no idea what the hell I'm doing with this shit, but I'm learning.

• 1:52:56Speaker 03

  We can do some fun stuff.

• 1:52:57Speaker 02

  So you could send somebody an email and with a, with a downloadable whatever.

• 1:53:05Speaker 03

  Yep, that's one way. Yep.

• 1:53:07Speaker 02

  And then.

• 1:53:10Speaker 02

  Plant that cable on them. They plug the cable in. It does the keystrokes automatically to open Chrome, log into their email, download the thing.

• 1:53:20Speaker 03

  Yeah, it's one way. Yep.

• 1:53:21Speaker 02

  Go to the Downloads folder, download it, then you're in.

• 1:53:24Speaker 03

  Yep.

• 1:53:25Speaker 02

  And it all happens within like a couple of seconds.

• 1:53:27Speaker 03

  Yep. That's one way. I mean, I probably wouldn't email it to them because if I was gonna email it, I probably include an email that convinces them to just run it for me.

• 1:53:34Speaker 02

  Mm-hmm.

• 1:53:35Speaker 03

  But if I'm up against a hardened target where it's they're not susceptible to that, they're unlikely to do it, I'm like, okay, well, let's get a cable that'll do it for me. Um, as an example, right? This can also do mouse movements too if we need. Um, lots of control there. And yeah, it's, you can also, yeah, so the malware, right? You can download that. You can also type it back out. Um, it's called Base64. It's just a whole bunch of, it looks like random garbage characters. If you open, like if you open up an executable with a notepad roughly. Stay in high level here. You're gonna see a bunch of garbage text, right?

• 1:54:16Speaker 02

  Mm-hmm.

• 1:54:16Speaker 03

  But you type that same text out in the notepad and save it. It's that executable. So I can type that back into the computer. And boom, there's the executable, which is something we've done quite a bit in environments where they're checking what is being downloaded from the internet. Okay, you're looking at the internet, cool. I'm gonna just type this this little piece of malware back into the computer. Um, lots of cool tricks you can do like that.

• 1:54:46Speaker 02

  Wow.

• 1:54:47Speaker 03

  Fun. And, and so there's other aspects of this too. So, you know, keystroke injection, mouse injection. I showed you the key logging. Oh, you were asking about the ways of triggering it. So I showed you remotely, I can click go. We can have it boot up and go. There's also, uh, what I refer to as geo-fencing. Basically, it's got wireless in there, so it can just look at the nearby networks and figure out where it is and where it isn't. And you can trigger or block things on that. And... There's a self-destruct function where it'll erase everything on it. Now, it sounds super nefarious, but it's actually prompted by legal.

• 1:55:25Speaker 03

  A lot of places have strict controls. So with the USB rubber ducky does the keystroke injection. It looks like a thumb drive by Hack 5. That's my business partner. They invented that 15 years ago-ish.

• 1:55:42Speaker 03

  What they would do is you could put like salaries.exe on it. So it's like, oh, that must be the company salaries and litter it in the parking lot, right? That's one way that people would be convinced to pick it up in the parking lot. Bring it inside, plug it in, see what's on it, right? And boom, they've just infected themselves with malware, right? There's a downside to that, which is depending on how bad that payload is. If you're a red team, you're an employee of this company, right? You've got malware sitting on a loose object that anyone could pick up and bring it home, bring it into another business, and now you have just infected another business. That's not ideal, right? So certain environments, their legal team is like, no way.

• 1:56:27Speaker 03

  You put geo fencing on this. You have a payload where it boots up and it just says, "Am I in the office? Is the corporate wifi present? Cool. If not, completely wipe everything."

• 1:56:39Speaker 02

  Are you shitting me? So you...

• 1:56:42Speaker 02

  Wow. Wow. So it knows where it's at?

• 1:56:46Speaker 03

  Yep.

• 1:56:48Speaker 03

  And where it isn't.

• 1:56:50Speaker 02

  Holy shit.

• 1:56:52Speaker 03

  So this scan right here, this was done by Lumifield. They've got a CT scanner, which is basically an X-ray scanner that takes a lot of X-rays, little slices across a product, and then assembles it into a 3D object. So Lumifield, I actually just did some work with them to, you know, sit down and talk about their machines. They use for all kinds of things. Manufacturing inspection, but also starting to get into like a lot of security stuff, like where you can literally see inside. This is a scan of the end of one of my cables. So right here is the connectors, USB connectors. And over here, we've got the components. So this is the main processor. And this little thing over here is the antenna. You can kind of see the USB wires run out the bottom there.

• 1:57:36Speaker 02

  Wow.

• 1:57:37Speaker 03

  And the cool thing is, let's see if I can turn this.

