160: Greg

Greg Linares (AKA Laughing Mantis) joins us to tell us about how he became the youngest hacker to be arrested in Arizona. Follow Greg on Twitter: https://x.com/Laughing_Mantis. SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. This show is sponsored by Red Canary https://redcanary.com/. Red Canary is a leading provider of Managed Detection and Response (MDR), helping nearly 1,000 organizations detect and stop threats before they cause harm. With a focus on accuracy across identities, endpoints, and cloud, we deliver trusted security operations and a world-class customer experience. Learn more at redcanary.com https://redcanary.com/. This show is sponsored by Miro https://miro.com/. AI doesn’t have to be intimidating—in fact, it can help your team thrive. Miro’s Innovation Workspace changes that by bringing people and AI together to turn ideas into impact, fast. Whether you’re launching a new podcast, streamlining a process, or building the next big thing, Miro helps your team move quicker, collaborate better, and actually enjoy the work. Learn more at https://miro.com/.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:05Jack Rhysider?

  Hey.

• 0:07Speaker 01

  Well, man, I don't see you.

• 0:08Jack Rhysider?

  Yeah, my tape is usually over my camera.

• 0:10Speaker 01

  Where do I see you?

• 0:11Jack Rhysider?

  I caught my tape on my camera. One second.

• 0:13Speaker 01

  Ah, I can't even hear you.

• 0:15Jack Rhysider?

  You can't hear me? There's a story I had that I totally forgot about, but I remembered recently, and I wanted to call up my dad and walk through it again with him to try to remember how it went.

• 0:25Speaker 01

  Yeah.

• 0:26Jack Rhysider?

  I want, uh, I want to recollect a story with you.

• 0:29Speaker 01

  Yes.

• 0:30Jack Rhysider?

  Because as I tell it, I don't think people will believe it. So I figure you can verify that this is true.

• 0:37Speaker 01

  Yeah.

• 0:38Jack Rhysider?

  All right, so do you remember my senior year at high school?

• 0:42Speaker 01

  Okay.

• 0:43Jack Rhysider?

  I had my own car then. I was like mentally done with school. I did not want to go to high school anymore. I was just sick of it. I just had, I'd been there too long. And I had one elective left, and I said, "What is the easiest possible, uh, class I can take?" Do you remember what I chose as my last elective in my senior year?

• 1:03Speaker 01

  It was either welding or typing. I can't remember.

• 1:05Jack Rhysider?

  Typing, yeah. But, but, but typing, how fast could I type as a senior in high school?

• 1:13Speaker 01

  Uh, at least ninety-nine words a minute.

• 1:16Jack Rhysider?

  Right.

• 1:16Speaker 01

  Very extreme.

• 1:17Jack Rhysider?

  Right, so choosing that as an elective.

• 1:20Speaker 01

  Oh.

• 1:22Jack Rhysider?

  That's the easiest class ever. That would, that's gonna be a walk in the park.

• 1:27Speaker 01

  I was happy for you, senior year.

• 1:31Jack Rhysider?

  Here's the problem, though. The class was the first period of the day, and...

• 1:36Speaker 01

  Eight forty?

• 1:36Jack Rhysider?

  Eight forty, yep. And so I had to be at typing first class of the, of the day. And, yep, the class was real easy. And when I got there, I was like, "Oh, good. This is a, this is just a beginner typing class. I could type super fast." So I'll, I'll tell you what I'll do is I'll finish up my lesson in like ten minutes. I could do this whole, these, all the, all the stuff you guys are doing today, I'll do it in ten minutes, and I'm done. And so I even worked ahead. I said, "Hey, teacher, can I, can I go on to the next lesson?" "Sure, sure." And so I would do like a whole week's worth of work on Monday. And then, um, I would help out some of the other students and stuff. I mean, I think I was the star student in that class.

• 2:18Speaker 01

  Of course you were.

• 2:20Jack Rhysider?

  But, once I got ahead enough...

• 2:24Jack Rhysider?

  I mean, you know what my morning routine is. Am I a morning person?

• 2:30Speaker 01

  I probably woke you up at eight thirty and said, you have ten minutes. Get this, you could not wake up.

• 2:36Jack Rhysider?

  Yeah, I had trouble waking up, so.

• 2:40Speaker 01

  You had narcolepsy or something.

• 2:43Jack Rhysider?

  I used to use that excuse all the time.

• 2:46Speaker 01

  You did.

• 2:46Jack Rhysider?

  So I would get to school late on, on this typing class. And I thought, no problem. I'm perfect, straight A student in this typing class. I'm helping the other ones. All my work is complete. I don't think it's gonna be an issue if I'm seven minutes late, ten minutes late. That's fine. And so I would show up late consistently to this typing class. But yeah, well, um, the teacher didn't like that. And she said, you can't, you can't come in late like that. I have to send you to the principal's office if you come in late one more time. You gotta come in on time. This is like your fifth time being late. I said, yeah, but I'm getting all the work done. What's the problem? And she said, no, no, no. If you come in late again, I'm gonna have to report you.

• 3:30Jack Rhysider?

  And so the next day, I couldn't get it together. You tried waking me up again and I was late. And she said, that's it. You gotta go to the principal's office. And the principal didn't wanna see me, but the vice principal was there. And he said, what's the problem? I said, no problem. I'm, I'm doing well. He said, well, the report here says that you're late. So, um, this is your, your senior, you know? If you, if you get late too many times, you're not gonna graduate.

• 3:56Speaker 01

  Oh, my.

• 3:58Jack Rhysider?

  I said, listen, I, uh, have you looked at my grade in this class? He said, that doesn't matter. If you're late. I said, no, it should matter. Listen, I think your priorities are all screwed up. If I'm acing this class, if I'm getting it all correct, and if I'm helping the other students and I'm a value add to the class in general, not just myself, then don't you think that I should be graduating with that sort of, uh, work ethic? And he said, no, it has, has everything to do with being on time. It has nothing to do with the work ethic. You have one more chance. And if you, I'm gonna be there tomorrow. And if you are late again this year, you are not gonna graduate.

• 4:35Jack Rhysider?

  I said, really, you're gonna hold me back just for being late, even though I have perfect grades? And the next day, of course, I'm late. I could not get it together. And the vice principal was standing at the door when I arrived.

• 4:48Speaker 01

  Oh.

• 4:48Jack Rhysider?

  And he said, that's it. You're late. This is the last straw. You failed this class. I said, how, how would you, why would you do this to me? Like, I'm, it's not like I'm struggling with this class. This class is easy. I've got it nailed. I'm like, three weeks ahead of every other student in the class. And he said, I don't care. You can't come to school on time, so therefore you're, you're fail. Fail.

• 5:14Jack Rhysider?

  And so they wanted to hold me back a year. A whole year of high school and not let me graduate.

• 5:21Speaker 01

  No, you're only missing a half a credit at that point. If you didn't graduate.

• 5:26Jack Rhysider?

  Mm hmm.

• 5:27Speaker 01

  You could have went to summer school and picked up a half a credit.

• 5:30Jack Rhysider?

  That's right, I could have.

• 5:32Speaker 01

  But you did something else.

• 5:35Jack Rhysider?

  So when I brought, when I brought this news home to you and I said, listen, I'm not gonna graduate this year. Your brain started going into overtime. And you started thinking up of solutions.

• 5:49Speaker 01

  Yeah, here's a couple of things. One, after you got thrown out of the class, I noticed you didn't go to school when I'd wake you up in the morning. I'm not even sure what was going on. You'd say, don't worry about it, Dad. I can get in there. It's second period, I gotta be there. So that. But third, your social engineering wasn't 100% yet. That was your problem.

• 6:13Jack Rhysider?

  Yeah.

• 6:14Speaker 01

  You should have done a lot better with the assistant principal and the teacher.

• 6:17Jack Rhysider?

  Oh, yeah. But you saved me that year.

• 6:20Speaker 01

  Of course I did.

• 6:21Jack Rhysider?

  I don't know how you came up with the idea, but you found me an extra half credit.

• 6:28Speaker 01

  Well. You one time switched high schools for, I don't know, four weeks or something. You didn't like those kids, so you went back to the original high school.

• 6:39Jack Rhysider?

  Mm hmm.

• 6:40Speaker 01

  Which, by the way, was less than a mile from our house. I don't know how you were ever late, less than a mile.

• 6:44Jack Rhysider?

  Yeah, it was very close.

• 6:46Speaker 01

  So I knew you were at that other school. I went over there and one of my kind of best friends played sports together and things. I said, you remember my son, Jack? Yeah, yeah, nice kid. Was he in your P E. class? Yeah, yeah. I said, you never gave him credit for that. He said, oh, man, this is so hard. Credit? I said, not only you gotta give him credit, but you gotta get it done before graduation. You got like six days. And he just said, I don't think I can do this. I said, no, you go to the registrar, you put his name down. Well, he said, you owe me big time.

• 7:27Speaker 01

  And somehow magically gave you a C for P E., sent it over to your high school. And that's really not the end of it. The end of it was graduation at your high school.

• 7:39Jack Rhysider?

  Yeah, yeah. And so that sorted it. Now I'm, now I was back on track to graduate and everything was fine. I went to the ceremony, I sat in the stands. And then what, how'd the ceremony go?

• 7:49Speaker 01

  The assistant principal, your arch enemy, he's the one handing out the diploma.

• 7:55Jack Rhysider?

  The same guy who told me I can't graduate?

• 7:58Speaker 01

  Yeah, just, just six days before you're not graduating. And now he calls your name, you come up, he looks at the diploma, stares at you. I didn't think he was gonna hand it to you and then he grimaced and gave it to you. And there you have the diploma with the missing half credit.

• 8:21Speaker 01

  And I think the statute of limitations ran out and all that, so.

• 8:25Jack Rhysider?

  Okay, I won't be kicked out of school?

• 8:28Speaker 01

  Uh, permanent record.

• 8:30Jack Rhysider?

  They'll go on my permanent record, this one, oh no.

• 8:33Speaker 01

  Yeah.

• 8:34Jack Rhysider?

  Yeah, so that was quite the, all because of the typing.

• 8:38Speaker 01

  I don't believe it, but no. Yeah, so do you still know how to type?

• 8:44Jack Rhysider?

  Yeah, I do. But do you know how at this point?

• 8:47Speaker 01

  No. I've never had a job in 40 years where I needed a typewriter or a computer. Never needed one. Or a cellphone. I'm analog all the way.

• 9:01Jack Rhysider?

  These are true stories from the dark side of the internet.

• 9:08Jack Rhysider?

  I'm Jack Resider. This is Darknet Diaries.

• 9:29Jack Rhysider?

  This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online, and then all clicking "Buy" multiple times within a 72-hour period. Now retailers all over have to somehow ship those orders out on time. And that seems like a whole new level of hectic. One that ShipStation is built to help businesses manage. ShipStation is an end-to-end order fulfillment platform, built to handle the order surge of peak season and bring all your orders into one place. So your team isn't scrambling when volume spikes. Over 1 million businesses have learned on ShipStation to get through peak season, scaling fulfillment up to 40x while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation.

• 10:14Jack Rhysider?

  Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply.

• 10:34Jack Rhysider?

