1IM exploit DISCOVERED_BY Greg Linares
Greg says he was one of the first people to discover the 1IM exploit.
Explicit Confidence 98% · Greg Linares EP 160 Details
“I was one of the first to discover the 1IM exploit.”
Episode
01 July 2025 Official episode · Official transcript
penetration test
Greg Linares describes his early work writing malware, discovering vulnerabilities, conducting vulnerability research at eEye, and later performing red-team and physical penetration tests.
Topics: AOL client integer-overflow exploitation, Macro viruses in Microsoft Word and Excel, Malicious document and spreadsheet macros, Fuzzing and file-format parsing, Hex editing and debugger-assisted exploit development, Data-pointer control and arbitrary code execution, Zero-day vulnerability research and responsible disclosure, Honeypots for attracting attackers, Insider-threat penetration testing, ARP poisoning and DHCP spoofing, Credential interception and man-in-the-middle attacks, Network bridging and guest-network segmentation failure, RFID badge capture and cloning, Access-control camera vulnerabilities, Boot-root attacks using Sticky Keys, Physical intrusion and covert data exfiltration
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
1IM exploit DISCOVERED_BY Greg Linares
Greg says he was one of the first people to discover the 1IM exploit.
Explicit Confidence 98% · Greg Linares EP 160 Details
“I was one of the first to discover the 1IM exploit.”
1IM exploit EXPLOITS Integer overflow
The 1IM exploit used an integer overflow in the AOL client triggered by an excessively long font-size value.
Explicit Confidence 99% · Greg Linares EP 160 Details
“the integer overflow in the AOL client when you sent a font size with a long enough number”
1IM punter DEVELOPED_BY Greg Linares
Greg says he made the 1IM punter after finding the AOL client vulnerability.
Explicit Confidence 98% · Greg Linares EP 160 Details
“I remember finding that and making the 1IM punter back in the day.”
macro virus DEVELOPED_BY Greg Linares
Greg says he wrote macro viruses, including a macro virus that modified his school's Excel grade records.
Explicit Confidence 98% · Greg Linares EP 160 Details
“I made a macro virus that would look for my student ID number”
Greg Linares USES Visual Basic
Jack describes Greg's specialty as using Visual Basic to create malicious macros.
Explicit Confidence 97% · Jack Rhysider EP 160 Details
“His specialty was using Visual Basic to code malicious macros”
Greg Linares USES Microsoft Word
Greg used malicious Microsoft Word documents and macros to compromise computers when victims opened them.
Explicit Confidence 97% · Jack Rhysider EP 160 Details
“he would send the Word doc to someone, trick them into opening it”
Greg Linares USES Microsoft Excel
Greg used Excel as the school's grade system to deploy his macro virus and alter grades and attendance.
Explicit Confidence 99% · Greg Linares EP 160 Details
“the entire grade system was in Excel, and I made a macro virus”
macro virus AFFECTS Microsoft Excel
Greg's macro virus modified Excel grade sheets and caused the school's Excel files to crash when a later column was added.
Explicit Confidence 96% · Greg Linares EP 160 Details
“the virus would restore the doc — the sheets when teachers opened up the sheets. That caused the Excel files to crash”
Greg Linares MEMBER_OF eEye
Greg joined eEye as a researcher after the company noticed his public exploit and malware work.
Explicit Confidence 99% · Jack Rhysider EP 160 Details
“eEye saw that Greg was writing a lot of malware and posting it publicly, and they liked that and decided to hire him”
Greg Linares USES fuzzing
Greg manually fuzzed Microsoft Word and later used fuzzing to search Office for crashes and vulnerabilities.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I went in there and started manually fuzzing Word at the time.”
Greg Linares USES hex editor
Greg used a hex editor to modify Office document data at a low level while testing Word and other Office applications.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I could look at Office — hex editors in Office”
“he opened up a Word doc, not in Microsoft, though; in a hex editor where you can manipulate the ones and zeros directly in the file”
Greg Linares USES Olly
Greg used Olly as a debugger to inspect application assembly, registers, memory, and behavior.
Explicit Confidence 99% · Greg Linares EP 160 Details
“Olly is a tool that you attach to your — any application that you want to see at low level”
Microsoft Office vulnerability AFFECTS Microsoft Office 2007
The episode identifies the vulnerability Greg ultimately found as the first disclosed vulnerability in Microsoft Office 2007.
