Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Greg Linares USES hex editor
Greg used a hex editor to modify Office document data at a low level while testing Word and other Office applications.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I could look at Office — hex editors in Office”
“he opened up a Word doc, not in Microsoft, though; in a hex editor where you can manipulate the ones and zeros directly in the file”
Proxmark USES RFID badge cloning
The Proxmark system was used for RFID badge cloning during the physical penetration test.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I’m gonna put a RFID cloner next to their badge reader”
Greg Linares USES Microsoft Excel
Greg used Excel as the school's grade system to deploy his macro virus and alter grades and attendance.
Explicit Confidence 99% · Greg Linares EP 160 Details
“the entire grade system was in Excel, and I made a macro virus”
Greg Linares USES boot root
After entering the server room, Greg used boot-root techniques to gain elevated access to the machines.
Explicit Confidence 99% · Greg Linares EP 160 Details
“Went to the server room, and from there, boot-rooted all the machines.”
Greg Linares USES fuzzing
Greg manually fuzzed Microsoft Word and later used fuzzing to search Office for crashes and vulnerabilities.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I went in there and started manually fuzzing Word at the time.”
Greg Linares USES Microsoft Word
Greg used malicious Microsoft Word documents and macros to compromise computers when victims opened them.
Explicit Confidence 97% · Jack Rhysider EP 160 Details
“he would send the Word doc to someone, trick them into opening it”
Greg Linares USES ARP poisoning
During a red-team engagement, Greg used ARP poisoning to intercept a plaintext credential.
Explicit Confidence 99% · Greg Linares EP 160 Details
“let’s try one more — let’s do some ARP poisoning”
Greg Linares USES Proxmark
Greg used a Proxmark system to capture an employee badge identifier and clone access badges.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I have a Proxmark system; I keep pulling it and all of a sudden I notice her ID matches up”
boot root USES Sticky Keys
The described boot-root method replaced Sticky Keys with a command shell and used the login-screen shortcut to obtain elevated privileges.
Explicit Confidence 99% · Greg Linares EP 160 Details
“Sticky Keys would be a ideal favorite. So, you replace Sticky Keys with command shell”
Greg Linares USES man-in-the-middle attack
Greg used man-in-the-middle attacks to steal credentials during a venture-capital-company penetration test.
Explicit Confidence 99% · Greg Linares EP 160 Details
“There, I start doing man-in-the-middle attacks”
Greg Linares USES Visual Basic
Jack describes Greg's specialty as using Visual Basic to create malicious macros.
Explicit Confidence 97% · Jack Rhysider EP 160 Details
“His specialty was using Visual Basic to code malicious macros”
Greg Linares USES DHCP spoofing
Greg identifies DHCP spoofing as one of the layer-two attack techniques he used or recommended during red-team work.
Explicit Confidence 94% · Greg Linares EP 160 Details
“your ARP poisoning, your DHCP spoofing, all of those”
ANT catalog ASSOCIATED_WITH National Security Agency
Jack describes the ANT catalog as leaked NSA documents; MG discusses it as the NSA ANT catalog.
Explicit Confidence 99% · Jack Rhysider EP 161 Details
“This was some leaked NSA documents which showed different types of devices and technology”
MG says he was interested in Bitcoin as it was taking off because of its decentralizing effect on power.
Explicit Confidence 91% · MG EP 161 Details
“I was also into that. I really like it at the time and the concept of it to just changing and decentralizing power.”
ANT catalog ASSOCIATED_WITH Snowden leaks
MG says the ANT catalog was commonly misattributed to Snowden and came from another leaker around that time; this is an association with, not an identity claim about, the Snowden leaks.
Uncertain Confidence 86% · MG EP 161 Details
“this was commonly mis-attributed to Snowden. I believe officially it’s just another leaker around that time”
Cottonmouth CONTAINS ANT catalog
MG says the ANT catalog included a malicious cable called Cottonmouth.
Explicit Confidence 99% · MG EP 161 Details
“one of the things in there was a malicious cable called the Cottonmouth”
Mr. Self Destruct DEVELOPED_BY MG
MG says he spent time making the exploding thumb drive called Mr. Self Destruct.
Explicit Confidence 99% · MG EP 161 Details
“I kinda spent a while making exactly that”
“I called this Mr. Self Destruct”
Wi-Fi Pineapple DEVELOPED_BY Darren Kitchen
Jack says Darren Kitchen was making the Wi-Fi Pineapple.
Explicit Confidence 91% · Jack Rhysider EP 161 Details
“Darren Kitchen was already making malicious devices like the Rubber Ducky and Wi-Fi Pineapple”
USB Rubber Ducky DEVELOPED_BY Darren Kitchen
Jack says Darren Kitchen was making the Rubber Ducky as one of Hak5's malicious devices.
Explicit Confidence 91% · Jack Rhysider EP 161 Details
“Darren Kitchen was already making malicious devices like the Rubber Ducky”
O.MG cable DEVELOPED_BY MG
MG describes designing and building the O.MG cable, including its PCB and features.
Explicit Confidence 99% · Jack Rhysider EP 161 Details
“So, he came up with a name for this cable, the O.MG cable”
“That took off. Then Defcon was coming up, August 2019”
MG MEMBER_OF Defense Distributed
MG says he volunteered with Defense Distributed rather than describing himself as an employee.
Explicit Confidence 94% · Jack Rhysider EP 161 Details
“So, you worked at Defense Distributed? MG: Let’s just say volunteered.”
Team Fortress PART_OF Quake
MG describes Team Fortress as a modification to Quake.
Explicit Confidence 98% · MG EP 161 Details
“Team Fortress, kind of a modification to Quake itself”
O.MG cable USES Keystroke injection
The O.MG cable can emulate a keyboard and run keystroke-injection payloads.
Explicit Confidence 99% · MG EP 161 Details
“We already talked about keystroke injection payloads, emulating a keyboard”
Russian GRU USES Wi-Fi Pineapple
MG, recounting a Hak5 example, says Russian GRU personnel used a Wi-Fi Pineapple during an operation in Brussels; the account is attributed to Hak5's example.
Attributed Confidence 95% · MG EP 161 Details
“Hak5 actually had a semi-recent example that is super applicable here with their Wi-Fi Pineapple and the Russian GRU”
“the Wi-Fi Pineapple was being used in the trunk of a car”
O.MG cable USES air-gapped computer access
MG describes using the O.MG cable to gain access to an air-gapped evidence computer.
Explicit Confidence 99% · MG EP 161 Details
“Of course, the goal was get — to gain access to that evidence computer which was air-gapped”