The Academy USES Microsoft Teams
Microsoft Teams was used for messaging at the Academy.
Explicit Confidence 88% · Jack Rhysider EP 113 Details
“read messages on Teams and Slack without people knowing”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
The Academy USES Microsoft Teams
Microsoft Teams was used for messaging at the Academy.
Explicit Confidence 88% · Jack Rhysider EP 113 Details
“read messages on Teams and Slack without people knowing”
Adam Georgeson USES VPN
Adam used the Academy’s VPN to connect to its internal network from home.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“I successfully VPNs into the school’s network”
The Academy USES Office 365
The Academy used Office 365 to manage its network, users, and email.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“This is the tool the Academy used to manage the school’s network, like usernames and e-mail boxes and that sort of thing.”
Adam Georgeson USES Office 365
Adam used the Academy’s Office 365 administrator portal to access accounts and administrative functions.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“I was logged into the school’s admin portal on Office 365.”
Adam Georgeson USES IP scanning
Adam used an IP scanner to enumerate computers on the Academy’s network.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“uses an IP scanner to get a lay of the land”
The Academy USES SharePoint
The Academy used SharePoint, which later became unavailable during the attack.
Explicit Confidence 98% · Jack Rhysider EP 113 Details
“SharePoint was down, e-mails were down”
The Academy USES Active Directory
The Academy used Active Directory as part of its network administration.
Explicit Confidence 96% · Jack Rhysider EP 113 Details
“look at and configure the Active Directory settings”
Samba zero-day exploit AFFECTS Samba
The zero-day exploit targeted the Samba service running on the employer's demo website.
Explicit Confidence 98% · Jack Rhysider EP 114 Details
“They developed their own exploit and attacked HD’s employer’s website”
“there’s a really awful remote 0-day in Samba”
Computer Sciences Corporation ASSOCIATED_WITH Air Intelligence Agency
CSC was doing work for the Air Intelligence Agency, formerly referred to as AFIC.
Explicit Confidence 94% · HD Moore EP 114 Details
“they were doing work for – I think at the time it was called AFIC, or – it eventually became AIA.”
Metasploit ASSOCIATED_WITH Wassenaar Agreement
HD says Rapid7 lobbying helped separate Metasploit framework from the Wassenaar Agreement's US interpretation.
Explicit Confidence 94% · HD Moore EP 114 Details
“splitting Metasploit framework from the Wassenaar Agreement”
SAINTexploit ASSOCIATED_WITH Metasploit
HD describes SAINTexploit as having substantial similarities to Metasploit framework, including shellcode and exploit code.
Explicit Confidence 98% · HD Moore EP 114 Details
“Half this shell code is ours and half these exploits really look really like the code that we wrote.”
HD says he started Rumble after leaving Rapid7 to work on network discovery.
Explicit Confidence 98% · HD Moore EP 114 Details
“I started my own company about three and a half years ago doing network discovery stuff. So, Rumble”
Meterpreter DEVELOPED_BY Matthew Miller
HD identifies Matthew Miller, known as Skape, as the architect behind Meterpreter.
Explicit Confidence 99% · HD Moore EP 114 Details
“Meterpreter was the brainchild of Matthew Miller, Skape”
Rumble Network Discovery DEVELOPED_BY Rumble
Rumble Network Discovery is presented as the product created by the Rumble company.
Explicit Confidence 98% · HD Moore EP 114 Details
“the product Rumble Network Discovery can now find all your networks”
Kronos DEVELOPED_BY Marcus Hutchins
The episode says Marcus Hutchins developed malware that became known as Kronos.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“he developed malware which became known as Kronos”
Metasploit DEVELOPED_BY HD Moore
HD is described as deciding to make Metasploit to organize and share his exploits.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“that’s why HD Moore decided to make Metasploit.”
Butterfly botnet DEVELOPED_BY Iserdo
The episode says Iserdo created the Butterfly botnet.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“The Butterfly botnet was created by a guy named Iserdo”
Samba zero-day exploit DISCOVERED_BY HD Moore
HD captured the incoming traffic, carved out the exploit, and analyzed the unknown Samba vulnerability.
Explicit Confidence 98% · HD Moore EP 114 Details
“we were able to carve out the initial exploit”
“Did some analysis on it”
Samba zero-day exploit EXPLOITS Samba remote zero-day
The exploit was created for the previously unknown remote Samba vulnerability.
Derived Confidence 96% · Jack Rhysider EP 114 Details
“he realized this was a completely unknown vulnerability to everyone, which is called a zero-day exploit”
HD Moore MEMBER_OF Computer Sciences Corporation
HD says Computer Sciences Corporation gave him his first security-related job.
Explicit Confidence 98% · HD Moore EP 114 Details
“he set me up with a interview with Computer Sciences Corporation”
HD Moore MEMBER_OF Digital Defense
HD says he and the team left CSC and started the startup Digital Defense.
Explicit Confidence 99% · HD Moore EP 114 Details
“So, we took the whole team and started a startup. That was Digital Defense.”
Metasploit OPERATED_BY Rapid7
After Rapid7 acquired Metasploit, a Rapid7 team worked on it full time and commercialized a professional version while keeping the framework open source.
Explicit Direction flagged Confidence 97% · HD Moore EP 114 Details
“Even now, there’s a whole team at Rapid7 working on Metasploit full time.”
Meterpreter USES Remote desktop access over VNC
Meterpreter could load a VNC desktop-sharing service in memory and provide immediate remote graphical access.
Explicit Confidence 99% · HD Moore EP 114 Details
“we had a way to load the VNC desktop-sharing service in memory as part of the payload itself”
Metasploit USES Meterpreter
Meterpreter is presented as a payload integrated into Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“At some point, Metasploit got a new feature called Meterpreter.”
HD and colleagues used browser fuzzers to find large numbers of Internet Explorer and ActiveX vulnerabilities.
Explicit Confidence 99% · HD Moore EP 114 Details
“we put together some browser fuzzers”