Natalie Silvanovich MEMBER_OF Project Zero
Natalie works on Google's Project Zero team.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Natalie works for Project Zero”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Natalie Silvanovich MEMBER_OF Project Zero
Natalie works on Google's Project Zero team.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Natalie works for Project Zero”
David MEMBER_OF Project Raven
David was assigned to the Project Raven hacking unit after moving to Abu Dhabi.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“The name of the hacking unit Dave was assigned to was called Project Raven.”
Project Raven PART_OF CyberPoint
Project Raven was described as a hacking unit operating within or for CyberPoint.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“Project Raven was a hacking unit working for a company called Cyber Point”
Project Raven USES lateral movement
David described moving laterally through compromised networks to reach additional systems and credentials.
Explicit Confidence 98% · David EP 47 Details
“login remotely until you get where you want to go to the domain controller”
Project Raven USES Karma
Project Raven had access to and used, or could use, the Karma iPhone-hacking tool; the episode does not establish that David personally used it.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Project Raven had access to this crazy hacking tool called Karma.”
Project Raven USES web shell
The team uploaded an ASPX web shell through the Managed Engine ticket system to obtain access to a server.
Explicit Confidence 99% · David EP 47 Details
“you put an ASPX web shell on there, upload it as part of that ticket”
Project Raven USES pass the hash
The team used pass-the-hash or plaintext credentials for remote access during lateral movement.
Explicit Confidence 99% · David EP 47 Details
“passing the hash or even the plain text password”
Rori Donaghy USES WordPress
Rori used WordPress to create the human-rights website and blog for the Emirates Center for Human Rights.
Explicit Confidence 99% · Rori Donaghy EP 47 Details
“it was effectively just a WordPress website and the blog”
Project Raven USES default credentials
Project Raven gained initial access to a government VPN using default credentials.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“That VPN was using default credentials.”
Project Raven USES living off the land
The team used living-off-the-land methods, including native network utilities, during lateral movement.
Explicit Confidence 98% · David EP 47 Details
“living off the land, your net bios, your SMB”
Project Raven USES Data exfiltration
Project Raven collected communications and other data from targets rather than conducting destructive operations.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“This was just collecting communications.”
David installed ESXI on a home Mac Pro server while building a personal cybersecurity lab.
Explicit Confidence 99% · David EP 47 Details
“installed ESXI on that, and started building stacks”
Project Raven USES phishing
Project Raven personnel taught Emiratis how to establish phishing emails as an access method.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“how to set up a phishing e-mail and use Metasploit to gain access”
Project Raven USES Metasploit
Project Raven used or taught the use of Metasploit to gain access to victims' machines.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“use Metasploit to gain access to the victim’s machine”
Regin is described as capable of infiltrating GSM systems.
Explicit Confidence 98% · Jack Rhysider EP 48 Details
“it has the ability to infiltrate [00:35:00] GSM systems”
Regin AFFECTS mobile base station
The episode equates the GSM systems affected by Regin with mobile base stations and says this could give attackers control over mobile networks.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“GSM systems which are mobile base stations, giving the hackers control over mobile networks”
GCHQ ASSOCIATED_WITH National Security Agency
Snowden-related reporting described GCHQ as sharing collected data with the NSA; this is presented as an attributed surveillance relationship.
Attributed Confidence 93% · Jack Rhysider EP 48 Details
“sharing this data with the NSA”
Researchers found similarities between Regin and Flame, which the episode describes as a spy tool.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Quantum Insert ASSOCIATED_WITH timing attack
Quantum Insert is also characterized as a timing attack because the fake site must respond faster than the real site.
Explicit Confidence 98% · Jack Rhysider EP 48 Details
“but it’s also a timing attack because the fake LinkedIn site has to respond quicker than the real one”
Researchers found similarities between Regin and Duqu.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Quantum Insert ASSOCIATED_WITH man-in-the-middle attack
The episode compares Quantum Insert to a man-in-the-middle attack.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“This is sort of like a man-in-the-middle attack”
Quantum Insert ASSOCIATED_WITH man-on-the-side attack
The episode notes that some people call this type of traffic injection a man-on-the-side attack.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“some call it a man-on-the-side attack”
Operation Socialist ATTRIBUTED_TO GCHQ
The attack was attributed to GCHQ by documents from the Snowden archive, but the episode emphasizes that this attribution was alleged and contested.
Attributed Confidence 90% · Jack Rhysider EP 48 Details
“They said the cyber-attack on Belgacom was carried out by Britain’s GCHQ”
Flame ATTRIBUTED_TO National Security Agency
Flame is described as thought to have been created by the NSA and GCHQ, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Flame is thought to be created by the NSA and GCHQ.”
Duqu ATTRIBUTED_TO National Security Agency
Duqu is described as thought to have been created by the NSA, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Duqu is thought to be created by the NSA and Unit 8200 in Israel”