157: Grifter

26:04like you're not going to be able to walk into a store in a mall at you know 15 years old and walk up with your credit card and buy whatever like it just didn't seem i didn't realize also that people there are kids that did that and other places in the world like but um but i just thought there's no way anyone's going to believe that you should have a credit card so i just sat on it.

26:34But I was, I was like, I wonder if that was a fluke. Let me see if I can do it again. Again, I sent another one to a different house and again, it showed up. And I was like, okay, I've got something here. I'm not quite sure what, because I know I can't use these. What can I do with them? There was a guy he knew, the dad of one of his friends. And this dad was part of a group that did organized crime. Like in New York, fireworks were illegal, but this dad would have Grifter and some other kids go around and see who wanted fireworks, almost like they're going around selling Girl Scout cookies, and then you put your order in of what fireworks you want, and then a few weeks later, Grifter would come back and deliver the fireworks to you.

27:15In fact, this guy was so into organized crime that he was often hanging out with mafia-type people and had connections to some pretty serious criminals. Because I knew that he had some connection to like actual criminals. Like I approached him and said like, hey, so I can do this thing where I can get access to credit cards with higher limits on them. And I don't want to use them. I don't want to be on camera in stores. I don't want to do anything. Is that something that you or, you know, your people would be interested in? And he was like, yes. Like he just said to me, like, yeah, yeah. I would.

27:56And I'm like, okay. And he's like, let me talk to some people or whatever. And he's like, what are we talking here? And I'm like, I don't know,$5 ,000,$10 ,000, whatever, whatever. And he's like, let me find out what I can get you. And then he came back and said, oh, well, I need to know it's real. Do you have, do you have something to prove it? I said, sure. Got him one of the cards that I'd gotten. And I was like, that one's, you know,$5 ,000. And he's like, well, I can give you 10 % for that. And I'm like, okay, so I get 500 bucks? And he's like, yeah. And then he peeled off$500 bills and said, this better work.

28:37And I was like, it'll work. And then I was terrified because I was like, what if it doesn't work? Oh my gosh, right? But so I was like, don't spend the money, right? Like, don't spend the money. But now I'd been handed money for something that I was like, okay, this is actually a little bit nerve-wracking. But it worked, right? And then he came back and he was like, okay, great. Can you do it again? And I was like, well, I already have. I have one right now. He's like, all right, go get it, right? And I went and got it. And then I gave it to him. And then he peeled off another 500 bucks. And he's like, just come to me whenever you got it.

29:12And I was like, all right. So Grifter logged back into the credit card company And processed another card under another fake name And that was going to another abandoned house And this was making money for him But this guy wanted more, much more And Grifter would get in arguments with him saying Man, if we do too much, they're gonna know And they're gonna shut us down But if we take it slow, we can keep things going for a while And Grifter was right He would only give himself a new credit card every two weeks and that allowed him to keep it going for two whole years. I don't know how long that worked because I eventually just stopped doing it.

29:51Like I, at about 17 years old, I decided that I needed to get out of my town. Was sitting in the back of my friend's car and he said, just wait until we're like 25. We're going to own this town. I said, own what? Are you kidding me? Holy shit. If I'm still here when I'm 25, you guys kill me. I was like, oh my gosh, I have to get out. I have to get out of this town. And so I didn't have money, right? I didn't have a way to pay for college. I didn't have a way out. And a common response to that is I went to the military. What? You went to the military? Yeah. This is a, I would not expect a life of crime, hacking, drugs, and then suddenly, military.

30:43Yeah, this was a massive shift in my brain. And I just said, like, I have to go and I have to do this immediately. And while I was still a senior in high school, I signed the papers, man, and committed to go. My parents had to sign me over because I wasn't 18. And I went into the military when I was 17 years old. So as soon as I graduated, I went into the Air Force. And that was an incredibly eye-opening experience for me as well, because right into basic training, I met people who they'd never been in a fistfight before. And I was like, how? I just could not comprehend how. How did you not run your mouth at some point to a level that somebody wanted to put their fist in it?

31:25And then I'd hear the stories about how they grew up, and I was like, what? my mom tried to raise me like with morals and whatever and I did pretty good in some areas and really poorly in others but the Air Force core values are integrity service before self and excellence in everything you do and I took that to heart I didn't even really know what integrity meant at the time like I'd heard the word but I didn't really know what it meant and essentially to me the way that I took it was it's like doing the right thing even if nobody's looking, right? And I was like, okay, do the right thing even if nobody's looking.

32:00Great. Service before self. Okay, so put others before you. Always try to put others before you. Okay, I'll try to do that. And then like excellence in everything that you do, that was something that my mother had already instilled in me as well, where she was like, if you're going to be, I don't care what you are. If you're going to be something, be the best at it, whatever it is. You're going to grow up and you're going to be janitor, be the best janitor there is. You're to be a surgeon, be the best surgeon there is. But if you're going to put effort into something, if you're going to spend your time on it, be the best, right?

32:30And so like those core values, those like Air Force core values really like took hold. And the military was really good for me because it like forced me to be an adult. It put me in a situation where it was like, oh, you have to, you can't just tell somebody what you think of them just because you think it. You You can't swing on someone because they mouthed off to you. You have to show up here on time and you have to come ready to do the hard things and all whatever. The military was super, super good for me. He got stationed in Utah and in the Air Force, he was assigned to fix F-16 avionics.

