Barnaby Jack USES firmware modification
Barnaby loaded custom firmware to control ATM functions.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“He was able to load a custom firmware onto a USB flash drive.”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Barnaby Jack USES firmware modification
Barnaby loaded custom firmware to control ATM functions.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“He was able to load a custom firmware onto a USB flash drive.”
Carbanak USES money mule
The attackers created accounts and debit cards for money mules to withdraw stolen funds.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“They created all these accounts for their money mules.”
Barnaby Jack USES ATM jackpotting
Barnaby demonstrated dispensing all cash from an ATM's cassettes, which he called jackpotting.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“The most astonishing thing he could do was dispense all of the cash from all the cassettes which he called jackpotting.”
Barnaby Jack USES ATM remote access
Barnaby remotely controlled an ATM after bypassing its remote-login authentication and replacing its firmware.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Barnaby could now remote-control an ATM with his own custom firmware”
Toucan USES ATM jackpotting
Toucan provided a menu that allowed an operator to select cassettes and dispense their money.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“you basically get into the god-mode menu because you can choose from which cassettes you want the money”
Carbanak USES Metasploit
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
Jornt says Carbanak was based on malware called Carber.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“it was based on malware called Carber”
Tinker Secor ASSOCIATED_WITH penetration testing
Tinker identifies himself as a penetration tester who tests clients' security by hacking computers and breaking into buildings.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I am a penetration tester or Red Teamer”
Tinker Secor ASSOCIATED_WITH Red Team
Tinker says he is a Red Teamer depending on the engagement.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I am a penetration tester or Red Teamer”
Jack Rhysider AUTHORED Darknet Diaries
Jack says the show is made by him.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“This show is made by me, the President of D-Corp, Jack Rhysider.”
Tinker Secor EXPLOITS unquoted service path
Tinker found an unquoted service path and attempted to use it to execute a malicious program with system privileges.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“the one that worked was unquoted service path”
“it will run your program as in this sense, system”
Tinker Secor MEMBER_OF United States Marine Corps
Tinker says he used to be a Sergeant in the Marine Corps.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I used to be a Sergeant in the Marine Corps”
Tinker Secor USES privilege escalation
Tinker includes privilege escalation in his standard approach and attempts to escalate to system level.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“escalation privileges, actions and target”
Tinker Secor USES Active Directory
Tinker queried Active Directory and later extracted users, groups, host names, and other domain information.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I logged into SYSVOL on the main controller, pulled all of Active Directory.”
Tinker Secor USES Meterpreter
Tinker's payload opened multiple Meterpreter sessions on the finance computer.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“Then I see Meterpreter Session Two, Session Three, Session – it popped eight shells.”
Tinker Secor USES single sign-on
Tinker accessed the company's single sign-on environment using recovered credentials and investigated its applications.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“Get into their single sign-on, their internet.”
Tinker Secor USES SYSVOL
Tinker used a stolen user's credentials to access SYSVOL and retrieve domain scripts and configuration information.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I logged into SYSVOL on the main controller”
“You can mount SYSVOL and get all the group post preference.”
Tinker Secor USES social engineering
Tinker impersonated IT over the phone to persuade an employee to disclose a Citrix MFA code.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I lie to them and then I say hey, I’m somebody else from IT”
“She read it to me. I typed it in within the minute”
Tinker Secor USES Nvidia GTX 1080 Ti
Tinker's password-cracking rig consisted of eight Nvidia GTX 1080 Ti cards.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“It was eight Nvidia GTX 1080 TIs mounted in a 4U Rack server.”
Tinker Secor USES persistence
Tinker lists persistence as a possible phase of his methodology and later says he obtained persistence on a finance computer.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I get persistence”
Tinker Secor USES lateral movement
Tinker includes lateral movement in his standard penetration-testing approach and later says he needs to move onto servers.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“initial breach, lateral movement, pivot”
Tinker Secor USES pass the hash
Tinker attempted to authenticate to other computers using the recovered local administrator hash.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“First thing I try to do is pass the hash which just uses the actual hash as a password.”
Tinker Secor USES Net-NTLMv2
Tinker collected Net-NTLMv2 hashes from Responder activity.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I pulled down these hashes. Again, they’re Net-NTLMv2 hashes.”
Tinker Secor USES GPU password-cracking rig
Tinker used an offsite GPU password-cracking rig to process hashes collected with Responder.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“He loads these up into his GPU password-cracking rig”
Tinker Secor USES reverse shell
Tinker deployed a PowerShell reverse shell to obtain remote access to a finance workstation.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“my PowerShell, reverse shell”
“I’ve got a little thumb drive with my malware on it”