• 1:57:42Speaker 03

  There it is. That is the whole internal and lots more components kind of on the back. You can use this to step through every layer and just see literally every little detail about something. So if you got untrusted hardware, for instance, that scanner would reveal all of the internals. In this case, it's just really cool and it shows off, here's what's inside my cable.

• 1:58:08Speaker 02

  Man.

• 1:58:08Speaker 03

  All the magic.

• 1:58:09Speaker 02

  You gotta get that framed.

• 1:58:11Speaker 03

  Yeah, I think I'm gonna. It's a beautiful scan.

• 1:58:14Speaker 02

  That is very cool.

• 1:58:15Speaker 03

  Yeah. They have done a lot of work to kind of democratize the access to CT scans. CT scanning machines are normally this industrial machine that's really hard to use and really expensive. Like, we're talking like a million plus dollars for machines, roughly. They do a subscription where it's like the cost of a maintenance contract. And they did some amazing stuff to make it super usable. Like, you can see me turning this. It's super easy to use the outputs and set it up. And they did something magic, and I don't know that they communicate this, but the sensor in a x-ray machine normally decays and you have to replace it.

• 1:58:56Speaker 03

  They've somehow made like an eternal scanner, so it reduces the cost as well, which I don't know. I'm completely obsessed with their technology right now, so sorry for the momentary splurge on that, but...

• 1:59:08Speaker 02

  Oh, that is super cool. Super cool.

• 1:59:10Speaker 03

  Good stuff.

• 1:59:11Speaker 02

  Who are your customers?

• 1:59:12Speaker 03

  I got everyone, basically. So here's the thing. Me personally, I've got one customer, Hack5. And we can probably go into the story about how we met. But basically, when I was making these things by myself and I needed to take the jump into manufacturing, I had a lot of bad experiences, but Hack5 was amazing. They're like, "Let me just kinda show you the ropes," right? Manufacturing, running the business, all this stuff. Darren has been great to me. So I sell all of my stuff to him and all of my products are available on Hack Five as a result. They take care of who gets it and they have very tight expert controls.

• 1:59:55Speaker 03

  There's a lot of countries they would just will not ship to. Can I just go on there and buy it? Yeah, you can. You're not in a prohibited country. Wow. So yeah, you can just go in there and buy it and hobbyists can use it. Security researchers, awareness training. So that's where you go on stage and kind of just show off concerning things so that people will change their behavior and primarily red teams. There's lots of red teams in the private space, you know, Fortune 500s, military, industrial, government, all have their own equivalencies to that. And again, the red team is where you are emulating what an actual attacker does from end to end.

• 2:00:35Speaker 03

  Penetrating to the company, getting into the company and all the entire chain of hopping around and getting to the crown jewels, pulling those back out, that is red teaming and

• 2:00:47Speaker 03

  this is used a lot there. So I have a lot of customers who will also reach out just for advice on how to use the cables or maybe they've run into a situation like that legal constraint. Like, hey, this is cool, but like, oh yeah, cool. Let me just fix that and solve that legal problem. Now, I don't know like the full scope of what they're doing, but it's like, oh, here's a problem. I can solve that for you.

• 2:01:11Speaker 03

  There's, yeah, every, they are, the people I've talked to and now I've, I know a lot more than I can talk about here, but there are plenty of people who have said, yeah, you're going to Sean Ryan. Go ahead and you can talk about it this way. Couple of people. Who are those people? Yeah, so.

• 2:01:31Speaker 02

  Is it my former employer?

• 2:01:34Speaker 03

  I mean, possibly. So I don't know that level of detail and don't really want to, but as long as they're part of like, the okay entities.

• 2:01:42Speaker 02

  Are there any okay entities?

• 2:01:44Speaker 03

  Yeah, I know exactly, right? The ones who aren't-

• 2:01:46Speaker 02

  That's a whole other podcast.

• 2:01:48Speaker 03

  This is gonna be defined on who is or isn't going to put me in prison. So that's my definition of good in this scenario is keeping those people happy. But to be clear, there's another advantage here, which is some of these places are critical infrastructure that they work at, or are tasked with securing or improving the security. So we all benefit from that. Like, I don't want a place that has some form of nuclear material in it getting compromised, because the people who want to compromise those places are probably looking to hurt me in some way, right? So let's help them. So the other feature kind of added to these cables recently is, we'll call it HidX Stealth

• 2:02:33Speaker 03

  Link. It's kind of the branding of it to explain what it is. Ultimately, still acting as a keyboard, but now it's got bidirectional data transfer. So like a network interface, but without ever showing as a network interface. You can send data back and forth between the computer, and it just looks like a keyboard to the target system. This was used by quite a few people in a lot of environments, but in this case, you know, the critical infrastructure was not looking for this type of exfiltration technique, and it worked really well. Got them in, and they achieved their objectives with this critical infrastructure and got

• 2:03:15Speaker 03

  it fixed. You know, I was told that my name got put into a report that I will never have access to, but that is extremely cool. It's like, cool, I got my name into a report to fix some critical infrastructure with a technique that we developed with my team. And honestly, I'd love to pause and even talk about that team, because while I make the hardware and the manufacturing to run the business, all the tricks this does heavily about the actual firmware that runs on this and that requires multiple people to pull off.

