Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Boston Children’s Hospital network attack ATTRIBUTED_TO Martin Gottesfeld
Jack says the evidence suggests Martin Gottesfeld started the campaign and waged the attacks himself, while noting that the courts would decide the issue.
Uncertain Confidence 88% · Jack Rhysider EP 14 Details
“it seems like Martin was the person who started this campaign and waged the attacks himself. But the courts will ultimately decide that.”
Boston Children’s Hospital network attack COMPROMISES mail server
The attackers gained access to and read email from the hospital’s mail server.
Explicit Confidence 99% · Jack Rhysider EP 14 Details
“hackers were able to get into the hospital’s mail server. They started reading e-mails”
Boston Children’s Hospital network attack INITIAL_ACCESS_VIA phishing
Initial access to the hospital’s mail server was obtained after an employee clicked a phishing email.
Explicit Confidence 99% · Jack Rhysider EP 14 Details
“At some point an employee of the hospital clicked on a phishing e-mail and hackers were able to get into the hospital’s mail server.”
#OpJustina INVOLVES phishing
The campaign involved phishing emails that were used to gain access to the hospital’s mail server.
Explicit Confidence 98% · Jack Rhysider EP 14 Details
“They were sending in a lot of spam e-mails too, and phishing e-mails.”
#OpJustina INVOLVES distributed denial-of-service attack
The campaign involved repeated distributed denial-of-service attacks against the hospital.
Explicit Confidence 97% · Jack Rhysider EP 14 Details
“the DOS against the hospital was growing larger and getting more serious”
Boston Children’s Hospital network attack INVOLVES distributed denial-of-service attack
The hospital network attack involved a prolonged distributed denial-of-service attack that lasted approximately three weeks.
Explicit Confidence 99% · Jack Rhysider EP 14 Details
“After three weeks of a continuous distributed denial-of-service attack, the network traffic returned to normal.”
Boston Children’s Hospital network attack INVOLVES Harvard University
The attack affected part of Harvard’s network because Harvard University shared the network with Boston Children’s Hospital.
Explicit Confidence 99% · Jack Rhysider EP 14 Details
“Harvard University is affiliated with Boston Children’s Hospital [00:15:00] and they shared the same network.”
#OpJustina INVOLVES spam email
The campaign involved sending large volumes of spam email to the hospital.
Explicit Confidence 98% · Jack Rhysider EP 14 Details
“They were sending in a lot of spam e-mails too”
#OpJustina TARGETS Boston Children’s Hospital
The campaign targeted Boston Children’s Hospital in response to the dispute over Justina Pelletier.
Explicit Confidence 99% · Jack Rhysider EP 14 Details
“members from Anonymous began a network attack on the Boston Children’s Hospital”
Anonymous USES distributed denial-of-service attack
Anonymous members used denial-of-service attacks against the hospital’s network and public websites.
Explicit Confidence 99% · Jack Rhysider EP 14 Details
“members from Anonymous began a network attack on the Boston Children’s Hospital. It was a typical denial-of-service attack”
Attackers associated with Anonymous used phishing emails during the campaign.
Explicit Confidence 95% · Jack Rhysider EP 14 Details
“They were sending in a lot of spam e-mails too, and phishing e-mails.”
Martin Gottesfeld USES distributed denial-of-service attack
In a letter attributed to Martin Gottesfeld, he said he coded and ran the attack that took down the hospital’s donations page; the surrounding episode identifies that attack as a DDoS campaign.
Attributed Confidence 90% · Jack Rhysider EP 14 Details
“I coded around the clock for two weeks to perfect the attack.”
“Boston Children’s Hospital’s donations page went down.”
Carbon Black AFFECTS Windows XP
Carbon Black was deployed broadly to systems running Windows XP and above that could support its agent.
Explicit Confidence 90% · Matt Bromiley EP 15 Details
“everything Windows XP and above”
Tiny POS AFFECTS Back-of-house systems
The malware also ran on back-of-house systems and scraped data there.
Explicit Confidence 99% · Matt Bromiley EP 15 Details
“The other twenty percent was the back of house systems as well”
“Those systems were also – also had data that was being scraped in them, too.”
Tiny POS AFFECTS Point-of-sale registers
The malware ran on point-of-sale registers and captured card data processed there.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“Malware that exists on twelve hundred computers that are cash registers”
“the malware was grabbing every credit card that was swiped on that register”
Tiny POS AFFECTS SQL servers
The malware captured historical unencrypted track data loaded into SQL-server memory.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“The back of house systems were running SQL servers.”
“The SQL servers had historical unencrypted tracked data that was being loaded into memory and the malware was picking that up.”
Jack Rhysider AUTHORED Darknet Diaries
Jack states that the show is made entirely by him.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“This show is made entirely by me, Jack Rhysider.”
Retail credit-card breach COMPROMISES Point-of-sale registers
The breach compromised cash-register systems used to process payment cards.
Explicit Confidence 99% · Matt Bromiley EP 15 Details
“the systems that are compromised are those particular systems”
“They’re the cash registers where you go buy something and you swipe your card”
passwordwolf.com DEVELOPED_BY Jack Rhysider
Jack says he made the password-generator website and its API.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“I made a random password generator.”
“It has an API which allows you to use it in your own programs.”
Retail credit-card breach INITIAL_ACCESS_VIA phishing
Matt personally believed the attackers probably entered through a phishing message, but he presented this as uncertain rather than confirmed.
Uncertain Confidence 86% · Matt Bromiley EP 15 Details
“I think personally, they came in with a phish”
“it makes me want to think it was likely a targeted approach but you never know”
Retail credit-card breach INVOLVES Backdoor
The attackers installed hundreds of back doors to preserve access to systems.
Explicit Confidence 99% · Courtney Dayter EP 15 Details
“They had added 350 back doors.”
“they were just allowing themselves access back in”
Retail credit-card breach INVOLVES Kroll
The retail company hired Kroll to investigate possible malware in its network.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“this store wanted to investigate anyways so they called a consulting firm called Kroll”
Retail credit-card breach INVOLVES IP scanner
During the attackers’ renewed activity, the team observed them running an IP scanner and logging into multiple IP addresses.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“they ran an IP scanner and then hard-coded and were able to log into all these IPs”
Retail credit-card breach INVOLVES Network segmentation
The company’s flat network and lack of segmentation enabled the malware to spread widely; network-infrastructure changes were recommended afterward.
Explicit Confidence 98% · Courtney Dayter EP 15 Details
“changing their network infrastructure so it’s not so flat”
“every system could essentially reach every other system”
Retail credit-card breach INVOLVES Tiny POS
The newly uncovered card-scraping malware was described as a derivative of the Tiny POS malware family.
Explicit Confidence 96% · Matt Bromiley EP 15 Details
“it’s an unknown variant but it’s a derivative of Tiny POS”