33:07He wanted to do computers, but you don't really get a choice. They just tell you what to do. But it was cool to sit in a cockpit and swap out instruments. And he was even deployed to the Middle East for a while. But after a while, the whole thing was starting to frustrate him. If there's anything that just riles me up or a pet peeve of mine, it's inefficiency. And the military is really inefficient. So I would be like, hey, if we change this process, it would save us this many hours and probably this many parts and all this sort of ever. And they would be like, just do it the way the Air Force tells you.

33:36And I hated that. Oh, I hated it. And then also, in a lot of cases, you get rank because you've been there longer or you test better than other people. It's not about leadership experience. And so you'd have to take orders from people who were making poor decisions. And I just couldn't do it. I was like, one, I can't keep my mouth shut. Two, like, I just, I can't handle it, like, as a person. And so I was like, I've got to get out. And so when I got out of the military, I only knew how to do two things. And it was work on F-16s or break into computers. And so I was like, okay, well, I guess I'll go back to breaking into computers.

34:15Stay with us. We're going to take a quick break, but when we come back, we have to break some new computers.

34:44to share their knowledge through webcasts, blogs, zines, comics, and training courses, all designed by hackers. For hackers. But do you need someone to do a penetration test to see where your defenses stand? Or are you looking for 24-7 monitoring from their active SOC team? Or maybe you're ready for continuous pentesting, where testing never stops and your systems stay battle-ready all the time. Well, they can help you with all of that. They've even made a card game. It's called Backdoors and Breaches. The idea is simple. It teaches people cybersecurity while they play. Companies use it to stress test their defenses.

35:16Teachers use it in the classroom to train the next generation. And if you're curious, there's a free version online that you can try right now. And this fall, they're launching a brand new competitive edition of Backdoors and Breaches, where you and your friends can go head to head, hacking and defending, just like the real thing. Check it all out at blackhillsinfosec.com slash darknet. That's blackhillsinfosec.com slash darknet.

35:43Now, Grifter was stationed in Utah, and one state over from Utah is Nevada, where the biggest hacker conference in the world is DEF CON. So I knew about DEF CON from the first DEF CON, but being poor and being like 14 years old or something when DEF CON started, I was like, well, my parents are never going to take me to Las Vegas and I can't afford to go there myself. It was like a month or two months before I was separating from the military. DEFCON 8 happened in 2000. And I was like, screw it, I'm going. Military be damned, I'm going to go. And so I did. I went out to DEFCON and, you know, met my people.

36:25Essentially, it was great. It was an incredible experience. What makes you connect with the people at DEFCON? So, yeah, I'd been to small hacker meetings before, But going and at the time it was probably, I don't know, there might have been a thousand of us or something like that at Defcon 8, if that. I love the fact that you could just, anybody could be talking about anything. You could walk up to somebody and be like, what you guys talking about? And they'd start talking about something. And whatever it was, it was interesting. Like, you know, there was something interesting. Or there'd be people crowded around a table with like computers and like some electronics or something or whatever.

37:04and they're like, oh, we're trying to get this thing to do this. Like, I had this idea in my head that I was like, oh man, if we could actually take all these people and like stick them on an island and just be like, here's the problem that we have. Can you solve it? That there was like nothing that couldn't be solved. And so I knew, like I knew from that first time I went that I would always go to DEF CON, that that would be it. I felt the same way. The first DEF CON I went to was DEF CON 17 and that was back in 2009. And yeah, the place feels magic. It's electric. It's amazing. And I was hooked from that first visit and I've been going for 15 years now.

37:44At DEF CON 8, a buddy of mine had brought 20 t-shirts or something that he had brought. And I was like, what's the t-shirts for? And he said, oh, I'm going to sell the t-shirts when we get there. And we road trip down, right? So he was like, I'm going to sell the t-shirts when we get there, 20 bucks a piece. And that will fund my weekend. So it'll pay for the hotel. I'll get to eat really good or whatever it'll pay for DEF CON and I'm like oh what a cool idea so the next year I decided I was going to make t-shirts but I don't do anything halfway and so I was like okay well I'm going to get a table in the vendor area I'm going to make a t-shirt I had a really nice design put together and I ordered 320 t-shirts 20 to trade to friends and to other t-shirt vendors and 300 of them to sell so I took them down and we sold them all in the vendor area.

38:33It was a really nice design. So they were gone. And I was like, sweet! Like, I just made a bunch of money, like, off of selling T-shirts. And then I met Russ Rogers. Russ Rogers is one of the conference organizers and as grifter to goon next year, which basically means to volunteer, to help with the conference. There's a lot of different types of goons. There's crowd control goons, speaker assistants, technical support, and other things like helping with the vendors or contests. But at the time, everyone had to start at security, which is like crowd control and checking badges. And there are massive lines at DEF CON, and someone has to keep them all in check.

39:09So he took the role of goon and was part of the DEF CON staff. At DEF CON 10, I was a security goon. And then at DEF CON 11, I went and I was a vendor goon. And yeah, and then I've been a goon ever since. So from DEF CON 10 till now this year will be DEF CON 33. Gosh, that's 23 years of being with DEF CON at this point. And because of his attitude of being excellent in everything he does, he quickly started taking on more responsibility at DEF CON. I started doing things like I ran the DEF CON forums with another guy who went by Null Tone. The two of us were the administrators for the DEF CON forums.

39:45At the same time that I was gooning, I was a vendor as well. I never stopped selling t-shirts. So I was a goon, a vendor. I was administrator for the DEF CON forums. I ran the DEF CON scavenger hunt. Oh, and then starting at DEF CON 10, I started speaking. So I spoke at DEF CON 10, 11, 12, 13, or whatever. And so I was busy, right? And then somewhere in there as well, I eventually started running all the technical operations for Black Hat. Black Hat is another hacker conference in Vegas, and it's happening the same week as DEF CON. And they're both started by the same person, Dark Tangent. But Black Hat has an entirely different vibe over there.

