Deviant Ollam
Appearances
Darknet Diaries
134: Deviant
Yeah, I think the real thing there that you hit on perfectly is the guardedness of knowledge in the old world of the trade of locksmithing. If you're doing a physical penetration test, the value isn't in the success of the tester. It's in the deliverable. It's in the report, the knowledge that they will give you.
Darknet Diaries
134: Deviant
And it really goes to show that if everything is... Because the vault had basically been protected to oblivion on the door. And if anyone messed with that door, tampered with that door, tried to torch cut whatever that door... That was where the alarm was. That was where all the sensors were. All the investment was in the door. Because they said, well, what do you do with walls?
Darknet Diaries
134: Deviant
And giving out that knowledge, physical pen testers, yes, we are many times locksmiths, but much like Penn and Teller are magicians, but part of their whole shtick over the years has been showing the audience how they did the trick. And there are some magicians that think that ruins it, that it takes all the shine and polish off of it and the magic is gone.
Darknet Diaries
134: Deviant
But I think that showing the execution, if it's elegant and well done and impressive, it doesn't take away, in fact, it enhances the audience's appreciation for, wow, I would not have been, like, even knowing how it works, I would take five years to learn how to do that trick properly. Same thing with us. I can show you how it works, but it's not really taking away
Darknet Diaries
134: Deviant
money out of my pocket or opportunity out of my colleague's portfolio if people know how my job functions. They're not all going out immediately trying to do this job. There's, as you say, that sort of comprehensive knowledge of being able to walk through a space and instantly look and recognize every little detail that comes with years of experience. So I'm not surprised at your friend's mother.
Darknet Diaries
134: Deviant
I'm not even disappointed. For the longest time, that was just part. I was deeply ingrained in the trade. And why aren't locks, even now as knowledge is opening up, why aren't they getting into penetration testing? A lot of them, even with their knowledge as locksmiths, they can't quite do what we do. And they're frankly making far, it's a very different business model.
Darknet Diaries
134: Deviant
We've never not gotten in. You're always going to get in. 100% success. 100% success in terms of entering the building. Yes, every building we've ever seen, we've been able to enter, sometimes quickly, sometimes it takes a while. The question is, are we detected? Is there a response? How competent is that response? Can we talk our way out of it?
Darknet Diaries
134: Deviant
I've interfaced with guards and had a good story, had an excuse for being there. Okay. Thank you for your time. All right. Sorry. Well, next time have an escort when you're in this area. I said, okay. Guards.
Darknet Diaries
134: Deviant
Their objective was to affect network access either externally from the parking lot, you know, a cantenna where nowadays, you know, we're not poor hackers anymore. You get a nice Yagi. But trying to pick up on, you know, the building's Wi-Fi. They said, did we, does the Wi-Fi leak? Or you can try to make internal, you know, connections.
Darknet Diaries
134: Deviant
I mean, there's only so much you can do with walls. But you can believe that at least a few bank vaults in Antwerp started looking at their diamonds. And they said, is concrete the only thing that's protecting us? Because we got to at least get some shake sensors in these walls or put one or two cameras in the vault.
Darknet Diaries
134: Deviant
So he was going to get in the building with me, find an unused network port or compromise a network port in a conference room, and then basically just, do they have Mac filtering? Do they not? Can I get a device to connect to the network? Can I not? Let me see if I can get this little Dropbox headless computer, and then it would backhaul off-site.
Darknet Diaries
134: Deviant
And it's a mutually beneficial relationship. It allows us to specialize only in what we're good at because I am, again, not a keyboard jockey these days. And it absolves a lot of headache and liability from the primary consultant team. They say, I don't want to touch that elevator. I'm not qualified. I'll touch the elevators. So what do you bring to this engagement?
Darknet Diaries
134: Deviant
So I had kind of a little field bag on me of some bypass tools, some lockpicks. I did have my elevator keys. I'll have an underdoor tool. I'll have door shims, a mini knife, kind of your typical kit.
Darknet Diaries
134: Deviant
Because if somebody goes in the concrete and they're in there all weekend, well, that's a problem.
Darknet Diaries
134: Deviant
And you can also tell if you're yanking on the door and it's very clearly being held shut, maybe with the very top, but the bottom of the door is wiggling by a quarter inch, half inch. You're like, all right, that's a mag lock. That's a magnetic lock at the top of this door. I'm pretty sure we electronically can release that mag lock either looking around.
Darknet Diaries
134: Deviant
You don't see any push to exit buttons through the windows. No, it's got to be looking through the window some more. It's got to be a sensor somewhere. Where is that rec sensor? Normally, it's right above the door. And eventually, we had to look through another window from the side, and my buddy I was with, he's like, oh, my God, is that it? Is that it? Where the heck?
Darknet Diaries
134: Deviant
It's almost like down and to the right. I said, by the other door? Oh, my God, yeah, that's where they put it.
Darknet Diaries
134: Deviant
It has a request to exit sensor or REX sensor. These are sensors are very common in physical access control environments, which will detect egress events, impending egress events, and they do it through motion sensors. Most of these are infrared, simple passive infrared sensors. If they sense a change in temperature, they presume that must be an individual making their egress from the building.
Darknet Diaries
134: Deviant
Okay, no problem. So how can you exploit this? If you're on the outside of the building, do you throw a fire stick under the door, like a road flare, make it hot? Well, you don't have to do anything quite like that. What you can do is take a can of compressed air, or if you're very fancy, you go to a scientific supply shop and you get a can of like tech spray or freeze spray,
Darknet Diaries
134: Deviant
The idea being if you spray into the air a little cloud of propellant, a little refrigerant cloud, it will boil off in the atmosphere and make a very cold patch of air. You can do this to open doors. You stick the little straw through the door crack, blast, and all of a sudden you hear a click. Oh, that's the lock. Okay, the lock is released. Open the door.
Darknet Diaries
134: Deviant
This was like that, although the position of the sensor was much further down in the vestibule. It was a double vestibule kind of door. And I said, oh man, I'm trying to spray the air, spray the air. And we literally killed one can of propellant. And I said, oh man, we're going to have to go back to OfficeMax or something. Eventually...
Darknet Diaries
134: Deviant
I was able to rig up a long, skinny straw that I could feed all the way through, kind of snaking it down this vestibule, and almost like a wacky, waving, inflatable arm of a flailing tube, man. It's... Looking way down at the end of the vestibule, you see this straw spinning its way all through the floor and this cloud going everywhere, and the door finally popped open.
Darknet Diaries
134: Deviant
You went under the door. We had to go all the way under to keep it as straight as I could on the floor, and it wanted to curve around. But eventually, I got this door to release. So you hear a click, and then you know the door's unlocked. Thank goodness, too, because this was a good 45 minutes of poking and prodding and going back to the shop. Okay.
Darknet Diaries
134: Deviant
And we find a little conference room thing. And I said, okay, look at the, oh cool, Polycom phone system. And there's an RJ45 connector. I said, do you want to try this jack? And he looks in his backpack and he goes, oh no, I didn't bring the Dropbox.
Darknet Diaries
134: Deviant
You go back. You take the keys. Here you go. Take the car. Go back to the hotel. I'm not leaving the building. We took so long farting around with that door. I'm going to stay in this building. I can just let you back in.
