160: Greg

27:38And so I became, I was a musician and I was a successful musician. If you've ever seen the Matrix sequels movies, then you've heard my music at one point. What? Your music is in the Matrix sequels? Yeah. So I got contacted by a company called Spiderbyte Studios and they wanted to make music for the Matrix, especially behind the scenes Matrix stuff. They wanted to do some music there. the big thing is they were looking for someone to make music for the trailer for the video game the matrix online and so they sent me an email and they were like hey you know your music sounds great so that was my uh that was my first example of being exploited in a contract by a large company um i sold my music rights for four hundred dollars each i think i got a four thousand dollars total out of that deal.

28:32So I was like, I'm$4 ,000 richer. That is awesome. And after that, that got into a lot of people asking me to do music and go touring. So I did a European tour. It was all throughout Europe. I think I went to every country except for Latvia and Lithuania. Toured for a while and then came back. What are you playing here? Synthesizer. It was a one-man project. So I did. I love synthesizers. At one point, I owned over 80 of them. So, yeah, after that, I came back. After a long tour time, I came back to Arizona. I was homeless for a while because you only make$30 ,000 as a musician average a year at that time.

29:09Especially like an industrial musician, you don't make any money. So I came back homeless. And then I lucked out in getting a job working at that Massage Envy. Massage Envy is a massage parlor, but it's a chain. And they have over a thousand locations all over the U.S. And their headquarters are in Scottsdale, Arizona. And they needed someone to work on the back end of their booking system. They gave Greg a shot, and he excelled at it. It was all vb.net and ASP code back end. And so I was coding that, and I was breaking software in the meantime. Millworm. So I was coding exploits on Millworm and just throwing them up there.

29:48And I was literally trying to throw an exploit up there a day. And I remember I got an email from EI and they were like, you're cracked. What is going like? What are you doing? Like, where do you work at? Tell us about you. And I was like, well, I'm a software developer in the middle of Phoenix, Arizona. I work on Massage Envy's backend. And they couldn't believe it. They were like, what? Like, you're not in security at all. I was like, no. I was just like, I just break stuff for fun. EI was a cybersecurity company based in California. It's spelled E-E-Y-E, E-I. They created some tools to help people be more secure, like they made a vulnerability scanner, and that's how they were able to make money.

30:29So EI saw that Greg was writing a lot of malware and posting it publicly, and they liked that, and decided to hire him and flew him out to California to give him a job. Yeah, well, the team I was on, we were all about finding zero days and finding exploits. Yeah, but there's no money in that. Marketing, my friend. When you have a good research team and they're rock stars, they're going to look at you and your products and think, oh, man, those guys know what they're doing. So when I got there, the person I replaced was Barnaby Jack. I actually had his desk and everything, man. Wow. Yeah, yeah.

31:05Lots of respect to him, man. I never filled his shoes, but it was just an honor to be a part of – be around him. I got to meet him multiple times. He was a great guy. See, back then, nobody had a bug bounty program. If you found a vulnerability in some software, that company wouldn't pay you anything. You'd be lucky if they sent you a t-shirt. There was zero money in vulnerability research then. But the reason EI did this research to try to find vulnerabilities in software was for two important reasons. One, to earn credibility. That EI company must have some pretty sharp researchers to constantly be finding vulnerabilities and things.

31:47I bet their tools are great. It works. And two, recruitment. By making the news again and again that they keep finding vulnerabilities, top talent would want to come work there. Now, they did follow responsible disclosure. When they'd find a vulnerability, they would do two things. First, tell the software maker and show them exactly what they found. Then they would announce publicly that they found a vulnerability in a product. They wouldn't say what the vulnerability was, though, not until after the software company was able to fix it and patch it. So that was the team that Greg joined to simply find new bugs in software that nobody knows about, which is what's known as a zero-day vulnerability.

32:29So I get there, and Office 2007 drops probably about four weeks after, like within my first month of working there. And we were looking at other software. We were looking at, I think, CA ArcServe Backup, if you remember that terrible product. I have, as a macrovirus author, and I can look at office, like, hex editors in office, I can tell you where the blobs are in office. I know the BIF format very, very, very well. So when it comes out— So your boss or someone told you— Mark Mayfrey, yes. We'll put his name for the record here.

33:12Mark Mayfrey, I've heard that name before. If you don't know, Mark Mayfrey got famous from MTV's A True Life, I'm a Hacker. That's where, that was his claim to fame. He was on that. You know, over like the last few years and like basically ever since I got into hacking, just been kind of like a wild ride or, you know, somewhat of a movie. After the raid, I started thinking a lot different about like my life and like what I wanted to, you know, start doing with it and then, you know, turn things around. These days, Chameleon is living the hacker dream, creating security software for companies to protect themselves from people just like him.

33:49That was a clip from the MTV show called True Life Hacker from 1999. The show follows Mark around as he hacks stuff. He's wild back then. So I imagine it'd be really crazy to have him as a boss. So your boss told you, Office 2007 just came out. Do you want to take a look at it? It would be great if you could find some sort of virus or bug, not virus, but exploiting there, a bug that we could use for marketing and make a big deal about. So jump in there. And you were assigned to do that. No, yeah, that's exactly how it worked. Anything that came out, any big thing, we were essentially bounty hunters.

34:26We would go out and be like, yeah, let's go break this thing. Yeah, but there wasn't paid bounties back then. You'd get a t-shirt, if anything. It was all about the honor of being the first. We wanted to be the first. too. That was a big deal. That honor was a reward. Yep. It was be the people who first found the bug. And so I went in there and started manually fuzzing Word at the time. Fuzzing. The first time I did fuzzing was when I was five years old and I went to the supermarket and they had a gumball machine. My mom gave me a dime and showed me how you put it in and you turn the crank and you get candy.

35:06It was awesome. and for years I was drawn to them. I just had to touch them every time I saw them and checked them out. Like I would try turning the crank on everyone to see if it would just give me candy with no money in it. Nope, unless you put money in it, the crank won't turn. I would sometimes try to put money in it and turn it very slowly to see if I could get a little bit of candy, and as soon as I do, turn it back real quick to reset it and do it again. But that didn't work. I would check the dispenser chutes to see if anyone left candy behind there. And yes, sometimes they did. And that was cool.

35:39A little bit of free candy. I would shake the machine sometimes to see if I could get candy to come out that way. And that did sometimes work too. But then I was like, how does it know I put money in here? Like, how does it know what a quarter or a nickel or dime actually is? So I started jamming anything I could find that would fit in there. Plastic pieces, metal washers, cardboard, shoelaces. I'd shove it in. I'd turn the crank and I would see what happens. And I'm telling you, from like five years old all the way to 15 years old, I was fiddling with these things every time I saw one. And that to me is what fuzzing is.