• 2:03:45Speaker 02

  Let's talk about your team.

• 2:03:46Speaker 03

  Yeah, so- There's a couple pieces of this, but one guy's retired and just loves working on Harper. Prior to this, I mean, he did a lot of things, but prior to this, he was working on firmware for police body cameras. So very interesting background there. Another guy is blind and he does kind of the UI you see. It's kind of poetic. The blind guy is in charge of the UI. He's got a lot of experience.

• 2:04:15Speaker 02

  What is UI?

• 2:04:16Speaker 03

  Yeah, so the visual interface, when you open it up in the control panel and you've got all the buttons and stuff in there.

• 2:04:21Speaker 02

  Are you, hold on. Pick that cable up.

• 2:04:26Speaker 03

  Yeah, yes.

• 2:04:27Speaker 02

  When you open that thing up and look at the control panel, the buttons.

• 2:04:30Speaker 03

  Wirelessly. So when you connect to it wirelessly with your web and then you open your web browser and then connect to the IP address, you get like a web, webpage, right?

• 2:04:40Speaker 02

  Okay.

• 2:04:41Speaker 03

  With all the buttons on it that give you the controls, you can view the key logs, open the hundreds of payloads you can save on here and run them. All that's purely visual.

• 2:04:50Speaker 02

  Okay.

• 2:04:51Speaker 03

  Click on stuff. It doesn't have to be, you can automate it. But yeah, it's primarily visual and it allows all the cool controls to happen. So got another guy who, you know, in education and a lot of them are familiar with, you know, the government contracting spaces as well. Fairly small team, but they've been along for the ride the whole time and just constantly interested in picking up challenges. And like the way the key logger works on here is like, that's not supposed to be possible.

• 2:05:22Speaker 02

  How did you get this word out? How are you marketing this?

• 2:05:26Speaker 03

  That's a really good question, actually, is I have not done any marketing yet. This thing kind of has its own legs, which.

• 2:05:31Speaker 02

  I mean, I could imagine, but I mean, what was the first thing? Like, how did?

• 2:05:36Speaker 03

  I put a, I think I just put a video out. A video of like, hey, like I made this with my mill, check it out. Here's what it can do.

• 2:05:45Speaker 02

  Excuse me?

• 2:05:47Speaker 03

  Yeah, where's, and here's what it can do. And then it just took off. Like that was mostly in the InfoSec space. So, you know, kind of went around the hacker community and the professional, security professionals, security professionals.

• 2:06:04Speaker 03

  And at some point, it just kind of goes outside of that bubble because it gets enough traction. Like Vice took it, Forbes took it, you know, there's, there's so many different high-profile.

• 2:06:14Speaker 02

  This has been in Forbes?

• 2:06:15Speaker 03

  Oh yeah, this has been in Forbes a couple times.

• 2:06:19Speaker 03

  Look mom, I made it to Forbes.

• 2:06:24Speaker 03

  Yeah, it's, uh, it's been pretty wild.

• 2:06:29Speaker 03

  I, I am at the point though, where I am starting to think about focusing purely on this because it's just become this awesome monster that takes a lot of my time as well as running, you know, red team as well. So that's probably something I'm going to be pivoting into very shortly and focusing on that, helping the team and seeing, seeing what more we can do. Probably going to relax for a bit though.

• 2:06:56Speaker 02

  Good for you.

• 2:06:56Speaker 03

  I'm tired.

• 2:06:57Speaker 02

  How is business? Is it going well?

• 2:06:59Speaker 03

  It's very good. So, um, it's, I'm probably long overdue to jump.

• 2:07:04Speaker 02

  When do you, what do you think you'll grow into with this?

• 2:07:07Speaker 03

  I have no idea. That's so I've, I've never had a plan ever on any of this. It's just what's the thing, the opportunity at the moment and how can I play with that in an interesting way?

• 2:07:20Speaker 03

  Which, you know, there's a lot of things why you would want to plan in business, but I just, yeah, I don't know. Maybe eventually I'll have a plan.