  This episode is sponsored by DeleteMe. Have you ever thought, "I should really be doing something to protect myself from stalkers, scammers, and hackers"? But you're not sure what? Here's what you do. Go to joindelete.me/darknetdiaries and enter code DD20 and you'll get 20% off DeleteMe. A few years ago, I signed up. And ever since then, DeleteMe has been busy scouring the internet for my name and giving me reports on what they found and deleted stuff. Take control of your data and keep your privacy. ...life private by signing up for Delete Me now at a special discount just for my listeners. Get 20% off your Delete Me plan when you go to www.joindelete.me/darknetdiaries and use promo code DD20 at checkout.

• 11:18Jack Rhysider?

  The only way to get 20% off is to go to www.joindelete.me/darknetdiaries and enter code DD20 at checkout. That's www joiningdelete.me/darknetdiaries code DD20.

• 11:36Jack Rhysider?

  I want you to meet Greg.

• 11:38Speaker 02

  So I grew up really, really poor. I grew up in Tucson and fortunately, my father was an avionics technician. And he was an undiagnosed autistic brilliant man. He was a MacGyver and the man would just tinker and make things throughout his life. And while we were poor, my father decided to dumpster dive.

• 12:03Jack Rhysider?

  His dad would find various computer parts in trash dumpsters behind buildings and bring them home. And after doing that a few times, he had enough spare parts to assemble whole computers.

• 12:13Speaker 02

  I had a Commodore Vic 20, I had a Trash 80, and then I had an Apple IIe. All, you know, like all but when I was born, and I always loved them.

• 12:23Jack Rhysider?

  Back then, computers were not as common as they are now. Having one in your house was a luxury. Having three, you were really fancy. And simply having these things within easy reach enabled Greg to learn tons growing up instead of maybe getting introduced to them sometime in high school, if your school was lucky enough to even have computers.

• 12:41Speaker 02

  That was my escape as a kid. I was a, I was an undiagnosed autistic kid until in my 30s and I just immediately loved computers.

• 12:52Jack Rhysider?

  Computers were a novelty for me as a kid until we got AOL. Then I became obsessed with them.

• 12:58Speaker 02

  I was an AOL kid too. Matter of fact, that's where most of my first programs that ever came around. I was one of the first who discovered the OneIM exploit. That was my first vulnerability I ever discovered was the integer overflow in the AOL client when you sent a font size with a long enough number. And I remember finding that and making the OneIM punter back in the day.

• 13:23Jack Rhysider?

  I remember AOL punters. You could send someone a message, but then put something in that message that when they receive it, their client wouldn't know how to process it and it would just crash their AOL session. So you could come into a chat room, send everyone a message, and then see like half the room suddenly disappear because their apps would be crashing and they would disconnect. So all this fascinated Greg. To be able to force someone else's computer to do something it's not supposed to, that's cool. What else can you do? And his interest in hacking took root and grew. Soon he found himself in an online group that was trying to create malware.

• 14:00Speaker 02

  When I was a virus writer, my ideology I had, I actually targeted pedophiles. Every single, every piece of malware I ever wrote was designed to target pedophiles. And we ran a group in there to target people who were targeting children. And the best part about targeting pedophiles is I think it's the only case that you can say, "I gave malware to someone" and they're absolutely not going to report you to the police. Because what are they going to say? "I was trying to pick up this kid and they sent me a JPEG.exe to them?" And that was the case for many years. When I wrote viruses, that was the only people I targeted. Otherwise, for me, writing viruses again was the thrill of learning about polymorphism,

• 14:44Speaker 02

  metamorphism, and as well as high-level, low-level code execution. It was, I just genuinely loved the thrill of the knowledge of it. It was an art. I still think it's an art form.

• 14:55Jack Rhysider?

  His specialty was using Visual Basic to code malicious macros in Microsoft Word documents. So he would send the Word doc to someone, trick them into opening it. And if they had macros enabled, that would allow Greg to take over their computer. Now, keep in mind, he was doing all this in middle school, not even in high school yet. And middle schools back then didn't even have computer classes. If they did, it was just to like, take a math quiz or something like that. Not really teaching how to use them and stuff. And by the time he got to high school, they were just starting to teach kids commands and certain applications on computers. So one of the first classes he took was keyboarding, which is learning to type.

• 15:36Speaker 02

  And I was like, no, fuck that. I, I, I get to type. I, I know how to type. So our school worked on Excel. All the great systems were in Excel. And so I'm one of, I'm one of the old school macro virus writers. I remember like, like colors in back of the day, that those series of colors and tri-state. Those were the areas of macro viruses I remember started programming in. And so with Excel, I was like, I could do this. Like, I don't want to be in this class. I don't want to be in this school. So the entire grade system was in Excel and I made a macro virus that would look for my student ID number, would have a trick number, identify the, the areas where the grades were in.

• 16:17Speaker 02

  Take the average number of, of the, the number of the percentage. Or if it was A through F, it would be, I'd make it myself as a B. And when I averaged the number to be about 87% and gave myself 87%.

• 16:31Jack Rhysider?

  He was able to take this malicious Excel file and get it onto the teacher's computer. And suddenly, he was getting all Bs in his classes. On top of that, he made it so he had perfect attendance too, no matter if he was there or not. So he just stopped going to class. And what's hilarious is he did all this while in his typing class. He even coded in obfuscation techniques to avoid detection. Like after the teacher would record his grade and then close Excel. That's when the macro would trigger on close. And he would stage all this information in a column that he hid off to the side. So you couldn't see any of the funny business happening.

• 17:09Speaker 02

  This worked really well. I was in school for nine days. That's how long it took me to write this and then put it into the school system. And then every day I went, I went home. I was just at home. And one day my friends came over and they came back from class because I still would hang out with them. And they were like, hey, Greg, um, man, the computers at school are really weird. I was like, oh, what are they doing? And he's like, well, they're crashing. Everyone says Excel's like not doing well. And I, I remember my stomach like sinking like, oh, what do you mean? They're like, well, they, you know, when they're getting everybody ready for, you know, the, the finals, they, you know, everything changed and something crashed. I think they're calling McAfee over it. And I was like, oh no. So I walked, I went to school the next day.

• 17:51Speaker 02

  Guinness School Library, and I had been in school for like so long that the librarian was like, who are you? And I was like, I go to the school, I promise I'm here. And she's like, I've never seen you, like, who are you? And I was like, well, do you have a student ID? I was like, no, I don't have a student ID. She's like, okay, go to the principal's office. So principal, like they're saying, hey, we know you're a kid, you know, we know your, your, your name checks out. You're in these classes, but none of your teachers recognize who you are. I was like, oh, I'm sorry. And I just kind of shut up at that point. They sent me home. And what that happened was the school added a column in all the Excel sheets to calculate final grades and to do something, you know, something for final grades. And unfortunately, that column just happened to be where I stored the previous data of all the columns.

• 18:36Speaker 02

  So, so the virus will restore the doc, the, the, the sheets. Um, when teachers opened up the sheets. That, that caused the Excel files to crash on grade. And they sent the sample to McAfee. And McAfee at the time was like, yeah, this is a macro virus and it was custom written for your school.

• 18:57Speaker 02

  So the school decided to call the police. Police showed up, knocked on my door, arrested me.

• 19:02Jack Rhysider?

  Really?

• 19:03Speaker 02

  Yeah, yeah. I mean, it's a government, it's a public school. It's a public high school, so it's technically a government.

• 19:08Jack Rhysider?

  This was real bad. He went to juvie, juvenile detention. They locked him up in a concrete room with a steel door and a tiny little window. It's a scary place for a teenager. I have a note here.

• 19:24Jack Rhysider?

  It says you're the youngest hacker to be arrested in Arizona.

• 19:28Speaker 02

  I was the youngest child to be arrested in the state of Arizona for a computer, computer crime for, I'm not sure if that still holds, but that was the case for a long, long time.

• 19:37Jack Rhysider?

  A politician wanted to make an example of him, saying, see, cyber criminals are really bad and we should do more to stop them. But he caught a lucky break.

• 19:46Speaker 02

  But they came back that the Tucson police failed to handle the evidence correctly and my case got dropped, luckily for me.

• 19:54Jack Rhysider?

  However, he was ordered not to touch computers for a whole year. Can you imagine? No computers for a whole year?

• 20:01Speaker 02

  They made a deal with, with the courts to say, I won't touch a computer for a year. I'll have to get a probation officer to sit next to me when I, when I operate computers. And then I, and after that, we'll, we'll reevaluate the situation. So for a year, anytime I wanted to touch a computer, which is mostly the library back in the day, if you remember where libraries had the little internal library machines to go look up for, you know, books in the library. I had to go call this very large, sixty-year-old man who was, absolutely had no idea what computer, you know, computer hacking looked like. And I remember fucking with him quite a bit and saying, you know, like, I'm on him, like, oh, I'm getting into the system. He'd like, look at me and grab my hand and pull me away from the computer and like, we're going now.

• 20:47Jack Rhysider?

  What kind of person, what kind of kid were you like in high school?

• 20:49Speaker 02

  Oh, man, I was, I was absolutely, I was a goth kid. I, I was the goth kid who wore the large, I had, I got in trouble for wearing a black trench coat because unfortunately going to high school and during two thousand and one era, that you come across the, the Columbine incident.

• 21:07Jack Rhysider?

  You know, back in the, back in the nineties, when I saw a goth kid, I just thought they really liked the movie The Pro.

• 21:13Speaker 02

  Yeah, The Crow was a good one. Uh, my best friend at the time, his name was John Oller. John was a, was a huge Crow fan. He actually, he kinda looked like Brandon Lee too, so he was a, he was a, he was a Goth of the Crow type. I was more into industrial music. I always loved like Skinny Puppy and Suicide Commando, Velvet Acid, Curry, still that, all those like late 90s industrial bands. So I was more of a rivet head. Um, I didn't know at the time what rivet head was, but just an industrial kid, big stompy boots, Goth and industrial music. I, I liked metal, but I didn't like metal so much. I like, I like electronic music. So when I found out industrial music, which is essentially Goth music mixed with, with techno, I was like, this is it. This is my lifestyle.

• 21:55Jack Rhysider?

  You wear earrings?

• 21:56Speaker 02

  No, I actually, uh, well, sorry, take that back. Uh, in high school, I think I had, I think I had like nine piercings. So I had, you know.

• 22:05Jack Rhysider?

  And, and did you wear eyeliner?

• 22:07Speaker 02

  No, I was not, I was not a makeup Goth. I was not a makeup Goth. I had, I had the dog collar, so I had the Goth collar. So I had the, the, uh, the bondage outfits. Uh, I was one of those Goth for sure.

• 22:19Jack Rhysider?

  Okay, so this, this just emphasizes like when they're like looking for the person who did this. There's like, you're the one who does not look like everyone else.

• 22:28Speaker 02

  I'm sorry, everyone, the Goth, the Goth stereotype for the virus writers, that was me. That was, that was me, everyone, I apologize. Yeah, I remember.

• 22:38Jack Rhysider?

  You started this.

• 22:39Speaker 02

  I, I did, I did. So my parents kicked me out of my house. I was, I lived in a group home after, after being arrested. I was in a group.

• 22:45Jack Rhysider?

  Just because of that event?

• 22:46Speaker 02

  Yeah, yeah. Um, so I lived in a group.

• 22:48Jack Rhysider?

