OxyMonster USES Bitcoin
OxyMonster used Bitcoin for a tip jar and later cashed out those Bitcoin proceeds.
Explicit Confidence 99% · Jack Rhysider EP 58 Details
“OxyMonster cashed out on his tip jar earnings”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
OxyMonster USES Bitcoin
OxyMonster used Bitcoin for a tip jar and later cashed out those Bitcoin proceeds.
Explicit Confidence 99% · Jack Rhysider EP 58 Details
“OxyMonster cashed out on his tip jar earnings”
OxyMonster USES Dream Market
OxyMonster was an administrator, vendor, and active participant on Dream Market.
Explicit Confidence 99% · Jack Rhysider EP 58 Details
“OxyMonster is an admin to Dream Market”
Gal Vallerius USES Silk Road
Prosecutors found connections linking Gal to Silk Road under another username.
Explicit Confidence 95% · Jack Rhysider EP 58 Details
“connections of him being on Silk Road, Silk Road 2, AlphaBay, Hansa”
Iowa Judicial Branch ASSOCIATED_WITH Coalfire Systems
The Iowa Judicial Branch hired or contracted Coalfire to conduct penetration testing, although the scope of the physical testing later became disputed.
Explicit Confidence 99% · Jack Rhysider EP 59 Details
“It was the Iowa Judicial Branch that called up Coalfire and asked the company to come and do a penetration test on the courthouses themselves.”
Iowa courthouse penetration-test arrests ATTRIBUTED_TO Iowa
The incident took place at Iowa courthouses and involved Iowa state and county authorities; the episode does not treat the state and county authorization issue as fully settled at the time of the arrests.
Derived Confidence 86% · Jack Rhysider EP 59 Details
“this was a county courthouse and it was a state department that hired them. State and county are two different things”
Iowa courthouse penetration-test arrests COMPROMISES Dallas County Courthouse
During the engagement, Justin and Gary gained unauthorized physical access, from the county's perspective, to the Dallas County Courthouse in Adel, Iowa.
Explicit Confidence 99% · Jack Rhysider EP 59 Details
“We’re here testing the security. ... we’re hired by Iowa State Courts.”
“Two men arrested for breaking into the Dallas County Courthouse say they were hired to do it by the state.”
Iowa courthouse penetration-test arrests INVOLVES Remote device
The engagement included attempting to place a drone or remote device so the testers could access the internal network after leaving the facility.
Explicit Confidence 98% · Justin Wynn EP 59 Details
“plug in a what we call a drone or remote device to be able to access that network later once we’re off-site”
Iowa courthouse penetration-test arrests INVOLVES Get-out-of-jail-free card
The testers carried documentation listing their Iowa Judicial Branch contacts and used it to establish that the courthouse access was an authorized engagement.
Explicit Confidence 99% · Jack Rhysider EP 59 Details
“They create what’s called a get-out-of-jail-free card. This is a slip of paper that lists all the people who hired Coalfire to do this penetration test.”
Iowa courthouse penetration-test arrests INVOLVES Gary De Mercurio
Gary De Mercurio participated in the Iowa courthouse physical penetration testing and was arrested during the engagement.
Explicit Confidence 99% · Reporter EP 59 Details
“Justin Wynn and Gary De Mercurio are both now charged with third-degree burglary and possession of burglary tools.”
Iowa courthouse penetration-test arrests INVOLVES Coalfire Systems
The Iowa courthouse penetration-test arrests arose from work Coalfire performed for the Iowa Judicial Branch.
Explicit Confidence 98% · Jack Rhysider EP 59 Details
“the Iowa Judicial Branch that called up Coalfire and asked the company to come and do a penetration test on the courthouses themselves”
Iowa courthouse penetration-test arrests INVOLVES physical penetration testing
The incident involved a contracted physical penetration test of Iowa Judicial Branch facilities.
Explicit Confidence 99% · Jack Rhysider EP 59 Details
“they’re specifically asking for a physical penetration test at five locations”
Iowa courthouse penetration-test arrests INVOLVES Lockpicking
The courthouse assessment involved lockpicking; Gary and Justin picked locks to enter courtrooms and discussed lockpicking as an authorized technique.