• 2:07:29Speaker 02

  Do you have any fear about this being on the market so available?

• 2:07:32Speaker 03

  Um, I mean, it's been five, six years now and I'm very proud of like the results of it with all the places where it's been fixed in the very low abuse scenarios. Like we're, we're very intentional when we think about, okay, let's add a feature to this, but let's figure out who wants this feature? Who's going to make use of it? Like for instance, like the number one that I want to avoid is like stalkerware, spouseware stuff. People look at this and they're like, oh yeah, I need that for that. I'm like, no, I'm going to make that hard. Like that's not as valuable to a red team professional. I like, we're trying to get into corporate infrastructure. We're trying to do like Ocean's Eleven shit on.

• 2:08:14Speaker 03

  Like a Fortune 10 or something like that.

• 2:08:17Speaker 02

  This would be so easy to plant in any government facility.

• 2:08:21Speaker 03

  Yeah.

• 2:08:22Speaker 02

  I mean, I shouldn't say, I shouldn't say any government facility, but you know, it might be, it's been a while since I've been to a SCIF, but you know, it's, they seem to have a pretty,

• 2:08:35Speaker 03

  Oh, yeah.

• 2:08:36Speaker 02

  You know, pretty good gauge on what's going on, but I'm, I'm talking like DC Congress,

• 2:08:41Speaker 03

  Yes, absolutely.

• 2:08:43Speaker 02

  Politicians, those types would be, it would be a fucking joke just to, you could hand them out.

• 2:08:54Speaker 03

  Yeah. And they'll use them. Here's the thing, though, is that's the other aspect is there's a lot of very detectable defaults. You have to really know how to use the tool to work around these things, but by design, it's supposed to be detectable if you're doing good security. Like this is going to light up and it's literally, it announces itself as an OMG cable out of the, you know, effectively out of the box, right?

• 2:09:18Speaker 02

  Mm hmm.

• 2:09:19Speaker 03

  Hopefully you're at least checking that.

• 2:09:20Speaker 02

  In all of your experiences is doing Red Cell operations.

• 2:09:27Speaker 03

  Yes and no.

• 2:09:27Speaker 02

  How many people do you think are testing that?

• 2:09:30Speaker 03

  So here's the thing is the people who are that low on the bar of security, I don't, I don't need these to get in. I just pick up a phone, I send an email.

• 2:09:38Speaker 02

  Okay, fair enough.

• 2:09:40Speaker 03

  That's, that's, that's that sweet spot where it's like all, you know, you map out all the desires, the capabilities and the threats and the negative consequences and just thread the needle to get just that sweet spot. And we spend a lot of time thinking about that, but I, right now, I just point to the last five years of like, look, the, the results and that way, you know, I can talk all day about how, how much intent we put into it, but the results are far better than the intent in terms of convincing somebody.

• 2:10:14Speaker 03

  Um, another thing, so I think I showed you.

• 2:10:19Speaker 03

  These should actually ship deactivated for multiple reasons, which you can imagine. There's a little, we call it the programmer, it's kind of a firmware tool. So you plug this into your computer to activate it, right? This doubles for multiple other things. So if you do like a self-destruct on it, you recover the cable with this if you wanted to. You have to get it back out of the field. But self-destruct will just put it into a neutral cable that's just not harmful at all. Really good if you can't pull the thing back out of the field. You want to neutralize all your stuff. However, if you're blue team and you found this, you can also use one of these to dump every bit of firmware that's running on here, which includes payloads and all this stuff.

• 2:11:02Speaker 03

  So as long as, you know, it hasn't been self-destructed, you can just dump that and do a full forensics on it. So they get to practice as well.

• 2:11:09Speaker 02

  Wow.

• 2:11:10Speaker 03

  So yeah, we've done a lot of things that kind of show off the forensic capabilities and ways of approaching. So it's meant to be holistic for security, not just purely offensive use. But it's really about raising the bar, basically.

• 2:11:28Speaker 02

  Interesting.

• 2:11:30Speaker 02

  I mean, when I look at that, you know, I've always heard, you know, I've always heard RIT guys always telling us, you know, don't be buying shit off Amazon. If you're gonna get, if you're gonna get an iPhone cable, get it from the Apple Store, not from Amazon. If you're getting Wi-Fi extenders, go from the manufacturer and not some shit on Amazon. It's trying to put this shit into our ecosystem.

• 2:11:51Speaker 03

  I doubt it. So these are highly targeted. So it's kind of...

• 2:11:56Speaker 02

  Things like this.

• 2:11:57Speaker 03

  Yeah, exactly. But I think it's good to think about it, like, let's step back to like a different type of crime, like pickpocketing versus like Ocean's Eleven bank job, right? Like, this is more on the, you know, the bank job, whereas pickpocketing, that's what you're more likely to experience as just a random individual, like...