  And you're, and you're not, you're not normal, Greg. You're wearing, you've got too many piercings, come on.

• 22:54Speaker 02

  Um, yeah, I did that all myself too. Um, so I, I got kicked out. I lived in a group home from the age of 14 to 18. Um, so I, I was in and out.

• 23:06Jack Rhysider?

  That was a tough time. So at 14 is when you got arrested?

• 23:10Speaker 02

  Correct.

• 23:10Jack Rhysider?

  And then, that's a hard time to go through an arrest. That's scary. You don't know what you're facing there.

• 23:15Speaker 02

  Correct.

• 23:15Jack Rhysider?

  And then to be thrown out of the house and then like, what? I, I gotta do this on my own.

• 23:19Speaker 02

  Yeah, so I lived in a group home, didn't have access to a real computer. So my only computers at the time were the ones in school. And it was, it was rough, man. It's, it's one of the big reasons why I always try to reach out to people who are kind of in rough situations, because my life has not been an easy one. It has not been easy. And living in a group home, which the group home was, the one I always got assigned to, was a government group home, and it was mostly for kids who were domestic violence or runaways, and so it was a lot of violent kids in there. It was, it was a small, it was like a small four-bedroom house, but it had, at any time,

• 24:03Speaker 02

  it had between six, six guys and six girls and then staff members there. So it was cramped. Everything was shared. It was not, it was not a good time. It was a rough life.

• 24:20Jack Rhysider?

  I think, I think I just got some clarity on what it means to be Goth just now. It's not about the clothes and the makeup and the music. It's, it's about not fitting into a world that tells you to shrink and conform and smile when you're falling apart inside. It's about understanding that you are different and you can embrace your difference. And you gotta pay the price. Being misunderstood by your teachers, so-called friends, even your own family, can become isolating. There's this moment, I imagine, that every Goth must face. You have a choice. Either break yourself down into something more acceptable, force yourself into a version

• 25:05Jack Rhysider?

  of normal that everyone wants you to be, or you can embrace that shadow inside you, that one that's screaming out, wanting to be seen, wanting to be heard, but knows that it's just too weird for people to understand. Goth's choose to embrace that inner shadow, lean into their Weirdness, wear it like armor and let your darkness be your beauty. And when you're in a place like a halfway house with nowhere to go and no one who really knows you, that identity, being Goth, can become more than just a style. It becomes your anchor. Because being Goth means you already know what it's like to live on the outside. You already live in the cracks of the system. So when the worst happens, when your life is shattered,

• 25:51Jack Rhysider?

  being Goth is a reminder that it's okay to be on the outside of society. The music reinforces the idea that it's okay to live outside what's normal. And there's a level of comfort to hear that music and to see other Goth's who are also struggling to fight what's normal. Those quiet rebels, the kids who find beauty in broken places. I imagine that being Goth makes you more resilient to problems like this. It gives you a tribe without borders. It gives you a sense of self when the world pretends you're invisible. So I imagine being Goth in that halfway house was an amazingly helpful way to get through it, to self-soothe.

• 26:35Jack Rhysider?

  Every time he put on dark clothes, it was like he was giving himself a hug and saying, "It's okay to be different. Don't worry about what everyone else thinks of you." And man, to go through something like that and Goth being your anchor, that could easily make you Goth for life.

• 26:54Jack Rhysider?

  Man, I think I've got carried away there. Okay.

• 26:57Speaker 02

  So after I get out of high school, so I was doing music, one of the few things. So I became, I was a musician and I was a successful musician. If you've ever seen The Matrix sequels movies, then you've heard my music at one point.

• 27:17Jack Rhysider?

  What? Your music is in The Matrix sequels?

• 27:19Speaker 02

  Yeah, so I got contacted by a company called Spiderbyte Studios and they wanted to make music for The Matrix, especially behind the scenes Matrix stuff. They wanted to do some music there. The big thing is they were looking for someone to make music for the trailer for the video game The Matrix Online. And so they sent me an email and they were like, hey, you know, your music sounds great. So that was my, that was my first example of being exploited in a contract by a large company. I sold my music rights for $400 each. I think I got a $4,000 total out of that deal. So I was like, I'm $4,000 richer. That is awesome. And after that, that

• 28:01Speaker 02

  got into, a lot of people asking me to do music and go touring. So I did a European tour. It was all throughout Europe. I think I went to every country except for Latvia and Lithuania, toured for a while and then came back.

• 28:14Jack Rhysider?

  What are you playing here?

• 28:15Speaker 02

  A synthesizer. It was a one man project. So I did, I love synthesizers. At one point I owned over 80 of them. So yeah, after that, I came back, after a long tour time, I came back to Arizona. I was homeless for a while because you only make $30,000 as a musician average a year at that time, especially like an industrial musician, you don't make any money. So I came back homeless. And then I lucked out in getting a job working at that Massage Envy.

• 28:43Jack Rhysider?

  Massage Envy is a massage parlor, but it's a chain and they have over a thousand locations all over the US. And their headquarters are in Scottsdale, Arizona, and they needed someone to work on the backend of their booking system. They gave Greg a shot and he excelled at it.

• 28:59Speaker 02

  It was all VB.net and ASP code backend. And so I was coding that and I was breaking software in the meantime, Millworm. So I was, I was coding exploits on Millworm and just throwing them up there. And I was literally trying to throw an exploit up there a day. And I remember I got an email from EEY and they were like, you're cracked. What is going, like, what are you doing? Like, where do you work at? Tell us about you. And I was like, well, I'm a software developer in the middle of Phoenix, Arizona. I work on Massage Envy's backend. And they couldn't believe it. They were like, what? Like, you're not in security at all? I was like, no. I just break stuff for, for fun.

• 29:40Jack Rhysider?

  EEY was a cybersecurity company based in California. It's spelled E-E-Y-E, EEY. They created some tools to help people be more secure, like they made a vulnerability scanner and that's how they were able to make money. So EEY saw that Greg was writing a lot of malware and posting it publicly. And they liked that and decided to hire him and flew him out to California to give him a job.

• 30:04Speaker 02

  Yeah, well, the team I was on, we were all about finding zero days and finding exploits.

• 30:09Jack Rhysider?

  Yeah, but there's no money in that.

• 30:11Speaker 02

  Marketing, my friend. When you have a good research team and they're rock stars, they're gonna look at you and your products and think, oh, man, those guys know what they're doing. So, yeah, when I got there, the person I replaced was Barnaby Jack. I took, I actually had his desk and everything, man. Yeah, yeah. You know, lots of respect to him, man. It was, it was, I, I, I never filled his shoes, but it was, it was just an honor to be a part of, you know, just be around. I got to meet him multiple times. He was a great guy.

• 30:43Jack Rhysider?

  See, back then, nobody had a bug bounty program. If you found a vulnerability on some software, that company wouldn't pay you anything. You'd be lucky if they sent you a T-shirt. There was zero money in vulnerability research then. But the reason EI did this research, to try to find vulnerabilities in software, was for two important reasons. One, to earn credibility. "Oh, that EI company must have some pretty sharp researchers to constantly be finding vulnerabilities and things. I bet their tools are great." It works. And two, recruitment. By making the news again and again that they keep finding vulnerabilities, top talent would want to come work there. Now, they did follow responsible disclosure.

• 31:27Jack Rhysider?

  When they'd find a vulnerability, they would do two things. First, tell the software maker and show them exactly what they found. Then, they would announce publicly that they found a vulnerability in a product. They wouldn't say what the vulnerability was, though, not until after the software company was able to fix it and patch it. So that was the team that Greg joined to simply find new bugs in software that nobody knows about, which is what's known as a zero-day vulnerability.

• 31:54Speaker 02

  So I get there and Office drops, Office 2007.

• 32:00Speaker 02

  Drops probably about four weeks after, like within my first month of of working there. And we were looking at other software. We were looking at, I think, C A Arcserve Backup, if you're, if you remember that terrible product. I I have, as a macro virus author, and I I can look at Office, like Hex editors in Office. I could tell you where the blobs are in Office. I know, I know, I know the bit format very, very, very well. So I mean, it comes out.

• 32:26Jack Rhysider?

  So there, there, your, your object, I mean, you're, that your boss or someone told you.

• 32:31Speaker 02

  Mark Mayfray, yes. We'll, we'll put his name for the record here.

• 32:36Jack Rhysider?

  Mark Mayfray, I've heard that name before.

• 32:39Speaker 02

  If you, if you don't know, Mark Mayfray got famous from MTV's A True Life, I'm a Hacker. Uh, that's where, that was his claim to fame. He was on that.

• 32:48Speaker 03

  You know, over like the last few years and like basically ever since I got into hacking, just been kind of like a wild ride or, you know, somewhat of a movie. After the raid, I started thinking a lot different about like my life and like what I want to, you know, start doing with it and then, you know, turn things around.

• 33:05Speaker 04

  These days, Chameleon is living the hacker dream, creating security software for companies to protect themselves from people just like him.

• 33:13Jack Rhysider?

  That was a clip from the MTV show called True Life Hacker from 1999. The show follows Mark around as he hacks stuff. He's wild back then. So I imagine it'd be really crazy to have him as a boss. So your boss told you Office 2007 just came out. Do you want to take a look at it? It would be great if you could find some sort of virus or bug in, not a virus, but an exploit in there, a bug that we could use for marketing and make a big deal about. So jump in there like, and, and you were assigned to do that.

• 33:44Speaker 02

  No, yeah, that's exactly how, how it worked. Anything that came out, any big, you know, any big thing, we were essentially bounty hunters, you know, we would go out and be like, yeah, let's go break this thing. If we have customers.

• 33:53Jack Rhysider?

  Yeah, but there wasn't, there wasn't paid bounty.

• 33:55Speaker 02

  Back then, you'd get a T-shirt if anything. It was it was all about the honor of of being the first. We wanted to be the first, too. That was a big deal. That honor was a reward. Yep, it was be the be the people who first found the bug. And so I went in there and started manually fuzzing word at the time.

• 34:16Jack Rhysider?

  Fuzzing. The first time I did fuzzing was when I was five years old. And I went to the supermarket and they had a gumball machine. My mom gave me a dime and showed me how you put it in and you turn the crank. And you get candy. It was awesome. And for years, I was drawn to them. I just had to touch them every time I saw them and check them out. Like, I would try turning the crank on every one to see if it would just give me candy with no money in it. Nope, unless you put money in it, the crank won't turn. I would sometimes try to put money in it and turn it very slowly to see if I could get a little bit of candy. And as soon as I do, turn it back real quick to reset it and do it again. But that didn't work. I would check the dispenser chutes to see if anyone left candy behind there.

• 35:01Jack Rhysider?

