Episode

EP 78 — Nerdcore

10 November 2020 Official episode · Official transcript

cybercrime black hat hacktivism penetration test

The episode profiles cybersecurity-focused nerdcore musicians and discusses their early hacking activities, penetration testing, red teaming, malware analysis, cloud security, and security-related music.

Topics: WinNuke and attacks against Windows systems through port 139, IRC bots and bulletin board systems, AOL account-directory scraping and client exploitation, ColdFusion arbitrary file upload exposure, Website defacement, Spam-based referral monetisation, CAN-SPAM regulation, LulzSec and Operation AntiSec, Internal red teaming of cloud-service development teams, Web shells and .NET payloads, Application-security white-box and black-box testing, Domain-admin compromise and network pivoting, Reverse engineering of copy-protection systems, Malware sandboxing and indicator extraction, Cryptocurrency-mining malware, Command-and-control infrastructure and coordinated takedowns, SSH public-key access and SFTP/SCP file transfer

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

Entities (70)

Claims (43)

Qualified statements from this episode, not graph facts.

YTCracker’s father MEMBER_OF Hughes Aircraft

YTCracker says his father worked for Hughes Aircraft on Peacekeeper missiles.

Explicit Confidence 99% · YTCracker EP 78 Details

“He worked for Hughes Aircraft and he was working on peacekeeper missiles”

YTCracker · offsets 1682–1754

YTCracker’s father MEMBER_OF Martin Marietta

YTCracker says his father worked with Martin Marietta after moving back to Colorado.

Explicit Confidence 99% · YTCracker EP 78 Details

“he was working with Martin Marietta, which eventually became Lockheed Martin”

YTCracker · offsets 1888–1964

Martin Marietta ASSOCIATED_WITH Lockheed Martin

The episode says Martin Marietta eventually became Lockheed Martin.

Explicit Confidence 94% · YTCracker EP 78 Details

“Martin Marietta, which eventually became Lockheed Martin”

YTCracker · offsets 1908–1964

YTCracker USES bulletin board system

YTCracker says his first real hack involved accessing a public library bulletin board system.

Explicit Confidence 97% · YTCracker EP 78 Details

“the public library had a bulletin board system”

YTCracker · offsets 3034–3080

YTCracker USES Eggdrop bot

YTCracker says he dropped into a shell on a bulletin board system and turned it into an Eggdrop bot.

Explicit Confidence 99% · YTCracker EP 78 Details

“I found out how to drop into a shell. I turned it into an Eggdrop bot.”

YTCracker · offsets 3083–3154

YTCracker USES IRC

Jack describes the Eggdrop installation as an IRC bot.

Derived Confidence 93% · Jack Rhysider EP 78 Details

“He installed an IRC bot on it”

Jack Rhysider · offsets 3262–3291

YTCracker USES WinNuke

YTCracker says he used WinNuke to knock people offline or crash Windows computers.

Explicit Confidence 98% · YTCracker EP 78 Details

“I remember WinNuke had come out”

YTCracker · offsets 6205–6236

WinNuke AFFECTS port 139

YTCracker explains that WinNuke sent a packet to port 139.

Explicit Confidence 99% · YTCracker EP 78 Details

“you send out a band packet to port 139”

YTCracker · offsets 6254–6292

YTCracker USES AOL

YTCracker describes using AOL systems and chatrooms to identify and intimidate users.

Explicit Confidence 96% · YTCracker EP 78 Details

“We were working on defacing keywords. We had access to the CRIS.”

YTCracker · offsets 7168–7233

YTCracker USES Consumer Resource Information Service

YTCracker says he and others had access to AOL's Consumer Resource Information Service to look up user information.

Explicit Confidence 99% · YTCracker EP 78 Details

“We had access to the CRIS. It was the Consumer Resource Information Service”

YTCracker · offsets 7207–7283

YTCracker EXPLOITS ColdFusion default-upload vulnerability

YTCracker says he used the ColdFusion default-upload bug to upload files to websites.

Explicit Confidence 98% · YTCracker EP 78 Details

“There was a cold fusion bug when it was in default upload”

YTCracker · offsets 9887–9944

YTCracker USES Website defacement

YTCracker describes replacing or modifying website pages as a form of web page defacement.