36:14It's trying to use the tool or machine or application in ways it's not supposed to be used to see if you could glitch it or somehow get it to act weird. What Greg was doing was he was opening Microsoft Word and trying to put something in a Word document that wasn't allowed. I don't know, maybe trying to put a Chinese letter in there or some strange ASCII symbol. Word would accept some of these characters, but then just deny others. Now, if Word won't let you input a strange character, why? Will it break if you somehow force it to take that strange character? Well, Greg wanted to try. So he opened up a Word doc.

36:50Not in Microsoft, though. In a hex editor, where you can manipulate the ones and zeros directly in the file, almost like doing surgery on the file. and he'd put in a character directly into the file that he knows Microsoft Word can't accept. And then he'd save it and try to open it up in Word to see what it would do. Nothing. Okay, fine, that didn't work. But let's try again. This time, let's see what the max font size is in Word. 1638, whoa, that's pretty big. Okay, so Word won't let you make a font size bigger than that number. Challenge accepted. Let's set the font to the max, 1638, to close down Word, open up the file in a hex editor, look for where that number is, 1638.

37:31Where does that show up? Ah, right there. And maybe that means the font size. So let's change that to 9999 and save it and open it up in Word and be like, what now, Word? You wouldn't let me set the font bigger, but I did. What are you going to do? Nothing. It just reverts back to the default font size. It had some sort of logic to handle what happens with the font size that we can't accept. And that is what fuzzing is. And that's what Greg was tasked with doing, to try to make the brand new Microsoft Office 2007 suite crash. It's really a hunt to try to see if the developers at Microsoft accounted for every single problem that could possibly go wrong in Word and handle it gracefully.

38:16So you're modifying these files at the lowest level possible, and you're introducing all this unexpected code, unexpected code paths. It's parsing these files, and it's parsing these files, it's encountering these unexpected data points. And these unexpected data points are introducing areas of opportunity for you to find a vulnerability. And basically, the goal is to get Word to execute malicious code, such as giving someone else control of that computer. But you can't just put malicious code in a Word doc, and then when someone opens it, it runs. Word doesn't execute code like that. It just displays it as text.

38:50That's its job. So can you hide this malicious code somewhere in the Word document that it will also get executed when Word gets opened? No, not really that either. Yeah, there's macros that act like code, but that's different. What we want is for Word to take our malicious little code and stick it into the memory of the computer. So the goal is to cause Word to crash, but then use that crash to force malicious code into memory or a pointer that references the code into memory. Now, just opening Word is not enough to see all the stuff that's happening. You want extra visibility on how well Word is behaving, what stuff it's putting into memory and everything.

39:29And that's where a debugger comes in. At the time, he was using a debugger called OLLI, which will show him a lot more details of what Word is actually doing. Correct. OLLI is a tool that you attach to any application that you want to see at low level, the assembly level. You want to see what the code is actually doing, your registers and your memory output and what's going on with the application. You attach a debugger that allows you. Sounds like a wrapper for the app. So you open Oli and then tell Oli to open this. And then Oli will be like, I will watch all the memory and everything that's happening here and tell you everything.

39:59That's a great summary of that. And that's exactly what it does. It sounds a bit tedious to open a file in a hex editor, manually change one or two numbers, then close it and then open Word up and then see how it behaves and nothing. So just close it all and try again. So all day he's editing these files, opening them in Word and then closing them. I just really liked looking at the files in the hex editor, modifying the files, opening the file, and noticing the UI changes. Like, it would distort the, it would, like, if you had your, like, your office file, if you had, like, graphics and stuff in there, it would distort it or make it look, you know, wrong because it's rendering improperly.

40:37So you could actually get better feedback, I found, by doing it that way to identify where in the file you're affecting. And so, I mean, I did this for like two days, and all of a sudden, I had a crash. Ooh, a crash. This is what he's been trying to create. Okay, first things first. Will it crash every time? Yes. Awesome. Okay, it wasn't a fluke. Next. Can he inject code into memory when it crashes? Yes. Wow, this is great. Now he has to see if he can get control of a pointer or inject some shell code into memory along with this crash. And yes, he can. And it was a classic crash at that time where you overwrote a data pointer and you can control the data pointer at that, which is allows it.

41:23That's the basis for remote code execution. So what he's discovered is he can craft a malicious Word doc so that when the user opens it, Word crashes. But then malicious code is put into memory and now the system is severely weakened. It's vulnerable. Wow. Very cool. all within weeks of Microsoft Office coming out. Greg has discovered a pretty serious vulnerability in it, which allows arbitrary code execution. He feels great. His team is impressed. So you tell your coworker, your coworker tells your boss, you tell your boss, whatever. And what does your company do with this? My boss is like awesome.

42:02He immediately starts writing all the press. And Mark Mayfrey is, if you know him, he's very enthusiastic. He's just like, oh, my God, we're going to, we're going to, this is going to be fucking awesome. We're going to send this to the press. We're going to throw this out there. And so he immediately starts writing to everyone, you know, all his typical, you know, tech writing, you know, the tech writers. And so they immediately start writing. And then we report to Microsoft. Again, they aren't sharing exactly what the vulnerability is to the press. They're just telling them that EI found another zero day, this time in the latest Microsoft office.

42:37And of course, only giving Microsoft the full details so they can fix it. And once it's fixed, then EI will show the world how it was done. The news spread fast. A few big tech publications were talking about this zero day that Greg found. About three days later, we get an email back from Microsoft and says, hey, we can't reproduce this. And we're like, this is typical. We've dealt with this before. This is a typical Microsoft or security response team, typical action. So they're like, okay, so we send the sample again, and we're like, hey, you know, we show the debug output. We show like a...

43:15And then like another day after that, it comes back, and they're like, hey, did you try this without a debugger attached? And Mark Mayford is like, of course we did. And then he looks over to Andre, and Andre looks at me, and I'm like, I don't think so. So we go run it again. And there is a special trap that Microsoft added. This is at the time, this was pretty new technology, where they had debug-only routing inside Office. so it would reach a code flow path that was only exploitable, only triggerable when you had a debug attached to the word. Meaning no one is going to be vulnerable to this unless they're having a debug attached or unless they're a security researcher.

44:11Oh man, how embarrassing. The news is out there saying that EI found a serious vulnerability, but now it turns out they don't actually have a vulnerability. And it's because this new kid, this weird-looking goth kid, didn't verify it all the way. And so I remember there was yelling. There was yelling involved. I remember I was there for three weeks, and I remember just literally just staring down, being ashamed. Just like, oh, God, this is it. This is how I lose my career. It was nice. It was a good couple months. It's a game. Because the stress here is because a press release was written, right?