• 2:12:19Speaker 03

  That's going to be more equal to like phishing emails, like really low-grade commodity malware type stuff that's delivered over email. Like, the risk of physically delivering this stuff is too high. Or, in the case of like, oh, we're gonna contaminate, contaminate the shelves, effectively, online or not. That's so high cost and so easy to find. That's like, some, you just need one person to detect that this happened and we'd all hear the news story. Which kind of reminds me of that Bloomberg Grain of Rice story, right? Which was complete bullshit. My friend Joe Fitzpatrick is a great guy to talk about this. But basically, there was

• 2:13:04Speaker 03

  this Bloomberg News story that a little grain of rice component was found implanted in a bunch of servers, right? And it just doesn't make sense. Which is why that story didn't make sense. Because there are so many other ways of approaching that, that are way less detectable. Just anybody, like, how do you control where that goes? It's very hard to control where implanted hardware goes. And if you don't have control, anyone's gonna find it. I think like, the closest you can get to that might be that Israeli pager story, where they had to create a fake manufacturing plant to develop these things. And that is how they controlled where it went.

• 2:13:49Speaker 02

  Hold on. I don't, I'm not familiar with this.

• 2:13:51Speaker 03

  Ah, yes.

• 2:13:51Speaker 02

  Go into this?

• 2:13:52Speaker 03

  Yeah, yeah, totally.

• 2:13:53Speaker 02

  It's the Israeli pager story where they blew up all the Hezbollah guys.

• 2:13:56Speaker 03

  Yes, exactly. So,

• 2:13:57Speaker 02

  Fascinating.

• 2:13:58Speaker 03

  Thousands of pagers. I think it was a batch of 5,000 and 4,000 went out. So, yeah, a lot of, a lot of booms. But basically, what they did is set up a fake manufacturing company, right? And they, I think they had their own manufacturing plant and everything. They licensed a legitimate

• 2:14:19Speaker 03

  Model of pager from a legitimate company, well-known. This is a typical relationship for a lot of hardware. You just license it and you sell it. And then you're like, yeah, put my name on it. Uh, depends on what it is. Like, obviously, Apple's gonna do their own thing. But we're talking pagers, right? This is like 30-year-old technology here. Um, so they did that. They had a bunch of, they, they even went as far as getting a bunch of random customers and gave them good pagers. But then they got their Hezbollah client. And I'm always curious about how they did that. I have some postulations, but, um, they got their Hezbollah client and they, they made exploding pages for them. They, they put, uh, high explosives in part of the battery and a detonator in there.

• 2:15:03Speaker 03

  And basically it was configured to explode, detonate this thing, uh, after a specific message was sent to the pager. And the way pager networks work are all like broadcast. So you can, you can send one message that goes to all pages in the network, which is probably what they did. Anyway, uh, this was in play for, I don't know, I think it was like one or two years. Like, these were out there and, uh, slowly going through, you know, the IT operations of, hey, guys, we got new hardware and slowly sending them out to the field. I think they were encrypted pagers. Um, it was funny, uh, in, in some ways that this pager focus was entirely because they knew their cell phones were compromised. Like, oh, let's start using pages.

• 2:15:48Speaker 03

  Or maybe it was the walkie-talkies, I forget. But they were moving away from one comms to another to avoid surveillance. And as a result, they got explosions. Uh, but that's the kind of like level of control. Like, if, if those got out to someone else, which, I mean, there's still opportunity for that. Like, they're not watching one pager go from hand to hand to hand. Like, it's like, oh, we deployed it to Hezbollah and it's reasonable to assume that this level of dissemination with this margin of error and other people touching them. And, you know, they, they probably did the math on that, right? Um, I didn't.

• 2:16:26Speaker 03

  But uh, that's kind of a good example of like how far you can go and like the risks of discovery. Uh, stuff like Stuxnet. Stuxnet's another good example of, I think it was the Iranian enrichment facilities where, oh, I can't remember the full story here, but there was like a thumb drive with a worm on it. And it got in, basically it got carried into this enrichment facility and it would damage the part of the enrichment machinery, right? But didn't do it all at once. It would randomly pick one or the other because you don't want to be discovered, right? If you did it all at once, you're like, oh, something's up. It's like, oh, one went up?

