ASUSGATE INVOLVES anonymous FTP access
The incident involved anonymous FTP servers on vulnerable ASUS routers.
Explicit Confidence 99% · Jack Rhysider EP 5 Details
“found just over ten thousand IPs that were running the anonymous FTP server”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
ASUSGATE INVOLVES anonymous FTP access
The incident involved anonymous FTP servers on vulnerable ASUS routers.
Explicit Confidence 99% · Jack Rhysider EP 5 Details
“found just over ten thousand IPs that were running the anonymous FTP server”
ASUSGATE involved the ASUS router model that Kyle tested and related ASUS router models.
Derived Confidence 95% · Jack Rhysider EP 5 Details
“The vulnerabilities he found were present on ten different Asus router models”
Kyle Lovett MEMBER_OF Veracode
Kyle Lovett says he is a Senior Penetration Tester with Veracode.
Explicit Confidence 99% · Kyle Lovett EP 5 Details
“I am a Senior Penetration Tester right now with Veracode.”
US-CERT PART_OF U.S. Department of Homeland Security
US-CERT is described as a branch of the U.S. Department of Homeland Security.
Explicit Confidence 99% · Jack Rhysider EP 5 Details
“The Department of Homeland Security has a branch called The US Computer Emergency Readiness Team”
Kyle Lovett USES partial disclosure
Kyle used partial disclosure to pressure ASUS to address the vulnerability.
Explicit Confidence 99% · Kyle Lovett EP 5 Details
“I decided to go with the partial disclosure online”
Kyle Lovett USES penetration testing
Kyle used his penetration-testing skills while examining the router.
Explicit Confidence 98% · Jack Rhysider EP 5 Details
“Kyle used his penetration testing skills to see if he could find something else”
Kyle Lovett USES Shodan
Kyle used Shodan to estimate how many vulnerable routers were exposed on the internet.
Explicit Confidence 99% · Jack Rhysider EP 5 Details
“Kyle used a website called Shodan to try to understand the size of this problem”
Kyle Lovett USES fuzzing
Kyle says he began looking and fuzzing the router.
Explicit Confidence 99% · Kyle Lovett EP 5 Details
“I just started looking and fuzzing”
Breakthrough ASSOCIATED_WITH National Geographic
Breakthrough is described as a National Geographic show or episode that filmed Jason doing some of the security-testing activities.
Explicit Confidence 97% · Jack Rhysider EP 6 Details
“there’s even an episode of National Geographic that filmed him doing some of the stuff”
Beirut ASSOCIATED_WITH Lebanon
Jack identifies Beirut as the capital city of Lebanon.
Explicit Confidence 99% · Jack Rhysider EP 6 Details
“Beirut is the capital city of Lebanon”
Darknet Diaries REFERENCES Breakthrough
The episode references the Breakthrough program as documenting Jason's bank break-in.
Explicit Confidence 99% · Jack Rhysider EP 6 Details
“that break-in he did was documented by National Geographic for an episode of a show called Breakthrough”
Jason E. Street USES Proxmark3
Jason says his mission equipment may include a Proxmark3 tool.
Explicit Confidence 98% · Jason E. Street EP 6 Details
“it may be a Proxmark3 tool”
Jason E. Street USES Unauthorized physical access
Jason physically enters and moves through areas where he should not have been during the engagement.
Explicit Confidence 99% · Jack Rhysider EP 6 Details
“he did cross the line for where he shouldn’t have been physically”
Jason E. Street USES User ID and password
Jason obtains and uses a user ID and password as objectives in the bank security engagement.
Explicit Confidence 93% · Jason E. Street EP 6 Details
“I will get us a user ID, a password, a smart card, a computer, and network access.”
Jason E. Street USES Physical security testing
Jason is hired to test the physical security of company locations.
Explicit Confidence 99% · Jack Rhysider EP 6 Details
“He’s hired by companies to test the physical security of a place.”
Jason E. Street USES Pretexting
Jason uses fabricated auditor, Microsoft, and headquarters-related stories as pretexts to obtain access.
Explicit Confidence 99% · Jason E. Street EP 6 Details
“I could have done all these pretexts”
Jason E. Street USES USB Rubber Ducky
Jason carries and plugs a USB Rubber Ducky into employee and teller computers to test whether they can be controlled.
Explicit Confidence 99% · Jason E. Street EP 6 Details
“Usually it’s a pwn plug, it’s a USB rubber ducky”
“The first thing he does is plug a rubber ducky into her machine.”
Jason E. Street USES Security Awareness Engagement
Jason performs what he calls security awareness engagements to test whether employees and physical security controls can stop an unauthorized person.
Explicit Confidence 99% · Jack Rhysider EP 6 Details
“One of his favorite things to do is what he calls Security Awareness Engagement.”
Jason E. Street USES social engineering
Jason uses social manipulation and plausible explanations to gain access to offices, teller areas, and computers during engagements.
Derived Confidence 97% · Jason E. Street EP 6 Details
“It’s all psychological.”
“I tell her that yeah, I’m here with the auditor.”
USB Rubber Ducky USES Keystroke injection
The USB Rubber Ducky identifies itself as a keyboard and sends prerecorded keyboard commands to the computer.
Explicit Confidence 99% · Jack Rhysider EP 6 Details
“it tells the computer that it’s a keyboard and rubber ducky then proceeds to send pre-recorded keyboard commands”
Jason E. Street USES Pwn Plug
Jason says his vest of doom usually contains a Pwn Plug for demonstrating potential damage.
Explicit Confidence 98% · Jason E. Street EP 6 Details
“Usually it’s a pwn plug”
Jason E. Street USES Dropboxes
Jason says his vest may contain Dropboxes as part of the equipment used to demonstrate potential damage.
Explicit Confidence 98% · Jason E. Street EP 6 Details
“a couple Dropboxes, just some malicious things to show them the damage that I could do”
Jason E. Street USES Smart card
Jason obtains a smart card from a supervisor during the engagement as one of the requested objectives.
Explicit Confidence 94% · Jason E. Street EP 6 Details
“While I was there I got the user ID, the password, and the smart card from one of the main supervisors.”
Server-side validation failure AFFECTS Shadowbane
Shadowbane is described as having no server-side validation for packets sent by the player.
Explicit Confidence 99% · Jack Rhysider EP 7 Details
“He found that there was no server side validation for any packet he sent”
Manfred ASSOCIATED_WITH Ultima Online
Manfred describes playing and player-killing in Ultima Online under the name Phuckchop.
Explicit Confidence 99% · Manfred EP 7 Details
“Back in the early days of Ultima Online I did a lot of PKing and griefing”