Renegade Legion USES War dialing
Joe describes the group’s earlier exploratory activity as war dialing.
Explicit Confidence 91% · Joe Grand EP 155 Details
“The earlier days, there was a lot of this curious exploration because we would war dial.”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Renegade Legion USES War dialing
Joe describes the group’s earlier exploratory activity as war dialing.
Explicit Confidence 91% · Joe Grand EP 155 Details
“The earlier days, there was a lot of this curious exploration because we would war dial.”
Besa Mafia ASSOCIATED_WITH darknet markets
Besa Mafia is presented as functioning like a darknet market, with registration, escrow, messaging, and orders.
Explicit Confidence 96% · Chris Monteiro EP 156 Details
“It was just like a darknet market like Silk Road or something like that.”
Besa Mafia ASSOCIATED_WITH Romania
The episode links Besa Mafia's operators or affiliates to Romania, but does not establish that Yura himself is Romanian.
Uncertain Confidence 82% · Chris Monteiro EP 156 Details
“There were a series of arrests in Romania which — of the site operators or at least people affiliated with them.”
“continues to enrich Romanian scammers”
Carl Miller AUTHORED Kill List
Jack says that Carl made the Kill List podcast, which documents the investigation.
Explicit Confidence 99% · Jack Rhysider EP 156 Details
“Kill List is an amazing podcast that Carl made”
Richard Linklater AUTHORED Hit Man
Jack identifies Hit Man as a movie by Richard Linklater.
Explicit Confidence 99% · Jack Rhysider EP 156 Details
“the movie Hit Man by Richard Linklater”
insecure direct object reference DISCOVERED_BY Chris Monteiro
Chris discovered the access-control flaw while inspecting Besa Mafia message URLs.
Derived Confidence 98% · Chris Monteiro EP 156 Details
“I looked at my order for taking out Bob the Builder, and I looked at the address bar, and I saw that there was an ID in the address bar.”
Chris Monteiro EXPLOITS insecure direct object reference
Chris exploited an insecure direct object reference by changing an object identifier and retrieving other users' private messages.
Derived Confidence 99% · Jack Rhysider EP 156 Details
“One user should never be able to access another user’s private data such as private messages like this.”
“he just changed one number in the URL.”
Besa Mafia OPERATED_BY Yura
Jack identifies Yura as the administrator of Besa Mafia.
Explicit Confidence 99% · Jack Rhysider EP 156 Details
“The administrator of Besa Mafia — his name is Yura”
Chris Monteiro USES URL parameter tampering
Chris changed message identifiers in the URL to access other users' messages.
Explicit Confidence 99% · Chris Monteiro EP 156 Details
“I wonder if I change the message ID to something else; change it to 122. I got someone else’s messages.”
Chris Monteiro USES cron job
Chris used a cron job to pull down and process the site's administration data.
Explicit Confidence 99% · Chris Monteiro EP 156 Details
“I basically have a small cron job. I’m pulling them down fully as is.”
Chris Monteiro USES Besa Mafia
Chris registered on Besa Mafia, placed a test order, and investigated the site's functionality.
Explicit Confidence 99% · Chris Monteiro EP 156 Details
“I will register on the website and see how it works.”
Ron Ilg USES Besa Mafia
Ron Ilg paid Besa Mafia and used the site to arrange a multi-step plan involving his wife and another woman.
Explicit Confidence 98% · Chris Monteiro EP 156 Details
“he’s paying something upward of $50,000 for this”
“The guy had literally already loaded in all the money for a whole series of things that had to happen to Jennifer”
Chris Monteiro USES web scraping
Chris scraped kill orders from the site, including in near-real time.
Explicit Confidence 98% · Carl Miller EP 156 Details
“He’s beginning to scrape these kill orders”
Stephen Allwine USES Bitcoin
Investigators found that Stephen's Bitcoin wallet sent the payment to the hitman-for-hire website.
Explicit Confidence 99% · Jack Rhysider EP 156 Details
“his Bitcoin wallet was, in fact, the one that sent the money to the website”
Stephen Allwine USES Besa Mafia
Stephen Allwine used Besa Mafia to arrange and pay for a hit against Amy Allwine.
Derived Confidence 96% · Jack Rhysider EP 156 Details
“it was her husband who paid to have her killed”
“someone has paid them $12,000 to have you killed”
Defcon financial-data exfiltration ASSOCIATED_WITH Russia
The incident was associated with Russia because the FTP server connection and its IP address were identified as being in Russia; the episode does not establish who operated the server.
Uncertain Confidence 93% · Grifter EP 157 Details
“That connection to an FTP server in Russia — the IP address was also geolocated to Russia”
Chris Hurley AUTHORED Aggressive Network Self-Defense
Chris Hurley is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Grifter AUTHORED Aggressive Network Self-Defense
Grifter says he co-authored Aggressive Network Self-Defense with Dan Kaminsky, Bruce Potter, Pyro, and Chris Hurley, publishing it under the name Neil Wyler, AKA Grifter.
Explicit Confidence 99% · Grifter EP 157 Details
“then we put out a book. But that was the thing about putting out a book, was I was like, am I really just gonna put Grifter on the cover of this thing? I was like, I cannot publish a book and not put my name on it. For me, personally, it was like, I want to see it on the shelf in a library and be like, that one’s mine. So, I made the decision that I was gonna put on there Neil Wyler, AKA Grifter”
Pyro AUTHORED Aggressive Network Self-Defense
Pyro is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Dan Kaminsky AUTHORED Aggressive Network Self-Defense
Dan Kaminsky is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“it was like Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Bruce Potter AUTHORED Aggressive Network Self-Defense
Bruce Potter is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Defcon Groups DEVELOPED_BY Grifter
Grifter says he came up with the idea for Defcon Groups, then worked with Dark Tangent and Russ Rogers to establish its structure and initial chapters.
Explicit Confidence 99% · Grifter EP 157 Details
“I came up with the idea for Defcon Groups”
Grifter EXPLOITS elevator card-reader vulnerability
Grifter says he found an exposed pinout under an elevator card reader, shorted the pins with his thumb, and was then able to select different floors.
Explicit Confidence 99% · Grifter EP 157 Details
“underneath it was — there was an open pin out. But I was like, oh, cool, we could probably connect to this and get to any floor we want. I’m like, that’s wild. Then I ran my thumb across the pins, and it shorted out and the light blinked green, and I could tap any floor”
Defcon financial-data exfiltration INVOLVES FTP
The financial-data exfiltration incident involved recurring FTP traffic to a host in a .ru domain.
Explicit Confidence 99% · Grifter EP 157 Details
“We look and it’s FTP traffic going to a host name, not even an IP address but a host name that ends in .ru”
Defcon financial-data exfiltration INVOLVES Data exfiltration
The incident involved nightly transmission of a zip file containing the organization’s financial transactions and trades.
Explicit Confidence 99% · Grifter EP 157 Details
“that is every financial transaction and trade that we’ve made in the last twenty-four hours”