• 2:17:08Speaker 03

  Whatever. It must be bad, right? Like, see, there's like the psychology of making sure it doesn't seem like it's something to investigate. It's like, oh, a bad machine, this must be bad process. They kept doing that. And eventually, I can't remember how it got discovered, but there was an issue where it started spreading around elsewhere, like the worm or something like that. And somebody noticed it, I think. I can't fully remember, but there was a discovery event because it kind of got too wide. And once it's discovered, okay, now you can defend against it. Now you can find them in the wild. And dude, the moment somebody found anything in our stuff, they're gonna tell the world, like, hey, look at this cool thing I found. I'm a security researcher.

• 2:17:50Speaker 03

  So, that said, on the flip side, there's plenty of places we don't look. Most of the stuff you find in there is just vulnerabilities. Like, oh, I didn't think there would be a hole on whatever, some aspect of a product. Like, oh, if you just log in 10 times and do this, you get in, you bypass everything. It's like, wait, what? You do what? That's the type of stuff that's typically, well, nobody thought to try that. So, yeah, it really depends.

• 2:18:25Speaker 03

  Physical implants are much easier to discover because I mean they're physically there. You can't revoke them. You can't be like, oh, self delete. It's there. I mean, not counting the pager situation. It's a different type of delete. But, uh, you know, delete in a way that doesn't leave the, the evidence around.

• 2:18:39Speaker 02

  Yeah, yeah. I'm, I'm like, what's in your head, man? What's next for you?

• 2:18:45Speaker 03

  I don't know yet. Um, I'm just gonna

• 2:18:46Speaker 02

  What are you thinking about?

• 2:18:47Speaker 03

  Like, I, I have been focusing more, more on personal stuff, just like hanging out with my kids, spending more time with them while I got, got the, the time and they're growing, you know, one's 14. So, you know,

• 2:18:58Speaker 02

  You can shut it off.

• 2:19:00Speaker 03

  No, yeah. So, learning how to do that is part of, part of it. So, um,

• 2:19:06Speaker 02

  I haven't learned how to do that.

• 2:19:07Speaker 03

  Yeah, it's, it's

• 2:19:09Speaker 02

  When you do, let me know.

• 2:19:10Speaker 03

  It's hard, dude. It's hard.

• 2:19:12Speaker 02

  Cause you love this. I can tell this is your passion.

• 2:19:15Speaker 03

  Yeah.

• 2:19:15Speaker 02

  You're, you, you're moving into this full-time. This is going to be your full-time business.

• 2:19:20Speaker 03

  Yep.

• 2:19:22Speaker 02

  Give me a snapshot.

• 2:19:23Speaker 03

  I mean, here.

• 2:19:24Speaker 02

  What, what are some of your ideas?

• 2:19:25Speaker 03

  Here's an example. So I'm reusing the same implant in a couple of ways. So, I mean, this is an easy one. So, USB adapters, basically a cable, right? Cool. Uh, I had a thing where customers were enjoying the firmware so much for like payload development, they would get the cable and cut the end off. I'm like, dude, no, that's my baby. What are you, what are you doing? So, you know, there we go. Keychains that, you know, don't have the cable on it. Cool. Got that. Um, now here's another one. Uh, are you familiar with USB data blockers?

• 2:19:59Speaker 02

  No.

• 2:20:00Speaker 03

  So, it's a commonly recommended, like, secure charging mechanism. You're like, oh, I can't trust the airport charger or something like that. You're like, well, get a data blocker.

• 2:20:12Speaker 02

  Can you trust an airport charger?

• 2:20:14Speaker 03

  Um, mostly. I mean, I, I, I'm personally more concerned about the quality of the electricity coming out there frying my phone than I am about like a data situation because going back to the discoverability, you put something in a wide space like that, once it gets detected, you hear about it. We've not heard about it.

• 2:20:34Speaker 02

  Gotcha.

• 2:20:34Speaker 03

  And especially in a secure space, like

• 2:20:39Speaker 03

  all the airport locations, like there's, everybody's on camera, right? Like, good luck. Uh, it would be really hard. There's advisories that come out and I think the FBI was doing them. They get a lot of flack for that because there's no, like, proof it existed, but I don't know, like, I, I don't have the intelligence they have either, so. I mean, there's things you could do.

• 2:21:04Speaker 03

  I'm, I also don't consider my, my creativity to be all inclusive on all ways. You can do something negative. Like, there's plenty of people with different motives and minds than me, so, yeah. We'll see. Uh, it would be a cool story, but yeah, data blockers. That's the, the idea you, you now have safe charging. I'm like, cool, I'll put one of my things in a data blocker. Now, you know, cat and mouse.

• 2:21:27Speaker 02

  Yeah.

• 2:21:28Speaker 03

  I just thought it was funny, but just as an example, just kind of chase that a little bit.

• 2:21:34Speaker 03

  Go from there. I don't know. We'll see.

• 2:21:37Speaker 02

  Do you have any wazoo crazy inventions that you, that, that you're dreaming up?