Darknet Diaries
134: Deviant
when you get here and he's like man i mean the hotel's 10 minutes away and i gotta get the thing come back that i could be gone half an hour you're just gonna sit in this conference room i said no i'll find somewhere to hide so what i did is i chose to look around a little bit and i was looking for kind of an empty office or maybe a janitor's closet those are nice if the janitor's not around you can break into the janitor's closet and just sit in there silently because the the guards aren't going in the janitor's closet the staff aren't going in the janitor's closet
Darknet Diaries
134: Deviant
If a janitor comes along, you gotta, you know, say, I just had some anxiety. I work here. I needed a place to chill. Or pretend you're doing drugs. I don't know. And you say, I promise I'm going to rehab. Don't tell me. Don't narc on me, buddy. But no, I didn't find any good closets or anything. I found an elevator. And I said, okay, well, we got an elevator.
Darknet Diaries
134: Deviant
It's got no windows in the elevator cab. No, I didn't see any cameras. I'm just going to stay here, bro. And he's like, really? I said, yeah, I'm going to put the elevator on independent service, which is like a local admin mode that removes it from general dispatch demand around the building. So this elevator cab will not answer hall demand that other people might be registering, placing calls.
Darknet Diaries
134: Deviant
I said, I'll just stay in the elevator. There was even a little locked panel that I popped open. And I said, there's even a little power plug in here. I can plug my phone in. I'm just going to hang out. I could just scroll Twitter, read posts on the internet. I said, you go to the hotel, get what you got to get. Message me when you're on your way back. I'll let you in.
Darknet Diaries
134: Deviant
I thought this would be half an hour of me just getting paid for free. It turned into hours. And I was like, I was messaging him like, hey, man, did you get to the hotel? Did you go to the wrong hotel? What is happening? Are you, did you fall into a bathroom? Do you have some bowel distress? And so I'm thinking, what is going, finally, I got an answer. where he's like, yeah, it's not going well.
Darknet Diaries
134: Deviant
And I said, what's not going well? And he's like, I'll tell you when I get there. He was found a little frustrated. I said, hey, I'm getting paid by your company either way. I'm on the clock. Back to Twitter.
Darknet Diaries
134: Deviant
Then, suddenly, I hear this really, you know, boom, boom, boom, boom, boom. This pounding noise sounded like it was on the hoistway doors, just someone banging on the doors of the elevator. And I went, holy crap. Do they know I'm in here? Have they spotted me? And I'm looking, maybe there is a hidden camera. What's going on? And I said, no, calm down, calm down.
Darknet Diaries
134: Deviant
It's like if you're camping, everything sounds loud in the woods. A deer could walk through your camp at night and you think it's a bear. But I said, no, all right. I look at my phone. All right, it's like after five at this point. This has got to be the cleaners. They must be, I don't know, getting fingerprints off of the Hoistway door chrome or something. I don't know.
Darknet Diaries
134: Deviant
But I just said, no, it's fine. And I stayed in there a little longer. I really wanted to start to use the bathroom. Thank goodness my buddy's like, all right, I'm coming back to the hotel. I'll be there in a minute. Okay, elevator back to automatic. go back to the lobby, open the doors. And I said, I'm right near the vestibule. I'm going to head toward it.
Darknet Diaries
134: Deviant
But just, I don't know what made me turn and look as the elevator was shutting itself automatically. I noticed that there was...
Darknet Diaries
134: Deviant
literally a notice that somebody had taped on the doors because I had been sort of in between two floors I've been a little bit off platform but I could hear I was right near the lobby level they were in fact hitting that door but they were it was a security guard taping a notice that said this elevator out of service yes we're aware of it we're looking into it please use you know elevators on north bank of the building and I went oh man somebody noticed I was in there just thank goodness they didn't think I was there I let my friend in
Darknet Diaries
134: Deviant
He's in the building now. Thank goodness we didn't have to fight with the long straw. All right, back to the conference room, back to the conference room. Okay. And we barely got six or seven steps down the hall when around the corner, we see a guard. Because now we're the only ones, now it is a little weird. At this point, yeah, what are you doing? It's after five, this place is dead.
Darknet Diaries
134: Deviant
And the guards look at him, look at me, and my friend is like, oh, what's going to happen here? The guard immediately saw that I had, because I was in the elevator for so long, I had put a little badge on that just said Otis. You know, I have a variety of little badges in my kit. And he went, looked at me, looked at my Otis badge, and he went, oh, you guys got here fast.
Darknet Diaries
134: Deviant
And I was like, yeah, I heard there was a report. And I, you know, I just, I lie for a living. I just dropped into it. My friend, I don't know if he was nervous or not, but I said, yeah, I heard you had a problem with one of your passenger elevators today. They pulled us off of some other job because you're paying for this elite care service.
Darknet Diaries
134: Deviant
You've got a good tier of service package with us here at Otis. Point me at the problem. Let's get you squared away. And he proceeds to lead us right back to that elevator where I had been with the notice still taped on the door. And he's like, this frigging thing, I got calls all afternoon. So now I like this. I like that this guy, he's invested in the problem. He's invested in it being solved.
Darknet Diaries
134: Deviant
And I said, oh, man, and it's the only elevator in the bank. You don't even have other cabs. Your phone must have been ringing nonstop. He's like, oh, well, there's not a lot of people in here, but they still let me know about it. I said, well, let me see what I can do, sir. I pull out my keys. I still have my keys. The keys will turn, obviously, in all the key switches.
Darknet Diaries
134: Deviant
So I have the trappings of legitimacy where I, A, look like I have credentials, B, B, I'm sympathizing with his problem. I can express familiarity with his problem. And then C, I am pulling, casually pulling implements out of my pockets that clearly work in the system.
Darknet Diaries
134: Deviant
If you were in a parking lot and you saw somebody with a red blazer and you thought they might be a valet and they say, oh, is it really busy in the restaurant tonight, sir? And then they are holding a key that opens a car door. Well, that's gotta be the valet. They're doing all the things that I've seen valets do. So this guy just thought, well, he's obviously the Otis guy.
Darknet Diaries
134: Deviant
And I'm rattling off some techno jargon and I'm turning key switches that don't do much, but I'm claiming, oh, I'm resetting the door sensors. Now this will reboot the door operator if we hold it for three seconds. Here, let's everyone step into the cab for a second. Let's let this door close. So now we're bringing the guard with us and the doors close. And I say, all right, well, that's good.
Darknet Diaries
134: Deviant
Let's try door open. No, we're still level. We're not misleveled. Sometimes a mislevel event can cause the doors to jam. Let's try to go up a few floors. So he just starts taking us up to other floors, floors that I didn't have credential access to. But he's going up floors and we're stuck in platforms pretty well.
Darknet Diaries
134: Deviant
I'm pretending to measure the platform leveling because, again, I have just enough industry knowledge to speak to what you're expecting a technician to do. I'm actually a, you know, I'm a trained life safety fire door inspector. Not because I do that for a living, but because I can walk around a building. If anyone catches me and say, what are you doing in here?
