Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Saudi Aramco cyber-attack (2012) ATTRIBUTED_TO Iran
Some security researchers believed the attack was retaliation from Iran for Stuxnet, but the episode presents this as a theory rather than a confirmed attribution.
Uncertain Confidence 78% · Jack Rhysider EP 30 Details
“some security researchers believe this was a retaliation from Iran because of the Stuxnet attack”
Chris Kubecka AUTHORED Hack the World with Osint
Chris Kubecka authored the book Hack the World with Osint.
Explicit Confidence 99% · Jack Rhysider EP 30 Details
“her newest one which should be out in a few days, is called Hack the World with Osint”
Chris Kubecka AUTHORED Down the Rabbit Hole, an Osint Journey
Chris Kubecka authored the book Down the Rabbit Hole, an Osint Journey.
Explicit Confidence 99% · Jack Rhysider EP 30 Details
“Her first one is called Down the Rabbit Hole, an Osint Journey”
Saudi Aramco cyber-attack (2012) COMPROMISES Saudi Aramco
The 2012 attack struck Saudi Aramco and gave the attackers administrative access to its network.
Explicit Confidence 99% · Jack Rhysider EP 30 Details
“Saudi Aramco. You may not ever have heard of Saudi Aramco before and neither did I until I started researching this story and that’s because they don’t sell to consumers. Instead they sell to manufacturers and distributors so what do they do? Saudi Aramco is one of the largest oil and natural gas producers in the world. It controls massive amounts of oil reserves. It drills it and ships it all over the world. Saudi Aramco may be the most profitable company in existence and produces 25% of the global oil. It’s not a publically trading company though, so we really don’t know how much it’s worth. Because Saudi Aramco is huge and operating globally, it has a lot of computers. There are pump stations, plants, shipping terminals, logistics centers, laboratories, research and development centers, and storage facilities. Let’s not forget the teams it takes to run it. There’s an HR department, IT department, marketing, truck drivers, mechanics, engineers, public relations, finance, drilling teams, and advisors. Add all that up and Saudi Aramco has over 50,000 employees. Imagine how many computers there are at a company that has 50,000 employees. Not only do a lot of them have individual computers to work on but there’s a lot of servers; domain controllers, e-mail servers, SharePoint systems, files servers, and more. In 2012 Saudi Aramco had over 40,000 computers in their network worldwide. Now I say 2012 because that was when the most profitable company in the world was hit with the most devastating cyber-attack any company has ever seen.”
Saudi Aramco cyber-attack (2012) INITIAL_ACCESS_VIA phishing
The attackers likely gained initial access through a phishing e-mail.
Uncertain Confidence 94% · Jack Rhysider EP 30 Details
“The attackers likely got in through a phishing e-mail.”
Saudi Aramco cyber-attack (2012) INITIAL_ACCESS_VIA exploit of unpatched Microsoft Word or Adobe Acrobat vulnerabilities
The suspected phishing attachment could exploit known vulnerabilities in unpatched Microsoft Word or Adobe Acrobat installations.
Derived Confidence 90% · Jack Rhysider EP 30 Details
“the file would attempt to exploit one of these known vulnerabilities to gain access to the computer”
Saudi Aramco cyber-attack (2012) INVOLVES default usernames and passwords
Attackers briefly regained access because some perimeter security appliances retained default usernames and passwords.
Explicit Confidence 98% · Chris Kubecka EP 30 Details
“had left some of the stuff with default usernames and passwords on the network and security appliances”
Saudi Aramco cyber-attack (2012) INVOLVES lateral movement
After gaining access, the attackers moved around the network with ease.
Explicit Confidence 96% · Jack Rhysider EP 30 Details
“When the attackers got into Saudi Aramco, they were able to move around with ease.”
Saudi Aramco cyber-attack (2012) INVOLVES Domain controller
The attackers focused on domain controllers and obtained administrative privileges on them.
Explicit Confidence 98% · Jack Rhysider EP 30 Details
“The attackers focused on these domain controllers”
“the attackers had access to Saudi Aramco’s network and had administrative privileges to the domain controllers”
Saudi Aramco cyber-attack (2012) INVOLVES Shamoon
The attack involved the Shamoon wiper virus.
Explicit Confidence 99% · Jack Rhysider EP 30 Details
“This wiper virus would be known as the Shamoon virus.”