Explicit Confidence 99% · Gary De Mercurio EP 59 Details
“I ended up picking two doors in a row to a court room and then we ended up making it in.”
Iowa courthouse penetration-test arrests INVOLVES Justin Wynn
Justin Wynn participated in the Iowa courthouse physical penetration testing and was arrested during the engagement.
Explicit Confidence 99% · Reporter EP 59 Details
“Justin Wynn and Gary De Mercurio are both now charged with third-degree burglary and possession of burglary tools.”
Gary De Mercurio MEMBER_OF Coalfire Systems
Gary De Mercurio says he works at Coalfire Systems and runs its Bellevue office.
Explicit Confidence 99% · Gary De Mercurio EP 59 Details
“My name is Gary De Mercurio and pretty much mirror everything Justin said except I’m a managing senior and I run the Bellevue office in Washington.”
Justin Wynn MEMBER_OF Coalfire Systems
Justin Wynn says he is a senior security consultant with Coalfire Systems and works there as an offensive penetration tester.
Explicit Confidence 99% · Justin Wynn EP 59 Details
“My name is Justin Wynn. I’m a senior security consultant with Coalfire Systems.”
Justin Wynn USES Google Maps
Justin uses Google Maps to compare the physical perimeter and layout of a courthouse facility.
Explicit Confidence 98% · Justin Wynn EP 59 Details
“we walked up, assessed the perimeter and matched it up with what we were seeing on Google Maps”
Gary De Mercurio USES Lockpicking
Gary uses lockpicking during physical penetration tests.
Explicit Confidence 98% · Jack Rhysider EP 59 Details
“Gary is also really good at lockpicking so he’ll certainly have these in his pockets”
Gary De Mercurio USES Cutting-board door bypass
Gary uses a notched plastic cutting board as a bypass tool for crash-bar doors.
Explicit Confidence 99% · Gary De Mercurio EP 59 Details
“What we’ve come up with that we like to use ... is a cutting board.”
Justin Wynn USES under-the-door tool
Justin uses an under-the-door tool for physical access testing and says Gary taught him how to use it.
Explicit Confidence 99% · Justin Wynn EP 59 Details
“Gary was the first guy who handed me the under-the-door tool and taught me how to use this”
Coalfire Systems USES physical penetration testing
Coalfire performs physical penetration tests for clients as part of security assessments.
Explicit Confidence 98% · Jack Rhysider EP 59 Details
“a financial institute called up Coalfire to ask for a physical penetration test on their branches”
ImageMagick remote code execution vulnerability AFFECTS ImageMagick
The episode identifies the issue as an ImageMagick remote code execution vulnerability and explains that malicious image uploads could provide access to a website.
Explicit Confidence 98% · Tommy DeVoss EP 60 Details
“ImageMagick remote code execution vulnerability was public at that time”
“websites let you upload an image but you could send a malicious image to it”
Tommy DeVoss ASSOCIATED_WITH HackerOne
HackerOne announced that Tommy was the sixth hacker on its site to make one million dollars; Jack says he confirmed this with HackerOne’s announcement.
Attributed Confidence 99% · Jack Rhysider EP 60 Details
“HackerOne themselves has announced that Tommy was the sixth hacker on their site to make one million dollars”
Tommy DeVoss EXPLOITS ImageMagick remote code execution vulnerability
Tommy says he used the public ImageMagick remote code execution vulnerability to obtain remote code execution on two Yahoo servers.
Explicit Confidence 99% · Tommy DeVoss EP 60 Details
“I actually got remote code execution on two of Yahoo’s servers using that”
H1-415 INVOLVES Tommy DeVoss
Tommy attended H1-415 and earned $101,000 during the event, receiving the Most Valuable Hacker distinction.
Explicit Confidence 99% · Jack Rhysider EP 60 Details
“Tommy went and he was finding bug after bug and reporting them”
“he earned $101,000 which gave him the coveted MVH, Most Valuable Hacker”
H1-415 is described as a nine-hour hackathon put on by HackerOne.
Explicit Confidence 99% · Jack Rhysider EP 60 Details
“This is a nine-hour hackathon put on by HackerOne in San Francisco”