Darknet Diaries
134: Deviant
I can say, what are you all doing in here? Because these fire doors are not to code. And I can rattle off all the different, the signage is wrong. The glazing is this. You can't have appurtenances that interfere with that. So I look like a technician. We're getting up. We finally get to the top floor, which is a really juicy floor in this building. And I say, let's walk around for a minute here.
Darknet Diaries
134: Deviant
You said there's another elevator. I'm pretty sure this one's fine. But let's try the South Bank elevator, the North Bank elevators. And now the guard is so used to being in our company that even anyone else who's in the building who sees us on camera or in person, well, this guy has been with the guard, so he must belong here.
Darknet Diaries
134: Deviant
And I start spinning a story about, do you have a room with a bunch of computers in it? Because your elevator controller would be in that room. It would not be in that room. I said, but where's the elevator? I can look for the error log data on the elevator controller. We can try to troubleshoot it because you don't want to have us coming out here again and again.
Darknet Diaries
134: Deviant
Those stoppages, that was no fun for you. So yeah, the guard took us to, he's like, well, I walk around every night and this is the one room. It's got all these fans in here. So he takes us and I think my badge works. Boom. And he badges us into the server room. And I say, all right, well, you help me look.
Darknet Diaries
134: Deviant
There's going to be a bright neon green server, which is, again, I'm making that up, but I'm giving him a wild goose chase. Do you turn to your buddy and be like, this is the moment.
Darknet Diaries
134: Deviant
You need to go now. He was tracking at that point. He knew it was up, and he was amazed that it was working so well. But he was ready to go. A good friend will see you lying, and it's all improv. It's all yes and. You just go with it. You build the world with them that they're trying to build.
Darknet Diaries
134: Deviant
So my buddy, he had the Dropbox kind of under his arm like it was a multimeter, ready to plug into something. And the guard goes down one aisle. I go down another aisle. Do you see it over there? And my buddy, of course, he's plugging stuff in. He's plugging in flash drives, watching, you know, documenting. And the guard eventually says, well, I can't find it. We can't find it.
Darknet Diaries
134: Deviant
I said, all right, that's all right. You know, it's working for now. I'm going to write it up. I'm going to write it up as a priority ticket. We'll get you squared away. What was your name again? And he gave us a name. I said, okay, well, we're going to walk around, just check. There's a few other lifts and other buildings.
Darknet Diaries
134: Deviant
If anyone else is on premises and they ask what we're doing, I'll just tell them to talk to you. But thanks for all your help. It's all good. And he was so happy that, yeah, we stuck around. Just in case we got challenged, because you want to give the client a win. You want to try to see, will anyone push back on you?
Darknet Diaries
134: Deviant
It's not about getting away so clean and so, if you work for the government and you're spying on a foreign adversary, sure, you want to get away and not experience a mortuary event. But if you're doing a corporate test, you want to see what their reactions are. If this staff didn't catch you, interface with a different staff member. If this building didn't stop you, try a different building.
Darknet Diaries
134: Deviant
Where are the good as well as the bad in their security posture? But yeah, we wound up walking everywhere for quite a long time. We got into everything at that facility at the end of the day, and digitally and mechanically and physically, yeah.
Darknet Diaries
134: Deviant
It was a small town. So this was a company doing large sort of, you know, blue collar industry in a small town where I'm not from. And the only thing I got going for me is that I'm a middle-aged white dude. And that's where my flex ends. Because I don't know people in this town. I can't speak to the widgets and wonkets that they pack into boxes and parcels and drive out on a big rig.
Darknet Diaries
134: Deviant
She's amazing. She's a dog so perfectly trained. You could let her off the leash. And she knows commands where she could, you know, run and just kind of be hidden in the woods. And so now he's a guy walking around with a leash. And who doesn't want to help a guy with a dog leash? Of course, you got that beautiful dog of mine. So eventually, you know, he'll call, she'll come running out.
Darknet Diaries
134: Deviant
The goal was to demonstrate access to, quote, sensitive areas. We had a list of sensitive areas, manufacturing areas, certain people's offices that were in charge of critical functions. If we could demonstrate, we could tamper with end product before it goes to market, that would be bad. No, no, you just tamper. It means you touch hands on this one machine or this one package and take a picture.
Darknet Diaries
134: Deviant
So why don't you think you can get in? What's the what's the thing there that you're like? It was a small crew. I mean, it was maybe a dozen employees on any shift and everyone knows each other. And it's not an environment that was open to the public. So it's not like customers or visitors were coming and going, which is much more common in offices, you know.
Darknet Diaries
134: Deviant
Yeah, if we were on site, not to mention we had to read all their briefing materials on their OSHA regs and their best industry practices. So if you're in a production environment, you've got the hard hat here, you've got this, you've got the earplugs. Otherwise, the foreman will be saying, who is that person? Who let you in here? Jag off. So we wanted to minimize contact with humans.
Darknet Diaries
134: Deviant
We would go at night, we said, and we would try small town America, you play to what you think is going down, you say, it's either gonna be Saturday night football or Sunday everyone's maybe at church, I don't know. So Saturday night, we started to weaken the target. So we'd approach. We would remove card readers from their mounts. It turns out there was an open campus.
Darknet Diaries
134: Deviant
You could walk onto the grounds. There were no fences. But we would remove card readers from the wall. We would install little interception devices behind the card reader, put them back on the wall. It's a device called an ESP key. We're going to check a few doors. The doors are all tight as a drum. We'll compromise the card readers.
Darknet Diaries
134: Deviant
Hopefully, somebody coming or going on a late shift, because they worked in three shifts, maybe someone's going to use a door and we'll be able to compromise the credentials when we come by tomorrow. Sunday, we asked, do you have any hours on Sunday? They said, no, it's pretty thin on Sunday. Okay. I mean, production environment, the actual factory was running, but the offices were dead on Sunday.
Darknet Diaries
134: Deviant
We did okay. Come by Sunday morning, and we drove by the parking lot, just pulled in and pulled out enough that I could dump the remotely. I could radio into the interception devices. I got some credentials.
Darknet Diaries
134: Deviant
And as we're there... My buddy, the guy who has the dog, he didn't have the dog at this moment, but that one partner, he's like, I'm just going to take one more walk around, just kind of see the factory. I'm going to get myself a little coffee or something. And he comes back to where we were as I'm making these badges. He comes back 20 minutes later. He's like,
Darknet Diaries
134: Deviant
this is going to be interesting, man. I just stuck my head in at the post office. Everybody knows. Hey, Frankie, Sally, how you doing, Bobby? And it's like, if we run into anybody, it's going to be a record scratch. It's going to be weird, man. But we said, all right, we've done this. We've been in hard jobs before. Let's go, everybody. We pull into the parking lot.
Darknet Diaries
134: Deviant
We had some PPE and hard hats kind of with us looking vaguely factory-ish. So you're looking like employees that should be there or technicians visiting? Just looking like employees. If anybody literally, like if a town cop was going by, we're like, they'll think we must work here. We look like blue collar workers. And sure enough, nobody, no police. It was right on Main Street.
