151: Chris Rock

21:52And if it does, it's like, man, that was the one in chance. So you're right, multi-gear, it's one of those things you have to plan for the worst. The goal was to get access to this company's network. But where's that company's network? And how do you get into it without being caught? This is where the more you know about that company, the better. He discovered this company had a Wi-Fi network set up in the building. And what's more is the Wi-Fi they were running was using WEP encryption. This was years ago when WEP wasn't so uncommon. Today we use WPA, which is much more secure, but WEP had some vulnerabilities.

22:29If you could get a radio near the WEP Wi-Fi router, you could intercept enough beacons and packets to get on their Wi-Fi network. So that was the goal. Get in the building, get within range of their Wi-Fi router, and plant a device to listen to and capture the WEP packets. We actually had to do custom-built stuff. So, you know, I got an Italian motherboard. It was like the tiniest motherboard at the time, and then built up my own Linux stack with Wi-Fi hacking. and things like putty and reverse shelters like plink and stuff like that that we would use that we would plant close to the VC firm. So he loads up his kit full of cool gadgets and flies over to that country.

23:13You got any sort of way you dress up when you go out to these things? Just a black or blue suit with a white shirt and tie. Like it's just, even if it's 50-degree heat like in QA, that's what you wear. That's not what a black hat hacker looks like. I know, I know. Exactly right. So, yeah, so hoodie, all that sort of stuff, that doesn't command respect over there. But suit guy over there, in their eyes, respect. He goes to the office building and starts planning out how to get in. That's the easy part. A white guy in a suit with a laptop, with someone holding lots of books, someone will open the door for them.

23:52It's one of those pen-testing stories that you've probably heard a million of. But that works in the U.S. or even in Australia. But if you're a white guy walking into a place with a bunch of people that don't look the same, now you're out of place. Your thinking is right. But when a white – let me show you. Middle Eastern companies like a Westerner in there because these people have been trained outside of the Middle East. We trust them. They've been to Cambridge and MIT, all this stuff. So it comes with an inherent trust. You're right, Jack. Your thinking is, oh, you know, the white guy sticks out of place.

24:28But no, over there, a white guy, you do what they say. Because if you've done any work in the Middle East, they employ, you know, the best German engineers and the best, you know, English, you know, financiers and stuff like that. It's not unusual for a white guy to come and pretty much run the show, if that makes sense. So he's let in the building. No problem. And it's a co-working space, which means there's a lot of small businesses working out of this building. and he can use that to his advantage because everyone is used to seeing strangers roaming around. Getting access to the building was really easy because it was, like you said, it was a co-working space and then finding out that they were on a floor that had one of those communal kitchens.

25:03Like for us, it was like easy as, I didn't have to get past, you know, a receptionist or someone, what are you doing here? It was essentially, you know, a guy making a coffee, pulling the microwave forward, sticking something behind her and then boom, we had a device planted in to get this last VC firm. You said we a few times, who else is on your team? Yeah, we're not talking about owning level three, level two, level one targets. I mean, there might be 20 targets behind the scenes. We're talking about Bob's doctor, Bob's lawyer, Bob's accountant, Bob's gym. In extreme cases, things like Bob's bank.

25:34You can't do that all by yourself. I mean, that would be a year-long exercise and it's not worth the effort. So I always work in a team to do these activities just to make that load easier, if that makes sense. Okay, so it was fairly uneventful getting in, but he managed to slip in, go into their kitchen, go behind their microwave, plug in this little computer with an antenna, and then slip out of the building. Now him or his team can access this little device remotely because it has its own cell connection so that he can just access it from anywhere in the world. Their first goal is to get on the Wi-Fi network.

26:07To do that, they're going to have to crack the WEP protocol. They log into that little device and fire up a tool called AircrackNG. What this does is it intercepts as many Wi-Fi packets as it can. If you think about it, Wi-Fi is wireless, so the packets are just flying through the air all over the place. It's pretty easy to tune your antenna to just see them and grab them. Today's modern WPA protocols make it so even though you can grab the packets out of the air, you can't see what's in them. But with web encryption, there are vulnerabilities in which you could grab enough packets to be able to decipher it and get into the Wi-Fi yourself, which is what they did.

