Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Daniel Kelley USES MITRE CVE program
Daniel reported vulnerabilities through MITRE's CVE program and sought publication of CVE identifiers after vendors patched the issues.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“One place he liked reporting bugs to was MITRE’s CVE program”
Daniel Kelley USES Skype Resolver
Daniel used the Skype Resolver to obtain another player's IP address before DDoSing him.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“So, I had a booter and Skype Resolver, and I decided to test this theory”
Daniel Kelley USES VPN
Daniel used a VPN for another extortion operation and reused its Bitcoin address in the TalkTalk case, allowing investigators to link the offenses.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I had hacked and blackmailed another company without using Tor; I only used a VPN”
Skype Resolver USES Skype
The Skype Resolver used a Skype username and attempted to call the user to obtain their IP address.
Explicit Confidence 98% · Jack Rhysider EP 117 Details
“they created a little tool called the Skype Resolver, and with this little tool, all you had to do is enter someone’s Skype username”
Daniel Kelley USES responsible disclosure
Daniel reports that he spent two years responsibly disclosing vulnerabilities rather than exploiting or extorting companies.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I started engaging in responsible disclosure”
Daniel Kelley USES Google dorking
Daniel learned and used Google dorking to find potentially vulnerable websites.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“This is where he learned about Google dorking”
Gmail cookie-validation vulnerability AFFECTS Gmail
The cookie-validation vulnerability affected Gmail’s password-recovery process.
Explicit Confidence 99% · Jack Rhysider EP 118 Details
“One day, he found a bug in Gmail which let him reset anyone’s password”
GMX session manipulation vulnerability AFFECTS GMX
The session-manipulation vulnerability affected GMX’s account-reset process.
Explicit Confidence 99% · Jack Rhysider EP 118 Details
“This was a pretty serious vulnerability on GMX”
Verizon account-number disclosure vulnerability AFFECTS Verizon
The account-number disclosure vulnerability affected Verizon’s bill-payment website.
Explicit Confidence 99% · Jack Rhysider EP 118 Details
“Joseph found a page on Verizon’s website which lets you put in someone’s phone number to pay their bill”
Augur ASSOCIATED_WITH Ethereum
Joseph describes Augur as an Ethereum-based altcoin and an ERC-20 token on the Ethereum blockchain.
Explicit Confidence 98% · Joseph Harris EP 118 Details
“Augur, which was the first ERC-20 token to be featured on the Ethereum blockchain”
Joseph Harris ASSOCIATED_WITH Lizard Squad
Joseph says he knew people in Lizard Squad and was contacted by one of its members for help accessing accounts.
Explicit Confidence 94% · Joseph Harris EP 118 Details
“I knew some people that I’m not sure if you’ve heard of them; Lizard Squad”
Joseph Harris EXPLOITS Verizon account-number disclosure vulnerability
Joseph used a Verizon website flaw that disclosed account numbers to obtain the information needed to take over accounts.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“I find a JavaScript variable that has the account number just completely disclosed right there”
Joseph Harris EXPLOITS Gmail cookie-validation vulnerability
Joseph used fake cookies to make Gmail believe he had previously logged into a victim’s account, enabling password resets.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“I was able to get it so it would appear that way for any account”
Joseph Harris EXPLOITS GMX session manipulation vulnerability
Joseph used the GMX session-manipulation vulnerability to take over GMX accounts.
Explicit Confidence 99% · Jack Rhysider EP 118 Details
“he’d use this vulnerability, get into that person’s e-mail account”
Jack Rhysider REFERENCES Episode 112: Dirty Coms
Jack recommends Episode 112, “Dirty Coms,” as background on SIM-swapping.
Explicit Confidence 99% · Jack Rhysider EP 118 Details
“I did Episode 112. It’s called Dirty Coms”
Joseph Harris TARGETS Crowd Machine
Joseph shifted from targeting individual crypto holders to targeting Crowd Machine, a company holding cryptocurrency.
Explicit Confidence 98% · Jack Rhysider EP 118 Details
“Instead of targeting people with crypto, why not target companies that have crypto?”
Joseph Harris USES social engineering
Joseph says he began by socially engineering email providers and account owners.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“I started kind of as a social engineer”
Joseph Harris USES Monero
Joseph used Monero to launder stolen cryptocurrency and obscure its origin.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“I’d change the crypto to Monero”
Joseph Harris USES SIM swapping
Joseph learned and used SIM-swapping to take over phones and reset email passwords.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“I started dabbling with it”
“I’m getting a text directly to that phone in my hand”
Joseph Harris USES Google Drive
Joseph accessed Google Drive accounts to search for cryptocurrency wallet backups, seed phrases, and private keys.
Explicit Confidence 98% · Jack Rhysider EP 118 Details
“he would find ways into this and start looking around for interesting stuff there”
Joseph Harris USES LocalBitcoins
Joseph used LocalBitcoins to exchange stolen Bitcoin for PayPal funds.
Explicit Confidence 99% · Jack Rhysider EP 118 Details
“The way he would get the Bitcoin into his PayPal wallet was using LocalBitcoins”
Joseph Harris USES social engineering
Joseph used victims’ names and addresses to persuade email providers to reset passwords.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“all you need to know is someone’s name and address and you can completely take over their AOL account”
Joseph Harris USES Account takeover
Joseph took over victims’ email and gaming accounts in order to sell them.
Explicit Confidence 98% · Joseph Harris EP 118 Details
“take the accounts and then sell them for money”
Joseph Harris USES MetaMask
Joseph used MetaMask to load a recovered passphrase and access a Crowd Machine wallet.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“I put that new numeric passphrase in MetaMask, it loads up the wallet”
Joseph Harris USES Credential stuffing and password mutation
Joseph searched breach data for passwords and tried common variants and site-specific mutations.
Explicit Confidence 99% · Joseph Harris EP 118 Details
“I’m copying these passwords, I’m trying them with variants”