Darknet Diaries
134: Deviant
It was a tiny, tiny town. But this factory was right in the middle of town. It was the only thing in the damn town, honestly. So, boop, card reader works. Okay, we get in one building. Thank goodness we're inside. We're walking around. Once you're inside, a lot of buildings, security's a little weaker on the inside. You can get into offices. You can slip a latch. You can pop a drawer open.
Darknet Diaries
134: Deviant
We found a company trucker cap. Somebody took a company jacket. Again, just you're looking a little more like you belong there. And the thing is, the badges we made, we had seen long distance photos of their badges. So I had pre-printed these badges with their logo and everything in roughly the right place to look, the badges look the part and the badges are opening doors.
Darknet Diaries
134: Deviant
But within maybe half an hour, we hear one of my teammates come around. He's like, hey man, someone just pulled into the parking lot, not to the factory. Somebody pulled in and they're coming into this office building, which no one is in this office building at this Sunday. And we're like, oh, well, we just look like we're working here. We sat kind of in the break room area. And this guy comes in.
Darknet Diaries
134: Deviant
He must have been 56, 57 years old. He's like, how do you do, gentlemen? I said, hey, how's it going there? can I ask what you're doing in the office today? And the vibe was instantly off. We said, oh, you know, we're just checking a few. We had a story. I think we said we were doing an environmental audit. We were checking door seals. He was in the building? He was already in the building.
Darknet Diaries
134: Deviant
How did he get in? So he clearly worked there. Okay. And we could see on his hip he had a badge. And we said, no, we're just checking some door seals. There were some door closure issues. And for regulatory compliance, you have to keep products separated, blah, blah, blah. We had a bit of a story. And we said, well, you know, we'll get out of your hair. We're just leaving this building anyway.
Darknet Diaries
134: Deviant
And we kind of left the building. And the guy didn't quite vibe on that. He was looking at us a little weird.
Darknet Diaries
134: Deviant
And then we, in the new building, we're like peering out the windows through the blinds. And this guy walks to the parking lot where the guy's going to get in his car. Nope. Walks by all the cars, walks to the building we just got in. We're like, oh my God. And we hear him start walking around this building. And at this point, we're pretty sure we're roasted here. Two of us break off.
Darknet Diaries
134: Deviant
One guy goes, he meets two of the guys in some other hall. He's like, excuse me, gentlemen. I'm going to ask the same question I asked before. What are you doing in this building? And we said, well, we're doing this. He's like, no, no. Who hired you to do this job? We said, well, it was Francis. Francis in HR. She brought us. He's like, I don't know if Francis would have brought you on.
Darknet Diaries
134: Deviant
I'm going to have to try to call Francis. And he couldn't reach her. And as he's dialing, it was like, no, no, come on. Was Francis Award you made up? No, we knew. We checked their staff. We knew some staff. We said, no, Keith at the Wyoming plant, Keith knows that we're here. He's like, I've been working with Keith for a long time. Keith might have said something about new folk.
Darknet Diaries
134: Deviant
I haven't heard that. I can call Keith. So we're like, oh my God. And eventually after he's getting, he keeps trying to dial phone numbers on Sunday. And we realized if he's not going to reach anybody, he's going to just call law enforcement. This was not going to fly.
Darknet Diaries
134: Deviant
He said, I know that person, but I'm going to call her cell phone and not the number that you've printed here. So as it turns out, and we spoke to him, he said, okay, all right. Well, if you say so. All right, Susan, you know.
Darknet Diaries
134: Deviant
But he's like, well, I was driving by. He wasn't even on site that day, but I was driving by and I saw a couple of you boys entering the building just as we were just getting into a door. He's like, it didn't feel right. So I got a block or two down the street and I turned around and came back.
Darknet Diaries
134: Deviant
Who the hell gets past their office and has that much emotional investment to go, I should go back to the office and see what's going on. He drove all the way back in, parked and started checking around buildings till he could figure out why were these fellas he didn't recognize from 200 yards away. Why are you in my building? He had worked for this company for something like 38 years.
Darknet Diaries
134: Deviant
And he had emotional investment in the company. The company mattered to him as a person. And he was not going to take anybody giving him a line. He said, no, I want to know what you're doing. It felt like if someone was in your backyard... and they said, well, I'm just trimming your trees for your neighbor. But they kept kind of walking through your backyard.
Darknet Diaries
134: Deviant
You might be like, I'm going to knock on my neighbor's door. Why is this person in my backyard? So that's what happened. And that was the first time we ever had to show the action. And we knew, we could have had a fake letter, but we're like, that's not going to fly. This guy, he is switched on, he is sharp, and he got quite a little kudos out of that. And he was professional the whole time.
Darknet Diaries
134: Deviant
Didn't try to tackle us, didn't make threats, just kind of slowly plotted after us.
Darknet Diaries
134: Deviant
We went to have lunch. We did come back and we only made it in again. gosh, 45 minutes, an hour, until we ran across some other person. And I didn't even interact with this person. This was just in a production of, I just kind of walked past them. And they almost on their heels turned and spun and said, hi, can I help you? What are you doing in this space? And we were like, son of a bitch.
Darknet Diaries
134: Deviant
But that was a great day because we, you know, this little Nowheresville facility, they had a really sharp, head of security, who had been coming to DEF CON and Black Hat, watching talks like mine, really investing and upgrading their locks and their access control credentials. And even after that, he's like, oh, you did clone, you made the ESP key. We're going to revamp our backhaul protocols.
Darknet Diaries
134: Deviant
For a little nowhere factory in nowhere. Nowhere. Not subject to threats and not subject to robber. The most threat they probably have is people trying to break in and, I don't know, steal copper or something. You know, like rural threats are not the same as an urban environment where you have a lot more
Darknet Diaries
134: Deviant
potential risk of different kinds but no this one guy he was really all about it and he took it to heart he taught he had a lot of buy-in from management and everyone was just they were pleased and proud of their people we told them keep investing in your people they like it here make sure they keep liking it here because they are the best line of defense that we've ever come across you were caught um do you consider this a caught do you consider this a fail does this is this the only time you've ever been caught or have you been caught before
Darknet Diaries
134: Deviant
I will consider it a caught. I won't consider it a fail because if you're doing your job right, this is the best success you could have. We got caught for all the right reasons, and I'd like to get caught like that much more in the future by companies that have employees that... actually care about what's going on.
Darknet Diaries
134: Deviant
The only way you get that is if you have a real nice environment where you're treating people well, not just as meat grinding through the mill, right? You actually have to make people want to work there by rewarding them, by paying them properly, by giving them real benefits. That's the only time we've been caught and didn't bluff our way out of it, talk our way out of it.
Darknet Diaries
134: Deviant
Most of our jobs, we get a list of sensitive assets or sensitive areas from the client. And we say, what, you know, would accessing this asset or being in this space represent a severe breach? Would a bad actor in this space have the ability to severely compromise operations or cause severe impact? Once you have that list of assets, you formulate a series of attack chains.
Darknet Diaries
134: Deviant
You sit with your team after a lot of recon, and you say, all right, so do we think it's smart enough to go to this one first, or should we try to go through this one? We've identified where these assets are, which parts of the buildings and the grounds. Okay, so which team is best suited to position here, here, here? And you come up with a plan. And if one team gets burned,
Darknet Diaries
134: Deviant
You'll say, okay, well, that team is – all right, they might have gotten noticed, might have not. Let's pull them back. Let's get off campus. They just became Overwatch. They're running a drone. They're running long-range cameras. They're back at the base on radios. Let's put another team in. We do a lot of rotating out of rental cars where you go back to Hertz or National or somebody.