26:42After running Aircrack NG long enough, they got their little device on the office Wi-Fi, which now they have a little machine on the inside giving them an inside look into their network. A network scan shows them a few devices that are there. And then they look at what ports are open on those systems. And then they can guess what devices those might be. They find a file server, which employees were using to store documents and such. And remember, this is an investment firm. So they're managing a lot of money and have to maintain relationships with people. and know which businesses they are invested in.

27:14So all this must be documented somewhere. And this file server was exactly where it all was. That's correct. And then we had access to file servers and stuff like that and email servers. And that's how we got into that company that we couldn't get in through the whole remote PDF stuff. At this point, Chris has a huge amount of visibility into this investment firm and the suspects who might be stealing this money and intellectual property. He's got a ridiculous amount of listeners in place, full access to the network, Like he can look at all the files on their file servers and email servers, full access to some of the suspects' computers through remote access Trojans that were put on there.

27:49He's able to see every email in and out. And he also has key loggers on their computers. So you can see what their usernames and passwords were. But he also has access to emails and computers with people around the suspects, family members, friends, doctors. He's also looking to see what kind of bank accounts these people have, just in case he needs to get in there and take a look to see where money's going. So with all this access, he starts finding stuff that the client might be interested in. On file service, you'd start seeing folders, like a folder. And then we're talking about in the investment firm, you would see like, you know, bulbs.

28:21And then you would see things like IP and stuff like that, which we would then run past our clients saying, is this the sort of stuff that you're worried about leaking into somebody else's hands? And then we would send that to our handler who'd say, yes, no, yes, keep targeting that sort of stuff. So you start starting building a picture. And, I mean, this exercise went for a long time. I don't want to exaggerate, but I think this one went for nine plus months on this exercise. It was just a continual stream. So over that time, you're reading every email back and forth. And so you would get all that sort of information and learning how they speak and how they think and proper language.

28:58So you start piecing the puzzles together on what this guy is actually doing. And because, I'll say this, we don't give a shit what he's doing. It's essentially, here's what he's doing, client. Is this what you want? Is this what you suspected? There's no emotion. We didn't give a fuck. It's just a job. And then we would give that, say yes, no. How do you want us to proceed? And then go from there. The client kept telling him he's on the right track. Keep finding more details and send them over. And like he said, he maintained his access for quite a while as he gathered all this info. But he doesn't want his presence to be detected.

29:31So he has to be very careful not to be seen. so essentially what we would do with a blackout exercise we might compromise say eight targets around the world and the last hop would be from the home country so for example we might you know compromise a hotel in pakistan and an airbnb in india and then another country now these countries don't participate they don't do forensics with each other like they're essentially war with each other so you would pop your traffic cross seas and then the last hop would be in this case it was It was a Q8, so essentially the last hop before the target would be a Q80 IP.

30:07And we actually owned the telco at that stage in Q8, so it essentially didn't really matter. It just looked like an AT &T. What? My gosh, just to log into their Gmail, you're like, wait, we can't do it from Australia. Let's get over there and log in from there. I'll tell you what, I got a plan. First, we're going to hack into an Airbnb in Pakistan, and then we're going to hop over from there to hack into a telecom provider in that country. And then from the telecom provider, that's when we're going, that sounds so crazy. Yeah, and so, Greg, so when people talk about like a little black book, we would essentially have a network of these compromised targets, not the telcos, let's leave the telcos.

30:52We would have a network of a path we could use when we want to do a hack job. We're not doing it from the local McDonald's or from your home, for example. So we would have this rotating list of our own proxies, not TOR or anything like that. We do our own targeted proxies that do the hops that we want. Like we definitely want to do India, Pakistan, Sri Lanka, Bangladesh because like I said, they hate each other. So there's no, oh, can you give us your diss for this activity? Like it's not going to happen. So we would use the wars of the world to benefit us. So that would be our black book of targets.