Explicit Confidence 95% · Greg Linares EP 160 Details
“we have indeed the first vulnerability in Microsoft Office”
Microsoft Office vulnerability AFFECTS Microsoft Visio
The successful vulnerability was found in Visio, a product inside the Office suite.
Explicit Confidence 99% · Greg Linares EP 160 Details
“it happens to be in Office Visio. It was another product inside the Office suite.”
eEye Office 2007 vulnerability disclosure INVOLVES Microsoft Office vulnerability
The eEye Office 2007 disclosure involved the vulnerability Greg found through fuzzing and subsequent validation without a debugger attached.
Explicit Confidence 98% · Jack Rhysider EP 160 Details
“eEye found another zero-day, this time in the latest Microsoft Office”
eEye Office 2007 vulnerability disclosure INVOLVES Microsoft
eEye reported the Office vulnerability to Microsoft so it could investigate and patch it before public disclosure.
Explicit Confidence 99% · Greg Linares EP 160 Details
“then we report to Microsoft”
Greg Linares USES ARP poisoning
During a red-team engagement, Greg used ARP poisoning to intercept a plaintext credential.
Explicit Confidence 99% · Greg Linares EP 160 Details
“let’s try one more — let’s do some ARP poisoning”
Greg Linares USES man-in-the-middle attack
Greg used man-in-the-middle attacks to steal credentials during a venture-capital-company penetration test.
Explicit Confidence 99% · Greg Linares EP 160 Details
“There, I start doing man-in-the-middle attacks”
Greg Linares USES DHCP spoofing
Greg identifies DHCP spoofing as one of the layer-two attack techniques he used or recommended during red-team work.
Explicit Confidence 94% · Greg Linares EP 160 Details
“your ARP poisoning, your DHCP spoofing, all of those”
Greg Linares USES Proxmark
Greg used a Proxmark system to capture an employee badge identifier and clone access badges.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I have a Proxmark system; I keep pulling it and all of a sudden I notice her ID matches up”
Proxmark USES RFID badge cloning
The Proxmark system was used for RFID badge cloning during the physical penetration test.
Explicit Confidence 99% · Greg Linares EP 160 Details
“I’m gonna put a RFID cloner next to their badge reader”
Greg Linares EXPLOITS access-camera buffer overflow
Greg exploited an unpatched access-camera buffer overflow to gain control of the cameras.
Explicit Confidence 99% · Greg Linares EP 160 Details
“there’s an access buffer overflow that allows you to control and gain access to every one of these cameras”
Greg Linares USES boot root
After entering the server room, Greg used boot-root techniques to gain elevated access to the machines.
Explicit Confidence 99% · Greg Linares EP 160 Details
“Went to the server room, and from there, boot-rooted all the machines.”
boot root USES Sticky Keys
The described boot-root method replaced Sticky Keys with a command shell and used the login-screen shortcut to obtain elevated privileges.
Explicit Confidence 99% · Greg Linares EP 160 Details
“Sticky Keys would be a ideal favorite. So, you replace Sticky Keys with command shell”
Li Feng ASSOCIATED_WITH Microsoft
Greg alleges that Li Feng worked for Microsoft while being placed at eEye to obtain information about eEye's zero-days; Jack says the story could not be confirmed.
Uncertain Confidence 72% · Jack Rhysider EP 160 Details
“Microsoft got someone to — a job at eEye”
“I can’t confirm that that story is true”
Greg alleges that Li Feng was placed at eEye to identify and report eEye's Microsoft zero-days; the account is explicitly unconfirmed.
Uncertain Confidence 72% · Greg Linares EP 160 Details
“Li Feng, he was working for us to identify zero-days that you guys may have found”
“I can’t confirm that that story is true”
corporate espionage allegation involving Li Feng INVOLVES Li Feng
The corporate-espionage allegation centers on Li Feng and alleged placement between Microsoft, eEye, and a foreign government entity.
Uncertain Confidence 90% · Jack Rhysider EP 160 Details
“this is corporate espionage”
“I can’t confirm that that story is true”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:41:45.727546+00:00