Darknet Diaries
134: Deviant
You say, oh, this car is pulling to the left a little bit. They say, we have another one. We said, do you have a different model, maybe a really different color? Because if somebody's seen that weird car in the parking lot. So there was a job like that. It was meticulous. And we had, it was a large job. There were probably three or four different field teams at any given time of pairs of people.
Darknet Diaries
134: Deviant
Okay, so who are you and what do you do? My name is Debian Olaf, and I am a physical penetration specialist. I have been involved in lockpicking, safe manipulation, physical entry, physical bypass, and teaching about covert entry tactics for... Well, well in excess of 10 years at this point, we'll say it that way. Much longer.
Darknet Diaries
134: Deviant
This job was the kitchen sink, man. This job had case upon tons of Pelican cases shipped in. It was close enough that I could, it was many states away from where I was at the time, but I was living in Montana. I just said, I'll drive. If the budget's there for me to draw, I'll make it a couple day drive. And my truck was, I mean, we brought the works, man. We had a 3D printer in the Airbnb.
Darknet Diaries
134: Deviant
We had a couple of our really large key machines, our exotic key machines, just in the Airbnb on the living room table. We were ready for as much as we could be.
Darknet Diaries
134: Deviant
We're all cross-disciplined. Babic is very electronic-focused. Of all the team members, he is the highest strength among us in the electronics department, especially as it relates to access control technologies, credentialing technologies.
Darknet Diaries
134: Deviant
He gets good information from a lot of the industry sources and partners where he'll get the new badge printer that somebody's just pioneering, and he'll get a sample model of that, and we'll try it out. Drew came along for this one. Drew is our main surveillance person. Drew is an incredible person with camera glass, drones, you know, ultralight aircraft.
Darknet Diaries
134: Deviant
He is the eyes on the ground and in the sky. They called in Sophie, too. Sophie is a devastating social engineer. Robert was another key player here. Robert is an incredible physical tactician, along with being personable with people at the drop of a hat. I mean, he used to be a cop, right? So he can lie.
Darknet Diaries
134: Deviant
through his teeth, with a smile on, and his job is to manipulate you as a human because he's going to get what he needs and he's going to get it out of you for information or he's going to get out of your sights because he wants to move. He can be front and center or he can be a ghost. Imagine being called a physical tactician. That's quite the title, isn't it?
Darknet Diaries
134: Deviant
Drew and I reached out to an old colleague of mine named Laz, who was back East. We brought Laz in. We had a couple of interns at the company who wanted to get some exposure to field work. And a lot of times jobs just aren't big enough, but this was great. So yeah, they'd bring the interns. So we had quite the cadre of people and we actually had two Airbnb units right next to each other.
Darknet Diaries
134: Deviant
We had so many people. It was these two little like cabin type houses on some park somewhere.
Darknet Diaries
134: Deviant
That was almost a week of recon. Yeah, that included driving by for the first few days, just a lot of long range camera work in cars, which led to then hikes through fields where it was a lot of Drew and Robert just in I mean, they're in hunter's camo. They're hunters and stuff, right? So they're going to crawl through field.
Darknet Diaries
134: Deviant
They were first walking, and then they were low crawling to get really up close to the buildings.
Darknet Diaries
134: Deviant
And we were all about it. Who gets to do this and not ever really risk getting hurt for it, you know? I think it's a great thing to get to do it.
Darknet Diaries
134: Deviant
And some of that is spoken to in terms of the client's willingness to have a more involved job. I mean, labor is cost, right? So time is money, and they provisioned, they said, no, they were really serious about, they're targeted by foreign adversaries. They are targeted by real threat actors at that point. And an actual threat actor would not think twice about
Darknet Diaries
134: Deviant
spending an entire night just in, belly down in the dirt with long range glass, learning which employees go through which doors at which times and when the security patrols come around and when they don't.
Darknet Diaries
134: Deviant
He's like, yeah, yeah, you spotted the spotter. Cool, yeah. We have it pretty masked, but you must be, he's like, you must have been really close. I was like, yeah, we were right up against that fence line. He's like, okay, yeah, you know, you got it. You got it. Don't approach from the west side. You spotted that one.
Darknet Diaries
134: Deviant
Because again, let's say you're the Chinese government and you got a guy laying in the dirt, crawling up to a fence line, and then this guy takes some pictures and you say, well, look at those technology. Are they using, oh, oh, that's RF. They're using spotter RF. It's a way of looking for motion sensing in a field.
Darknet Diaries
134: Deviant
I was a network person. I was a computer person. I was like a lot of people in the tech world, mostly making my living on a keyboard. And I liked locks and lock picking and door bypassing. I knew about these tactics. It's a very common hobby. But that's, you know, that's your avocation. But I had clients. There was a law office in town. The law office had a sysadmin.
Darknet Diaries
134: Deviant
And if it's the Chinese government, they would then back off and they would say, okay, let's spend another two weeks figuring out who sold it to them. Let's figure out which version they have, what its coverage is. Whereas for us, we just signal message. We said, hey, I found this. Is this what I'm seeing? They say, no, yeah, yeah.
Darknet Diaries
134: Deviant
We're not going to make you charge us another week's worth of effort to go get a sample unit, you know, and set it up in a lab and figure out the exact distance and range that it covers. It doesn't match the manufacturer spec. So it's a week of that. It's a week of getting close, taking pictures, coming back to the Airbnb, analyzing. Who's this guard? Is this mobile too?
Darknet Diaries
134: Deviant
No, he was, well, he was on foot yesterday. No, the guy on foot was in a, okay, no, this is the guy in the truck. Let's make a name for him. You make up names. It's like a pinboard, like out of a detective show, right? You got a wall of people. And one really great photo of a guard looking at us through these binoculars. Yeah, that guy, we printed that photo out a lot, put it around the Airbnb.
Darknet Diaries
134: Deviant
So some of those guards are really switched on. Well, because he couldn't see us, but he saw something and he was like, what's that? And Rob and Drew just stood stock still in the dirt in their ghillie suits for like an hour.
Darknet Diaries
134: Deviant
The work involved in setting up a fake profile is non-trivial. It's really hard to create like a fake LinkedIn or a fake anything these days that looks legit. I mean, you need to have history there. You need to have connections. It's like planting crops. You have to create these profiles and then you water them.
Darknet Diaries
134: Deviant
You come back and you connect and you make posts and you connect to this people and you endorse that person. Months and years later, these are now fully formed and you can maybe use one of them on a job to connect to other people. But if you get burned, well, that's all right. There's a year and a half of work that that profile is roasted. Yeah.
Darknet Diaries
134: Deviant
So the fact that she has access to these and she made those connections to find out what was going on and can, let's, can I share your profile so I can see your photos from the job? Okay, now you got the access to the private photos. Oh, that's the company's having a pizza party on Friday, that kind of thing.