31:24So we always have, and when we're not working, we would essentially find these targets for our next assignment. So you always have that. that little black book of, like you talked about before, tools. We would have compromised targets around the world that we were going to bounce off. The telco was just happened to be something that I love hacking telcos. So it was one of those things that was going to come in handy. Gosh, so to carry out a task like this, he has to spend quite a bit of time and resources finding vulnerable systems around the world so he can hack into them only to use that system to jump over to another computer in the world.

31:56This way, it's impossible for anyone to track his route back to where he came from. But also, think about the fact that he has that little computer behind the microwave in the office that he's targeting. It's on the same Wi-Fi as the people in that office. So he could use that computer to log into things like Gmail, which would appear to be the same IP those people are typically logging in from, making Gmail think this is normal activity and not alert the user. After a while, Chris had collected and delivered enough evidence that the client called the police. Yeah, so the evidence was essentially what they suspected, that both money that had been sent to the company to build the company was being moved to both personal accounts and to the outside investment firm, as well as IP that was created in the business.

32:43The subsidiary was being moved to another investment firm as essentially our collateral, our moat, for example. This is the data. And how did you find that? Where was that smoking gun that you found? That was freaking everywhere. That was everywhere. These guys are operating like, again, the Wild West are operating their emails, both Gmail, both company emails, file servers, everything. It was just that evidence was everywhere. It just took a while to put it all together and connect the dots. Yeah, and remember, that was not our job. Our job was to present what we found and then they were to go, is this your – because we don't care.

33:16Like I said before, I don't want to sound non-inch along, but is this your shit? Yes, no. Do you want us to find more shit? No, we have all the shit we need. Go do your job. That's how we operate. Because, again, it's not personal. We don't care what the information is. Is this the right shit or are we on the wrong track? We just need to know. Now, the payment for this, was it sufficient? Because I can imagine them saying, here's a briefcase of money. And then you're like, well, dude, okay, we've been working on this for three months. If you want us to keep more, we need another briefcase. Yeah, we don't – how we operate is we'll have an initial fee, a finalisation fee, and then we will have what we call an ongoing fee.

33:59So, you know, the jobs like this we'd like to have over within a month. So, initial fee, completion fee. But if you want us to continue to monitor, you know, these eight people and this outside company, you're going to have to have like a monthly charge, almost like a subscription model, where they would pay to just find out what's going on in these people's lives. So you don't want them to think they're idiots. So you'll put a quote in front of them and they'll say, we agree to that quote. You better stand by that quote. You know what I mean? Like if you want referral jobs going forward, like if you said half a mil or a mil or two mil, whatever you quote, that you stick to that.

34:33You don't say we need more. Like you make it crystal clear because this is, again, this is repeat business that you want. Yeah, I'm just starting to put the picture together of like how much you charge versus how much they're losing. it's worth more to them to pay a million or two million to you and if they're going to recover what? How much money do you think was being stolen here? In this case, I know exactly how much money was being sold. I think it was 2.5 US or 2.75 US, say a million dollars in this case. But you've got to think when you're in business, Jack, I know you're in business, but when you're working with a customer, their initial first year spend might be, let's say it's half a million dollars for the initial spend.

35:17And once they see how useful you are and then you do repeat business, it's like it's an investment firm. They're always investing shit. So they're always going to use your services down the track. So you might do – it's a bit like a drug dealer. You might give them a taster for half a million and the next job is going to be worth two. You know what I mean? Like you just – they know your work. They know your style. And then you know you're going to get repeat business with higher stakes. I mean he's dealing with wealthy people here, billionaires, oil money. Yeah, if he can prove that he's the go-to person to these folks, yeah, these could be long-term customers of his.

35:50And in this case, they were very happy with him. They got enough evidence to take action on this thief. They then got lawyers involved from their side. They had to be really careful about what they presented to the lawyers. But it was, we believe, XYZ, and then get the police to arrest the ringleader, Bob, at that moment. and so that was essentially their goal, to get him in jail because they took it personally. Like I said to you, you've got to treat them with respect and if you disrespect them, then they get really emotive and then for them, jail was the worst case of action for them. Okay. Story's over, right?

36:31You found the thief. They put him in jail. Yeah, so Jack, the story's not over there. This is where it gets exciting. Stay with us. We're going to take an ad break, but it's going to get exciting after that.