44:58Yes. And EI at the time was like, they were like the rock stars. Like this is, all everyone else in the room, you know, all those rock stars, Yuji, Derek, Daniel Soder, the brothers, everyone else in there has written vulnerabilities in a professional manner. They've all done this for years. They found the first Vista vulnerability. They found, you know, this is their thing. and now i'm the new guy who screwed up and made them look bad so behind the closed door they were like we gotta fire this guy and luckily for me um i believe andre was like naadi we're gonna give him a chance he's gonna we're gonna give him a chance you know make this right so they come out And they were like, look, man, you got to find a vulnerability.

45:47We don't care how you do it. It's got to happen. I'm like, okay. There's some hope still. The press release just said they found a vulnerability in Microsoft Office, which consists of Excel, Word, PowerPoint, Visio, and more. It didn't give any details as to how the vulnerability works. So if they can find a bug in any of these products, it'll save the reputation of the company. But to be clear, for a young guy in his first cybersecurity job, to find a zero-day vulnerability in Microsoft Office, that's an incredibly complicated task. The entire team of coders at Microsoft worked tirelessly to prevent people like him from finding bugs like that.

46:32So he's got to find something they missed? This was a big deal for Greg. He needed to find a zero-day vulnerability in Microsoft Office or else he's going to be fired. He calls his girlfriend and says, don't wait up for me tonight. I am going to be working late. Sorry, I just have to do this. And he just gets dialed right into the zone, downing energy drinks, grabbing extra monitors to be more productive, ordering pizza right to his desk. Like he's fully committed to doing this. He was so committed that he was going to stay in that office until he found a zero-day vulnerability. So I am there 24 hours by myself, just like manly tricking.

47:13And I'm just like, oh God, I can't do it. He's sleeping under his desk. He's living off of donuts and coffee. So what happened here, man, was like, so the crew comes up to me and they're like, dude, we're not gonna let you do this by yourself. We got your back. And so everyone stayed in there and we were in there for three days. And man, I remember girlfriends calling, wives calling guys and being like, are you guys coming home yet? They're like, no, we gotta do this. This is an important thing. We ordered pizza. We had Mountain Dew. That area of the office, I remember, it was not smelling great.

47:51Like, the other teams were like, what are you guys doing? What is going on in here? Are you just, like, opening text files and edit and then close and then open and then close? Yeah, we have, okay, so I think during that time, so there's at least six of us. We have one guy who's writing his own program to Fuzz It. We have, I think Yuji had like three screens up, buzzing data, reverse engineering. He's like trying to reverse engineer that. I have a program I've written running on one machine over here. I have a machine to my left. I have a machine next to me that's running software to find and find this vulnerability.

48:21I'm in a hex editor editing files left and right. I think Derek was also editing files. Derek found, was finding something else. He found, I think he later found another vulnerability out of this. But he's going in there, editing, looking at this. Everything we find is really interesting stuff, which turns out it was like we found a lot of really cool stuff in office at the time, but none of it was a vulnerability as we described. So we are literally just sitting there geeking out and just pizza being ordered. EI was a wild time. Days go by like this where all the researchers are pouring tons of time into this.

48:56Nobody was going home. People were sleeping in shifts under their desk in the break room. The energy was amazing to have so many people come together to try to save the reputation of the company. And day three, I was modifying a file and all of a sudden it popped. And we look at it and we're like, oh, wait. And I remember Yuji. Yuji looks at it first and he's like, Yuji is this incredibly, unbelievably talented Japanese hacker. and he's like, oh, it looks good. And when Uzi says it's good, everyone's like, okay. So, and the first thing that happens after that is I remember one of the guys was like, is the debugger detached?

49:40We were like, oh yeah, get that thing off there. So retry it. And it happens to be in Office Visio. It was another product inside the Office suite. So it wasn't Word, not as sexy as Word, but hey, we only said Office 2007. So again, saved our butt. And the thing is, when Microsoft sent that email, they were like, hey, man, this vulnerability occurs in this wrapper function called safeint. And what safeint does is it prevents the integer overflow from occurring and causing that controlled flow, the code execution to occur. So it checks all the integers. What happened with the new vulnerability we found was we just happened to find a legacy pointer for integer that was not safe and wrapped and was vulnerable.

50:30So they sent that email out. And unfortunately, David LeBlanc in Microsoft. David, if you were listening to this, I'm sorry, man. I think he was on vacation. He got called back. Maybe he didn't get called back. But that's what I heard because he was the one who was in charge of Safe End. Safe End was his baby. And it's an awesome security feature. He got called back because when we sent that sample to Microsoft and it worked, that was a big deal to them. So, you know, we are all happy. The vulnerability goes out. Like a couple months later, it gets disclosed. And we have indeed the first vulnerability in Microsoft Office.

51:13and that was the case. That was a wild time, to say the least. He saved his butt on that one. His whole career was on the line and he did what he had to do to save it. And being awake for so long, there wasn't much of a celebration after he found it. Dude, I crashed. I fell asleep. I remember just being so exhausted. At the time when I found it, I was already tired because I was half asleep. and I remember the alarm that I had for it to find to like find it I nearly spilled I think I did spill soda all over this place because I was just like waking up like we're all fasting out like we're literally sleeping at our desk here there's no we were not sleeping on hammocks or anything we're just like sleeping at our desk and so I remember it being like we find the vulnerable we like we're like yes and we're all so tired to actually have a proper like I guess we did have a proper we did yell out extremely like a mouth we're like yes we're And then immediately after, because we're like, we're celebrating, like high-fiving, everything was like that.

52:13But man, after that, I just remember us all just being like, and we're going home. And I fell asleep in the office. I didn't even make it home at the time. Because I lived walking distance. I was too tired to even walk home at that day. So I just crashed out, woke up, went home. And I remember my girlfriend just threw me the pillow and the blanket. And I was on the couch for like a week for that one. Rightfully so. She was so pissed. But it was your job on the line. She should understand that. Like, listen, I'm going to get fired or I could stay at three days and not see you. What would you rather I do?

52:51Oh, man. I was a newly father. My kid was probably like, oh, okay, okay. So, hold on. So, you just had a kid at the time? My kid, when I started EI, was six months old. So, that kid was not even a year old. And colic. And my kid was extreme colic. like 12 hours a day crying um man she was so mad um oh that that's that makes it even more stressful oh yeah oh oh yeah um but yeah so yeah that was i remember i remember the emails that was like the emails getting from her was like always popping up just be like her just getting angrier and angrier as the day is going on and she's like where are you why like i don't believe Eve, you're at work for three days doing this.

53:38And I was like, okay, I'll send you a picture of us. And we had the team just doing random pictures. I was like, oh, man, this was a time. EI was a magic place. A lot of amazing talent worked there, and many went off to start their own cybersecurity businesses. Rumor has it that some of the anecdotes from the TV show Silicon Valley came from stories that happened at EI. And Greg learned a ton from working there for years. So years later, this is like my third year at EI, I remember we had a honeypot system, which it's a system that's designed to catch hackers and lure in individuals. And we were trying to get zero-day exploits, and they definitely tried to lure people into attacking the system.