Darknet Diaries
134: Deviant
So we determined that it was feasible to get through the fence line. In fact, as a proof of concept one night, a small team did that. They crawled up to the dirt berm where the earth had been compacted, but not quite enough in one spot. And they trenched under the fence. They just dug and dug with small entrenching tools, and they're pulling out rocks.
Darknet Diaries
134: Deviant
And they proved you could slip under the fence. And they just took a picture of one guy on the other side of the fence and then came back. that's not super practical. We knew this was still a site that was being built out. And we told our point of contact, we said, hey, just so you know, we proved we did this. The shake sensors in the fence didn't catch us.
Darknet Diaries
134: Deviant
He said, nope, I bet I can tell you, which you were probably on the north side, that's all gonna be concreted in. The footer of the fence, it's still being built. We said, okay, well, it's a data point for the metrics. But we're not going to treat that as a standard entry point.
Darknet Diaries
134: Deviant
Small to medium business, one-stop shop, single guy in an office. He ran the show with the IT. And he just sort of rage quit one day. Just, you know, table flip, I'm out of here, and slammed his office door. And it was a pretty crappy law firm, so I'm not surprised. But... When he left, the staff kind of looked at each other. I don't know if he's coming back.
Darknet Diaries
134: Deviant
It's like visiting, it was non-military, it was a civilian compound, but it's like a military base, right? If you have a working credential, you drive up to the vehicle checkpoint, they see it, you boop it, and you go. If you don't have credentials, you're going to the visitor's building, the tiny shack, and someone is coming out and dealing with you.
Darknet Diaries
134: Deviant
And without a credential, you're not getting in. But there's always some exploits here, right?
Darknet Diaries
134: Deviant
And we learned, we said, okay, this is interesting. This is interesting. Look at this. Let's look at what happens here. You drive up and staff were holding their badge up at like the clearly they're presenting a badge to the guard who visually kind of would nod at it.
Darknet Diaries
134: Deviant
Then they would drive further down, a good 10 yards, past the little overhang, and there was a badge reader sitting out in the middle of the, just like unattended. There's just a big badge reader on the, and they would, boop, they would badge that, and then a vehicle gate, a gate arm would open up. I said, that's an interesting thing. That's an odd thing. Then we said, well, look at that gate arm.
Darknet Diaries
134: Deviant
Look at that gate arm. Many gate systems... will use ground loop sensors. Much like when you pull up to a stoplight, it knows your car is there because it can detect the metal of your vehicle and it'll cycle the light. A lot of gate systems use these. A very typical configuration would be, the most common one is a stop or safety loop.
Darknet Diaries
134: Deviant
Right in where the gate arm is, if a vehicle stalls out and sits there for some reason, the gate arm won't come down and hit the vehicle. You don't want to damage anything. That's typical. You might have an entry loop so that once you pull up, the gate arm just doesn't operate unless somebody boops their car. You can't walk in on foot. This is not a pedestrian entrance. I'm sorry, you need a car.
Darknet Diaries
134: Deviant
If you're a pedestrian, go to the pedestrian entrance. It's around the fence over there. This is a very common problem for certain motorcyclists or bicyclists. People on bikes sometimes don't have enough metal to trip the ground loops depending on how they're built.
Darknet Diaries
134: Deviant
But the real one, and this is the one that a lot of buildings do not use, you got an entry loop, you got that stop loop, the safety loop. There's also sometimes a clear loop. Clear meaning you have cleared the checkpoint, bring that arm right down. It costs money to install these. You got to cut into the asphalt and you're doing, you know, everything's money.
Darknet Diaries
134: Deviant
A lot of installations, this one included, chose to configure it, well, we don't need a clearage loop. We'll just, the arm goes up, there's a dwell time, and after that, it'll just drop down, unless there's somebody stalled out. So they were using a dwell time, and the dwell time was set to like, gosh, it was like 20 seconds. It was long. We're like, okay, this is news we can use.
Darknet Diaries
134: Deviant
So our plan was, we're going to tailgate in We're going to tailgate in behind what we think is a real vehicle because it was a long entrance road off the main road to get even to the vehicle checkpoint. Our plan was you're going to tailgate in. We're going to give Sophie in the front seat of the car who looked businesslike. We'll give her a badge that looks like their badges.
Darknet Diaries
134: Deviant
Are we supposed to do something if that happens? Because he's got all the passwords. He's like, what are we doing here? And of course, you do need to put a plan into place.
Darknet Diaries
134: Deviant
We knew what their badges looked like. It's a multinational company. We've seen their badges in other facilities. We don't have their badge technology. They were using private keys on their credentials, so we couldn't easily clone their badges. But Sophie could pull up and smile at a guard and hold up a badge. Then she's tailgating behind someone's vehicle, literally tailgating.
Darknet Diaries
134: Deviant
As that person boops the reader and goes through, Sophie would pull up, pretend to boop the reader. Again, that's 10 yards away from the guard shack. They can't hear a beep noise. And then before that dwell time finished, she would hightail it through. And if a guard was really sharp, they might be like, oh, that gate came down kind of quickly after that car.
Darknet Diaries
134: Deviant
But nobody's going to be that sharp, we said. All right. Now, the critical thing, we said, we need about three or four, we need different ways to have you peel off if there's a problem. The first thing is there's that construction lot, right, where I parked to get the footage.
Darknet Diaries
134: Deviant
We said if for some reason the car you're tailgating isn't a regular employee, if anything goes wrong, if they ask for directions, their lot, who the hell knows, just pull into the construction lot, K-turn, and get out of there. It's a little weird, but who cares? We'll roast that car. We'll switch the car out. We'll regroup. Let's say you're fine.
Darknet Diaries
134: Deviant
Let's say you get past, like you hold your thing up to the guard and the guard looks at you and says, hey, you know, do you work here? Do you not work here, et cetera? You say, no, I'm new here. So if you're bad, you know, you can social engineer that if you had to. If you say, you know, oh, I'm lost or is this not the main answer to the visit? No, I just started. Okay, we'll pull over there. Okay.
Darknet Diaries
134: Deviant
Figure that one out. The last one was a really slick one. We said if for any reason you get trapped at the gate, like let's say the arm starts coming down and you're like, oh, shoot, I can't tailgate in. We had printed a nearly identical badge. It looked very similar, but the logo was another company in town.
Darknet Diaries
134: Deviant
It was out in a rural area, but it was another big firm that had a warehouse or something, a fulfillment warehouse in town. And we said, pretend to boop and say, my badge isn't working. And make the guard get out of the shack and walk over. But she would switch the badge. And it was on this red lanyard. And she's like, my badge isn't working.
Darknet Diaries
134: Deviant
And so the guard would go, oh, is this the badge you just showed me? No, I'm sorry, ma'am. You've got to go down the road another few miles. You're in the wrong place. Oh, I just started. Duh, sorry. So we had all these little outs.
Darknet Diaries
134: Deviant
It wasn't just her in the car. It was Robert and I were wedged into the trunk of this car. because we wanted to get as many people as we could onto the corporate campus if we could get this to work.