37:10SpyCloud's new Identity Threat Report reveals that nearly half of all corporate users have been infected by info stealer malware at some point. With 63.8 billion distinct identity records now circulating on the dark web, the scale of this threat is staggering. What's even more alarming is that only 38 % of organizations can actually detect these historical identity exposures that create ongoing risk. Knowing what's putting you and your organization at risk, from stolen credentials to session cookies to PII, is critical for protecting against identity-based threats like account takeover, session hijacking, and yes, even ransomware.

37:46With SpyCloud, you're never in the dark about your company's exposure from third-party breaches, successful fishes, or infostealer infections. Read the full report and check your Darknet exposure for free at spycloud.com. slash darknetdiaries. That's spycloud.com slash darknetdiaries.

38:10There was enough evidence to prove that this guy Bob stole the money and the intellectual property, but they told Chris they were worried about the money. The customer worried that Bob was going to use that money in defense. He was going to, you know, get on all his bloody Shapiro lawyers to fight his case and use the funds that he'd stolen to fund that exercise. So they asked Chris, get us back that stolen money. Do your job as a hacker by any means necessary and return the money to us. Which, in my opinion, is crazy because why not just have the police return the money? They didn't want to wait because you're thinking American system, not Middle Eastern system.

38:45They didn't want to fuck around with that sort of stuff. They didn't want to go through, we want the money, you know, we want this, we want, you know, and then put a brief together, stuff like that. They don't roll that way. So his objective was clear. Get into this guy's bank account while he's in jail and move the money out. This job has essentially turned into a bank heist at this point. And it seems to me that Chris doesn't have any moral concerns about robbing a bank. No, no, no. And Jack, I've listened to a lot of your sessions and that comes up quite a lot. I don't have that boundary. Does that make sense?

39:16So for me... So, okay. So this doesn't make sense just economically, right? So if somebody pays you$50 ,000 to go get a million dollars out of a bank account, why don't you just go get the million dollars and be like, you know what, forget you. I'm just going to go steal my own money. And that's actually happened on jobs before where you take your share as well.

39:40So in our case, remember, we were returning the funds. We didn't return the funds and a little bit extra. Yes, we could have taken money from somebody else's account, but that raises flags in case. So we were essentially returning the money that was stolen. So there's no actual victim. Does that make sense? The money was returned to the rightful person. Yeah, it does make sense. Okay. And remember, we're after repeat work and word of mouth, which is how you work over there. It's like building a business.

40:13Okay. So you accept this job to get the money back. Now, how did you do it? How did you get the money back? We compromised the bank, which was pretty easy. So we essentially used the same sort of techniques of PDFs inside, going to the core banking system, finding out the internal where their internet banking web servers were, replacing the front page to actually log all the usernames and passwords and two factors. And then we would have a log file of all the username, passwords and two factor. So what he just said was that he found a bank employee, sent them a phishing email, got them to open a PDF, which planted a Trojan on their computer.

40:54And then he was able to get into their computer. And from there, he hopped into the server of the bank's network. And from that, he was able to find the front end web server for the online banking. And he configured the online banking site so that anyone who logged in, their username and password would be stored in a log file so that he could see it. But on top of that, he was also logging two-factor authentication codes that people were entering. This is incredible. Well, he's only trying to get access to a single user account. He's basically accessed all the bank users who logged in during that window while he was watching.

41:22I just can't believe this guy. I suppose the question is, why are you surprised, Jack? You talk to people for years and you know the pen tests that are out there that people can talk about. It's fucking normal. Like you do know, but you would not believe how shit banks are locally and internationally. Like the shit security that they have out there that it's just, you know, if there was more bad people in the world, there'd be more banks getting done. Well, I guess maybe that's why I'm surprised is because the hackers of the world is the immune system for all these banks, right? And so, well, you got a shit security bank.