54:25It was like one of the largest honeypots at the time. It was nearly a class B internet group of honeypots. It was massive. and I remember I was logging into one of the systems that we had maintained for that and I see a login called Elfang and I was just like what is this? Whose account is this? Maybe this is a new hire I just don't know about and I walk into my boss's office and I was like hey hey, I got that all set up. However, there was someone who logged in recently. Maybe it's someone who we hired in DevOps or something. Do you know El Fang? And I remember my boss was just typing. All of a sudden, I remember the distinct sound of him stopping and the sound of the chair creaking back and him looking at me.

55:20And he's like, you found what? Who? And I was like, yeah, El Fang. I think I looked at the extended name was Li Fang and he's like what do you mean you found a Li Fang login and I was like yeah it's on the honeypot system it was like it looked like it was a maintainer and he goes and he closes the door behind me and he's like all right I'm gonna tell you a story about Li Fang and I was like okay let's hear about it so back in the day like I mentioned, EI was the rockstar group for finding vulnerabilities. It was like EI and iDefense. That was like the two big companies back in the day for finding zero-day vulnerabilities.

56:05And at one point, EI was so good at what they were doing, Microsoft decided to hire someone in order to go work at EI in order to get them to tell them, Microsoft, about the zero days they found at Microsoft. Wait, wait, what? Hold on a second. You're saying Microsoft got someone a job at EI. It was a different time. But they worked for Microsoft so they could report to Microsoft what EI is working on. It was a different time. Yeah. This is ridiculous. You don't hear about this ever. It was a different time. Did this news ever actually go public? I don't think so. I can't imagine Microsoft hiring to work, getting people to work at other companies.

57:04This is corporate espionage. That's correct. Well, it gets even better. It gets even better after that. It gets even better after that. Okay, so Microsoft hires Li Feng to work for them, but then plants him in EI to go find out what they're working on and report back to Microsoft. So Li Feng was working at EI for a while, but then suddenly left, and nobody really knows why, he just disappeared one day. But then Microsoft, sometime after he left, they're like, hey, we got to have a talk. We got to have this conversation. and so we're like okay and so Microsoft was like so Li Feng he was working for us to you know identify zero days that you guys may have found.

57:52Which had to be a bombshell for your company to hear they thought that must have been I think they had suspicions that he was being a little odd but so Microsoft then goes to say so apparently he was also working for a foreign government entity to do the same for us and you. So someone placed him in Microsoft. Correct. Go get a job there. And then he got chosen to go work for us. We hired him and he got planted. And then he was siphoning zero days from not only us, apparently, he also had privy information at Microsoft. and that went back to his foreign government that he was ultimately working for.

58:41Holy moly, someone planted him at Microsoft and then Microsoft planted him at EI? That's unreal. How embarrassing for Microsoft. It's like being caught doing something you shouldn't have been doing, like, I don't know, having your pants down when the elevator door opens. They know they shouldn't have been playing that game, but now they realized that they got played themselves. Oof. So I really wanted to confirm this story, and I reached out to people that I know who have been at Microsoft for a very long time. And all of them said that does not sound like something Microsoft would do. So I can't confirm that that story is true.

59:16But I would love to know if it is or isn't. So if you have information about Microsoft planting people in other companies, tell me about it. Because here's the thing. We know corporate espionage is happening. There's people sending secrets back and forth to tech giants all the time. But it's a secret. So we don't know about it. We only know about the ones who get caught. So it seems plausible like something like that could happen. And you know what? I'm curious what corporate espionage stories are out there. And take a quick peek. There seems to be some cool ones. In fact, I think I'm going to take an ad break and look at this a little deeper because I'm fascinated by corporate espionage, and I might have to do a few episodes on that sort of stuff.

59:58But stay with us because after the break, Greg is going to tell us some penetration testing stories that he's done.

1:00:30web. Trusted by leading internet and infrastructure providers and brands large and small, they clean up the web a little more every day. Proudly earning one-star reviews from cyber criminals and five-star reviews from customers, Netcraft's automated brand protection platform sifts through the noise to deliver high-fidelity signal that powers takedowns at any scale. Keep your story off this podcast by learning more at netcraft.com slash dnd that's netcraft.com slash dnd

1:01:06After a while, Greg left EI and started doing red team stuff. that is penetration testing, breaking into companies to test their security. And he also does threat intelligence, which he tells me he got some really interesting contacts and worked at some very interesting places. But we're going to have to skip those stories because they're too sensitive to talk about. But he is willing to tell us a few pen test stories that he did go on. The first story is about a time when he was paid to try to hack into a major tech firm, which has a lot of user data. I mean, they have millions of users, but not just simple user data.

1:01:42They collected highly personal information on their users as part of their service. So Greg meets with the customer. And it started out weird from the get-go. The customer was saying, look, we are crazy about security. We go over the top on cybersecurity because we cannot risk our user data getting out. So we don't think you're going to find anything. In fact, the last pen testing company struggled so bad to try to hack us that they got arrested. So they use a third-party payment processing system that is not used by them. And their previous pen testers accidentally exploited the third-party payment system that was vital to them.

1:02:21And the third-party payment system was an Oracle system and not owned by the customer at all. So when apparently, that's what I heard from the customer, they did their exploitation and then they said, hey, we got into credit cards and we're going to present it to you in the next day in the presentation. So they got the blue team there, all the blue team, all the people that were like, and they presented them and said, hey, we exploited this. We exploited this IP address. We got access. We gained it. Here is your raw credit card details. And as you can imagine, the team looks at it and they're like, what IP is that?

1:03:02That's not local. That's not like it's a local address, but that's not ran by us. That is not. And then they found it was actually owned by a third-party payment system, and they had exploited a zero-day in that, gained access to there. And on top of that, the credit card details were not. There was a stream of credit card details, so I believe it was outside of even scope for the customer. So the customer reported them on the safety of their half because they didn't want to think that someone on their network compromised them and reported them to the law enforcement authorities. And I believe that led to the arrest of them.

1:03:37Either way, that's always wonderful to hear going into a pen test. You hear like, hey, the previous guys got arrested. Why don't you guys come in here? So, you know, great start already. Great start. so if you know me i i still dress like a goth kid you know i still i'm still all black i'm cyberpunked out i wear neophoric love them i'll wear everything from vx underground all black anything i can so i show up at this facility and at this time we also have a co-worker of mine and like this is my co-worker's first big real big pen test and so he comes in too and i will never forget um the people there because they look at me and they look at each other and they're like oh god we we gotta put you guys in the back room so they set us a separate room away from everyone else uh throughout my career this is kind of the thing i'm the guy in the back room i've been there because of how i am so they sent us back there and this is a five-day insider threat Pentest, go.