  And yes, sometimes they did, and that was cool, a little bit of free candy. I would shake the machine sometimes to see if I could get candy to come out that way. And that did sometimes work, too. But then I was like, how does it know I put money in here? Like, how does it know what a quarter or nickel or dime actually is? So I started jamming anything I could find that would fit in there. Plastic pieces, metal washers, cardboard, shoelaces. I'd shove it in, I'd turn the crank, and I would see what happens. And I'm telling you, from like five years old all the way to 15 years old, I was fiddling with these things every time I saw one. And that, to me, is what fuzzing is. It's trying to use the tool or machine or application in ways it's not supposed to be used

• 35:44Jack Rhysider?

  to see if you could glitch it or somehow get it to act weird. What Greg was doing was he was opening Microsoft Word and trying to put something in a Word document that wasn't allowed. I don't know, maybe trying to put a Chinese letter in there or some strange ASCII symbol. Word would accept some of these characters, but then just deny others. Now, if Word won't let you input a strange character, why? Will it break if you somehow force it to take that strange character? Well, Greg wanted to try. So he opened up a Word doc, not in Microsoft, though, in a Hex editor, where you can manipulate the ones and zeros directly in the file, almost like doing surgery on the file. And he'd put in a character directly into the file that he knows Microsoft Word can't accept.

• 36:29Jack Rhysider?

  And then he'd save it and try to open it up in Word to see what it would do. Nothing. Okay, fine, that didn't work. But let's try again. This time, let's see what the max font size is in Word. 1638. Whoa, that's pretty big. Okay, so Word won't let you make a font size bigger than that number. Challenge accepted. Let's set the font to the max 1638 to close down Word, open up the file in a Hex editor, look for where that number is. 1638, where does that show up? Ah, right there. And maybe that means the font size. So let's change that to 9999 and save it and open it up in Word and be like, "What now, Word? You wouldn't let me set the font bigger, but I did. What are you gonna do?" Nothing, it just reverts back to the default font size.

• 37:14Jack Rhysider?

  It had some sort of logic to handle what happens with a font size that we can't accept. And that is what fuzzing is. And that's what Greg was tasked with doing, to try to make the brand-new Microsoft Office 2007 suite crash. It's really a hunt to try to see if the developers at Microsoft accounted for every single problem that could possibly go wrong in Word and handle it gracefully.

• 37:40Speaker 02

  So you're modifying these files at the lowest level possible. And you're introducing all this unexpected code, unexpected code paths. It's parsing these files and it's parsing these files. It's encountering these unexpected data points. And these unexpected data points are introducing, you know, areas of opportunity for you to find a vulnerability.

• 37:59Jack Rhysider?

  And basically, the goal is to get Word to execute malicious codes, such as giving someone else control of that computer. But you can't just put malicious code in a Word doc and then when someone opens it, it runs. Word doesn't execute code like that. It just displays it as text. That's its job. So can you hide this malicious code somewhere in the Word document? That it will also get executed when Word gets opened? No, not really that either. Yeah, there's macros that act like code, but that's different. What we want is for Word to take our malicious little code and stick it into the memory of the computer. So the goal is to cause Word to crash, but then use that crash to force malicious code into memory or a pointer that references the code into memory.

• 38:44Jack Rhysider?

  Now, just opening Word is not enough to see all the stuff that's happening. You want extra visibility on how well Word is behaving, what stuff it's putting into memory and everything. And that's where a debugger comes in. At the time, he was using a debugger called Ollie, which will show him a lot more details of what Word is actually doing.

• 39:02Speaker 02

  Correct. Ollie is a tool that you attach to your, any, any application that you want to see at low level, the assembly level, you want to see what the code is actually doing, your registers and your memory output and what's going on with the application. You attach debugger that allows you-

• 39:16Jack Rhysider?

  Sounds like a wrapper for the app. So you open Ollie and then tell Ollie to open this. And then Ollie will be like, I will watch all the memory and everything that's happening here and tell you everything.

• 39:24Speaker 02

  That is, that's a great summary of that. And that's exactly what it does.

• 39:27Jack Rhysider?

  It sounds a bit tedious to open a file and a hex editor manually change one or two numbers, then close it and then open Word up and then see how it behaves and nothing. So just close it all and try again. So all day, he's editing these files, opening them in Word and then closing them.

• 39:44Speaker 02

  I just really liked looking at the files in the hex editor, modifying the files, opening the files. And noticing the UI changes like it would distort the it would like if you had your like your your office file if you had like graphics and stuff in there it would distort it or make it look you know wrong because it's rendering improperly so you could actually get better feedback I found by doing it that way to identify where in the file you're affecting and so I mean I did this for like two days and all of a sudden I had a crash.

• 40:14Jack Rhysider?

  Ooh, a crash. This is what he's been trying to create. Okay, first things first, will it crash every time? Yes. Awesome. Okay, it wasn't a fluke. Next, can he inject code into memory when it crashes? Yes. Wow, this is great. Now he has to see if he can get control of a pointer or inject some shell code into memory along with this crash. And yes, he can.

• 40:38Speaker 02

  And it was a classic crash at that time where you overwrote a data pointer and you can control the data pointer at that which is allows it's that's the basis for remote code execution.

• 40:52Jack Rhysider?

  So what he's discovered is he can craft a malicious Word doc so that when the user opens it, Word crashes, but then malicious code is put into memory and now the system is severely weakened. It's vulnerable. Wow, very cool. All within weeks of Microsoft Office coming out. Greg has discovered a pretty serious vulnerability in it which allows arbitrary code execution. He feels great. His team is impressed. So you tell your coworker, your coworker tells your boss, you tell your boss, whatever. And what is it? What does your company do with this?

• 41:24Speaker 02

  My boss is like, awesome. He immediately starts writing all the press and Mark Mayfray is he, if you know him, he's very enthusiastic. He's just like, oh, my God, we're gonna, we're gonna, we're gonna fuck this is gonna be fucking awesome. We're gonna send this to the press. We're gonna throw this out there. And so he immediately starts writing to everyone, you know, all his typical, you know, the tech writing, you know, the tech writers. And so they immediately start writing and and then we report to Microsoft.

• 41:52Jack Rhysider?

  Again, they aren't sharing exactly what the vulnerability is to the press. They're just telling them that EI found another zero day, this time in the latest Microsoft Office. And of course, only giving Microsoft the full details so they can fix it. And once it's fixed, then EI will show the world how it was done. The news spread fast. A few big tech publications were talking about this zero day that Greg found.

• 42:15Speaker 02

  About three days later, we get an email back from Microsoft and says, "Hey, um, we can't reproduce this." And we're like, "This is typical. This is, this is, we've dealt with this before. This is a typical Microsoft or security response, response team, typical action." So they're like, "Okay." So we send them more, we send the sample again. And we're like, "Hey, you know, we show, we show the debug output. We show like a script." And then like another day after that, it comes back. And they're like, "Hey, did you try this without a debugger attached?" And my, Mark Mayfair is like, "Of course we did." And then he looks over the, you know, he looks over to Andre. Andre looks at me and I'm like, "I don't think so."

• 43:00Speaker 02

  So we go, we go, we go run it again. And there is a special trap that Microsoft added. This is at the time, this was pretty new technology, where they had debug-only routing inside Office. So it would reach code flow path that was only exploitable, only triggerable when you had a debug attached to the word. Meaning, no one is going to be vulnerable to this unless they're having a debug attach or unless they're a security researcher.

• 43:36Jack Rhysider?

  Oh, man. How embarrassing. The news is out there saying that EI found a serious vulnerability, but now it turns out they don't actually have a vulnerability. And it's because this new kid, this weird-looking goth kid, didn't verify it all the way.

• 43:54Speaker 02

  And so I remember, there was yelling. There was yelling involved. I remember I was there for three weeks and I remember just, literally just staring down, being ashamed, like, "Oh, God. This is it? This is how I lose my, this is how I lose my, lose my career." It was, it was nice. It was, it was a good, it was a good couple of months. It's okay.

• 44:19Jack Rhysider?

  Because the stress here is because... A press release was written, right?

• 44:22Speaker 02

  Yes, yes. And EI at the time was like, they were like the rock stars. Like this is all everyone else in the room, you know, all those rock stars, Yuji, Derek, Daniel Soder, the brothers. Everyone else in there has written vulnerabilities in a professional manner. They've all done this for years. They found their first Vista vulnerability. They found, you know, this is, this is their thing. And now I'm the new guy who screwed up and made them look bad. So behind the closed door, they were like, we gotta fire this guy. And luckily for me, I believe Andre was like, no, we're gonna give him a chance. He's gonna, we're gonna give him a chance to, you know, make this right.

• 45:05Speaker 02

  So they come out and they were like, look, man, you gotta find a vulnerability. We don't care how you do it. It's gotta happen. I'm like, okay.

• 45:16Jack Rhysider?

  There's some hope still. The press release just said they found a vulnerability in Microsoft Office, which consists of Excel, Word, PowerPoint, Visio and more. It didn't give any details as to how the vulnerability works. So if they can find a bug in any of these products, it'll save the reputation of the company. But to be clear, for a young guy in his first cybersecurity job, to find a zero-day vulnerability in Microsoft Office, that's an incredibly complicated task. The entire team of coders at Microsoft worked tirelessly to prevent people like him from finding bugs like that. So he's gotta find something they missed?

• 46:00Jack Rhysider?

  This was a big deal for Greg. He needed to find a zero-day vulnerability in Microsoft Office or else he's going to be fired. He calls his girlfriend and says, don't wait up for me tonight. I am going to be working late. Sorry, I just have to do this. And he just gets dialed right into the zone, downing energy drinks, grabbing extra monitors to be more productive, ordering pizza right to his desk, like he's fully committed to doing this. He was so committed that he was going to stay in that office until he found a zero-day vulnerability.

• 46:32Speaker 02

  So I am there 24 hours by myself, just like manly trucking. And I'm just like, oh, God, I can't do it.

• 46:40Jack Rhysider?

  He's sleeping under his desk. He's living off of donuts and coffee.

• 46:43Speaker 02

  So what happened here, man, was like, so the crew comes up to me and they're like, dude, we're not gonna let you do this by yourself. We got your back. And so everyone stayed in there and we were in there for three days. And man, I remember girlfriends calling, wives calling guys and being like, are you guys coming home yet? They're like, no, we gotta do this. This is an important thing. We ordered pizza. We had Mountain Dew.

• 47:12Speaker 02

  That area of the office, I remember it was not smelling great. Like the other teams were like, what are you guys doing? What is going on here?

• 47:19Jack Rhysider?

  Are you just like opening text files and edit and then close and then open and then close?

• 47:23Speaker 02

  Yeah, we have, okay, so I think during that time, so there's at least six of us. We have, we have one guy who's writing his own program to fuzz it. We have, I think Yuji had like three screens up, fuzzing data, reverse engineering. He's like trying to reverse engineer that. I have a program I've written, running on one machine over here. I have a machine to my left. I have a machine next to me that's running software to find the bind this vulnerability. I'm in a hex editor, editing files left and right. I think Derek was also editing files. Derek was finding something else. He found, I think he later found another vulnerability out of this. But he's going in there, editing, looking at this. And we're all looking, everything we find is really interesting stuff, which turns out it was like, we found a lot of really cool stuff in Office at the time, but none of it was a vulnerability as we described.

• 48:08Speaker 02

  So we are literally just sitting there, geeking out and just pizza being ordered. EI was a wild time.

• 48:15Jack Rhysider?

  Days go by like this, where all the researchers are pouring tons of time into this. Nobody was going home. People were sleeping in shifts, under their desk, in the break room. The energy was amazing to have so many people come together to try to save the reputation of the company.