41:58Okay, well, there's a million hackers out there that are going to fix that for you real quick. Yeah, exactly right. And the thing is, Jack, you might have a million hackers. You know, 800 ,000 of those are just like new to the industry, you know, the zero to five. And then, you know, if you then look at the, like, the bell curve of people who are into banks, you know, there's, you know, I'll just say 1 ,000 for argument's sake. But it's a smaller number that you need to protect against. But, Jack, I've seen some banks that where I've gone in and I've gone into A-Day and have a look at, you know, Joe Smith and it has the description of where they work.

42:31And what they put in the description was the user's password. So, you know, password 1 or password 2 ,000 in clear text in the descriptive field of the LDAP field. because when someone rang up and said, oh, I forgot my password, they would just read out the description field from the LBAP. And I couldn't fucking believe it. So they would have everyone's password on the list and just read off it. And then anyone knows anything about LBAP, you can just query that. But that's the shit that we see as a pen tester and as a blackout. Well, we've done banks, Jack, where we've seen other hackers in the bank itself.

43:03Like it's just fucking hackers right beside us. Wait, then you're like, hey, I recognize you. I've seen you at DEVCON. Exactly right. And the beauty of stuff like that is you work around each other. No one wants to lose access. This is like that Beastie Boys video, Paul Revere, you know, that song where they're just hanging out at the bar and then suddenly the one guy's like, I'm going to rob this place. You want you in? Yeah, I'm in. Let's go do it. Exactly right. And you don't know why they're there. You don't know if it's government, you know, if it's other hackers or whatever it is. You just work around each other.

43:35The beauty is if you do find tools that they're using, you take a copy of those tools because we can then use those tools to plant on another target's site so they get the blame for it, not us. So, you know, you look at the techniques that they're using, whether, you know, today we use APT groups, stuff like signatures, you'll create those signatures and you'll plant them somewhere else. So you might, you know, compromise a target, you know, format the dish. Before you format the dish, throw the tools on, format it, and then all of a sudden, you know, some double-H guy, you know, runs in case and goes, oh, I can see the deleted toolkit must be this group and then they get the blame for it.

44:11Oh my gosh, did you hear that? If Chris really wants to hide his tracks, he'll plant evidence on servers, which makes it look like some nation state hackers were there, which throws off investigators who are on his trail. And he only knows what tools that some of these other hackers use because in the past, he spotted them on the same servers that he's hacked into and watched what they've done. Okay, so you got to the web page. You were able to see this target, Bob's username, password, two-factor authentication code. And were you able to log in and transfer his money out with this? No, because when you did a transfer, then asked for your two-factor authentication code again.

44:51Now, the problem we had is fucking Bob's in jail at this stage, so he doesn't have access to his texts. Oh, right. How's he going to do online banking from jail? They managed to get his username and password and were able to log into his account before he went to jail. But there's this problem with the 2FA code now. So when you go to wire the money out, it asks you for another two-factor authentication. Correct. This bank did, yes. And you didn't have a way to get that second one. No, because we had the session live, so we kept that session live so it wouldn't log us out when we got access before we went to jail.

45:26But when it then asked for another transfer, did like a, oh, you need another code to do that transfer. So we couldn't move that money out. You're insane. Okay, so plan A failed. How do you do it? Yeah, so plan A failed, and I don't want to sound like a glass is half full, but it was enough to prove that the money was all, not the whole money, but a good proportion of the money was still there. Bob obviously had some expenses. So at this stage, remember, we'd already compromised the bank itself. So it was just essentially going in as a teller. When you're a bank teller, you're God. You can do whatever the fuck you want.

46:03And if a bank teller doesn't have the rights, you can be treasurer. You already own the bank. You can move up horizontally vertically to get the guy's access to move the money. Interesting. If he can pose as a bank teller, get the access they have, they have the power to conduct any transfer they want. And keep in mind, Chris spent 10 years working in the banking sector, So he knows exactly how banks operate. Well, step one, comb through the directory of employees. Find which ones are the tellers. Then find which ones have remote access to the bank where they can do like work from home stuff. Maybe like phone support or something.