40:23It's more professional and corporate compared to DEF CON. I describe it as, at Black Hat, there are tons of companies all there saying, hey, if you buy our products, it'll make your company safe and secure. While at Defcon, the overall message is, everything is vulnerable. Nothing is safe and secure. And here's how to hack anything. So Black Hat, you see more people wearing collars and even ties. While at Defcon, everyone just wears all black. Cargo pants are common. Mohawks are common. And wires and antennas are sticking out of everyone's backpacks. until Grifter started volunteering at both conferences.

40:58I got busy fast, right? And then I had a day job on top of it. I did become, I guess, part of what would be considered to be like the DEF CON inner circle, right? Like where it's like, okay, we need to decide what DEF CON's vision is going to be. What direction are we going to go in? What are we going to, like coming up with new ideas to keep DEF CON fresh? Like I came up with the idea for DEF CON Groups. So DEF CON groups is hacker meetups that happen in different cities and different countries all over the world. They are very similar to the 2600 meetings that I used to go to when I was younger.

41:35And the reason that we kind of departed from 2600 was because they started to get political and kind of let their politics get involved. And they were telling hackers, you should vote for this person or vote for that. And I didn't like that. I didn't like the idea of saying like, yeah, vote this way. And so I approached, you know, Dark Tangent, Jeff Moss, and said like, hey, I don't like this about the way that 2600 is going. DEF CON has a lot of clout. You know, we could probably do something like that and we'll do it by area code. And we could just, you know, we'll come up with a name for it or whatever.

42:13And he's like, I love it. Love the idea. Talk to Russ. Again, Russ Rogers. And he's like, yeah, let's do it. We came up with all the ground rules and concepts and all whatever and the structure for it. And then we started running DEFCON Groups, our meetups. I think it was February of 2003, I want to say. And it was Salt Lake City and Colorado Springs, which is where Russ is from. So we had DC801 and DC719. And those were the first two DEFCON Groups. And we ran them until DEFCON. And then we announced DEFCON Groups at DEFCON and it spread like wildfire. DEFCON Groups has grown to over 100 chapters worldwide.

42:50And they're typically really cool people who go to these things. A lot of people ask me, hey, how do I get started in cybersecurity? Or where can I find a mentor? And I always recommend them to look to see if there's DEFCON groups in your area. It's a great way to meet people who are super passionate about cybersecurity. And I attended one just the other day, and it was great. I met so many cool people. I mentioned all of the stuff that I did previously, right? So it was like a DEF CON administrator, vendor, goon, running the DEF CON scavenger hunt. Oh, we also ran the DEF CON movie channel. Like it was a lot.

43:21I was doing a lot. And I said to DT after DEF CON 13, I was like, I'm going to stop gooning. Like it's just too much. It's too much. And he was like, please don't. He's like, don't, don't stop. Like what's the problem? I was like, I'm just burning out. I can't run all of these things. he's like okay well how about this he's like we're moving to a new venue next year um and it's going to be at the riviera and he's like and there's this space that are there are these sky boxes that overlook the convention floor and he's like i think you know what if you were like in charge of what like whatever we put in that space like you can just there'll be a small portion of a conference.

44:08You can do whatever you want with it. Like come up with something cool that people will want to do. And I was like, okay. He's like, I'm sure people want to have parties or whatever. And I'm like, okay, great. So he goes to the Riviera, the place where DEF CON is going to be held that year. And he looks at the space and tries to decide what to do with it. It's a cool set of rooms. They're up high and they overlook the whole conference. And like I was saying in the intro, DEF CON has a lot of parties. Conference goes on all day and parties go on all night. In fact, there's so much going on at DEF CON, it's actually hard to remember to eat and shower and even sleep.

44:43It's the best conference in the world. So, of course, these skybox rooms are perfect party rooms. But that's a nighttime thing. What do you do in them during the day? And which parties are going to be up there? And that's when Grifter got the idea. He posted on the DEF CON forums, we have a place for you to host a party. But if you want the space, you have to fill the room with something cool during the day. You can't just come party at night. And the first ones to say, okay, we'll do it, was Tool, the open organization of lockpickers. And they were like, we want one of those skybox spaces so we can have a party.

45:19And we'll come in and we'll put out tables and we'll put a bunch of locks on the tables and we'll teach people introductory lockpicking. And we'll bring all kinds of examples of things to bypass and we'll just show people how to do it. And I was like, great, that sounds awesome. And then it was, again, it was Russ who said, hey, I'll get some folks and we'll set up a hardware hacking like area and we'll have people come in and they can like learn how to solder and learn how to like do basic electronic stuff. And we'll teach them how to do that. And I was like, great. 303 was like, we'll do talks, but we're going to do talks that aren't allowed to be recorded, that you can't have your like phone out, that you can't, like nothing can be, like it doesn't exist, right, type of thing.

46:04And I was like, that sounds cool. Let's do that. And so that's how the villages started was the first ones to call themselves a village was the Lockpick Village. Not only is that where DEFCON Villages was born, but it's also where Sky Talks was born. That name came to be because there were talks in those skyboxes at the Riviera. Because all the DEFCON talks are recorded and posted to YouTube. But Sky Talks is where no recordings are allowed, which allows people to give talks that are more secretive or maybe even incriminate themselves. I've probably been to a dozen of these Sky Talks and I've heard some pretty wild stories.