• 48:33Speaker 02

  Day three, I was modifying a file and all of a sudden it popped and we look at it and we're like, oh, wait. And I remember Yuji, Yuji looks at it first and he's like, Yuji is this incredibly, unbelievably talented Japanese hacker. And he's like, oh, it looks good. And when Yuji says it's good, everyone's like, okay. So, and the first thing that happens after that is, I remember one of the guys is like, is the debugger detached? We were like, oh yeah, get that thing off there. So retry it. And it happens to be in Office Visio. It was another product inside the Office suite. So it wasn't Word, not as sexy as Word, but hey, we only said

• 49:18Speaker 02

  Office 2007. So again, saved our butt. And so, and the thing is, when Microsoft sent that email, they're like, hey, man, this vulnerability occurs in this wrapper function called safe int. And what safe int does is it prevents the integer overflow from occurring and causing that controlled flow code execution to occur. So it checks all the integers. What happened with the new vulnerability we found was we just happened to find a legacy pointer for integer that was not safe integer wrapped and was vulnerable. So they sent that email out and unfortunately, David LeBlanc in Microsoft, David, if you're listening to this,

• 50:04Speaker 02

  I'm sorry, man. I think he was on vacation. He got called back. Maybe he didn't get called back, but that's what I heard. Cause he was the one who was in charge of safe int. Safe int was his baby. And it's an awesome, it's an awesome security feature. He got called back because when we sent that sample to Microsoft and it worked,

• 50:23Speaker 02

  that was a big deal to them. So. You know, we are all happy the vulnerability goes out like a couple of months later, it gets disclosed and we have indeed the first vulnerability in Microsoft Office. And that was, that was the case. That was, that was a, that was a wild time to say the least.

• 50:45Jack Rhysider?

  He saved his butt on that one. His whole career was on the line and he did what he had to do to save it. And being awake for so long, there wasn't much of a celebration after he found it.

• 50:57Speaker 02

  Dude, I crashed. I fell asleep. I remember like being like, just being so exhausted. I straight up like, at the time when I found out, I was already tired because I was half asleep. And I remember the alarm that I had for it to find, to like, find it. I nearly spilled, I think I did spill soda all over the place because I was just like waking up. Like, we're all fasting out. Like, we're literally sleeping at our desk here. There's no, we were not sleeping on hammocks or anything. We're just like sleeping at our desk. And so I remember it being, like, we find the vulnerability. We like, we're like, yes. And we were all so tired to actually have a proper, like, I guess we did have a proper, we did yell out extremely like a mouth. We're like, yes, we're finally, and then, and then immediately after, because we're like, we're celebrating, like, high fiving, everything was like that.

• 51:38Speaker 02

  But man, after that, I just remember us all just being like, and we're going home. And I fell asleep at the office. I couldn't even make it home at the time because I had to, I was gonna, I lived walking distance. I was too tired to even walk home at that day. So I just crashed out, woke up, went home. And I remember my girlfriend just threw me this, like, the, the, like, pillow and the blanket. And I was on the couch for like a week for that one. Rightfully so.

• 52:04Jack Rhysider?

  Yeah.

• 52:05Speaker 02

  She was so pissed.

• 52:06Jack Rhysider?

  But, but it was your job on the line. She should understand that. Like, listen, I am gonna get fired, or I could stay here three days and not see you. What would you rather I do?

• 52:15Speaker 02

  Oh, man. I was a newly, I was a newly father. My kid was like, probably like, oh.

• 52:18Jack Rhysider?

  Oh, okay, okay.

• 52:21Speaker 02

  My kid.

• 52:22Jack Rhysider?

  So, well, hold on. So you just had a kid at the time?

• 52:25Speaker 02

  A kid. When I started EI, I was six months old. So that kid was not even a year old. And colic. And my kid was extreme colic, like 12 hours a day crying. Oh, man, she was so mad.

• 52:38Jack Rhysider?

  Oh, that's, that's, that makes it even more stressful.

• 52:42Speaker 02

  Oh, yeah. Oh, oh, yeah. But yeah, so.

• 52:47Speaker 02

  Yeah, that was, I remember, I remember the emails, that was, like, the emails getting from her was like always popping up, just be like, her just getting angrier and angrier as the day is going on. And she's like, where are you? Like, I don't believe you're at work for three days doing this. And I was like, okay, I'll send you a picture of us. And we had like, like, the team just like doing random pictures. I was like, oh, man, this is, this was a time.

• 53:13Jack Rhysider?

  EI was a magic place. A lot of amazing talent worked there, and many went off to start their own cybersecurity businesses. Rumor has it that some of the anecdotes from the TV show Silicon Valley came from stories that happened at EI. And Greg learned a ton from working there for years.

• 53:29Speaker 02

  So, years, like, years later, oh, God, like, this is like my third year at EI. I remember, we had, we had a honeypot system, which, you know, it's a system that's designed to catch hackers and lure in individuals. And we tried to, we were trying to get zero day exploits, and they definitely tried to lure people into attacking the system. It was like one of the largest honeypots at the time. It was nearly a Class B internet group of honeypots. It was massive. And I remember, I was logging into one of the systems that we had maintained for that, and I see a login called Lfang. And I was just like, what is

• 54:11Speaker 02

  this? Who, whose account is this? Maybe this is a new hire, I just don't know about. And, and I walk into my boss's office, and I was like, hey, you know, I got that all set up. However, there was, there was someone who logged in recently, and maybe it's someone who we hired in like DevOps or something. Do you know Lfang? And I remember, I remember my boss was just typing, also I heard the distinct sound of him stopping, and the sound of the chair creaking back, and him looking at me. And he's like, you found what? Who? And I was like, yeah, Lfang. I think I looked at the extended name was Li Fang. And he's

• 54:54Speaker 02

  like, what do you mean, you found a Li Fang login? And I was like, yeah, it's on the honeypot system. It was like, it looked like it was a maintainer. And he goes and he closes the door behind me, and he's like,

• 55:09Speaker 02

  All right, I'm gonna tell you a story about Li Feng. And I was like, okay, let's hear about it. So, back in the day, like I mentioned, EI was the rock star, you know, group for finding vulnerabilities. It was like EI and iDefense. Um, and that was like the two big companies back in the day for finding zero-day vulnerabilities. And at one point, EI was so

• 55:37Speaker 02

  good at what they were doing, Microsoft decided to hi- hire someone in order to go work at EI in order to get them to tell them, Microsoft, about the zero-days they found in Microsoft.

• 55:54Jack Rhysider?

  Wait, wait, what? Hold on a second. You're saying Microsoft got someone to a job at EI.

• 56:04Speaker 02

  It was a different time.

• 56:05Jack Rhysider?

  But they could, but they worked for Microsoft so they could report to Microsoft what EI is working on.

• 56:09Speaker 02

  That's it. It was a different time. Yep.

• 56:11Jack Rhysider?

  There's, this is ridiculous. How, like, you don't hear about this ever.

• 56:16Speaker 02

  It was a different time.

• 56:17Jack Rhysider?

  Did this news ever, like, actually go public?

• 56:19Speaker 02

  I don't think so. This is, this is, this is a

• 56:22Jack Rhysider?

  I can't imagine Microsoft hiring to work to, getting people to work at other companies. This is corporate espionage.

• 56:30Speaker 02

  That's correct. Well, it gets even better. It gets even better after that. It gets even better after that.

• 56:39Jack Rhysider?

  Okay, so Microsoft hires Li Feng to work for them, but then plants him in EI to go find out what they're working on and report back to Microsoft. So Li Feng was working at EI for a while, but then suddenly left, and nobody really knows why, he just disappeared one day.

• 56:58Speaker 02

  But then Microsoft, sometime after he left, they're like, hey, we gotta have a talk. We have a, this, you know, this conversation. And so we're like, okay. Apparently, and so Microsoft was like, so Li Feng, he was working for us to, you know, identify zero-days that you guys may have found.

• 57:16Jack Rhysider?

  Which had to be a bombshell for your company to hear. Like, they thought that must have been

• 57:21Speaker 02

  I think they had suspicions he was being a little odd, but, um, so Microsoft then goes to say, so apparently, um,

• 57:30Speaker 02

  He was also working for a foreign government entity to do the same for us and you. So.

• 57:41Jack Rhysider?

  So someone placed him in Microsoft?

• 57:43Speaker 02

  Correct, correct.

• 57:45Jack Rhysider?

  Go get a job there and, and.

• 57:46Speaker 02

  And then he got chosen to go work for us. We hired him and he got planted. And then he was siphoning zero days from not only us, apparently he also had privy information at Microsoft. And that went back to his foreign government that he was ultimately working for.

• 58:06Jack Rhysider?

  Holy moly, someone planted him at Microsoft and then Microsoft planted him at EI? That's unreal. How embarrassing for Microsoft. It's like being caught doing something you shouldn't have been doing, like, I don't know, having your pants down when the elevator door opens. They know they shouldn't have been playing that game, but now they realized that they got played themselves. Oof. So I really wanted to confirm this story and I reached out to people that I know who have been at Microsoft for a very long time. And all of them said, that does not sound like something Microsoft would do. So I can't confirm that that story is true, but I would love to know if it is or isn't. So if you have information about Microsoft planting people in other companies, tell me about it.

• 58:49Jack Rhysider?

  Because here's the thing, we know corporate espionage is happening. There's people sending secrets back and forth to tech giants all the time, but it's a secret. So we don't know about it. We only know about the ones who get caught. So it seems plausible, like something like that could happen. And you know what? I'm curious what corporate espionage stories are out there. And take a quick peek, there seems to be some cool ones. In fact, I think I'm gonna take an ad break and look at this a little deeper because I'm fascinated by corporate espionage and I might have to do a few episodes on that sort of stuff. But stay with us because after the break, Greg is going to tell us some penetration testing stories that he's done.

• 59:31Jack Rhysider?

  This episode is sponsored by Arctic Wolf. Everyone is slapping AI-powered on their security tools. But Arctic Wolf took a different approach. Instead of duct taping AI onto the SOC, they rebuilt the SOC around AI and called it the Aurora Superintelligence Platform. If you ever tried to build your own AI pipeline, you know the pain. Data engineering, model tuning, governance, validation. Aurora removes all of it. You deploy it and instantly inherit the intelligence, guardrails, and operational maturity of one of the world's largest agentic SOC. Under the hood, Aurora is running a fully agentic architecture. They call the Swarm of Experts. These agents are battle-tested inside the world's largest commercial SOC

• 1:00:13Jack Rhysider?

  and only ship when they can outperform human-only workflows. And its integration is seamless as Aurora works within Arctic Wolf's concierge experience, allowing your security team to focus on higher-value strategy and proactive risk reduction. If you want to see what a real trustworthy agent-led SOC looks like, not the marketing slide version, go to arcticwolf.com/darknet. That's arcticwolf.com/darknet.

• 1:00:42Jack Rhysider?

  After a while, Greg left EI and started doing red-team stuff. That is, penetration testing, breaking into companies to test their security. And he also does threat intelligence, which, he tells me, he got some really interesting contacts and worked at some very interesting places. But we're gonna have to skip those stories because they're too sensitive to talk about. But he is willing to tell us a few pen test stories that he did go on. The first story is about a time when he was paid to try to hack into a major tech firm, which has a lot of user data. I mean, they have millions of users, but not just simple user data. They collected highly personal information on their users as part of their service. So Greg meets with the customer. And it started out weird from the get-go.

