Person
person:os
Also: Owl Stalker
An anonymized former warez participant, Marine, and cybersecurity consultant interviewed about the Puerto Rico lottery investigation.
An anonymized former warez participant, Marine, and cybersecurity consultant interviewed about the Puerto Rico lottery investigation.
“I’ll just abbreviate his name to O-S and call him Os for short.”
“Let’s call it Owl Stalker.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | warez scene | Explicit | 101 |
| outgoing | USES | Internet Relay Chat | Explicit | 101 |
| outgoing | MEMBER_OF | United States Marine Corps | Explicit | 101 |
| outgoing | USES | digital forensics | Explicit | 101 |
| outgoing | USES | penetration testing | Explicit | 101 |
| outgoing | USES | Metasploit | Explicit | 101 |
| outgoing | USES | Windows 98 accessibility-feature login bypass | Explicit | 101 |
| outgoing | USES | John the Ripper | Explicit | 101 |
| outgoing | USES | Password hash cracking | Explicit | 101 |
| outgoing | USES | Nmap | Explicit | 101 |
| outgoing | USES | network enumeration | Explicit | 101 |
| outgoing | USES | reverse shell | Explicit | 101 |
| outgoing | USES | man-in-the-middle attack | Explicit | 101 |
| incoming | DISCOVERED_BY | Puerto Rico lottery fraud | Explicit | 101 |
Os USES warez scene
Os says that in the early days he participated in the warez scene as an administrator, rooter, and cracker producing zero-day releases.
Explicit Confidence 99% · Os EP 101 Details
“I used to run around in the warez scene as a wares administrator and a rooter”
Os USES Internet Relay Chat
Os used IRC while participating in the warez scene and hosting distribution servers.
Explicit Confidence 96% · Jack Rhysider EP 101 Details
“So, he was on IRC, the Internet Relay Chat, and was setting up servers”
Os MEMBER_OF United States Marine Corps
Os joined the Marine Corps specifically to pursue computer and cybersecurity work and served five years active duty.
Explicit Confidence 99% · Os EP 101 Details
“I chose the Marine Corps specifically”
“I spent five years active duty”
Os USES digital forensics
Os performed defensive and forensic cybersecurity work in the Marine Corps and later at a consulting firm.
Explicit Confidence 95% · Os EP 101 Details
“So, I did both”
“They were doing forensics and other cyber-security kinda stuff”
Os USES penetration testing
Os conducted penetration tests as part of his offensive cybersecurity work and consulting work.
Explicit Confidence 98% · Jack Rhysider EP 101 Details
“he’s a pen tester”
“Os has done a number of penetration tests before he did offensive work while in the Marines”
Puerto Rico lottery fraud DISCOVERED_BY Os
Os and his team uncovered the database manipulation and traced it to an insider.
Explicit Confidence 99% · Jack Rhysider EP 101 Details
“Os has cracked the case”
“He’s figured out how the millions of dollars are being stolen from the lottery”
Os USES Metasploit
Os used Metasploit to find an accessibility-feature exploit for a Windows 98 system and later to identify an exploit against a Drupal web server.
Explicit Confidence 99% · Os EP 101 Details
“I’m like, alright; Metasploit, what do you have for 1998 Windows systems?”
“I go through the Metasploit table”
Os USES Windows 98 accessibility-feature login bypass
Os created and used a USB exploit to bypass the Windows 98 login screen and obtain local administrator access.
Explicit Confidence 99% · Os EP 101 Details
“ended up being able to create an exploit that I could plug in a USB and bypass the log-in screen”
“Drop it in, get full access”
Os USES John the Ripper
Os extracted credential hashes and used John the Ripper to attempt password cracking.
Explicit Confidence 99% · Jack Rhysider EP 101 Details
“He then runs a tool called John the Ripper to try hundreds of thousands of passwords”
Os USES Password hash cracking
Os attempted to crack password hashes obtained from the compromised Windows computer.
Explicit Confidence 99% · Jack Rhysider EP 101 Details
“he grabs this hash file to try to crack the passwords on this computer”
Os included Nmap in his portable tool suite and used scans to examine the lottery network.
Explicit Confidence 98% · Os EP 101 Details
“a bunch of tools on it like Nmap and freaking man-in-the-middle tools”
“Nmap scans are also common”
Os USES network enumeration
Os enumerated the internal network to map reachable systems and identify the lottery network structure.
Explicit Confidence 99% · Os EP 101 Details
“So, I actually enumerate the network”
Os USES reverse shell
Os established a reverse shell on the long-forgotten computer so he could access it remotely from the hotel.
Explicit Confidence 99% · Jack Rhysider EP 101 Details
“he sets up a reverse shell to this computer”
Os USES man-in-the-middle attack
Os routed traffic through a compromised Linux server to capture and analyze traffic inside the lottery network.
Explicit Confidence 99% · Jack Rhysider EP 101 Details
“This is the man-in-the-middle attack that he was wanting to do”