1:04:46So his job was to simulate an employee there who had gone rogue or had been hacked. Just by being in the building, what could he do? Sniff some Wi-Fi traffic? Plug into some network ports? Well, all that's worth checking out. But they did give him a single user's login. And they said, that user should be locked down so tight that you shouldn't be able to do any harm even by knowing their password. This customer, I've been red teaming a lot of places. Their blue team, their SOC team is absolutely legit. One of the best defense teams I've ever had the honor of working with. And so they literally are running their own kind of like built-in EDR system that they built themselves that's tying into their SOC, going in there.

1:05:34And we get nowhere, man. Day one, nothing. Day two, nothing. thing day three my co-worker's laptop dies in the middle of it and he can't even work anymore and we had to give a report on to the customer and I remember them just looking at us and being like I think we hired the wrong people like literally they're like do you the are you guys want to resign and we can scrap this up call it quits and then we can go hire somewhere else and I was like no man we got this day four happens and we i remember it was like 4 4 30 and we have to give at five o 'clock we have to give our meeting and my co-worker had got had to go to best buy buy a brand new machine and he spent the entire day imaging a machine on a red team engagement and we're he looks at me he's like man i don't know what to do so i was like hey let's let's try one more let's do let's do some art poisoning and just do one more time and i remember looking up and that art poison grabbed one plain text credential that just happened to be an ftp job and we're like oh we got a credential we got somewhere you know we got something it turns out that credential was the build system process and it allowed us to get into the build system to roll code throughout the entire thing.

1:06:59And it just so happened at 4.30, they rolled it out to do an end-of-day lockdown and build system configuration to lock everything down so no one's doing any more builds. We went to that meeting, said, hey, we just intercepted this. And I remember them all thinking, wait a minute, that's the old build, and that credential is still active. At that point, we had a really cool exploit for that one. We got into the build system, and they had a lot of controls on the actual files in there. So we couldn't modify in the build files, but we could edit the command line. So we rolled an inline assembly.net include in there to roll in, go into their portal and steal all the customer data who would enter a credit card in there.

1:07:42We marked it in the data. We blocked out that credit card, but we put an asterisk in there, stolen last four digits, and then had it sent out to them. They test it. They round out. They were like, holy crap, we have not had a red team roll out code to production in the eight, nine, ten years that we're here. Come back next year. Come back next year. Talk about a Hail Mary. Not a single find all week. And then 4.30 p.m. on the last day, they catch a lucky break by sniffing a credential in the network, which gave them tons of access. What a good find that saved their butts. I come back next year and they're like, hey, we want you to do something kind of crazy.

1:08:20We want you to target DNA. Part of what this company did was genetics studies. They had DNA data on their users. And this was regarded as one of the most protected assets of the company. So why not hire a hacker to try to find it and steal it? And we don't care how you get it. Any way you can get it, That's fair game. So I spent like a week in there as a malicious insider. He starts with a basic employee login again. It is locked down pretty tight, but it's just enough for him to get a foothold somewhere else. And from there, he finds an exploit in another system. And then he was able to pivot from there, collecting more system logins.

1:09:08and finally, he's able to get in a system which manages backups of machines. He can see there's some really large files here. Maybe those are system snapshots or backups? But what system is it a backup for? No idea. But he decides to try to download it anyway to see if he can look at what's in these files. It literally aired out on the share size. And I was like, I've never seen that before. And I remember clicking a file, and I'm on a local network, and I remember that file taking forever to get to me. And I was like, how big is this? So I grabbed the file and I'm on the local machine and I remember looking at it and it's TCGACT, like those letters.

1:09:54And I was just like, I think that's DNA. I think that's DNA. And I was like, huh, I don't know, maybe this has got to be, this can't be, this can't be right. So I grab it and I cut off like as much as I could and then I sent it over I worked with a I worked with a biologist she was very very smart girl and she just happened to be a biologist who was working with mice at the time and she actually knows DNA and she worked with DNA and I was like hey what does this look like to you and I sent it to her and she looks at it and she's like oh oh, this is a DNA sequence mapped out by this program. And I was like, oh, okay, cool.

1:10:37And then she's like, hang on, I can even tell you what kind of DNA this is. And a couple minutes go by and she's like, why do you have human DNA? I was like, I got to go. I got by, click. And so my next task was like, they were like, you have to get the data out. We can get in, you have to get access to it, but you have to get it out. so at the time again it was ran by a very very good sock team um i there was there was a lot of the air the environment i was in was very very well restricted and um the only way i got to her was through you know sending a picture like i remember selecting it all and then putting it into like an app sending her a picture of it and it was like so bad quality i just said it a couple times actually but so i was like how am i going to get all this data i can't do with the phone and I can't do it with a picture.

1:11:29How am I getting all this data out? I was a malicious insider. So I was working as a quote-unquote IT member. And so I got introduced to the IT group and they were like, oh yeah, you'll be working in this environment. It's cool. And so I was like, I got to figure out a way I can get a bunch of hard drives and I have to get a bunch of hard drives back into the building. So what I did was there was printers that were scheduled for to be, to be, um, these printers were scheduled to be, uh, taken to repair. I remember grabbing all those printers and gutting it as much as I could and walking out and going out to the front desk, going out the front door and be like, Hey, um, I got to send this printer to the repair shop.

1:12:12It has to be done today immediately. And so the front desk people were like, okay, just sign off for it. Cool. Sign off for the printer. Load that into my rental car. And I go to Best Buy and I'm like, I have to get hard drives. I have to get a lot of hard drives. so I went by and this is back in the day where external hard drives were those big obnoxiously ugly colored things and they came in like I think 32 gigs or 64 gigs was like a big hard drive at that time so I go through I have a shopping cart and I just go from the end line of these and just pull the whole thing into the shopping cart I have a full shopping cart of hard drives you put your arm on the shelf and just Do you know that meme where the guy is running around Best Buy and he's like, oh, hacked all the things.

1:12:59I hacked all the things. That was me except with hard drives shoving it into a shopping cart. And I remember going to the front of the desk, maxing out my credit card of hard drives. And then going back into my hotel at the time and loading them all into the printer. I put it – I shelled out the hollowed out printer. I just stacked the hard drives in there and clued it up together. And then I show up to work the next day, get the little trolley carts they have, go out and say, bring it back. And I remember I'm bringing back the printer and the front desk person was like, wait, you sent that off to be fixed yesterday.

1:13:45And I was like, yeah. He's like, you got to tell me how you got those guys to fix that in 24 hours. Because, man, they are always so slow. And I was like, oh, shit. Well, I bought them a root beer. And they're like, oh, that makes sense. I was like, I brought them a six-pack of root beer. And he was like, ah, okay. Good to know. So I go back to my area of the building, putting it. And I have this printer next to me. And then I'm opening up a little panel. and I'm just USB drive, literally copy, pasting, mounting, copy, pasting. And I started at, I started at like 8.15 AM. And I am there until they kicked me out of the building at like 9 PM, doing nothing but moving over data.

