Person
person:chris_rock
Australian security researcher, penetration tester, SIEM founder, and guest interviewed in the episode.
Australian security researcher, penetration tester, SIEM founder, and guest interviewed in the episode.
“So, my name is Chris Rock.”
“I am the CISO of SIEMonster”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Atari 2600 | Explicit | 151 |
| outgoing | USES | Commodore 64 | Explicit | 151 |
| outgoing | USES | Amiga | Explicit | 151 |
| outgoing | USES | Adobe PDF Reader | Explicit | 151 |
| outgoing | USES | Remote access Trojan | Explicit | 151 |
| outgoing | USES | keylogger | Explicit | 151 |
| outgoing | USES | Metasploit | Explicit | 151 |
| outgoing | USES | VirusTotal | Explicit | 151 |
| outgoing | USES | phishing | Explicit | 151 |
| outgoing | USES | Wi-Fi network | Explicit | 151 |
| outgoing | USES | WEP | Explicit | 151 |
| outgoing | USES | Aircrack-ng | Derived | 151 |
| outgoing | USES | Linux | Explicit | 151 |
| outgoing | USES | PuTTY | Explicit | 151 |
| outgoing | USES | Plink | Explicit | 151 |
| outgoing | USES | proxy chaining | Explicit | 151 |
| outgoing | USES | lateral movement | Derived | 151 |
| outgoing | USES | LDAP | Explicit | 151 |
| outgoing | USES | Electronic Death Registration System | Explicit | 151 |
| incoming | DEVELOPED_BY | SIEMonster | Explicit | 151 |
SIEMonster DEVELOPED_BY Chris Rock
Chris says he created a SIEM solution by stitching together open-source products, which became SIEMonster Version 1.
Explicit Confidence 98% · Chris Rock EP 151 Details
“I can stitch some open-sourch products together like Elastic and stuff like that.”
“Which seems to be the platform they’re running now, SIEMonster Version 1.”
Chris Rock USES Atari 2600
Chris identifies the Atari 2600 as his first computer.
Explicit Confidence 96% · Chris Rock EP 151 Details
“my career started when my parents bought me my first computer, which then it was an older computer, but it was the Atari 2600.”
Chris Rock USES Commodore 64
Chris says he moved from the Atari 2600 to the Commodore 64.
Explicit Confidence 96% · Chris Rock EP 151 Details
“From there it went to Commodore 64 and Amiga and then IBM.”
Chris Rock USES Amiga
Chris says he used an Amiga after the Commodore 64.
Explicit Confidence 96% · Chris Rock EP 151 Details
“From there it went to Commodore 64 and Amiga and then IBM.”
Chris Rock USES Adobe PDF Reader
Chris says he used malicious custom PDFs exploiting Adobe PDF Reader to gain access to targets.
Explicit Confidence 98% · Chris Rock EP 151 Details
“the Adobe was enough to get probably four or five of the eight people and also the subsidiaries.”
Chris Rock USES Remote access Trojan
The episode says Chris used PDFs that installed a remote-access Trojan on targets’ computers.
Explicit Confidence 98% · Jack Rhysider EP 151 Details
“that would allow him to install a remote-access Trojan and get access to their computer.”
Chris Rock USES keylogger
Chris says that after obtaining a remote shell, they used keyloggers; Jack also describes keyloggers on the targets’ computers.
Explicit Confidence 98% · Chris Rock EP 151 Details
“it’s things like key loggers and stuff like that.”
Chris Rock USES Metasploit
Chris says he used Metasploit in penetration-testing work and used a listener comparable to Metasploit in this operation.
Explicit Confidence 97% · Chris Rock EP 151 Details
“we would use Metasploit as a pen tester”
“have a listener like Metasploit, but we would have our own listeners”
Chris Rock USES VirusTotal
Chris says he uploaded custom PDFs to VirusTotal to check whether antivirus products detected them.
Explicit Confidence 98% · Chris Rock EP 151 Details
“we would upload it against VirusTotal to make sure nothing picked it up.”
Chris Rock USES phishing
The episode describes Chris sending phishing emails with PDF attachments to compromise bank employees and other targets.
Explicit Confidence 99% · Jack Rhysider EP 151 Details
“he found a bank employee, sent them a phishing e-mail, got them to open a PDF which planted a Trojan on their computer”
Chris Rock USES Wi-Fi network
Chris’s team planted a device near the target’s Wi-Fi network and used it to gain internal network access.
Explicit Confidence 96% · Chris Rock EP 151 Details
“sticking something behind it, and then, boom, we had a device planted in to get this last VC firm.”
Chris Rock USES WEP
Chris’s team targeted the company’s WEP-protected Wi-Fi network and cracked it to obtain internal access.
Explicit Confidence 99% · Jack Rhysider EP 151 Details
“Their first goal is to get on the Wi-Fi network. To do that, they’re gonna have to crack the WEP protcol.”
Chris Rock USES Aircrack-ng
The episode attributes the Aircrack-ng Wi-Fi attack to Chris and his team.
Derived Confidence 95% · Jack Rhysider EP 151 Details
“They log into that little device and fire up a tool called Aircrack-ng.”
Chris Rock USES Linux
Chris says he built his own Linux stack for the planted Wi-Fi-hacking device.
Explicit Confidence 99% · Chris Rock EP 151 Details
“built up my own Linux stack with Wi-Fi hacking”
Chris Rock USES PuTTY
Chris explicitly lists PuTTY as part of the custom device he built for the operation.
Explicit Confidence 99% · Chris Rock EP 151 Details
“with Wi-Fi hacking and things like PuTTY and reverse-shell tools like Plink”
Chris Rock USES Plink
Chris explicitly lists Plink among the reverse-shell tools used on the custom device.
Explicit Confidence 99% · Chris Rock EP 151 Details
“reverse-shell tools like Plink and stuff like that”
Chris Rock USES proxy chaining
Chris says his team routed activity through multiple compromised systems and maintained a rotating list of targeted proxies.
Explicit Confidence 99% · Chris Rock EP 151 Details
“we would have this rotating list of our own proxies. Not Tor or anything like that; our own targeted proxies to do the hops that we want.”
Chris Rock USES lateral movement
The operation involved moving from compromised endpoints into servers and other systems on the target network.
Derived Confidence 91% · Jack Rhysider EP 151 Details
“from there he hopped into the server of the bank’s network”
Chris Rock USES LDAP
Chris says he queried LDAP directory data and found passwords stored in descriptive fields.
Explicit Confidence 99% · Chris Rock EP 151 Details
“If anyone knows anything about LDAP, you can just query that.”
Chris Rock USES Electronic Death Registration System
Chris describes researching and demonstrating how the Electronic Death Registration System could be abused to create or declare people dead.
Explicit Confidence 94% · Chris Rock EP 151 Details
“in the US, they have — they used to have a paper-based system”
“the doctor will log into a US system called EDRS”