Explicit Confidence 99% · YTCracker EP 78 Details

“I kind of really liked web page defacement”

YTCracker · offsets 9744–9786

YTCracker USES spam

YTCracker says he gathered millions of email addresses and sent spam for referral payments.

Explicit Confidence 99% · Jack Rhysider EP 78 Details

“I could send them all an e-mail telling them to go sign up at this website and I’d get paid”

Jack Rhysider · offsets 12793–12884

YTCracker TARGETS NASA

The episode says the website-defacement pattern included servers maintained by NASA.

Explicit Confidence 97% · Host EP 78 Details

“The pattern was repeated on over forty websites including servers maintained by NASA.”

Host · offsets 16973–17058

Operation AntiSec OPERATED_BY LulzSec

Jack states that Operation AntiSec was a hacking campaign conducted by LulzSec.

Explicit Confidence 99% · Jack Rhysider EP 78 Details

“operation AntiSec was a hacking campaign conducted by a group of anonymous hackers called LulzSec”

Jack Rhysider · offsets 25493–25590

Operation AntiSec INVOLVES Sony

Jack says LulzSec's Operation AntiSec hacked Sony's websites.

Explicit Confidence 97% · Jack Rhysider EP 78 Details

“They hacked into a ton of websites including Sony”

Jack Rhysider · offsets 25593–25642

Operation AntiSec INVOLVES United States Senate

Jack says LulzSec's Operation AntiSec hacked the US Senate's websites.

Explicit Confidence 96% · Jack Rhysider EP 78 Details

“including Sony, PVS, the US Senate”

Jack Rhysider · offsets 25628–25662

YTCracker ASSOCIATED_WITH Project Chanology

YTCracker says he was involved in Project Chanology and related activity.

Explicit Confidence 99% · YTCracker EP 78 Details

“I was involved in Project Chanology and some of the other stuff”

YTCracker · offsets 25741–25804

YTCracker MEMBER_OF Amazon digital security

YTCracker says he is part of Amazon digital security.

Explicit Confidence 99% · YTCracker EP 78 Details

“I’m part of Amazon digital security”

YTCracker · offsets 26919–26954

Ohm-I USES ASP

Ohm-I says he encountered ASP during a web application penetration test and investigated what he could do with it.

Explicit Confidence 98% · Jack Rhysider EP 78 Details

“they had ASP and I was like oh, what can I do with this?”

Jack Rhysider · offsets 32807–32863

Ohm-I USES web shell

Ohm-I says he wrote a web shell to obtain command-line access and take over a machine.

Explicit Confidence 93% · Jack Rhysider EP 78 Details

“writing .NET payloads and all these other cool things”

Jack Rhysider · offsets 33116–33169

Ohm-I USES .NET payloads

Ohm-I describes using .NET payloads while developing a web shell for a penetration test.

Explicit Confidence 99% · Jack Rhysider EP 78 Details

“writing .NET payloads”

Jack Rhysider · offsets 33116–33137

Ohm-I USES Python

Ohm-I says he uses Python extensively in information-security work and automation.

Explicit Confidence 99% · Jack Rhysider EP 78 Details

“no matter what your field is in InfoSec, you can probably use Python for something”

Jack Rhysider · offsets 34788–34870

Ohm-I USES Red Team

Ohm-I says he works on an internal red team performing assessments against Azure product teams.

Explicit Confidence 99% · Jack Rhysider EP 78 Details

“Our job is to perform red team assessments against teams working on Azure products and services.”

Jack Rhysider · offsets 36047–36143

Int80 MEMBER_OF Dual Core

Int80 identifies himself as the rapper in Dual Core.

Explicit Confidence 99% · Int80 EP 78 Details

“I’m the rapper in Dual Core”

Int80 · offsets 37250–37277

c64 MEMBER_OF Dual Core

Int80 says c64 is the other half of Dual Core and produces its beats.

Explicit Confidence 99% · Jack Rhysider EP 78 Details

“the other half is c64. I write and record all the rap songs and c64 makes all the beats.”

Jack Rhysider · offsets 57500–57588

Int80 USES Net Send

Int80 says he used Net Send to send a false virus message to Windows computers at school.

Explicit Confidence 99% · Int80 EP 78 Details

“using Net Send, I sent a message to all the Windows computers saying there was a virus”

Int80 · offsets 38160–38246

Int80 USES punt strings

Int80 says he traded malformed HTML, which he called punt strings, for stolen accounts.

