Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Tinker Secor USES physical intrusion
Tinker physically entered the IT room after finding its door propped open and removed laptops for testing.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I walk in real quick and I see stacks and stacks of laptops.”
“I start taking armloads, like full handfuls of these laptops to my cubicle”
Tinker Secor USES password spraying
Tinker performed a targeted password spray against workstations using recovered usernames and passwords.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I do a very targeted spray with their username and their password against all of it.”
Tinker Secor USES exfiltration
Tinker lists exfiltration as a possible phase of his penetration-testing methodology.
Explicit Confidence 95% · Tinker Secor EP 36 Details
“exfiltration, and persistence may be in there if you need to”
Tinker Secor USES Hashcat
Tinker used Hashcat to try billions of password guesses against captured hashes.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“Then he runs a tool called Hashcat to cycle through billions of passwords”
Tinker Secor USES Responder
Tinker ran Responder to induce systems on the local subnet to disclose Net-NTLM authentication hashes.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“The next day he comes in, fires up Responder”
“I will run Responder twice a day”
Tinker Secor USES Ubuntu
Tinker says his personal hacking laptop used Ubuntu as its base image.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“loaded with Ubuntu as a base image”
Tinker Secor USES Reconnaissance
Tinker describes password, active, and environmental reconnaissance as part of his standard approach.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“Get in and do password reconnaissance, active reconnaissance”
Tinker Secor USES Metasploit
Tinker used Metasploit to listen for and manage the reverse-shell connection from the compromised finance computer.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“He pulls Metasploit up and waits and watches.”
Tinker Secor USES PowerShell
Tinker used PowerShell in a reverse-shell payload delivered to another workstation.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“He wrote an executable that will then call my PowerShell, reverse shell.”
Tinker Secor USES Wireshark
Tinker used Wireshark to sniff packets and identify hardware and host naming patterns.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“the first thing I did is run Wireshark”
“started trapping a lot of – sniffing a lot of the packets”
Tinker Secor USES Veil
Tinker says the PowerShell remote-shell payload was a tweaked version of Veil or a similar PowerShell tool.
Uncertain Confidence 90% · Tinker Secor EP 36 Details
“I think it was just a tweaked version of Veil or some sort of PowerShell, remote shell.”
Tinker Secor USES Kali Linux
Tinker brought a Kali image on USB and had Kali virtual machines on his rogue laptop.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“a Kali image burnt on a USB”
“loaded with Ubuntu as a base image with some Kali VMs”
Tinker Secor USES brute-force password cracking
Tinker used brute-force password cracking against captured authentication hashes.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“This is brute force password-cracking.”
Tinker Secor USES Citrix
Tinker targeted Citrix because he expected it to provide access to hosted internal applications or servers.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“One thing caught my eye though, in the single sign-on, was Citrix.”
wiper virus AFFECTS Microsoft Windows
The wiper virus targeted Windows machines and wiped the Windows Active Directory server in Las Vegas.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“targeting just Windows machines”
“the wiper virus hit the active directory server in Las Vegas and completely wiped it out”
Stuxnet ATTRIBUTED_TO United States
Jack states that Stuxnet was a US attack on Iranian soil.
Explicit Confidence 96% · Jack Rhysider EP 37 Details
“Stuxnet was a US attack on Iranian soil”
Moonlight Maze ATTRIBUTED_TO Russia
Jack describes Moonlight Maze as Russia hacking into a US Air Force base.
Explicit Confidence 97% · Jack Rhysider EP 37 Details
“an attack called Moonlight Maze which was Russia hacking into a US Air Force base”
Sony cyber-attack ATTRIBUTED_TO North Korea
James Clapper identifies a North Korean attack against Sony in November 2014.
Attributed Confidence 98% · James Clapper EP 37 Details
“and a North Korean attack against Sony in November”
Las Vegas Sands cyber-attack ATTRIBUTED_TO Iranian government
James Clapper attributed the attack against Las Vegas Sands to Iran; Jack presents this as an official attribution to the Iranian government or military, while noting the broader circumstances and motives were uncertain.
Attributed Confidence 97% · James Clapper EP 37 Details
“2014 saw for the first time destructive cyber-attacks carried out on [00:25:00] US soil by nation state entities marked first by the Iranian attack against the Las Vegas Sands Casino Corporation”
“James Clapper is saying that the people who did it was the Iranian government itself”
Las Vegas Sands cyber-attack COMPROMISES Las Vegas Sands
The cyber-attack compromised Las Vegas Sands' networks, servers, and data and caused extensive operational damage.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“The attack on Las Vegas Sands wiped out almost 75% of the company’s networks and servers”
Las Vegas Sands cyber-attack INVOLVES lateral movement
After compromising one server, the attackers attempted to move laterally and escalate privileges across the network.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“you now need to figure out how to laterally move or escalate your privileges”
Las Vegas Sands cyber-attack INVOLVES credential dumping
The attackers harvested usernames and clear-text passwords from the web development server using Mimikatz.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“they were able to see the usernames and passwords of web developers and IT admins for Sands Bethlehem”
Las Vegas Sands cyber-attack INVOLVES wiper virus
The attack involved a custom-written Visual Basic wiper code intended to destroy data and spread through the network.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“a wiper code with the goal of destruction”
“This wiper virus was on a mission to infect and spread to as many systems as it could and delete the data”
Las Vegas Sands cyber-attack INVOLVES two-factor authentication
The Sands security team enabled two-factor authentication for VPN users to prevent the password attack from succeeding.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They enabled two factor authentication for VPN users”
Las Vegas Sands cyber-attack INVOLVES Sands Bethlehem
The cyber-attack began with activity against the Sands Bethlehem network and its internet-facing systems.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“the IT team in the Sands [00:15:00] Bethlehem resort saw some worrying activity on their computer network”