46:37But what's more is Sky Talks has kind of made its way into many other conferences where there's a smaller room off to the side and no video or recordings are allowed in there. So that idea also has stuck and spread. So the next year when it came around, the hardware hacking people called themselves the Hardware Hacking Village. They adopted the name Village from the Lockpick Village. and then another group started the Wi-Fi village and they just immediately adopted the name village with theirs too. So they started calling themselves the Wi-Fi village. So the second year, so DEF CON 15, we had the lockpick village, the Wi-Fi village and the hardware hacking village.

47:15And then that concept of like having these broken out areas like spread to other conferences. Like people were like, oh, we're gonna have a lockpick area. Oh, we're gonna have whatever. And they started calling them villages. And so the village concept or those little community areas that you see at all of these other InfoSec conferences and stuff all came from people wanting to throw a party in a skybox at DEFCON 14. And then the villages were born. Now when Grifter first started getting involved with DEFCON, everyone only knew him as Grifter. And that's the thing about this conference is it's not unusual that people just know you as your alias or your hacker name.

47:56And nobody even questions it. If you say you're Grifter, then you're Grifter. Nobody's going to be like, oh, that's funny. What's your real name, though? No, DEF CON folks are different. They get it. Privacy is important for all of us. I had been grifter. Like I said, basically, I picked that name when I was about eight years old and I used it in the hacker community and nobody knew my name. When I went to hacker meetups, 2600s, when I anything I did, no one knew my name. I had no online presence at all. And I was proud of that. People didn't know who I was. and then at DEF CON 9, my wife at the time, my ex-wife, she came with me and I had said something to her and she was selling t-shirts and I said something to her and I was like, all right, I'll be back in a little while and I walked away and I started walking away and I got a few tables away and she said, oh wait, Neil.

48:46And I was like, oh, like it, like, oh, and I turned around and the look on my face must've just been like, oh my gosh, like, are you kidding me? And then she, and I'm like staring at her and she goes, oh, sorry, grifter. And I was like, oh my gosh, because now even people who weren't looking like turn their heads and were like, what? Like, and then there were guys that I'd known seven, ten years and they were like, your name's Neil? And I was like, yeah. They're like, huh, you don't look like a Neil. I'm like, cool. Like, I was like, oh my gosh. So that anonymity, like to some degree, like it flew out the window.

49:33After a while, Grifter got put in charge of running the Wi-Fi and network at Black Hat, that other conference that's happening in Vegas the same week as DEF CON. They call it the Black Hat NOC, which stands for Network Operations Center. And I should say, even though Black Hat and DEF CON happen the same week, they don't actually overlap. Black Hat is like Monday, Tuesday, Wednesday, Thursday, and DEF CON is Friday, Saturday, Sunday. And I should also mention that there are many other conferences happening that same time as well. Like there's B-Sides, which is a big one and it's on Wednesday and Thursday.

50:02And there are other ones happening around town like there's Toxic Barbecue, which is where a bunch of people meet up in a park and barbecue. And there's a DEF CON shoot, which is where people go to the desert and shoot guns. And there's just meetups like all over the place, like Diana Initiative and Queer Con. At any given moment during that week, there are 50 things happening and it's overwhelming and awesome. So anyway, Grifter was tasked with setting up the Wi-Fi at Black Hat, which you can imagine trying to get a Wi-Fi network up and usable at a hacker conference is challenging. Yeah, it is.

50:34It's actually incredibly difficult, but it's also super satisfying to do it. It makes it fun. You're going up against multiple different types of attacks ongoing throughout the conference at different times, trying to hit you in different ways. People learning new things and getting creative. We've had stuff where somebody discusses a vulnerability for a piece of equipment that we're using at the conference, and we've got to scramble to try to make sure that the network stays up because they just told 500 people in a ballroom how to do something against a piece of equipment that we've got running in the NOC.

51:09We call it the Black Hat NOC because it is a NOC. We replace every router, every switch, every firewall, and every access point at whatever venue we go to. So now that's Mandalay Bay. It's the Marina Bay Sands in Singapore, and it's the Excel Center in London. But we bring all of our own equipment because it allows us to have control over the environment, mitigate attacks if they come. We can't be opening a support ticket. Oh, yeah. The hotel would not have a chance against this, would they? Not a chance in hell. What do you tell them? Just shut it all down while we're here? Yeah, we actually do.

51:45We just say, please shut the Wi-Fi in these areas. And so, yeah, it's an interesting challenge. You think that they'd want to hire you to set up their Wi-Fi to be resilient against stuff like this and say, wait, just leave what you have here because we'll just use it from now on. Yeah, they're getting better. Again, it's like years have gone on and stuff. They're getting better, not to the point that we're willing to let them run things. Because, again, well, one, we call ourselves a NOC, but we are a full-fledged SOC. We have every piece of equipment that a modern-day security operations center has in there.

52:20And when we initially started out, we were running everything with, like, open-source, you know, hardware, open-source scripts and software and commercial stuff that you could just buy at, like, Best Buy, right? Yeah, their budget was very small at the beginning. But if you go to Black Hat, one thing you won't miss is the expo floor. I went last year, and I was blown away at how big Ed has grown. This is a room where if you're a cybersecurity vendor, you can set up a booth there and pitch your products to people who are walking through the conference. I walked through and it took me hours and hours to just try to walk past every booth and just read their name.