• 1:01:27Jack Rhysider?

  The customer was saying, "Look, we are crazy about security. We go over the top on cybersecurity because we cannot risk our user data getting out. So we don't think you're going to find anything. In fact, the last pen testing company struggled so bad to try to hack us that they got arrested."

• 1:01:45Speaker 02

  So they use a third-party payment processing system that is not used by them. And their previous pen testers accidentally exploited the third-party payment system that was vital to them. And the third-party payment system was an Oracle system and not owned by the customer at all. So when apparently, that's what I heard from the customer, they were, you know, they did their exploitation and then they, they said, hey, we got into, we got into, we got into credit cards and we're gonna present it to you in the next day in the, in the presentation. So they got the blue team there, all the blue team, all the people that were like, and they presented them and said, hey, we exploited this, we exploited

• 1:02:27Speaker 02

  this IP address, we got access, we gained it, here is your raw credit card details. And as you can imagine, the team looks at it and they're like, what IP is that? That's not, that's not local, that's not like, it's, it's, it's a, it's a tenant, you know, it's a local address, but that's not ran by us, that is not. And then they found it was actually owned by a third-party payment system and they had exploited a zero day and that gained access to there. And on top of that, the credit card details were not, there was a stream of credit card details. So I believe it was outside of even the scope for the customer. So the customer reported them on the safety of their half because they didn't want to think that's someone on their network compromised them and reported them to the

• 1:03:08Speaker 02

  law enforcement authorities. And I believe that led to the arrest of them. Either way, that was, that's always wonderful to hear going into a pen test. You're here like, hey, the previous guy's got arrested, why don't you guys come in here? So, you know, great start already, great start.

• 1:03:28Speaker 02

  So if you know me, I, I still dress like a goth kid, you know, I still, I'm still all black, I'm cyber punked out, I wear neo four, I love them. I'll wear everything from VX Underground, all black, everything, anything I can. So I show up at this facility and at this time, we also have a coworker of mine and like, this is my coworker's first big, real big pen test. And so he comes in too. And I will never forget the people there because they look at me and they look at each other and they're like, oh God, we, we, we gotta put you guys in the back room. And so they set us a separate room away from everyone else. Throughout my career, this is kind of the thing, I'm, I'm the guy in

• 1:04:09Speaker 02

  the back room. I've, I've been there because of how I am. So they set us back there and this is a five-day insider threat pen test. Go.

• 1:04:22Jack Rhysider?

  So his job was to simulate an employee there who had gone rogue or had been hacked. Just by being in the building, what could he do? Sniff some Wi-Fi traffic? Plug into some network ports? Well, that's worth checking out, but they did give him a single user's login. And they said, "That user should be locked down so tight that you shouldn't be able to do any harm, even by knowing their password."

• 1:04:49Speaker 02

  This customer, I've been red teaming a lot of places. Their blue team, their SOC team, is absolutely legit. One of the best defense teams I've ever had the honor of working with. And so they literally are running their own kind of like built-in EDR system that they built themselves that's tying into their SOC, going in there. And we get nowhere, man. Day one, nothing. Day two, nothing. Day three, my coworker's laptop dies in the middle of it, and he can't even work anymore. And we had to give a report to the customer. And I remember them just looking at us and being like,

• 1:05:29Speaker 02

  "I think we hired the wrong people." Like, literally, they're like, "Do you, are you guys want to resign? And we can scrap this up, call it quits, and then we can go hire somewhere else?" And I was like, "No, man, we got this." Day four happens, and we... I remember it was like 4:30, and we have to give, at 5 o'clock, we have to give our meeting. And my coworker had to go to Best Buy, buy a brand-new machine. And he spent the entire day imaging a machine on a red-team engagement. And he looks at me, and he's like, "Man, I don't know what to do." So I was like, "Hey, let's try one more, let's do some art poisoning and just do one more time."

• 1:06:08Speaker 02

  And I remember looking up, and that art poison grabbed one plain text credential that just happened to be an FTP job. And we're like, "Oh, we got a credential, we got somewhere, you know, we got something." It turns out, that credential was the build system process, and it allowed us to get into the build system to roll code throughout the entire thing. And it just so happened, at 4:30, they rolled it out to do an end-of-day lockdown and build system configuration, lock everything down, so no one's doing any more builds.

• 1:06:46Speaker 02

  We went to that meeting, said, "Hey, we just intercepted this." And I remember them all thinking, "Wait a minute, that's the old build, like, and that credential's still active." At that point, we had a really cool exploit for that one. We got into the build system, and they had a lot of controls on the actual files in there. So we couldn't modify into build files, but we could edit the command line. So we rolled an inline assembly.net include in there to roll in, go into their portal, and steal all the customer datas would enter, would enter a credit card in there. We marked it in the data, we blocked out that credit card, but we put an asterisk in there, stolen last four digits, and then had it sent out to them. They tested, they round out, and they were like, "Holy crap, we have not had a red team

• 1:07:31Speaker 02

  rollout code to production in like eight, nine, 10 years that we've here. Come back next year, come back next year."

• 1:07:38Jack Rhysider?

  Talk about a hail Mary. Not a single find all week, and then 4:30 PM on the last day, they catch a lucky break by sniffing a credential in the network, which gave them tons of access. What a good find that saved their butts.

• 1:07:51Speaker 02

  I come back next year, and they're like, "Hey, we want you to do something kind of crazy. We want you to target DNA."

• 1:08:00Jack Rhysider?

  Part of what this company did was genetics studies. They had DNA data on their users, and this was regarded as one of the most protected assets of the company. So why not hire a hacker to try to find it and steal it?

• 1:08:13Speaker 02

  And we don't care how you get it. Any way you can get it, that's, that's fair game.

• 1:08:20Speaker 02

  So I spent like a week in there as, as a malicious insider.

• 1:08:30Jack Rhysider?

  He starts with a basic employee login again. It is locked down pretty tight, but it's just enough for him to get a foothold somewhere else, and from there, he finds an exploit in another system, and then he was able to pivot from there, collecting more system logins, and finally, he's able to get in a system which manages backups of machines.

• 1:08:51Jack Rhysider?

  He can see there's some really large files here. Maybe those are system snapshots or backups. But what system is it a backup for? No idea. But he decides to try to download it anyway to see if he can look at what's in these files.

• 1:09:06Speaker 02

  It literally aired out on the on the share size. And I was like, I've never seen that before. And I remember clicking a file and I'm on a local network. And I remember that file taking forever to get to me. And I was like, how big is this?

• 1:09:21Speaker 02

  So I grabbed the file and I'm on the local machine. And I remember looking at it and it's TCGACT, like those, those, those letters. And I was just like, I think that's DNA. I think that's DNA. And I was like, huh. Wow, maybe this has got to be, this can't be, this can't be right. So I grab it and I cut off like as much as I could. And then I sent it over. I work with a, I work with a biologist. She was very, very smart girl. And she just happened to be a biologist who was working with mice at the time. And she actually knows DNA and she worked with DNA. And I was like, hey, what does this look like to you?

• 1:10:03Speaker 02

  And I sent it to her and she looks at it and she's like, oh, this, this is a, this is a DNA sequence mapped out by this program. And this is looks like, I was like, oh, okay, cool. And then she's like, hang on, I can even tell you what kind of DNA this is. And she like, a couple of minutes go by and she's like, why do you have human DNA? I was like, I gotta go, I gotta buy a click. And so my next task was like, they were like, you have to get the data out. We can get in, you have to get access it, but we had to get it out. So at the time, again, it was ran by a very, very good SOC team. There was, there was a lot of the environment I was in was very, very well restricted.

• 1:10:46Speaker 02

  And the only way I got to her was through, you know, sending a picture. Like I remember selecting it all and then putting it into like an app, sending her a picture of it. And it was like so bad quality, I had to send it a couple of times, actually. But so I was like, how am I going to get all this data? I can't do with the phone, you know, I can't do with the picture. How am I going to get all this data out?

• 1:11:08Speaker 02

  I was a malicious insider, so I was working as a quote-unquote IT member. And so I got introduced to the IT group and they're like, oh yeah, you'll be working in this environment. You're it's cool. And so I was like, I gotta figure out a way I can get a bunch of hard drives. And I have to get a bunch of hard drives back into the building. So what I did was there was printers that were scheduled for to be to be. These printers were scheduled to be taken to repair. I remember grabbing all those printers and gutting it as much as I could and be walking out and going out to the front desk. Going out the front door and be like, hey, um, I gotta send this printer to the repair shop. It has to be done today immediately. And so the front desk people were like, okay, just sign off work.

• 1:11:52Speaker 02

  Cool. Sign off for the printer. Load that into my rental car and I go to Best Buy and I'm like, I have to get hard drives. I have to get a lot of hard drives. So I went by, and this is back in the day where those were external hard drive for those big, obnoxiously ugly colored, colored, uh, colored things. And they came in like,

• 1:12:15Speaker 02

  I think thirty-two gigs or sixty-four gigs was like a big hard drive at that time. So I go through, I have a shopping cart and I just go from the end line of these and just pull the whole thing into the shopping cart. I have a full shopping cart of hard drives.

• 1:12:29Jack Rhysider?

  You put your arm on the shelf and just.

• 1:12:31Speaker 02

  Do you know that meme where the guy's running around Best Buy and he's like, oh, hacked all the things. I hacked all the things. That was me, except with hard drives shoving it into a, into, into a shopping cart. And I remember, I remember going to the best, at the front of the desk, maxing out my credit card. And then of hard drives and then going back and to my hotel at the time and loading them all into the printer. I put it like the shell out, the hollowed out printer, I just stacked the hard drives in there and closed it up together. And then I show up to work the next day, get the little trolley carts they have, go out and say, bring it back. And I remember, I remember I'm bringing back the printer and the front desk person was like.

• 1:13:18Speaker 02

  Wait, you sent that off to be fixed yesterday? And I was like, yeah, uh, uh, he's like, you gotta tell me how you got those guys to fix that in 24 hours. Because, man, they are always so slow. And I was like, oh shit, um, well, I bought them a root beer. And they're like, oh, that makes sense. I was like, I bought, I brought them a six pack of root beer. And he was like, ah, okay. Good to know. So I go back to my area of, of the building, putting it, and I have this printer next to me and then I, I'm opening up a little panel and I'm just, USB drive, literally copy, pasting, mounting, copy, pasting. And I started it. I started it like, like eight, eight fifteen AM.

• 1:14:01Speaker 02

  And I am there until they kicked me out of the building at like nine PM, doing nothing but moving over data. And then I leave the printer there. And for the next two days, um, I am literally doing this every day. And then on my last day of the pen test, I remember I walk out and I go to the front desk and the guy there, and he's still there, he's like, he's like, I was like, oh dude, printer broke again. And he's like, oh, don't worry, I got something for you. And he goes to the fridge, the little fridge he has, and he brings out a six pack of beer, of root beer. He's like, give this to them and tell them I said hi. I am sitting there trying not to laugh while I'm holding petabytes of like, I can imagine.

• 1:14:44Speaker 02

  I, I think, I don't know how, I, I couldn't get it all. But I, I remember I bought over like 80 hard drives, um, from Best Buy. I think, I actually went back a couple of days later and brought some more because I didn't think I had enough. And, and put them in my jacket and my pants. And I loaded this, this, this HP printer and filled that thing up and got to my hotel. And then at that point, had a, I had a secondary laptop that I asked, I requested to prove for exfiltration, connected to that laptop, loaded up and said, done.