• 2:21:42Speaker 03

  Um, I've done a lot with, on the manufacturing side, so, uh, I've had to invent so many tools and mechanisms, both for creating these cables, which turns into their own products. Cause you know, I'm teaching other people how to use them and brakes and I gotta do support for those products and you know, they're their own PCBs and everything, you know, it's, it's a hardware product with its own firmware, just to test these cables at multiple stages.

• 2:22:10Speaker 03

  So I'm still, uh, packing these at home with the kids, um, and the envelopes, right? I gotta label those. That gets really annoying over time. I'm like, you know, I'm gonna create a machine to label these, so. Uh, I just keep chasing that down and see how much I can do. You know, um, there's a, there's a guy called Cliff Stoll. He does a lot of really cool things, science, uh, math, uh, he's got a book on security, but he also makes something called Klein bottles. Total deviation here, but you'll, you'll see why. So Klein bottles are, you know, Mobius strip. Uh, you take a strip of paper and you pull the ends up, rotate, tape them together. Now you've got a 1D dimension, so if you follow it around, it's one dimensional. Klein bottle is a 3D version of that.

• 2:22:55Speaker 03

  Anyway, he.

• 2:22:58Speaker 03

  I think he lives in Palo Alto, a small place. He runs like distribution entirely out of his house for that. So, under his house, he has built an entire robotic warehouse system. It's like drives the thing around, pulls the stuff out. I think that's cool as hell. And it goes back to like the old school hacker mindset of just doing that. Like, that kind of stuff just catches me and I'll like, okay, cool. I want to do as much manufacturing in-home as I can. Cause A, my stuff is really small. But, you know, also let's just see how far I can take it, how much more I can optimize. Like, this, this orange clip that goes on these things that I ship with. So you know which ones are bad.

• 2:23:43Speaker 03

  I've redesigned it like six times so far.

• 2:23:45Speaker 02

  Wow.

• 2:23:46Speaker 03

  Like, I don't know, I just want to see how much further can I take it?

• 2:23:50Speaker 02

  Wow.

• 2:23:52Speaker 03

  Yeah.

• 2:23:54Speaker 02

  So are you manufacturing these yourself or?

• 2:23:57Speaker 03

  It's a mix. So, the process for it, I'm gonna go back to this PCB as a reference here. But, real quick. The process that I'm kind of taking right now is I ask one, one manufacturer, make the raw, the PCB, the green piece here. Then, that gets shipped to another place that assembles the components to the PCB. They're basically running it through high heat that melts solder and they all get like glued to the board, right? Now they're, they got a functional piece of. And now, once it's glued to the board, here's one of my implants.

• 2:24:42Speaker 03

  And we can get some close-ups later. But, here is, that's, that's one of the implants, that's the size of it.

• 2:24:49Speaker 02

  This is what goes in the little USB thing.

• 2:24:52Speaker 03

  Yep, inside of the boot of the cable, basically.

• 2:24:54Speaker 02

  This little bitty ass thing.

• 2:24:56Speaker 03

  Yep.

• 2:24:57Speaker 02

  Connects to the internet.

• 2:24:59Speaker 03

  Yep. It's

• 2:25:01Speaker 02

  Wow. Why the fuck is my modem so big?

• 2:25:04Speaker 03

  Yeah, I know.

• 2:25:07Speaker 03

  Um, I mean

• 2:25:08Speaker 02

  Serious, man? Wow.

• 2:25:09Speaker 03

  Yeah, there's, there's a lot of compromises to make that happen, like

• 2:25:13Speaker 02

  Look at that damn thing.

• 2:25:14Speaker 03

  Yeah. If, if you were not size constrained on that, that would be 10 times bigger because it would be so much easier to make with 10 components instead of, you know, two or whatever. I forget how many I have in there. I think I got like 12, but you know, times 10, the components is normally what you'd see. Uh, so that creates, uh, the need to do a lot of creative engineering to compromise and get, get small. But at some point, I'll show you here. I'll just Here is that little one with the USB C end on it and here is the USB C A. So that's kind of, you know, okay, components are on there, you know, one, one shop did the green PCB. One shop put all the components on there. Cool. Well, that's what I got right now. Right?

• 2:25:59Speaker 03

  It's not cable yet. So another shop can help integrate that into cables.