52:59It felt like it went on forever. Every cybersecurity company in the world seemed to be there. And there must have been hundreds. So as this Black Hat Knock grew, it needed more sophisticated equipment. And Grifter wondered, with all these vendors here, would any of them let us use their gear, like, just for the week? And so we were like, well, what if we went down to the expo floor and we approached some of the vendors and we say, hey, if you'll let us use your equipment or give us a software license, we'll put your logo, like, in the program that says, like, you help, like, partner with the Black Hat Knock.

53:37knock we go up to the first like vendor that we wanted to talk to they're like yeah oh absolutely and they were like when like now like do you want equipment do you need people like and I was like this response was like on a level that I wasn't prepared for and so I was like uh I was like I think we might be on to something here you know and they were like we'd love to help support it we'll like we'll give you whatever you need and and I just looked at Bart and I was like let's go shopping. So him and Bart, the other guy who runs the knock with him, realized that every vendor would love for them to use their equipment for free because each vendor would love to be able to say, we're trusted by Black Hat.

54:18If a hacker conference uses our equipment, surely that's got to mean something. And this made building the Black Hat knock even more fun, knowing that they could just walk down the hall and get any equipment they wanted to help secure this network. That's cool. And once vendors heard that Grifter was doing this, they started begging him to use their equipment. We've been offered money from vendors before where they're like, we'll cut you a check, like personally, not to Black Hat. Like they're like, hey, Grifter, I'll cut you a check for a hundred grand if you'll put our stuff in the knock. And I'm like, why don't you take that a hundred thousand dollars and invest it in your product and make it better?

54:54And maybe I'll choose it. And I say that for two reasons. One, because I'm a dick. But two, because integrity, right? I mentioned that earlier, is it's like, no, like, you can't buy my, like, you know, influence in this space, right? Like, it's like, I choose what I believe are the best technologies to go in here to do the job. And if you want to be in here, be better. And then maybe you'll be in here. Of course, Grifter sees tons of crazy things on the Black Hat network Like speakers might be on stage demoing an exploit And it'll trigger all kinds of alerts and knock A normal knock might freak out seeing that kind of stuff coming from inside their network But Black Hat realizes, oh, that's fine Since the speaker is just demoing the exploit on stage Or sometimes they'll see a vendor release a patch And attendees are trying to reverse engineer what was fixed in the patch And they'll find a new vulnerability and they'll start attacking with it the same day the patch is released.

55:51So they've got to hurry up and patch everything as soon as a new patch comes out. Or sometimes they see students in classes doing illegal things on the Wi-Fi. And of course, Grifter will go in there and warn them, hey, you shouldn't be doing that stuff. And then there are things where it's just folks who are, they think they're secure and they show up to Black Hat already compromised. And we look for stuff like that. Again, it's an incredibly modern security operations center. People will get on the network and they're immediately beaconing out to known C2 or they're hitting malicious sites or doing whatever.

56:21And we will go and look and be like, okay, is this something that looks like it's part of a lab? Is this something that happened when they first got on? And so people will often say, oh, don't get on to like the Black Hat Network because you'll get attacked. When I honestly think in reality, more people leave secure than they do compromised from Black Hat because we're looking for it. And if we see any kind of communication to known C2, if we see crypto mining activity, or we see clear text credentials coming from a device, we send a captive portal to that device that is doing it. They'll get a pop-up the next time they go to browse to something.

56:58They will say, hi, this is a message from the Black Hat NOC. This device is showing signs of communication to known command and control servers. Like, if this is expected behavior, you ignore this message. If not, please stop by the NOC for more information. And they'll come by and we can show them packets or logs or whatever they need to let them know, like, hey, you actually showed up compromised. They've even seen speakers on stage who are showing signs of infection on their laptop. And then they have to go and wait for the speaker to come off stage and then say, hey, by the way, your computer's very infected.

57:33Okay, I'm going to ask you some stories about DEF CON. Is it true that someone rappelled off the roof to try to sneak into a party at DEF CON? What happened was a year at the Riv, the year of the skyboxes, We had different parties and different skyboxes. And at some point, one of the organizers of the party, actually, like he he came up to me and he was like, hey, so we picked the lock on the closet and there's a panel in there. And if you open that panel, we can get on the roof. And I was like, I don't want to hear about it. I was like, all right. And then I left. and then a bunch of people went up on the roof and they basically like extended the party up onto the roof of the Riviera and there was a whole bunch of folks hanging out up there and this was just the conference center so we're not talking like 20 floors up.

58:29They were probably 30, 40 feet up, whatever it was and some people were going in and out and all whatever and then at one point security showed up. The way that I understand it is somebody went off the roof in order to avoid security. Multiple people got caught by security, though, and they were asked to leave the property. They got 86ed on Saturday night. Is it true that people will put malicious ATMs around DEFCON to steal people's money? It has happened. I don't know how often it happens, but it has happened. somebody brought an ATM in on a dolly they rolled it in on a dolly and set it up in the lobby area of the convention space trying to get DEF CON attendees that was also at the Riviera is it true that there was a federal agent who was there to try to arrest hackers or spy on hackers or learn from hackers or whatever, but got so impressed by what they were doing that he quit his job as a federal agent and switched to the dark side.

59:45Oh, I haven't heard that one. You're going to have to tell me that. That's wild. Is it true that there's a secret room at DEF CON where you can buy zero days? I don't think there's a secret room. Maybe that was true in the past. and it wouldn't have been a secret room it would have just been like you can talk to this person and I know who the person is but I won't mention their name I'm sure those kinds of things still go on everybody could get together and have a conversation in a place that was kind of like a demilitarized zone for hackers yeah demilitarized zones for hackers that's a really interesting way of putting it, I agree is it true that every year hackers take over an elevator at some hotel and trap someone in it?