1:14:32And then I leave the printer there. And for the next two days um i am literally doing this every day and then on my last day of the pen test i remember i walk out and i go to the front desk and the guy there he's still there he's like he's like i was like oh dude printer broke again and he's like oh don't worry i got something for you and he goes to the fridge the little fridge he has and he brings out a six pack of root beer he's like give this to them and tell them I said hi I am sitting there trying not to laugh while I'm holding petabytes of like I can imagine I I think I don't know how I couldn't get it all but I I remember I bought over like 80 hard drives um from Best Buy I think I actually went back a couple days later and brought some more because I didn't think I had enough and and put them in my jacket in my pants and I loaded this this this HP printer and filled that thing up and got to my hotel and then at that point had a I had a secondary laptop that I requested to prove for exfiltration.

1:15:34I connected to that laptop, loaded it up and said, done. So when it was time to show him what he found, he has them go into the room where he was working in and said, open up the printer. And they open it up. And when they do, a bunch of hard drives just come pouring out of it. And he says, those hard drives are filled with all your DNA data. Yeah. And they later said, hey, you were the first person to do that. And I worked for the red teaming for another, I think, three or four more times after that. And after that was their call center I attacked, targeted. Okay, here's the big question, though, right?

1:16:11First time, they're like, who got to go in the back office? We can't have that. After doing it like three or four times when you're walking through, are you feeling more confident? Like, oh, no, you could be in the front office. We don't mind you being around here. Oh, man, I went to their barbecues. I went to their family. They were all very nice. after the first time, they were like, look, you can never meet the execs, but we will absolutely hire you every single time. A few years go by of him doing pen tests and he gets another job, which also has an interesting story. This time, a venture capital company has hired him to try to hack them.

1:16:49Now, they wanted to see if he could hack into them to get data that would influence the market or something that might hurt the reputation of the company, or see if he can gain information that can be used against the company. So Greg gets tasked with going on-site to try to hack into this venture capital company, which, remember, even though he's well into his 30s at this point, he is still dressing all goth and considers himself a goth kid. I'm still a goth kid, man. I still dress in black. I still wear my goth, like, like, like I said, I don't wear, I don't like the collars or anything, but I still dress all black.

1:17:24I wear my goth outfits. I wear my VX underground, like my neophoric shawls and everything. I wear my goth boots. And what's funny is every single contract I sign for work, I have two clauses in there. Clause number one, I'll never code in Ruby. Fuck Ruby. Clause number two, I'll never adhere to a dress code, period. If those two don't happen, I don't work there, period. it. So, so, um, and that goes, that's, that goes back to like, I was one of the, when I was in cybersecurity, I was one of the kids who never went to college for cybersecurity. And so like all these places are like, Oh, you gotta get a college degree.

1:18:05You gotta, you gotta do all this kind of stuff and you gotta wear suits. And I was like, no, fuck that, man. If you, I got like, if you don't hire me for like the things I know that I don't want to work there. And that's, that's been a long belief. And I still believe that, you know, to this very day. Um, and I, I told my boss, you know, the day that my goth outfit interferes with the way I work, I would stop doing it. Still do it to the spare day. It's been 20 years. Anyway, so they send me over. And I remember I get out. They're like, hey, we want you to meet at this outside. It's going to be outside the hotel that we're all staying at.

1:18:41And I walk up to this guy. And this guy is wearing a suit. he is wearing like a suit that costs probably more than than what i make it a month and he's in there he's smoking a cigarette clean cut the guy looks like he's still like active secret service i think he even had an earpiece in man like and he looks at me and i was like hey are you are you this guy and we'll call him we'll call him brando are you brando and he was just like yeah and he's like are you greg and i was like yeah nice to meet you i know where he takes the longest drag out of his cigarette you know that meme from um uh what's that hbo true detective where where the meme of looking at the phone and the guy's just inhaling the cigarette where matthew mcconaughey i think is inhaling the cigarette i got that exact look from this guy looking at me and he just tosses that cigarette?

1:19:40And he's like, this is going to be a long week. He's like, let's go. So this guy is his escort and drives him to the building where he's supposed to do the pen test. And he takes Greg to the front door and he tries to go in with his escort. And I remember physical security is like, sir, who are you? What are you doing here? They literally get in front of me. I was like, no, I'm with Brando over there. And I'm part of of the assessment and they're like give us some id and they escort me into the building and also i'm getting a call from like my my contact and he's like where are you i was like i'm being detained and he's like oh god it's a great start um so they come over and they realize that i'm supposed to be there and then i go meet my contact and i remember him looking at me and being like, oh, man.

1:20:29He's like, all right, well, you can go work in that back room over there. We're going to tell everyone you're an auditor or someone, so no one bothers you. You're going to set up this back room and just don't bother anyone. Just go there. So they sat him down and said, okay, hack this place. And he's like, well, can you give me like a user login or something? No. All right. Can you give me the Wi-Fi password at least? No. Well, listen, I see a bunch of wireless networks and I don't want to accidentally hack into the wrong wireless network. So can you at least tell me which Wi-Fi network is yours?

1:21:07I can see the contact at the venture capitals like, man, it was like he looked at me and he wanted me to be out of this building to fail as much as possible. So he's like, our guest Wi-Fi ID is this. Go. That's it. That's all I had to go on. Nothing else. Just the guest Wi-Fi. So I get up and I'm like, okay. So I start walking around the building and the security team's absolutely following me at every step of this. And Brando from the other third party, he's like, where are you going? Like, what's going on? I was like, I'm looking for a Wi-Fi password. And he's like, I think, he's like, I'm pretty sure you're supposed to do that with the computers stuff.

1:21:46I was like, no, no, like they're going to have this. And I walk around the building and eventually I find it on a whiteboard. And I'm like, bingo. Let's go. So I go back and I sit down and now I'm on their guest Wi-Fi network. Nice. How clever. Just look around the building for the password. All right. So now he's connected to the guest Wi-Fi. So I get the password. I sit down and from there I start scanning. And the first thing I go is I hit the Wi-Fi router and it's a Cisco device. And this team, I'll later learn that this team is very, very good. However, again, like they mentioned, they've never had a full red team event.

1:22:27So the router security is nowhere near where it should be. It's actually, the router is a single router, a single Cisco device that is both the guest Wi-Fi and the internal Wi-Fi as well. So I exploit the router, I jump on the router, and then I make the entire network flat. I bridge over everything. So now my machine can attack anything on the inside of the network, even though I'm on the guest Wi-Fi. I can still start attacking anything on the inside network or on certain networks. They had multiple inside networks, so I started bridging them over one by one. How did you exploit the router? The router didn't have, like, A, their password was default, unfortunately.