46:37Then grab their username and hash and crack the hash. And now you can log in as that teller and move money around. Which is exactly what he did. As a teller, he transferred Bob's money out into another account. So remember we talked about 2.75 and I was fumbling over the 2.75 and 2.5. Essentially, we recovered the 2.5, but the original was 2.75. $2.5 million were taken from that guy's account while he was in jail. Crazy. This is a black hat bank robbery type stuff. Now I'm starting to put it all together on what he means when he says he doesn't care if he does illegal black hat type hacking. He's like a mercenary hacker for hire, you know?

47:18And maybe that makes him gray hat. where, yes, it's illegal, but he's helping someone fight a bad guy? But what I don't get is why the bank didn't raise alarm bells from all this. Like if$2.5 million got transferred out of the bank in a very suspicious manner, you'd think they'd launch a full-on investigation. Like, bring in the teller who did this transfer and ask them a bunch of questions and look through the security logs for any unusual activity. And if they notice all the usernames and passwords are being stored in the logs, then that's a data breach that should be disclosed to their customers and maybe impact their share price or something?

47:50Yeah, so you raised good points. In my world, there's people to make transfers disappear. So in my world, I've got bank accounts that I can use that can be scrubbed on the other end in the SWIFT network to say that that didn't exist. And then it goes through a laundry process where that money's cleaned over a nine-month period so that money gets returned. So the answer to your question is, in Bob's case, no one gave a shit. Bob had money in his account and money was returned. So there is no victim. Does that make sense? Like Bob stole the money, money got returned. There's no one who injured the bank, where's my money?

48:26Huh. Since nobody complained the money was stolen, then maybe nobody ever investigated this. Which means they don't have to hide the money trail either. Like he was preparing to wire the money to a bank where he can launder it and have it come out clean. But since this money rightfully belonged to the client, they didn't think he needed to go through all the hassle of cleaning the money. No. In this case, we didn't need to. it was just transferred back to the investment firm. So it was just like from Bob to investment firm has been returned, has been misallocated, misappropriated, and has been returned.

48:55How wild. Somehow this all slipped past the bank. I mean, perhaps later they saw this, but never came public about it or reversed the transfer. And maybe it was because Bob was in jail and never complained about it. Or maybe they wanted to avoid embarrassment of being hacked. Or maybe it was because they saw where the money went and it was to a very influential person who they didn't want to disturb or ask questions about. Or maybe they did ask that person questions and that person simply said, yeah, the money was stolen by Bob, who's now in jail, and here's the police report. Thank you so much for reversing the charge.

49:25This whole thing's just got my brain up in knots. In this method here, we could have created a fake teller and then just done a copy user and then replace and then just done the transfer that way. But we knew we didn't have to. The fact that the customer just wanted their money returned to their bank account, not a washing station like a laundromat, that it was just a good shit. We didn't have to delete the user. We didn't have to delete the transaction. I guess what I'm wondering also is if this is going back to the appropriate person, then why can't – I mean, the person – your client is a very influential person in the region.

50:01Why can't they just go to the bank and be like, listen, I found the guy who stole this money. We need to reverse the charge. Just do this. This is a legitimate reverse. That's a great question. All I can tell you is what we were told. We were told they feared that that money was going to be used, if the money was there, which it was, the money was going to be used in a court process. Like it was going to be a string out two to three year court trial and they were going to use those funds. So the time that they got that money back, the bank said, you need a court order. Can you prove it? Blah, blah.

50:33They were worried about that. Now, whether they could have just overridden that, I don't know. But in their head, that's what they were worried about. So keep in mind who we're dealing with here. This guy we're calling Bob has the guts to steal money from an investment firm owned by a super rich guy. Even though Bob got caught, he's still pretty smart. So he's probably got a plan for when all this goes wrong. So it's important for Chris to keep eyes on him as he goes to jail so he watches who Bob is messaging and what's he up to. Look, he's a kind of guy that I actually have respect for this guy because he's pretty cunning.

51:09And because I've been reading his emails, I knew him so well inside and out. You know what it's like when you're reading, or maybe you don't check, but when you read someone's emails, you have a relationship with them whether they don't know it, but you actually know them inside and out. So Bob's quite crafty, but Bob used the I am ill card and he worked with his doctor to get a bail hearing that he could get out on bail while this case was going forward. So he was essentially in jail for a week and then the doctors wrote, you know, my client is sick note, which we could verify because we talked about level two and level three.