• 1:15:14Jack Rhysider?

  So when it was time to show him what he found, he has them go into the room where he was working in and said, open up the printer. And they open it up and when they do, bunch of hard drives just come pouring out of it. And he says, those hard drives are filled with all your DNA data.

• 1:15:31Speaker 02

  Yeah, and they later said, hey, you were the first, you were the first person to do that. And I, I worked for the red teaming for another I think three or four more times after that. And it was after that was a call center I attacked, targeted.

• 1:15:44Jack Rhysider?

  Okay, here's the big question though, right? First time, they're like, we gotta go in the back office. We can't have that. After doing it like three, four times, when you're walking through, are you feeling more confident? Like, oh, no, you could be in the front office. We don't mind you being around here.

• 1:15:57Speaker 02

  Oh, man, I went to their, I went to their barbecues. I went to their family. They're all very nice. After the first time, they're like, look, you can never meet the execs, but, but we will absolutely hire you every single time.

• 1:16:15Jack Rhysider?

  A few years go by of him doing pen tests, and he gets another job, which also has an interesting story. This time, a venture capital company has hired him to try to hack them. Now, they wanted to see if he could hack into them to get data that would influence the market or something that might hurt the reputation of the company, or see if he can gain information that can be used against the company. So Greg gets tasked with going onsite to try to hack into this venture capital company, which, remember, even though he's well into his 30s at this point, he is still dressing all goth and considers himself a goth kid.

• 1:16:51Speaker 02

  I'm still a goth kid, man. I, I, I still dress in black. I, I still wear my goth, like, my, like, like I said, I don't wear, I don't like the collars or anything, but I still dress all black. I wear my, my goth outfits. I wear my, my VX underground, like my neophoric shawls and everything. I, I wear my, my goth boots. And what's funny is every single contract I, I sign for work, I have two clauses in there. Clause number one, I'll never code in Ruby. Fuck Ruby. Now, clause number two, I'll never adhere to a dress code. Period. If those don't, if those two don't happen, I don't work there. Period. So.

• 1:17:29Speaker 02

  So, um, and that goes, that's, that goes back to like, I was one of the, when I was in cybersecurity, I was one of the kids who never went to college for cybersecurity. And so like all these places are like, oh, you gotta get a college degree. You gotta, you gotta do all this kind of stuff. And you gotta wear suits. And I was like, nah, fuck that, man. If you, I, I got like, if you don't hire me for like the things I know, then I don't want to work there. And that's, that's been a long belief and I still believe that, you know, to this very day.

• 1:17:55Speaker 02

  And I, I told my boss, you know, the day that my, my goth outfit interferes with the way I work, I will stop doing it. And still do it to this very day. Uh, it's been 20 years. Um, anyways, so they send me over and remember I get out, uh, they're like, hey, we want you to meet at this area, you know, meet at this outside, it's going to be outside the hotel that we're all staying at. And I walk up to this guy and this guy is wearing a suit. He is wearing like a suit that costs probably more than, than what I make in a month. And he's sitting there, he's smoking a cigarette, clean cut. The guy looks like he's still like active secret service. I think he even had an earpiece in there like, and he looks at me and I was like, hey, are you,

• 1:18:40Speaker 02

  are you this guy? And we'll, we'll call, we'll, we'll call him Brando. We'll, you know, are you Brando? And he was just like, yeah. And he's like, are you Greg? And I was like, yeah, nice to meet you. I remember he takes the longest drag out of his cigarette.

• 1:18:59Speaker 02

  You know that meme from, um, uh, what's that HBO True Detective? Where, where the meme of looking at the, the phone and the guy's just inhaling the cigarette, where Matthew McConaughey, I think is inhaling the cigarette. I got that exact look from this guy looking at me and he just tosses that cigarette. And he's like, this is going to be a long week. He's like, let's go.

• 1:19:20Jack Rhysider?

  So this guy is his escort and drives him to the building where he's supposed to do the pen test. And he takes Greg to the front door and he tries to go in with his escort.

• 1:19:28Speaker 02

  And I remember physical security is like, sir, who are you? What are you doing here? They, they, they literally get in front of me. I was like, no, I'm, I'm, I'm with, I'm with Brando over there and I'm part of the, of the assessment. And they're like, give us some ID. And they escort me into the building. And also, I'm getting a call from like my, my contact and he's like, where are you? I was like, I'm, I'm being detained. And he's like, oh God, this is a great start. So they come over and they realize that I'm supposed to be there. And then I go meet my contact and I remember him looking at me and being like, oh man. He's like, all right, well, you can go work in that back room over there.

• 1:20:12Speaker 02

  We're, we're gonna tell everyone you're, you're an auditor or someone, so no one bothers you. We're, you're gonna sit up in this back room and just don't bother anyone. Just, just go there.

• 1:20:21Jack Rhysider?

  So they sat him down and said, okay, hack this place. And he's like, well, can you give me like a user login or something? No. All right, can you give me the wifi password at least? No. Well, listen, I see a bunch of wireless networks and I don't want to accidentally hack into the wrong wireless network. So can you at least tell me which wifi network is yours?

• 1:20:44Speaker 02

  I could see the, the contact at the, the venture capital is like, man. It was like, he looked at me and he wanted me to be out of this building and to fail as, as much as possible. So he's like, our guest wifi ID is this. Go. That's it. That's all I had to go on. Nothing else, just the guest wifi. So I get up and I'm like, okay. So I start walking around the building and the security team's absolutely following me at every step of this. And Brando from the, the other third party is like, where are you going? Like, what was going on? I was like, I'm looking for a wifi password. And he's like, I think, he's like, I'm pretty sure you're supposed to do that with the computers stuff. I was like, no, no, like they're, they're gonna have this. And I, I walk around the building and eventually I find it on a whiteboard.

• 1:21:28Speaker 02

  And I'm like, bingo. Let's go to, so I go back and I sit down and now I'm on their guest wifi network.

• 1:21:35Jack Rhysider?

  Nice. How clever. Just look around the building for the password. All right. So now he's connected to the guest wifi.

• 1:21:42Speaker 02

  So I get it, I get the password. I sit down and from there, I start scanning. And the first thing I go is I hit the wifi router and it's a Cisco, Cisco device. And this team.

• 1:21:56Speaker 02

  I'll later learn that this team is very, very good. However, again, like they mentioned, they've never had a full red team event. So the routers, the router security is nowhere near where it should be. It's actually, the router is a single router, a senior Cisco device that is both the guest wifi and the internal wifi as well. So I exploit the router, I jump on the router, and then I make the entire network flat, a bridge over everything. So now, now, now my machine can be, it can attack anything on the inside of the network, even though I'm on the, on the guest wifi, I can still start attacking anything on the inside network. Or on, on certain networks, they had multiple inside networks, so I start bridging them

• 1:22:41Speaker 02

  over one by one.

• 1:22:42Jack Rhysider?

  How did you exploit the router?

• 1:22:44Speaker 02

  The router didn't have, like, A, their, their password was default, as unfortunately, as it, number two, I was, they had an administrative password on, like, the panels, so the access, the access was one, one password, and then I brute forced, I believe, the password of the admin panel. It was very close to standard password on there, gained access, unfortunately.

• 1:23:11Jack Rhysider?

  So the guest wifi should only have very minimal access, like, just to the internet, and no internal systems in the building. But when he bridged the networks, he could then access anything that other employees could access, which gives him access to a ton of internal systems.

• 1:23:27Speaker 02

  There, I start doing man in the middle attacks. And let me tell you, red teamers out there, pen testers out there, never skip out on layer two attacks. Layer two is your responders, your Cain and Abels, your, your, your art poisoning, your DHCP, your DHCP spoofing, all of those. That is, that is gonna be your bread and butter. I promise you, those vulnerabilities are still existing there, they still work. I work in engagements to this very day. That is where, that's where so many places fail.

• 1:24:01Speaker 02

  So I man in the middle, I start stealing credentials, and this is back in the era before, you know, SSL security was everywhere. So you could still do man in the middle and downgrade websites to HTTP logins. And I start getting credentials to people logging into work emails.

• 1:24:18Speaker 02

  After about an hour, I get access to a relatively new hire. She has like six months of work in her inbox. I get access for email. And the first thing I do is I go all the way down to day one. And what do you get in day one email? You get your employee training. You get your onboarding information. You get your onboarding documentation. And if you come to this building, you get your building alarm code. So have a physical alarm code that goes in her. And also have her badge ID number and what she looks like and such. So I'm like, okay, so what can I do next? And I remember the Brando, the ex-secret service guy looking over my shoulder.

• 1:25:03Speaker 02

  And he's like, what are you doing? And I was like, okay, so you know these card readers? He's like, yeah. He's like, we're gonna clone one of these card readers. And he's at this point where he's like, all right, goth guy. You're not so bad. Okay, I like this idea. And he's like, all right, I'm gonna work with you on this. And he's like, I talked with them and we're gonna talk about guard shifts and times to get into this building. And I was like, okay. So I tell him my plan and I was like, man, so I got a building alarm code. I'm gonna put RFID cloner next to their badge reader. And when they badge in, I'm gonna start getting all these badges. He's like, okay. And so a day goes by and eventually the girl who's building alarm code comes in, badges in. And I get her, I have like a proxy smart system.

• 1:25:47Speaker 02

  I keep pulling it and all of a sudden I notice her ID matches up. So now I have her employee ID badge and her building access alarm code.

• 1:25:55Jack Rhysider?

  To get into this building, you need to use your little badge and tap the badge reader and the door unlocks. And what Greg did is he put a little badge sniffer behind the real badge reader. So that anytime anyone taps their card, he gets to see what their badge is. And that essentially allows him to clone a badge.

• 1:26:12Speaker 02

  They gave me a tour of the building at one point, very, very against their will. They're trying to like hush me around. The two things I noticed when they gave me that tour was A, there was a balcony on the second floor that had a tree next to it. And from that balcony was a straight shot into their server room. And basically you go through one room. In that room, you get into, you go down one hallway and you're in a server room. And the server room did have a badge reader on it. The second thing I noticed is Sort of like a, like almost like a spiral staircase downward. There was lots and lots and lots of paintings.

• 1:26:51Speaker 02

  I remember asking during the tour, I was like, whoa, these, these look like, like real paintings. And they nodded, they're like, yeah, CEO, one of the CEOs here loves paintings. And this is their, their, this is their pride and joy. They like to show art and they like to make sure that, and I was like, huh. That's interesting. That's cool. And um, so I remember, so for the next couple of days, um, I, I had to get a badge of an IT guy because I needed to get access to the server room. And eventually I get it and it's through the Poxmark system as well. In the meantime, I'm doing man to middle, getting credentials, doing traditional attacking methods.

• 1:27:33Speaker 02

  But I really wanted to focus on this, on this whole physical element. Because the, the Brando working with me, he was just like, man, he's like, we can do some Mission Impossible stuff. And I was like, yeah, yeah, we could.