1:23:13There you go. Number two, they had an administrative password on the panels. So the access was one password, and then I brute-forced, I believe, the password of the admin panel. It was very close to standard password on there. Gained access, unfortunately.

1:23:35So the guest Wi-Fi should only have very minimal access, like just to the Internet, and no internal systems in the building. But when he bridged the networks, he could then access anything that other employees could access, which gives him access to a ton of internal systems. There, I start doing man-in-the-middle attacks. And let me tell you, red teamers out there, pen testers out there, never skip out on layer two attacks. Layer two is your responders, your cane enables, your art poisoning, your DHCP spoofing, all of those. That is going to be your bread and butter. I promise you those vulnerabilities are still existing there.

1:24:18They still work. I work engagements to this very day. That is where so many places fail. So I'm in the middle. I start stealing credentials. And this is back in the era before, you know, SSL security was everywhere. So you could still do man in the middle and downgrade websites to HTTP logins. And I start getting credentials to people logging into work emails. After about an hour, I get access to a relatively new hire. She has like six months of work in her inbox. I access her email. And the first thing I do is I go all the way down to day one. And what do you get in day one? Email. You get your employee training, you get your onboarding information, you get your onboarding documentation, and if you come to this building, you get your building alarm code.

1:25:12So, have a physical alarm code that goes in her, and also have her badge ID number, and what she looks like, and such. So, I'm like, okay, so what can I do next? And And I remember Brando, this ex-secret service guy, looking over my shoulder. He's like, what are you doing? He was like, I was like, okay, so you know these car readers? He's like, yeah. He's like, we're going to clothe one of these car readers. And he's at this point where he's like, all right, goth guy. You're not so bad. Okay, I like this idea. And he's like, all right, I'm going to work with you on this. And he's like, I talked with them, and we're going to talk about guard ships and times to get into this building.

1:25:48And I was like, okay. So I tell him my plan, and I was like, man, so I got a building alarm code. I'm going to put a RFID cloner next to their badge reader, and when they badge in, I'm going to start getting all these badges. And he's like, okay. And so a day goes by, and eventually the girl who's building alarm code comes in, badges in, and I get her. I have a proxmark system. I keep pulling it, and all of a sudden I notice her ID matches up. So now I have her employee ID badge and her building access alarm code. To get into this building, you need to use your little badge and tap the badge reader and the door unlocks.

1:26:24And what Greg did is he put a little badge sniffer behind the real badge reader so that anytime anyone taps their card, he gets to see what their badge is. And that essentially allows him to clone a badge. They gave me a tour of the building at one point, very, very against their will. They were kind of like hushing me around. the two things i noticed when they gave me that tour was a there was a balcony on the second floor that had a tree next to it and from that balcony was a straight shot into their server room and basically you go through one room uh in that room you get into you're doing that one hallway and you're in a server room and the server room did have a badge reader on it the second thing i noticed is sort of like a like almost like a spiral skirt staircase downward there was lots and lots and lots of paintings.

1:27:15I remember asking during the tour, I was like, whoa, these look like real paintings. And they nodded. They're like, yeah, one of the CEOs here loves paintings. And this is their pride and joy. They like to show art and they like to make sure that. And I was like, huh, that's interesting. That's cool. and so I remember so for the next couple days I had to get a badge of an IT guide because I needed to get access to the server room and eventually I get it and it's through the Poxmark system as well in the meantime I'm doing man in the middle getting credentials, doing traditional attacking methods but I really wanted to focus on this on this whole physical element because the Brando working with me, he was just like man he's like we can do something, Mission Impossible stuff and i was like yeah yeah we could and so the next phase was they had cameras everywhere they had internal cameras outside external cameras and i remember doing the network so eventually every day i'm i'm folding different parts of that of their internal networks into the guest network that i'm at so i can bridge over and start looking and eventually i find all their camera their camera network and luckily for me they're using access cameras and if anyone's work physical security.

1:28:38Everyone knows there was an era of access cameras from like 2001 to about 2008, 9, 10, where everyone had, all these places had these access cameras because they had a ton of features. They were cheap. They were, you know, Chinese made wonderful cameras. However, they were the worst security ever. They had so many default passwords. They had buffer overflows and the access control systems, they had buffer workflows and their web interface. They had like a web interface that when you connected to it, it looked like geo cities. Like it was like straight up like 2002 internet all over again. And that's how you controlled the cameras directly.

1:29:17So talk to Brando and he was like, okay, look, man. He's like, I know they do a guard change around, it's 2.30 a.m. between, you know, around that time. He's like, you got to be in and out of a building around this time and i was like well you know he's like and he's like also there's gonna be someone always watching these cameras and i was like okay that's fine you know he's like what are you gonna do with the cameras so i show him and i start connecting to all these cameras and at the time there's a there's an axis i think they're still running like firmware from like 2005 and there's an axis buffer overflow that allows you to control and gain access to every one of these cameras still running that they didn't patch them jump in and then from there i can access the shitty little interface.

1:29:59And I show them, I was like, look, what happens if I modify these two values? And the values is brightness and contrast. And you can edit both of them. It's usually for, you know, when a viewer wants to look at the camera, they're trying, oh, it's too dark or too bright. They can edit these. And UI, you can edit them a little bit, but programmatically, you can edit them all the way from zero to 255 values. So you can make them go all black or all white so i show him i was like watch we can make their cameras go boom and watch i show the camera it goes distinctly black for a second and then i undo it and he's like oh i was like yeah he's like all right goth guy all right i see what you're cooking here and so he's like well how are you gonna get these into an area that you know how are you gonna like do this in a way that you're going to be carrying a laptop with you.

1:30:49It's going to just be awkward. I was like, you know, that's a good point. So in this engagement, I had a shuttle device with me. A little tiny computers are like the size of a shoebox. A lot of pen testers used them for leave behind devices. And on that shuttle device, I put a Bluetooth radio on it. And so with the Bluetooth radio, I was like, okay, I'm going to walk around the building and I'm going to get measurements of where I'm at with the Bluetooth signal to noise ratio. And when I'm in front of those areas, I'm going to map out what cameras those are at and I am going to make sure that I can get access to the you know this and so so I tested out the Bluetooth range I had to put a big antenna on this thing to get the Bluetooth receiver on it and that worked so I could I could I could have the Bluetooth show I go in front of these two cameras the two cameras that point outside to the patio I could have them identified there was a camera on the inside there and then there was a camera facing the server room.

1:31:43So those are the those are the cameras I needed to black out. So my app set signals to Bluetooth. The shuttle device would take that signal and relay and when I received those it would send the packets to those cameras to make the values of brightness or contrast to 255 or 0 completely random. They flipped back and forth between them to make it look like a black and white screen sort of like an effect that was like the camera's malfunctioned for a bit. So I was like, man, I have to believe I can look at these cameras. I could test to see if this works. Not sure if this is really going to work, but we're going to try it.