1:00:32I don't think they trap people in it. We have definitely taken over elevators all the time. I actually got a talking to from the mayor. This is actually happening at Black Hat. It was right after the Mandalay Bay had installed the card reader so that then you had to tap your room key to go to your floor. I was messing with it because that's what we do. And I knocked the cover off of it and underneath it was there was an open like pin out but I was like oh cool we could probably connect to this and like get to any floor we want I'm like that's wild and then I ran my thumb across the pins and it shorted out and the light blinked green and I could tap any floor and so I took a video with my phone really quickly where I just I ran my thumb across it it blinked green and then I tapped like four different floors.

1:01:26The video was probably six to eight seconds long. I mean, super quick. And I just posted it to my Twitter and said like, oh, solid whatever system they've got going on in the elevators. And seriously, within five minutes, my phone rang. And it was the head of security for Mandalay Bay, who we work with because we're in the SOC and stuff. So we have meetings with them and tell them the type of stuff we're seeing. and all whatever. And he's like, Grifter. And he's like, you're supposed to be on our side. And he's like, will you please take that down? And I was like, I can't. And he is like, no, please take it down.

1:02:07And I was like, I'm sorry. I can't. I've already posted it. It goes against everything. Like, I believe as far as like, it should be better than you should call whoever installed that system on the elevators and make it better. And he was like, oh, and then he like, He hung up and he called me back and he was like, okay, look, I talked to this person, would you be willing to take it down for X amount of time? And then he said the words I didn't want to hear, which he was like, under responsible disclosure, you have now let us know that a vulnerability exists. Please give us time to fix it. And I was like, damn it.

1:02:42So I deleted the tweet. He played your game. He totally did. He totally did. And so, yeah, so I took it down and they fixed it. Is it true? That someone set the pool on fire one year. Set the pool on fire? Yeah, like there was smoke coming off. Oh, no, no, no. It wasn't fire. It was a massive amount of liquid nitrogen. So it was at DEFCON 8, 9, or 10, somewhere in there. It was at the Alexis Park. It was pool two. And the beverage cooling contraption contest had done their cooling contest out by the pool earlier that day. and a lot of people had liquid nitrogen like they just like that was the go-to like how they're going to make it cold fast and then they took all the containers of the stuff that was left over and put them in the little pool house like area that was next to the pool just for storage and then when it was at night there was like a party going on out there and like one of the guys was like oh oh shit, we've got all this liquid nitrogen.

1:03:47Let's see what happens. And they just dumped like gallons and gallons of liquid nitrogen into the pool. And it was awesome. And it made this cool like steam effect. There's some pictures of it out there somewhere. Like another year, then the next year they did it again. And a bunch of people threw blocks of dry ice in to try to like, you know, increase it. Of course, like everything, we'll try to one-up ourselves every time. After decades of going to hacker conferences, there are hundreds of stories like this that Grifter has. It's truly a unique experience and you never know what to expect when you go.

1:04:25I once saw Will Smith at DEF CON and Deadmau5 was just there last year just walking around checking the place out. I am what I consider or what I define myself as as a high-functioning introvert. So I can get on stage in front of 10 ,000 people and crack jokes and have a good time and all whatever, and it's fine. I can go out into the hallway and have an inflatable dinosaur battle with my friends and have a blast. I can act like a complete lunatic for the entire time that I'm in Vegas with my friends, and it's great. but then I crawl into a cave and recharge for weeks afterwards or I go back to my hotel room.

1:05:04Even during DEF CON, I did it a couple times this year where it's like, I'll just go to my room and lay on the bed. I actually did that right before your party this year where I was like, I'm just going to go back to my room. I'm going to take a shower. I'm going to lay on the bed and play a game for a little bit and then I'll go out and be social. Black Hat used to have a thing they called the gala reception which was basically just drinks and it was like an open bar and it was a couple of hours and all the attendees were invited and you just hang out and chat. And I was in my room after like, you know, volunteering all day.

1:05:37And I was like, oh, I don't want to go to this thing. I forced myself to go and I walk into the reception and I hear some guys that are near me mention a book that I had just read and I stopped and I was like, oh, that book sucks. And like, and the guy kind of chuckles and he was like, oh yeah, why? And I I was like, OK, well, the structure of it is this. It's lacking this. It doesn't talk about these things, blah, blah, blah. This book is better if you're looking at that topic. And he's like, oh, OK. So I was like, hey, it's been a pleasure chatting with you guys. You know, it was nice to meet you.

1:06:07And the guy was like, wait, let me give you my card. And he hands me his card. And he was the vice president of the publishing company whose books I had just been eviscerating for the last 45 minutes. And I just looked at him and I was like, oh, and he was like, oh, and he's like, hey, look, man, I really appreciate all the candid feedback. And he's like, I want to put you on a list that I have where when we put out a new book, we'll just automatically send it to your house. You let me know what you think of it or whatever. Would you be down to do that? And I was like, absolutely. Well, that relationship grew stronger between Grifter and his publisher, to the point that the publisher asked Grifter, hey, if you were to write a book, what would you make?

1:06:46And Grifter said, there should be a book on how to defend your network by attacking back at the people attacking you, which I think is ridiculous. Defenders can't be on the offense. They can't be aggressive. But he was pitching this idea and the publisher was liking it. I was like, look, dude, I don't know how to write a book. I don't know how to do that or whatever. And he's like, that's fine. We got editors. We'll teach you. He's like, why don't you do it with like a few other authors? Just co-author it. Then you can break it up into chunks. You'll act as the technical editor and make sure that everything is legit.