Darknet Diaries
134: Deviant
And all we could feel was just the car kind of rocking back and forth. And we judge, okay, there's some rough bumps. Those are the speed bumps, okay. And now we stop for a sec. That must be the guard. Oh, we're moving again. The guard didn't stop her, okay. And then, okay, we slowed down a little bit. Oh, we're really moving now. That must be the gate arm.
Darknet Diaries
134: Deviant
And we're really, we're jitterbugging along for 10 seconds, 20 seconds. We're like, we gotta be through that gate. We gotta be through, I know we're through that gate. And we eventually hear Sophie's voice like, it's Hollywood, we're through that gate, boys.
Darknet Diaries
134: Deviant
I'm looking at just your standard office, standard, you know, standard regular building. And I'm looking at the doors and the little badge readers, but nothing serious. And we get to this windowless door. the end of the hall, you know, sysadmin, IT room, some network, whatever name badge on the door, but it's just a regular door, little badge reader on the wall.
Darknet Diaries
134: Deviant
She was just charming. She just said, I'm new. She followed a group of people. I'm new here. I just started this week. Oh, did you get the tour? She said, no, there was a tour. We knew that there was a company tour that somebody posted on social media. And we're like, well, I didn't get the tour last week. I heard about that. And this guy who was like, well, I'll give you the tour, little lady.
Darknet Diaries
134: Deviant
So yeah, I mean, he's like, you should check this out. And he's taking her to place. And there were a couple other employees who, One of which even turned and looked at her and went, hey, I know it's a tour, but you can't tailgate. You have to use your badge. And she goes, oh, you're right. And just kind of pretended to boop her badge. And it's not making a sound, right?
Darknet Diaries
134: Deviant
We have little, we have, you know, beep, beep, like on our phones. So if you need to, everyone's on their phones. So you're just kind of, oh yeah, beep, beep. And just, okay, then you walk in. But yeah, one woman literally said, are you trying to tailgate? And she says, oh, you're right, you're right. They told us this in orientation training.
Darknet Diaries
134: Deviant
But yeah, they took her into the heart of the beast, right? She was sending signal messages to all of us like, hi, I'm in this thing.
Darknet Diaries
134: Deviant
Robert and I looked like construction workers. I mentioned there was construction ongoing at the facility. So we had our sort of jeans and steel cap boots. We had some high vis. We had, you know, the helmets kind of clipped to our belts. If you want to throw a helmet on, you can. And we had tools. We had workers tools on us and more in the trunk too.
Darknet Diaries
134: Deviant
So we just kind of walked around the building and started, quote, checking doors. You know, checking the handle. Is this door really locked? But also there's a little door gap checker. It's used when I do fire door stuff. There are tolerances. This is a quarter inch, eighth inch. How much tolerance is this door? You can check it. The door jams in the top of the door and the bottom of the door.
Darknet Diaries
134: Deviant
So we're just, quote, checking doors and pretending to take notes on a tablet. And we're going around and seeing if anybody left the door open or could we tailgate in. And eventually we did. We tailgated in. We walked through some spaces. And between us and another team was able to exploit a similar path. Now that we know, we're like, well, Sophie got in. Maybe Drew can do it.
Darknet Diaries
134: Deviant
Drew's not quite as charming as Sophie, but Drew can drive through a checkpoint.
Darknet Diaries
134: Deviant
And I said, this is, so it's not like a data center door. This is just a regular door. And they said, yeah, but you know, none of our badges work on the door. And we don't like the, we don't apparently even the head, you know, partner doesn't have a key. His key, we thought it was supposed to work. We'll have to talk to building management about that.
Darknet Diaries
134: Deviant
Shocking how once we got past that fence line, we started realizing that no one really challenged us.
Darknet Diaries
134: Deviant
We said, let's just try to be sloppy. Let's just try to like, hey, buddy, hold that door. And, you know, don't be polite about it. And we're like, man, we just keep getting in everywhere. And we kept getting into so many sensitive rooms. We're messaging our contacts and we're saying, hey, we're in here today. You want us to try the thirdware? You want us to try this generation building?
Darknet Diaries
134: Deviant
Okay, try to get in that building. And we're really not getting challenged. So by the end of the week, you're like, we really want to give you some wins here. Do you want us to just start doing stupid shit? Trying to see what level of noise it would take to make the employees at the customer site say, hey, that's not right. I should report this to security. And we were setting off...
Darknet Diaries
134: Deviant
alerts and alarms at that point. We were propping doors open with doorstops that you're not supposed to do. And if it's held for more than 30 seconds, then a guard has to come out and go, why is there a doorstop here?
Darknet Diaries
134: Deviant
At this point, we had literally caused headache on the part of the guards because we had been putting doorstops in and holding doors open and just really kind of, they were like, what's going on? Why are the employees being such a pain these last 24 hours? This day, At one point, I think I took caution tape and I propped the door open and put caution tape all around the door.
Darknet Diaries
134: Deviant
And like, do we take the tape off? Do we not? What are they working on? I put a work order on it that's, you know, because we'd seen other work orders in maintenance areas. An exit door? No, this is an internal door to a sensitive machine room. And the guards were like, do we... And they had to escalate to a supervisor and say, no, take the tape down and we'll figure out who left that there later.
Darknet Diaries
134: Deviant
And we're still not getting quite caught, right? We were interacting with some guards. I said, hey, who took the tape off this door? That kind of, you know. But they kept seeing our badges. okay, so finally we said, what do you want us to, we're on a quick three-way call with a customer. What do you want us to do here, man? We're really trying.
Darknet Diaries
134: Deviant
And I said, okay, well, can I try something for a second? I mean, I'm looking at your doors and I, you know, pick up the equivalent of a TPS report and just kind of rip the cover off of that. And I said, well, here, if I kind of, and I just shoved a, you know, I shimmed the door. I just popped it in, slid, the door popped open. And I was like, well, all right, cool.
Darknet Diaries
134: Deviant
We're trying to, we're walking up to people saying, hi, I'm not from this department. Can you tell me where to go? And no one asked, why are you in here? And they said, well, you said something once about destructive attacks. You can go destructive. What can you do there? You said, could you like drill a door or something?
Darknet Diaries
134: Deviant
I was like, I mean, yeah, there are plenty of things we show to other types of entry trainings we do for first responders or for military. We say, yeah, I mean, we could drill a cylinder out of the door and then you take the cylinder out and then you can pop the door. I mean, we can do that. It'll be noisy and it'll cause some damage. And they said, yeah, yeah, yeah. I mean, we'll budget it.
Darknet Diaries
134: Deviant
We'll say, here's how much you're allowed to damage and try to keep it under that amount. And let's try it on a door or two if you want. We'll pay for it. I said, okay. So we got out a giant, you know, I actually went to Home Depot or Lowe's or something, and I bought a big old blue Makita hammer drill with a big handle off the side, and I bought some high-speed steel bits. And there's footage.
Darknet Diaries
134: Deviant
There's actually footage that Robert shot with his cell phone of he and I in our high-vis just carving away at this lock in this door. And our point of contact was really trying to give his people a win. He's in the sock, and he's watching. And he's watching. He's looking at his people, and he's watching. He said, hey, Chris, can you pull up monitor 17? Can we center stage that?