1:32:17So he set everything up to try to break into the building overnight and not be seen at all. The front door might have extra security and he didn't want to take the risk. So his whole plan was to sneak up to the building, black out the cameras, get in and gain access to the server room. Keep in mind, everyone already was on high alert from this kid. They thought he was very suspicious and he was going to have to do something over the top to get in. And that's when he realized his point of entry should be the balcony. So that night, man, I came in 2.30 in the morning, climbed up the tree. I get onto the balcony.

1:32:54I push open the security door on the balcony that they would lock before you can get to the badge reading door there. I pry that open, hit the badge go into the building the alarm starts beeping i hit the building alarm code and lucky for me the girl had not changed her alarm code i was in and i look at the cameras and i remember being so nervous about this and being like oh man this is hopefully this will work or i'm gonna get tackled very soon so i make my way over to the server room and my back my secondary badge, the other one I have for the IT guy works for that one. Badge cloned, got him in there.

1:33:34Went into the server room and from there boot rooted all the machines. Now so if you're unfamiliar with boot root back in the day this was you plug a USB device into the machine, you turn off the the server. This machine would then boot off the USB device as a recovery device and from here you would replace a Windows component. Sticky keys would be an ideal favorite. So you replace sticky keys with command shell and then you reboot the machine. So the machine, after you do that machine, you reboot the machine, it goes into the password login prompt and you hit shift five times. That would then launch sticky keys, which has now been become a command prompt instead.

1:34:15And now you have a command screen on it. And then you can run commands as elevated bridges. You run a system. So you'd have elevated command. So from there, I exploited all the machines. I dropped a flag that said I was here. And then I went into their stores and put flags on all those. He's done it. He's successfully hacked into the servers Mission Impossible style. And so he starts to go out. But he notices something. Those paintings. So I proceed to go down the staircase and I go down to the paintings. I just quickly grab a sticky pad and put us little happy faces. I get a little sticky page and start putting them right next to all these paintings.

1:34:56Like there's a little placard for each of these paintings tell you essentially who made these paintings, what it has symbolized, in some cases how much they were worth. And I stick little happy faces on it that says, I stole this. So it's typical for a physical pen tester to leave a token behind, to prove that they were there in a server room or a desk drawer or something. I mean, just think about how you would feel if you went to bed and then woke up and there was a sticky note on your bathroom mirror that said, Greg was here. Just a small note like that can say a lot, can't it? Here, what Greg was doing was proving that he had access to these paintings and he had time to go right up to them, put notes on them, and security never saw him do it.

1:35:39So he wrote, I stole this, on a bunch of sticky notes and just kept putting the sticky notes on painting after painting after painting after painting. And I remember, like, 6.05, like, I get a call. Greg, Greg, yeah? Was this you? what's the happy face what's that mean well how did you do that what is it doesn't matter the CEO wants wants to like talk with you today get in here like eight o 'clock like like you he's like I don't know man he's really upset we had to figure out I was like okay okay and in the meantime like the physical security had an issue like they had a they had a incident because they were like they We were looking over and they were like, well, someone walked in and put all these happy face stickers on there.

1:36:26And they walked out of the building. They're like, what does this mean? I stole this. And I remember they are coming around and I get into the building. They escort me to the boardroom. And the boardroom has this massive table on it. And me, in my awkwardness, I remember sitting and picking the exact opposite of where I I imagine everyone in the exact corner of it. And the physical security is like, no, get over here. Get over here. And first, give us your ID again. We're going to run some background checks on you again just to make sure. Physical security knows to treat those paintings with a very high level of security.

1:37:04So when the CEO came in and he saw his paintings had sticky notes on them, he simply asked, who did this? What does this mean? And when security had no idea, then the CEO is like, okay, we'll find out. And then when security looked at the cameras, they saw they were glitched out during that time, and they had almost no evidence of who did it. This made the CEO furious. What do you mean no security footage? Find out who put these sticky notes on this. And the cameras around the building were just all black or white because Greg hacked into them to prove he could sneak into the building late at night with nobody noticing.

1:37:41The VC came in, the VC CEO came in and was like, what the fuck? What is this? What do you mean stole my paintings? and little happy faces on him and that's what kicked off the security team alert and and i remember i was sitting there and then my contact leans over to me and he's like look again i have never seen him cancel meetings like and move someone to see someone like this so i don't think it's going to go well and and then i look over to brando and brando is just like you know he's like maybe we flow a little bit too close to the sun here a little icarus just a little hard but you know whatever so ceo comes in with his single security they hand me back my id and he looks at me and i you can tell the thoughts of this goth kid um in his boardroom is not what he expected and not what he was expecting to meet for when he and he looks over and he's like, you hired this guy?

1:38:47And my contact who worked at the company was just like, yeah. Like looking ahead. He's like, all right. And he's like, so walk me through what you did. And for the next 10 minutes, I retell him the story of exactly how I did. And this VC previously had been very technical. He was a co-developer. He worked on software. And so he starts going and he starts asking me very intelligent questions. We start having a back and forth about, oh, okay, so why does this? and he's like so two questions for you first what were you going to do with the paintings and I was like oh I was dating a girl out of Brooklyn at this time and I was like you know I think about taking him to Pratt University and maybe you know fencing him at the university there that it's got to be someone who knows like some weird connections at the Pratt Art you know Pratt Institute of Art and he starts laughing he's like all right um He had a plan.

1:39:40And I was like, okay. And he's like, I really like those paintings. And I was like, I can't believe you. So I was like, yeah. I absolutely would have stole right out the front of it. Nothing to do. And he's like, all right. So then he's like, all right. So my next question is, what are you doing next year this time? And that's how I became their reoccurring Red Teamer for four years until they got tired of me breaking into the buildings and doing all the things. and hired me as full-time. So after this, I got introduced to a lot of the various levels of executives for this, and I got to pen test all their personal houses and got to show them why physical security is important, gaining access to all their penthouse suites, all their large houses.

1:40:30I did that for quite some time afterwards.

1:40:43A big thank you to Greg Linares, aka Laughing Mantis, for coming on the show and sharing these stories with us. Please consider supporting this show by visiting plus.darknetdiaries.com. If you do, you'll get 11 bonus episodes and an ad-free version of the show. By becoming a supporter is the most direct way that you can help make sure this show continues running and delivers you more episodes. Please visit plus.darknetdiaries.com. This episode is created by me, Captcha America, Jack Recider. Our editor is the super subnetter Tristan Ledger, mixing done by Proximity Sound, and our intro music is by the mysterious Breakmaster Cylinder.

1:41:20I've been working on a new dance lately. It requires the most efficient use of muscle memory in order to spin at the perfect RPM. I call my dance the algorithm. This is Darknet Diaries.

1:41:42身長