Saudi Aramco cyber-attack (2012) INVOLVES flat network
Saudi Aramco's flat network allowed access from one part of the network to other parts.
Explicit Confidence 98% · Jack Rhysider EP 30 Details
“because their network was flat, once you got into any part of the network you could get to anything, anywhere”
Saudi Aramco cyber-attack (2012) INVOLVES distributed denial-of-service attack
During the later attacks, the attackers launched a massive DDoS attack against Saudi Aramco.
Explicit Confidence 98% · Chris Kubecka EP 30 Details
“the attackers launched a massive DDoS attack against them”
Chris Kubecka MEMBER_OF Saudi Aramco
Chris Kubecka accepted a role with Saudi Aramco after it called and hired her to ramp up its security.
Explicit Confidence 94% · Jack Rhysider EP 30 Details
“Chris took the job and got right to work building her team.”
Security researchers linked Shamoon's Saudi Aramco attack as possible retaliation for Stuxnet; this relationship is presented as uncertain.
Uncertain Confidence 75% · Jack Rhysider EP 30 Details
“this was a retaliation from Iran because of the Stuxnet attack that hit their nuclear facilities”
Saudi Aramco cyber-attack (2012) SAME_AS Shamoon Attacks 1
The episode explicitly identifies the Saudi Aramco incident as Shamoon Attacks 1.
Explicit Confidence 99% · Jack Rhysider EP 30 Details
“This incident with Saudi Aramco is known as the Shamoon Attacks 1.”
Shamoon Attacks 2 and 3 TARGETS Saudi Aramco
Shamoon Attacks 2 and 3 were described as ongoing against Saudi Aramco.
Explicit Confidence 97% · Chris Kubecka EP 30 Details
“There’s now Shamoon Attacks 2 and 3 that are still ongoing against Saudi Aramco”
Shamoon Attacks 2 and 3 TARGETS Saudi Arabia
Shamoon Attacks 2 and 3 were described as ongoing attacks against Saudi Arabia, especially its critical infrastructure and airports.
Explicit Confidence 97% · Chris Kubecka EP 30 Details
“There’s now Shamoon Attacks 2 and 3 that are still ongoing against Saudi Aramco and Saudi Arabia, especially hitting Saudi Arabian critical infrastructures”
Shamoon TARGETS Saudi Aramco
Shamoon targeted Saudi Aramco's computer systems, wiping approximately 35,000 of them.
Explicit Confidence 98% · Jack Rhysider EP 30 Details
“35,000 computers had become completely unusable all at the same time.”
Shamoon USES logic bomb
Shamoon was described as a logic bomb set to trigger at a particular time and day.
Explicit Confidence 99% · Chris Kubecka EP 30 Details
“It was a logic bomb set to go off at a particular time on a particular day.”
Universal Plug and Play AFFECTS Chromecast
UPnP was described as a reason Chromecasts could be exposed to the internet.
Explicit Confidence 99% · Jack Rhysider EP 31 Details
“These Chromecasts were also exposed to the internet because of UPnP.”
Printer Exploitation Toolkit AFFECTS network printer
PRET can connect to network printers and perform actions including printing, listing files, and resetting the printer.
Explicit Confidence 98% · Hacker Giraffe EP 31 Details
“this tool can connect and you can do all kinds of things like list the files, reset the printer”
Universal Plug and Play AFFECTS Google Home Device
The episode places Google Home devices among devices whose ports could be exposed through router configuration involving UPnP.
Derived Confidence 90% · Jack Rhysider EP 31 Details
“Apparently Google Home Devices were also opening up this port and they had an API, too.”
internet-exposed printer AFFECTS network printer
Internet-exposed printers can receive print commands from anywhere; port 9100 had no authentication or encryption in the described setup.
Explicit Confidence 99% · Jack Rhysider EP 31 Details
“There’s no authentication or encryption; you simply send your PDF file to the port with the command to print”
Universal Plug and Play AFFECTS network printer
UPnP can cause routers to open printer ports to the public internet, exposing network printers.
Explicit Confidence 98% · Jack Rhysider EP 31 Details
“networked devices like printers can reach out to the router and request that port 9100 be opened”
Hacker Giraffe ASSOCIATED_WITH User
Hacker Giraffe collaborated with User on the later printer and Chromecast operations.
Explicit Confidence 98% · Hacker Giraffe EP 31 Details
“We came together after seeing a few articles came out”