51:43we had access to his doctor. So we got to see what was going on, that he used his doctor to get out of jail after two weeks in jail. What happened is we were reading some of the emails when he was in jail, obviously, and then outside of jail, and his language changed. He almost like he was putting it on. You know, like when you're an actor, you act, and when you're not an actor, you look like an idiot. And Bob was essentially looking like he was acting in his emails. And I said to the customer, this is not normal emails that he's sending out. He was going on fishing trips. He was planning a fishing trip and the car had never been fishing.

52:23You know what I mean? It was all these sort of, I'm going to be here at this time. And it was too much information that I think, you know, he's on. He knows that we're reading his emails and he's putting it on. And I said, look, this guy's a flight risk. And they said, no, no, no, he's fine. We've got his passport and blah, blah, blah. So because Chris had such a deep level of visibility into Bob, he watched him closely to see where he was going. Bob didn't actually go fishing. He was smuggled across the border in a bloody burka. And we tracked his headers of his IP saying, look, the guy's not even in the fucking country anymore.

52:59You guys think he's there. He's not. He's in Amman. So, you know, all this shit talk about we've got your passport. He's not going anywhere. And he actually escaped the system on a second passport. Because this was in real time over maybe a 12-hour period, I'll say 24-hour period, essentially the guy was moving fast, you know, car, he was in a car. We later found out that he was in a boot and then he went into the back seat with a burr car and then he hopped a border and then he had another passport and then he used that. But because we had the IP headers, we could see where he actually was. Like he was, I'm not saying he's stupid because a lot of people in that world don't understand IP headers.

53:39You were in his phone? No, he was sending emails out from his device. Okay. I will make that clear. Normally we do get into phones, but this case wasn't a phone. It was just email headers, not IP. Don't get me wrong. I don't normally talk about this, but sometimes we'll send a ping packet. So you get the odd SMS and you know, Jack, you get an SMS and you'll click on it, you know, your UPS mail is late. You'll click on it and go, oh, it's just some fucking scam. It's asking for my username and password. But what it does is it just tracks your location from your phone. We used that a couple of times on this project, but it wasn't a tool that was needed.

54:19Does that make sense? We had enough from the IP headers that we didn't need a GPS location. Once Bob left the country, there was nothing Chris's client could really do about it. So they said, thanks for letting us know. I guess that's it then. Here's your final payment. That's the end of the engagement. Weird question. Have you ever killed anybody? Only virtually. Yeah, virtually. The answer is going to be no on this podcast, Jack. Have I birthed anybody? That's another story. You have many kids. I have many kids. I have many kids. See, the thing that put Chris Rock on my radar is a talk he gave at DEF CON in 2015 titled, I Will Kill You.

55:05And in this talk, he explains exactly how to use hacking to kill someone. Part of my career as a pen tester, mercenary, team founder, is research. And one of my first DEF CON talks was I was watching the news in Australia. And the news report was a hospital accidentally sent out 200 death notices instead of 200 discharge notices. And I went, what the fuck? How is that even possible? And then that led me down the rabbit hole of researching the death industry, the medical component and the funeral director component on how the system has moved online and the flaws that involves where you could actually physically create a real person, like a fake person, and how you could kill them.

55:53Okay. So walk us through this step-by-step, how to kill someone. Yeah. So in America, actually, it's very similar around the world, but in the US, they used to have a paper based system where the funeral director would fill out half form on how the person died or where the person died or where they're buried and all that sort of stuff next of kin and the doctor would fill out the first part of the form which is the cause of death and you know those sort of details name of the victim and and then how they died that one piece of paper would go into essentially the birth deaths and marriages system and then that person would be declared dead what's happened now that's moved online.

56:26So essentially when somebody dies, the process is the doctor will log on to a US system called EDRS, log on with their username and password and actually put in what caused the person to die, a pulmonary embolism or whatever, a heart failure, that sort of stuff. And then that information would then pass to the funeral director. A funeral director would complete their part, again, username and password to log in, and that would form essentially the death certificate in the EDRS system. Now, the flaw in the system is both the medical and the funeral director component is essentially if you want to be registered to declare people dead, you essentially put in your license number, your medical license number and your office address.