1:07:22And I said, yeah, I'd like to do that. Fine, let's do it. And then I picked a few of my friends that I wanted to do it with me. And when I gave him the list of friends, he was like, these are some pretty heavy hitters. So are we going to get these people? And I'm like, they're just my friends. Like, I don't know. And so it was like Dan Kaminsky, Bruce Potter, Pyro, like, you know, Chris Hurley. He's like, all right, let's see what we can do. And all of them agreed to do it. And then we put out a book. But that was the thing about putting out a book was I was like, am I really just going to put Grifter on the cover of this thing?

1:07:57I was like, I cannot publish a book and not put my name on it. For me personally, it was like, I want to see it on the shelf in a library and be like, that one's mine. So I made the decision that I was going to put on there Neil Weiler, a.k.a. Grifter. And that was it, man. The cat's out of the bag. So the book is called Aggressive Network Self-Defense. And for 10 years, I was a network security engineer and I had read quite a lot of books. And this one never showed up on my desk. And I think it's because I wasn't interested in aggressive self-defense for the network. This is crazy. This is a crazy book.

1:08:37Aggressive self-defense network style. What is in this book? Well, it was essentially like there's this thing that we deal with as defenders like every day within these companies we work for and as individuals where you're being attacked constantly, right? And you're like, when do I get to swing back? And because of my upbringing, right, because of the way that I was, I wanted to swing, right? And so I didn't like the idea that we were in this defensive position where somebody could not just poke us in the chest. Because like getting port scanned was like getting poked, right? It was not a big deal.

1:09:12Somebody looks at you sideways, gives you a dirty look. But it's not just getting poked. They're full on attacking you and you just have to go, well, how do I block that? How do I make that stop? How do I do whatever? Or they break in and you just go, oh, I've got to get them out. And in my head, I was like, stop them for good. like like you know cut them off at the knees attack what they're attacking you with and like and i would get so much heat from people about that because they were like well you don't know if you're actually attacking some grandma's computer because it's not you know it's a jump box it's not likely that the person that you're attacking is that that's their machine and i'm like yeah but then let's let's get rid of their resources then if we if we knock the machine that's doing the attack offline, then the attack stops.

1:10:00And that's what I'm concerned about because they're costing us money by launching these attacks against it. They're costing us time. They're costing us stress and all these other things. So if I don't care if it's some grandmother's computer, I need it to stop attacking my network because it's eating up bandwidth. It's eating up cycles of my analysts. It's eating up all this stuff. It's like, okay, you've lost control of your machine and I need that machine to stop attacking me. So I'm going to send it to the bottom of the digital ocean. That book is 20 years old at this point, so it's useless, but it was fun to do.

1:10:38All this experience running the Black Hat Nock has given him a very sharp skill set to be able to detect and stop some of the most crazy attacks ever. Volunteering there gave him fantastic experience, which gave him great opportunities in his career. So now I recently took a position at a company called Coal Fire as the VP of defensive services. Prior to that, I was with IBM's X-Force for three years running their global threat hunting program. Prior to that, for the seven years before that, I was at RSA Security where I started and ran their threat hunting program around the world. So I spent a lot of the last over a decade at this point really focused on threat hunting, on going in and finding attackers when they've already bypassed your security and they're in the environment.

1:11:32So I would go into a company and I'd sit down with their security team and I'd be like, tell me about your environment. And they'd be like, well, we have these technologies that are deployed in these ways. Our network's set up this way. This is how we do these things. It's segmented this way. We have this. We do this. Blah, blah, blah, blah, blah. And I go, OK, great. If it was me attacking you, I would hit you here, here, and here. So let's go look and see if somebody did that. And then we'd go and see if they were attacked somewhere or got breached somewhere. And in the decade plus that I've been focused on hunting, we always find something.

1:12:05Whether it's an active attack or it's evidence of a previous attack. Or it's an employee who's doing something outside of policies or whatever. Of course, I wanted to hear a story. about a threat he found in the network. We were doing an engagement where we were asked to come into a really large financial organization, and myself and another hunter, Pope, you know, Pope. Pope and I went out on this hunting engagement. I do know Pope. He's the organizer at St. Con in Utah. Fantastic conference. You should definitely go if you're in Utah. So him and Pope go to this client. It's massive. And they have huge security teams there.

1:12:43No expense spared to keep this place secure. which has to be stressful, you know, to walk into a company with this level of security and you're expected to find things that they didn't already find? And so he sits down with their director of security and starts looking through the traffic. He's looking for protocols that shouldn't be there or outliers. And he sees FTP traffic in there. FTP is the file transfer protocol. It's just a way to move files from one place to another, but it's insecure and has mostly been replaced by more secure protocols now. It's like there's a really low number of FTP sessions, so we could go through those fairly quickly.

1:13:21And he goes, oh, we don't use FTP. And I was like, well, great. Like, this is a good example then because we can go through this really quickly. And he was like, no, you don't understand. We don't allow FTP. There are no clear text protocols. And I was like, okay, well, that's great. But it's here. Like, it's here. I can see it. And I was like, so why don't we just look at it? And he's like, all right. And we look and it's FTP traffic going to a host name, not even an IP address, but a host name that ends in.ru. I mean, we're not even trying to hide, right? and I was like is that normal? He's like no and I'm like okay well let's see what's happening and it's like okay it looks like it's sending out these files at like 1 o 'clock in the morning.