• 2:26:05Speaker 03

  And

• 2:26:08Speaker 03

  So this other shop's going to integrate it into cables to some extent. There's still unfinished work to do, unfinished testing. Um, then

• 2:26:18Speaker 03

  And, and if it's the woven cable, there's another factory has to like do special cutting and crimping and searing of the end. So it doesn't unravel. Anyway, so, you know, three, four factories later, it ships over to me. I'll do the finishing work on them. Sometimes it's closing the actual cables up, but at a minimum, it's testing everything, calibrating them, putting like that initial firmware on there, um, tons of QA and QC work, packaging, um, shipping it off to the, the Hack Five warehouse. So

• 2:26:49Speaker 02

  Wow.

• 2:26:50Speaker 03

  Lots of work.

• 2:26:51Speaker 02

  So where do people find this product?

• 2:26:52Speaker 03

  Yeah. So, uh, two places, basically. You can go to the o dot M G dot L O L website. That's, that's my primary website. Um, or you can go to my business partner. It redirects to my business partner effectively, which is Hack Five, H A K Five, Hack Five dot org slash O M G. And all of my products are up on their site.

• 2:27:15Speaker 02

  Wow. That's incredible, man. That is incredible.

• 2:27:22Speaker 03

  Fun stuff, man.

• 2:27:23Speaker 02

  I can't believe, uh,

• 2:27:26Speaker 02

  If the agency's been in touch with you to come work with

• 2:27:29Speaker 03

  Probably.

• 2:27:30Speaker 02

  Science and technology department or?

• 2:27:32Speaker 03

  I'm not sure I would know.

• 2:27:35Speaker 02

  You would know.

• 2:27:36Speaker 03

  Yeah. Um, and there's been a lot of interesting challenges too, like, uh.

• 2:27:41Speaker 02

  I mean, I'm saying, you know, that's, that's actually not a joke. That's.

• 2:27:45Speaker 03

  Oh, yeah, totally.

• 2:27:46Speaker 02

  You know?

• 2:27:46Speaker 03

  Yeah.

• 2:27:47Speaker 02

  Very, very sharp guy, very inventive, uh, very impressive.

• 2:27:52Speaker 03

  I'm, I'm happy to help, uh, all kinds of people secure their environments. So.

• 2:27:59Speaker 03

  Um, yeah, I mean, they know where to find me.

• 2:28:02Speaker 02

  I'm sure they do.

• 2:28:04Speaker 03

  Um, let's see.

• 2:28:08Speaker 03

  There's, uh, oh, you know, another thing might be interesting here is this kind of kicked off right when the pandemic kicked off.

• 2:28:15Speaker 02

  Mm hmm.

• 2:28:16Speaker 03

  It's like, you know, working with, uh, the factories, had to do all that remote. And that immediately ran into, uh, the chip shortage. I saw that coming from like six months before everybody else did. So immediately had to figure out all the supply chain logistics, where to find chips when they are out of the market everywhere, hoarding them, mass, like I, this, this is something I have put the, oh, first two or three years of profits entirely back into production. Whether it's improving the PCB, improving the capabilities or storing extra components because we're in the middle of a chip shortage. So I can still make my stuff.

• 2:28:58Speaker 03

  That was, that was a wild time. Um, and it felt like there was just one thing after the other that was like, no, you can't sell these. No, the market's down. Uh, no, you can't have access to the chips, uh, and just find, trying to find ways of working around that. Um, down to like component, all these little tiny components come on a, in a really long piece of tape coiled up on a reel. Right? I, I count those. I assemble those by myself as well. So, you know, I got machines to count them and assemble them. So I can just send it off to the assembler. Uh, there, there's so many different facets of running a hardware business that is like this, that, uh, is really unexpected and I'm just kind of learning on the fly. So, yeah.

• 2:29:45Speaker 02

  Very impressive, Mike.

• 2:29:46Speaker 03

  Thanks, man.

• 2:29:47Speaker 02

  Well, I think we're wrapping up the interview, but I just want to say, man, you are a super-sharp, fascinating individual and, um...

• 2:29:59Speaker 02

  What an amazing conversation.

• 2:30:01Speaker 03

  Thanks, man.

• 2:30:01Speaker 02

  Very inventive. Thank you.

• 2:30:03Speaker 03

  Thank you.

• 2:30:04Speaker 02

  And, uh, you know, I'll be tracking you. Where can people find you?

• 2:30:10Speaker 03

  Oh, yeah. I mean, I'm all over the place. I, um, definitely on Twitter, underscore MG underscore. Um, lots of other social networks starting to form and fall apart and whatever they may be. I'll try to keep all of that on the contact page of the o dot mg dot lol site, though.

• 2:30:27Speaker 02

  Perfect. Well, Mike, I wish you the best of luck and, um... I can't wait to see what you come up with next.

• 2:30:34Speaker 03

  Thanks.

• 2:30:35Speaker 02

  All right, brother. Cheers.

• 2:30:39Speaker 03

  Thank you.