57:10Now, if anyone's looked up a doctor before to see if they're a real doctor, all this shit's online. There's databases all around the world to say whether your doctor's a license to practice, their registration number and their office number. So you could register yourself as a doctor and then you could actually kill somebody off the first part. And again, with the funeral director component, it's pretty much the same as a doctor where you can declare yourself a funeral director and form the second part of that form and to kill somebody off and get essentially a death certificate. And why would you want to kill someone?

57:40Well, there's multiple reasons why you want to kill someone. First of all, if you want to kill your parents, for example, like you're waiting for their will but they're not giving you the money, you could actually kill them off. You could kill your boss. Your boss was being an asshole. You could kill him just to fuck with them. Or if you're under investigation, so you've got prosecution and judge and all that sort of stuff, you could actually kill them off to make their life more difficult. Oh my gosh. You're ridiculous. And so you're saying this flaw in the death system can also be done in the birth system?

58:16Yes. So it's exactly the same. Well, it's a different system but exactly the same as ERS for deaths and you need two parties. So you need the doctor or midwife and you need the parents. So, you know, the name of the child, the weight of the child and stuff like that. So the two parts would then make the birth certificate very similar to the funeral director and the doctor making the death certificate. And if you have a home birth, you may not even have a midwife, so it's something actually done by the parents. And so once you have an online system, you have a birth certificate, that person is then born.

58:50So in theory, you can create fake children. And then when they hit a certain age, you could kill them off and get their life insurance and build up their credit and all that sort of stuff. You doubled it to both of the things. Well, I really like this idea of making a fake persona to use as a second identity in case I've embezzled some money from a Middle Eastern millionaire and I need to leave the country. Exactly, Jack. And you think, and why have one when you can have 100? So you can have 100 fake people that have different credit. And so if you screw up your life and you go to jail and you have to come out and you go get another job or whatever, you have another clean identity, like another virtual ID.

59:29And it's real. Like it's not like someone entered it in the back end. It's actually a registered person that you can have. I suggest you keep yourself looking young because you might create someone who's zero. and then, but there's little flaws in the system as well and I may have mentioned that they don't want people going through life without being recorded. So you have up till the age of five to get yourself registered. So if you have, you can take five years off your virtual person by registering five years after they're born because they want to capture people as they go into the school system and they don't want them to be prevented from going to school or getting driver's license or stuff like that.

1:00:05So you don't have to register a baby at zero. You can register them at five as well. You know, when I saw you do this talk at DEF CON, I was so surprised that the governments haven't knocked on your door and said, hey, would you shut up about this? You can't just go killing people and making babies that are not real. You're teaching people to do bad things. Yeah, so the government haven't done shit even since my talk. Now, my talk was done nine years ago, Jack. So those same flaws exist today. Nothing's changed. If you're intrigued to know more about how to kill someone like a hacker, go to YouTube and type in Chris Rock DEFCON.

1:00:43He actually has given three talks at DEFCON and they're all phenomenal. In the second talk, he explains how to overthrow a government. And I have a sneaking suspicion that he's actually done it or was very much involved with overthrowing a government in the past. Let me know if you liked him and you want me to have him back on and tell that story. And his other talk is about how to bypass radio jammers in case someone is trying to jam your cell phone. And he'll show you how to get through it anyway.

1:01:15A big thanks to Chris Rock for coming on the show and giving us a good story. Come join our Discord. You can talk to a lot of people who are fans of the show, but it's also my favorite place to hang out. You can find us at discord.gg slash darknetdiaries. And on November 19th, we're going to be doing a t-shirt giveaway, so you can win some cool Darknet Diaries swag. So come on over to Discord. This episode was created by me, the script, Kitty It, Jack Recider. Our editor is the captain backspace, Tristan Ledger. Mixing done by proximity sound, and our intro music is by the mysterious Breakmaster Cylinder.

1:01:47Hey, Siri, why am I so bad at women? My name is Alexa. Damn it. This is Darknet Diaries.