Episode
01 April 2025 Official episode · Official transcript
black hat cons cybercrime
Jack Rhysider interviews Grifter, also identified as Neil Wyler, about his early hacking experiences, long involvement with DEF CON and Black Hat, network defense work, and career in threat hunting.
Topics: Threat hunting, Security operations centers and network operations centers, Command-and-control detection, Data exfiltration over FTP, Network monitoring and file extraction, Responsible disclosure, Elevator access-control security, Credit-card fraud and identity theft, Hacker conferences and security communities, Aggressive network defense
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Grifter USES bulletin board systems
Grifter says his first online experiences involved dialing into pirate bulletin board systems to download pirated games, and later using a hacker BBS.
Explicit Confidence 99% · Grifter EP 157 Details
“my first online experiences, which were dialing into pirate bulletin board systems to download pirated games”
Grifter USES barcode swapping
Grifter describes using barcode or sticker swapping to buy expensive goods at lower prices and return them for profit.
Explicit Confidence 99% · Grifter EP 157 Details
“we’d all go on a Saturday and we’d go out to the store and we’d do the barcode swapping”
Grifter says he used carding, which he defines as identity theft and credit-card fraud, to order goods and have them delivered to abandoned houses.
Explicit Confidence 99% · Grifter EP 157 Details
“carding is what we called it back in the day, which is basically just really identity theft and credit card fraud”
Grifter EXPLOITS elevator card-reader vulnerability
Grifter says he found an exposed pinout under an elevator card reader, shorted the pins with his thumb, and was then able to select different floors.
Explicit Confidence 99% · Grifter EP 157 Details
“underneath it was — there was an open pin out. But I was like, oh, cool, we could probably connect to this and get to any floor we want. I’m like, that’s wild. Then I ran my thumb across the pins, and it shorted out and the light blinked green, and I could tap any floor”
Grifter says he joined the Air Force at age seventeen after graduating high school.
Explicit Confidence 99% · Grifter EP 157 Details
“as soon as I graduated, I went to the Air Force”
Grifter says he became a Defcon goon and remained one from Defcon 10 onward, while also serving in other conference roles.
Explicit Confidence 99% · Grifter EP 157 Details
“At Defcon 10 I was a security goon, and then at Defcon 11 I went and I was a vendor goon. Yeah, and then I’ve been a goon ever since”
Grifter says he eventually began running all the technical operations for Black Hat and later ran its network operations center.
Explicit Confidence 98% · Grifter EP 157 Details
“I eventually started running all the technical operations for Black Hat”
Defcon Groups DEVELOPED_BY Grifter
Grifter says he came up with the idea for Defcon Groups, then worked with Dark Tangent and Russ Rogers to establish its structure and initial chapters.
Explicit Confidence 99% · Grifter EP 157 Details
“I came up with the idea for Defcon Groups”
Lockpick Village PART_OF DEF CON
The Lockpick Village is described as the first village created within the Defcon conference.
Explicit Confidence 95% · Grifter EP 157 Details
“the first ones to call themselves a village was the Lockpick Village”
Hardware Hacking Village PART_OF DEF CON
The Hardware Hacking Village was established as one of the broken-out areas at Defcon.
Explicit Confidence 95% · Grifter EP 157 Details
“the hardware-hacking people called themselves the Hardware Hacking Village”
Wi-Fi Village PART_OF DEF CON
The Wi-Fi Village is described as another village created at Defcon alongside the Lockpick and Hardware Hacking Villages.
Explicit Confidence 95% · Grifter EP 157 Details
“Then another group started the Wi-Fi Village”
Grifter AUTHORED Aggressive Network Self-Defense
Grifter says he co-authored Aggressive Network Self-Defense with Dan Kaminsky, Bruce Potter, Pyro, and Chris Hurley, publishing it under the name Neil Wyler, AKA Grifter.
Explicit Confidence 99% · Grifter EP 157 Details
“then we put out a book. But that was the thing about putting out a book, was I was like, am I really just gonna put Grifter on the cover of this thing? I was like, I cannot publish a book and not put my name on it. For me, personally, it was like, I want to see it on the shelf in a library and be like, that one’s mine. So, I made the decision that I was gonna put on there Neil Wyler, AKA Grifter”
Dan Kaminsky AUTHORED Aggressive Network Self-Defense
Dan Kaminsky is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“it was like Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Bruce Potter AUTHORED Aggressive Network Self-Defense
Bruce Potter is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Pyro AUTHORED Aggressive Network Self-Defense
Pyro is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Chris Hurley AUTHORED Aggressive Network Self-Defense
Chris Hurley is named as one of the friends who agreed to co-author the book.
Explicit Confidence 98% · Grifter EP 157 Details
“Dan Kaminsky, Bruce Potter, Pyro, Chris Hurley. He’s like, alright, let’s see what we can do. All of them agreed to do it”
Grifter says he recently took a position at Coalfire as vice president of defensive services.
Explicit Confidence 99% · Grifter EP 157 Details
“I recently took a position at a company called Coalfire as the VP of defensive services”
Grifter MEMBER_OF IBM X-Force
Grifter says he previously spent three years with IBM’s X-Force running its global threat-hunting program.
Explicit Confidence 99% · Grifter EP 157 Details
“I was with IBM’s X-Force for three years running their global threat-hunting program”
Grifter MEMBER_OF RSA Security
Grifter says he previously worked for seven years at RSA Security, where he started and ran its global threat-hunting program.
Explicit Confidence 99% · Grifter EP 157 Details
“for the seven years before that, I was at RSA Security where I started and ran their threat-hunting program around the world”
Grifter USES Threat hunting
Grifter describes spending more than a decade conducting threat hunting to find attackers who had bypassed an organization’s security.
Explicit Confidence 99% · Grifter EP 157 Details
“I spent a lot of the last — over a decade at this point really focused on threat hunting”
Defcon financial-data exfiltration INVOLVES FTP
The financial-data exfiltration incident involved recurring FTP traffic to a host in a .ru domain.
Explicit Confidence 99% · Grifter EP 157 Details
“We look and it’s FTP traffic going to a host name, not even an IP address but a host name that ends in .ru”
Defcon financial-data exfiltration INVOLVES Data exfiltration
The incident involved nightly transmission of a zip file containing the organization’s financial transactions and trades.
Explicit Confidence 99% · Grifter EP 157 Details
“that is every financial transaction and trade that we’ve made in the last twenty-four hours”
Defcon financial-data exfiltration ASSOCIATED_WITH Russia
The incident was associated with Russia because the FTP server connection and its IP address were identified as being in Russia; the episode does not establish who operated the server.
Uncertain Confidence 93% · Grifter EP 157 Details
“That connection to an FTP server in Russia — the IP address was also geolocated to Russia”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:37:53.087263+00:00