1:14:10Do you want to see what it's sending? And he's like yeah and so we just did file extraction it's a zip file even not an encrypted container, just a zip file. I'm like well I can't open it because it's not my company but you can open it if you want So he opens it. He opens it up. He looks at the document and then it sounded like somebody punched him. Like this sound came out of him like this. And the wind just got knocked out of him and then he closed it. And he goes, you didn't see that. And I was like, OK, well, just out of curiosity, what didn't I see? And he was like, that is every financial transaction and trade that we've made in the last 24 hours.

1:14:51And I was like, oh, so bad. Like, and he's like, how long? How long has that been going on? And I was like, okay, let's take a look, you know. And we start digging into the logs. And they only had six months worth, which was wild. That connection to an FTP server in Russia, the IP address was also geolocated to Russia. Like, so we're like, okay, like, it looks like that's where it's going. That happened every night at one in the morning for six months. And that's as long as we had logs for. So we were like, who knows how long that's been happening. And this is an organization that has hundreds of people on their security team, 30 plus people actively working in a sock just down the hall.

1:15:34All of the different technologies that you could possibly ask for. But they had tunnel vision because they were like, we don't use that. So we don't even look. Now, you would think that if something like FTP is not allowed in their network, that there should be a firewall rule blocking it. I mean, that's exactly what a firewall's job is, to block network traffic that shouldn't be allowed. And who knows, maybe they did put a block in at some point, but it wasn't blocked now. Maybe a new rule superseded the FTP block rule, or maybe someone accidentally took out that FTP block rule. These firewalls can sometimes have hundreds of rules of what's allowed or not allowed, and it's confusing to know exactly what it's doing sometimes.

1:16:13But what's more is how did these file transfers get triggered? It must have meant that someone got in this network and set up an automatic script to scrape the data and send it out. That's scary to realize that someone did that in their network right under the nose of their 30 engineers all looking for that threat. How did this hacker get in and how do they get them out? There's millions of things to do once you discover something like this and it feels devastating to experience it. It really does feel like you're getting punched in the gut. And, you know, as I think about this story, this is one of those typical I heard at DEF CON stories, which here's Grifter's telling me.

1:16:52So it practically is like something I heard at DEF CON. But it's one of these stories that I hear that was never told publicly. You know, a major finance company was hacked and every financial trade was being spied on by some foreign entity. That sounds like a big deal. And I wonder what the fallout would be if that story were to go public, you know? Would there be lawsuits? Would the government slap fines on them? Or to think, how bad does that company not want that story to go public? At what drastic lengths might they take to hush it up and keep it quiet, you know? I have a dream about this show, that one day someone will tell me a banger-level story that would be huge news when it gets published.

1:17:39some wild whistleblower type thing that would be fun, wouldn't it? I mean, I've heard some pretty insane stories that would be really big news stories if they came out but the people who told it to me I promised I wouldn't ever repeat it but I think it's just a matter of time though that a story does come across this show that really makes some waves someday but the threat hunting thing was great I ended up, I wrote a framework with a friend and that created some really cool opportunities. Like we, you know, consulted, you know, Congress and like NATO. Like I've gotten to consult foreign governments, some of the largest companies in the world.

1:18:22It's a strange space, this InfoSec space, because we're like hanging out with criminal hackers. Like you were a criminal hacker. And then you become this consultant for Congress and governments. and you're there to stop the bad guys and you're there stopping threats. But at the same time, you're going to DEF CON, which is where you're meeting even more hackers and more criminals hackers. And I don't know of any other thing that we're just as friendly with the bad guys as we are with the good guys as it is with cybersecurity. Yeah, it is a weird world that we live in. And I think ultimately the thing that ties it all together is that we like to learn.

1:19:05We like to chase. We like to hunt. Cybersecurity is an incredibly stressful field to be in, but it also is incredibly satisfying as far as like the cat and mouse game that we play about the opportunities to learn new things, about how one day you wake up and everything is fine and the next day a vulnerability drops and somebody has exploit code for it within hours and everybody's hair is on fire. And when those things happen, when those moments come and everyone's freaking out. I don't know, something about that situation and just makes me go, all right, game on. I got really, really lucky. The thing that I started doing when I was 11 years old because I thought it would be cool turned into a career that allowed me to, you know, put food on the table for my kids, put a roof over their heads and has allowed me to travel to all of the places that as a kid I used to go to only digitally because I thought I would never get to go there.

1:20:10A big thank you to Grifter for being so gracious and kind to give me his time and his busy schedule and to talk with us like this. He has so many more interesting stories and I feel like we barely got started with him. I mean, I've had dinner with him a few times and I've heard so many more and they are hilarious. I mean, you can imagine all the shenanigans going on at DEF CON and Black Hat every year. And he's given a ton of talks at conferences. So if you want to hear more from him, just go to grifter.org and you'll see tons of stuff that he's done. Real quick before you go. Do you know that you could have 11 bonus episodes of this show in your ears right now?

1:20:42Yeah, 11. All you got to do is support the show. I did the math. Less than 1 % of you support the show. And that's cool. No shade. Because I love making stuff and giving it to you for free. So I'll keep doing what I love. But man, when people do pitch in and give me a little something back, it feels damn good. It's like one of those hugs that feels extra genuine and you can feel it long after it's over. So please consider supporting the show. Visit plus.darknetdiaries.com. I'm just asking for you to buy me a cup of coffee once a month. Actually, I switched to matcha, but you get it. This episode was created by me, The Space Bar, Jack Recyder.

1:21:20Our editor is the key master, Tristan Ledger. Mixing done by Proximity Sound and our intro music is by the mysterious Breakmaster Cylinder. My girlfriend, she said she needed more space. So I got her a 4TB drive. This is Dark Knight Diaries.