Explicit Confidence 99% · Int80 EP 78 Details

“I used to trade these punt strings, this malformed HTML, for stolen accounts”

Int80 · offsets 40554–40630

Int80 USES Visual Basic

Int80 says his desire to weaponize punt strings drove him to learn Visual Basic.

Explicit Confidence 99% · Int80 EP 78 Details

“That drove me to learning Visual Basic and the Windows API”

Int80 · offsets 41027–41085

Int80 USES Windows API

Int80 says he learned the Windows API to write programs that could kick people offline.

Explicit Confidence 99% · Int80 EP 78 Details

“learning Visual Basic and the Windows API so that I could write my own punters”

Int80 · offsets 41044–41122

Int80 USES white-box assessment

Int80 says his application-security consulting engagements included white-box assessments.

Explicit Confidence 99% · Int80 EP 78 Details

“We would do white box or black box assessments”

Int80 · offsets 42642–42688

Int80 USES black-box assessment

Int80 says his application-security consulting engagements included black-box assessments.

Explicit Confidence 99% · Int80 EP 78 Details

“We would do white box or black box assessments”

Int80 · offsets 42642–42688

Int80 USES Reverse engineering

Int80 says he worked in reverse engineering, including cracking and analyzing copy protection.

Explicit Confidence 99% · Int80 EP 78 Details

“I then moved into a position doing reverse-engineering”

Int80 · offsets 44878–44932

Int80 USES malware analysis

Int80 describes sandboxing malware, picking it apart, and determining what it was doing.

Explicit Confidence 99% · Int80 EP 78 Details

“sandbox it, pick it apart programatically, figure out what it was doing”

Int80 · offsets 45672–45743

Litecoin-mining malware DISCOVERED_BY Int80

Int80 says he discovered Litecoin-mining malware on a social-media platform.

Explicit Confidence 98% · Jack Rhysider EP 78 Details

“he discovered some malware on the platform which would mine Litecoin”

Jack Rhysider · offsets 46052–46120

Litecoin-mining malware USES Litecoin

The malware mined Litecoin and used a Litecoin mining pool.

Explicit Confidence 99% · Int80 EP 78 Details

“I reached out to the Litecoin mining pool”

Int80 · offsets 46285–46326

Litecoin-mining malware USES Dropbox

Int80 says the malware staged files on Dropbox.

Explicit Confidence 99% · Int80 EP 78 Details

“the malware had stages up on Dropbox”

Int80 · offsets 46546–46582

Litecoin-mining malware USES Command and control

Int80 says the malware's command and control was hosted on a VPS.

Explicit Confidence 99% · Int80 EP 78 Details

“the C2 was at some hosting company”

Int80 · offsets 46762–46796

Litecoin-mining malware USES VPS

Int80 says the malware's C2 was on a VPS in a hosting provider's environment.

Explicit Confidence 99% · Int80 EP 78 Details

“this malware has got its C2 on a VPS in your hosting setup”

Int80 · offsets 46855–46913

coordinated malware takedown INVOLVES Litecoin-mining malware

The coordinated takedown stopped the Litecoin-mining malware from operating on the internet.

Explicit Confidence 99% · Int80 EP 78 Details

“We did this coordinated takedown and that Friday at 9:00 AM, the malware ceased to exist on the internet.”

Int80 · offsets 47231–47336

Int80 MEMBER_OF Salesforce

Int80 says he worked as a red-team operator at Salesforce.

Explicit Confidence 99% · Int80 EP 78 Details

“I worked on the red team at Salesforce”

Int80 · offsets 47444–47482

Int80 USES Red Team

Int80 says the Salesforce red team's job was to make controlled bad things happen and test critical business systems.

Explicit Confidence 99% · Int80 EP 78 Details

“After leaving the social media platform, I took a job as a red team operator.”

Int80 · offsets 47365–47442

Dual Core ASSOCIATED_WITH Defcon

The episode says Dual Core played at Defcon and was the first live hip-hop act there.

Explicit Confidence 95% · Int80 EP 78 Details

“We ended up playing at Defcon that year”

Int80 · offsets 44640–44679

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:44:19.136309+00:00