• 1:27:46Speaker 02

  And so the next phase was, they had cameras everywhere. They had internal cameras, outside, external cameras. And I remember doing the network, like, so eventually every day I'm, I'm folding different parts of that, of their internal networks into the guest network that I'm at, so I can bridge over and start looking. And eventually I find all their camera, their camera network. And luckily for me, they're using access cameras. And if anyone's worked physical security, everyone knows there was an era of access cameras from like 2001 to about 2008, nine, 10, where everyone had, all these places had these access cameras because they had a ton of features. They were cheap, they were, you know, Chinese made, wonderful cameras.

• 1:28:30Speaker 02

  However, they were the worst security ever. Uh, they had so many default passwords, they had, uh, they had buffer overflows in the access control systems. They had buffer overflows in their web, uh, their web interface. They had like a web interface that when you connected to it, it looked like GeoCities. Like it was like straight up like 2002 internet all over again. And that's how you controlled the cameras directly. So, talked to Brando and he was like, "Okay, look, man, um, he's like, "I know they do a guard change around, "it's 2:30 AM between, you know, around that time." "He's like, "You gotta be in and out of a building around this time." And I was like, "Well," you know, he's like, "And he's like, "Also, there's gonna be someone always watching these cameras." And I was like, "Okay, that's fine," you know. He's like, "What are you gonna do with the cameras?"

• 1:29:15Speaker 02

  So I show him, and I start connecting to all these cameras, and at the time, there was a, there was an access. I think they're still running like firmware from like 2005, and there's an access buffer overflow that allows you to control and gain access to every one of these cameras. Still running that, then patched them. Jump in, and then from there, I can access the shitty little interface. And I show him, I was like, "Look, what happens if I modify these two values?" And the values is brightness and contrast, and you can edit both of them. It's usually for, you know, when a viewer wants to look at the camera, they're trying, "Oh, it's too dark or too bright." They can edit these. And UI, you can edit them a little bit, but programmatically, you can add them all the way from zero to 255 values. So you can make them go all black or all white.

• 1:29:59Speaker 02

  So, I show him, and I was like, "Watch, we can make their cameras go boom." And watch, I show the camera, it goes distinctly black for a second, and then I undo it. And he's like, "Oh." I was like, "Yeah." He's like, "All right, goth guy, all right, I see what you're cooking here." And so, he's like, "Well, how are you gonna get these into an area that, you know, "how are you gonna like do this in a way that you're gonna have to carry a laptop with you? It's gonna just be awkward." And I was like, "You know, that's a good point." So in this engagement, I had a shuttle device with me. A little tiny lap, like computers are like the size of a shoebox. A lot of pen testers use them for leave behind devices. And on that shuttle device, uh, I put a Bluetooth radio on it.

• 1:30:42Speaker 02

  And so, with the Bluetooth radio, I was like, "Okay, I'm gonna walk around the building, "and I'm gonna get measurements of where I'm at with the Bluetooth, signal their noise ratio. And when I'm in front of those areas, I'm gonna map out what cameras those are at, "and I am gonna make sure that I can get access to, you know, this." And so, so I tested out the Bluetooth range. I had to put a big antenna on this thing to get the Bluetooth receiver on it. And that worked, so I could, I could, I could have the Bluetooth show. I'd go in front of these two cameras, the two cameras that point outside to the patio. I could have them identified. There was a camera on the inside there. And then there was a camera facing the server room. So those are the, those are the cameras I needed to black out. So, uh, my app set signals to the Bluetooth.

• 1:31:26Speaker 02

  The shuttle device would take that signal and relay it. And when I received those, it would send the packets to those cameras to make the values of brightness or contrast to 255 or 0, completely random. They flipped back and forth between them to make it look like a black and white screen. Sort of like an effect that was like the cameras malfunctioned for a bit. Um, so I was like, man, I have to leave, like, I could look at these cameras. I could test to see if this works. Not sure if this is really gonna work, but we're gonna try it.

• 1:31:53Jack Rhysider?

  So he set everything up to try to break into the building overnight and not be seen at all. The front door might have extra security and he didn't want to take the risk. So his whole plan was to sneak up to the building, blackout the cameras, get in, and gain access to the server room. Keep in mind, everyone already was on high alert from this kid. They thought he was very suspicious. And he was going to have to do something over the top to get in. And that's when he realized his point of entry should be the balcony.

• 1:32:23Speaker 02

  So that night, man, I came in 2:30 in the morning, climbed up the tree. I get onto the balcony, I push open the, they had like a security door on the balcony that they would lock, um, before you can get to the badge reading door there. I pry that open, hit the badge, go into the building. The alarm starts beeping. I hit the building alarm code. And lucky for me, the girl had not changed her alarm code. I was in. And I look at the cameras and I remember being so nervous about this. And being like, oh, man, this is, hopefully this will work or I'm gonna get tackled very soon. So I make my way over to the server room. And my secondary badge, the other one I have for the IT guy, works for that one.

• 1:33:08Speaker 02

  Badge cloned, got him in there, went to the server room. And from there, brute rooted all the machines. Now, so if you're unfamiliar with boot root, back in the day, this was you plug a USB device into the machine. You turn off the server. This machine would then boot off the USB device as a recovery device. And from here, you would replace a Windows component. Sticky keys would be ideal favorite. So you replace sticky keys with command shell and then you reboot the machine. So the machine, after you do that, machine, you reboot the machine. It goes into the password login prompt and you hit shift five times. That would then launch sticky keys, which has now been become a command prompt instead.

• 1:33:51Speaker 02

  And now you have a command screen on it and then you can run commands as elevated privileges. You run a system, so you'd have elevated command. So from there, I exploited all the machines. I dropped a flag that said I was here. And then I went into their to their stores and put flags on all of those.

• 1:34:09Jack Rhysider?

  He's done it. He's successfully hacked into the server's mission impossible style. And so he starts to go out, but he notices something.

• 1:34:17Speaker 02

  Those paintings. So I proceeded to go down the staircase and I go down through the paintings. I just quickly grab a sticky pad and put us little happy faces. I get a little sticky page and start putting them right next to all these paintings. Like there's a little placard for each of these paintings tell you essentially who made these paintings, what it symbolized. In some cases, how much they were worth. And I stick little happy faces on it and that says, I stole this.

• 1:34:45Jack Rhysider?

  So it's typical for a physical pen tester to leave a token behind, to prove that they were there in a server room or a desk drawer or something. I mean, just think about how you would feel if you went to bed and then woke up and there was a sticky note on your bathroom mirror that said Greg was here. Just a small note like that can say a lot, can't it? Here, what Greg was doing was proving that he had access to these paintings and he had time to go right up to them, put notes on them and security never saw him do it. So he wrote, I stole this on a bunch of sticky notes and just kept putting the sticky notes on painting after painting, after painting, after painting.

• 1:35:22Speaker 02

  And I remember like 605, like, like I get a call, Greg, Greg. Yeah, was this you? What's the happy face? What's that mean? How did you do that? What is? It doesn't matter. The CEO wants to like, talk with you today. Get in here like eight o'clock. Like, like, he's like, I don't know, man. He's really upset with the figure out. I was like, okay, okay. And in the meantime, like the physical security had an issue. Like they had a, they had a incident because they were like, they were looking over and they were like, well, someone walked in and put all these happy face stickers on there. And they walked out of the building. They're like, what does this mean? I stole this.

• 1:36:06Speaker 02

  And I remember they are coming around and I get into the building. They escort me to the, like the boardroom. And the boardroom has this massive table on it. And me, in my awkwardness, I, I pick, I remember sitting and picking the exact opposite of where I, you know, where I imagine everyone, the exact corner of it. And the physical security is like, no, get over here, get over here. And first, they give us your ID again. We're going to run some background checks on you again, just to make sure.

• 1:36:35Jack Rhysider?

  Physical security knows to treat those paintings with a very high level of security. So when the CEO came in and he saw his paintings had sticky notes on them, he simply asked, who did this? What does this mean? And when security had no idea, then the CEO is like, okay, we'll find out. And then when security looked at the cameras, they saw they were glitched out during that time and they had almost no evidence of who did it. This made the CEO furious. What do you mean no security footage? Find out who put these sticky notes on this. And the cameras around the building were just all black or white because Greg hacked into them to prove he could sneak into the building late at night with nobody noticing.

• 1:37:17Speaker 02

  The VC came in, the VC and CEO came in and was like, what the fuck? What is this? You know, who's like, what do you mean stole my paintings? And little happy faces on them. And that's what kicked off the security team alert. And, and I remember I was sitting there and then my contact leans over to me and he's like, look, again, I have never seen him cancel meetings like, and move someone to see someone like this. So I don't think it's going to go well. And, and then I look over to Brando and Brando is just like, you know, he's like, maybe we flew a little bit too close to the sun here, a little Icarus this a little hard, but you know, whatever. So CEO comes in with this physical security. They hand me back my ID and he looks at me.

• 1:38:03Speaker 02

  And I, you can tell the thoughts of this goth kid in his boardroom is not what he expected and not what he was expecting to meet for when he, and he looks over and he's like, "You hired this guy?" And my contact who worked at the company was just like, "Yeah." And like looking at him, he's like, "All right." And he's like, "So, walk me through what you did." And for the next 10 minutes, I retell him the story of exactly how I did. And this VC previously had been very technical. He was a code developer, he worked on software. And so he starts going and he starts asking me very intelligent questions back. We start

• 1:38:46Speaker 02

  having a back and forth about, "Oh, okay, so why those, this, all right." And he's like, "So, two questions for you. First, what were you gonna do with the paintings?" And I was like, "Uh, I was dating a girl out of Brooklyn at this time." And I was like, "You know, I was, I think about taking him to Pratt University and maybe, you know, fencing him at the university there. But it's gotta be someone who knows like some weird connections at Pratt Art, you know, Pratt Institute of Art." And he starts laughing. He's like, "All right, um, she had a plan." And I was like, "Okay." And, and he's like, "I really liked those paintings." And I was like, "I can't believe you, you know, like you would, you know." So I was like, "Yeah, um, I absolutely would have stole right out the front of, nothing to do." And

• 1:39:26Speaker 02

  he's like, "All right." So then he's like, "All right, um, so my next question is, what are you doing next year this time?" And that's how I became their reoccurring rent teamer for four years until they got tired of me breaking into the buildings and doing all the things and hired me as full-time. So after this, I got introduced to a lot of the various levels of, of executives for this. And I got to pen test all their personal houses and got to show them how, why physical security is important. Getting access to all their penthouse suites, all their large houses. That I did that for quite some time afterwards.

• 1:40:19Jack Rhysider?

  A big thank you to Greg Laneras, aka Laughing Mantis, for coming on the show and sharing these stories with us. Please consider supporting the show by visiting plus.darknetdiaries.com. If you do, you'll get 11 bonus episodes and an ad-free version of the show. By becoming a supporter is the most direct way that you can help make sure this show continues running and delivers you more episodes. Please visit plus.darknetdiaries.com. This episode is created by me, Capsha America, Jacque Cider. Our editor is the super-subnetter Tristan Ledger. Mixing done by Proximity Sound, and our intro music is by the mysterious Breakmaster Cylinder. I've been working on a new dance lately. It requires the most efficient use of muscle memory in order to spin at the perfect RPM.

• 1:41:03Jack Rhysider?

  I call my dance "The Algorithm." This is Darknet Diaries.