Darknet Diaries
134: Deviant
And this big scream. He's like, what's going on outside building six? Do we have Sheridan here? Did you see a work order? Are we servicing doors or something on building six today? I thought that building was already stood up. And you hear, you know, like rustling of papers and people are like, I thought they had so much work going on from so many contractors.
Darknet Diaries
134: Deviant
They were growing so much at this site that someone's like, I swear I saw something about that on the pass-off notes. I think we're doing doors. I think we're doing doors today. And he's like, okay. And he kind of stepped back and messaged us and said, no, man, they're looking at you on camera. And you look the part. What are you going to do?
Darknet Diaries
134: Deviant
So, yeah, I just kind of dropped the drill where it was. The door set off an alarm. And I just left the alarm going. I just walked through. But we were trying everything. We were just setting off like a chain of alarms. until guards eventually came to us and they said, hey, you know, fella, you know, stop what you're doing for a second.
Darknet Diaries
134: Deviant
I was trying to underdoor tool a door and not hiding it at all. Just Robert and I stand up and they say, so what are you guys doing here? And they're like, were you working on the side of Building 6? I'm like, yeah, yeah. There was like an alarm. That was really loud. Like, yeah. So what are you doing? What are you doing here, guys?
Darknet Diaries
134: Deviant
And Robert, again, like back pocket, kind of hand on the letter, thinking this has got to be, our ticket is up. And I just hail married. I said, what does it look like we're doing? And that broke the guard's brain. He went, well... It looks like you're working on door, it looks like you're trying to get open this door here. but you have badges. And Robert's hand just kind of comes off the letter.
Darknet Diaries
134: Deviant
Well, cancel the locksmith, I guess, save you a couple bucks there. And I just breeze on into the room. I'm sticking flash drives in and the old Pnordal NT boot tool. I'm rebooting machines and getting, you know, restoring local admin access. Okay. Resetting passwords. I mean, what was his name? Okay. So I see his user. I'm just going to kill his user.
Darknet Diaries
134: Deviant
Let's see where this, and the guy's like, yeah, I mean, you work here. You're obviously on the contract team, but you have a radio, because Robert had stolen a radio from a truck. He's like, you know you can just call for remote unlock. You don't have to have us come all the way out here and bother with it. We came all the way from the other side of the thing.
Darknet Diaries
134: Deviant
So he's like, yeah, no, it's the Sheridan guys. I'm here. Yeah, yeah, warehouse. Yeah, can you open the east side warehouse? He's like... The door goes green. He opens the door. He's like, yeah, see, I mean, you can just do that, man. You must be, you know, don't worry about it. But like next time, just call, man. We didn't know what was going on with all these alarms. I said, oh, thank you.
Darknet Diaries
134: Deviant
Yeah, the story continues to get crazier and crazier. I eventually took a bike, because they had corporate, they had a couple of people who biked into the corporate office. I took someone's bike and just biked it around the parking lot, hoping that someone would report a stolen bike. I took a golf cart and started driving that around.
Darknet Diaries
134: Deviant
And they eventually, because again, we had radios, someone's like, okay, Deve, they're finally onto you. You're going to have some attention soon. And I saw these white pickups with guards start trying to find me in parking lots. They thought I was like a mental case. They were like, is that the same guy? No, he's not wearing the high-vis anymore. Who is that guy?
Darknet Diaries
134: Deviant
And I was just – I was rolling around. And there's like, yeah, yeah, crazy guys on a bike. No, no, no, no, wait. Crazy guys in one of our carts. But it distracted them so badly that I had – it was like – It was like an OJ Simpson pursuit. I was pursued by these flashing light vehicles that couldn't, what are they going to do? Knock me off a bike? Try to ram into a golf cart?
Darknet Diaries
134: Deviant
You can't cause injury. So a bike can go places that trucks can't. I would just cut through bushes or cut in between buildings, and then they would have to like spin around and go driving around the other side. And while I was doing that, the other teams knocked down every target again and again and again. And they took pictures, you know, standing in all the sensitive rooms.
Darknet Diaries
134: Deviant
because everyone's eyes was suddenly on crazy guy. Yeah, at this point, nobody cared about trying to mask door sensors. It was so many alarms that it eventually was a supervisor who was off site that day. It was his day off. And his phone, his work phone was like lighting up with a light. And he went, door 21, door 17, door 17 again, door 17 again, door 55, roll up door 76.
Darknet Diaries
134: Deviant
He's like, what is going on? And he tried to call. No one would answer. He drove in. He lived, you know, a town over. He drove in, kind of burst through the doors of the security side. He said, what is going the F on? And he's got a bunch of guys looking at this. This crazy guy is on a bike, sir. He's like, I don't give a damn about that guy. Is he at a parking lot? What's all this?
Darknet Diaries
134: Deviant
And he's looking at all the alerts. And they go, oh, really? Something going on? He's like, look at your screens. There's all these red entries in Linnell Access. There's all these failed events. There's all these door entry events. So we heard squawks on the radio start going out that said... Mobile 6, you watch Bike Guy. Everyone else, return to your guard tours. Cancel all superfluous business.
Darknet Diaries
134: Deviant
There might be maybe backup accounts he made for maintenance, but I don't see immediately a way to... that he's getting in, you're probably fine. I'll send you a bill. We're pretty good, man. And I hand, you know, here's your piece of paper. So here's your new root passwords. And the guy, you know, the keys to the kingdom, he takes it. He goes, yeah, yeah, sure, root password, sure.
Darknet Diaries
134: Deviant
Challenge all unknown parties. Figure out what, there's more afoot here. Some guy even said Bike Guy may be a distraction. And that's what it took. That's what it took to finally get them to start challenging our teams. And that was, at the end, I just kind of got off the bike at one point and now these, like, all these trucks pull up and they all jump out and like, what are they going to do?
Darknet Diaries
134: Deviant
Again, they're not cops. They're not allowed to shoot you or go hands on. And they went, sir, could you please stop? And I went, I'm stopped. I'm perfectly fine. What's going on, fellas? Having a good day? And they asked me to sit down, and I'll have a seat by the curb. And I said, this might explain it, and I hand them a letter.
Darknet Diaries
134: Deviant
And then some of the guys were former service members, and they said, oh, all right, it's an exercise, boys, look.
Darknet Diaries
134: Deviant
Yeah. Hopefully some people out there start seeing it this way too. It's not a bad way to be. You don't have to live in fear. You just live in awareness. I'm a fan of Amanda Palmer. She's a cool musician and poet. And she talks about how it's not the job of the artist to make you feel joy all the time. It's actually the job of the artist to take you into the darker places.
Darknet Diaries
134: Deviant
And if you've ever heard her music, she's good at that. But darkness isn't scary because it's dark. It's scary because you're alone. And I like to remind people that if we go into these dark places in our world with friends and allies and peers and loved ones, you realize that the dark isn't that scary because it's dark. It's just because you didn't know what was in there.
Darknet Diaries
134: Deviant
And that's why I like to bring people into the darkness with me and realize it's not that scary and they can learn from it and they can be improved by it.
Darknet Diaries
134: Deviant
And just kind of puts it in his breast pocket. What'd you do to that door? And I was like, oh, yeah, your doors are all installed with these electronic strikes. They're actually – it's a super common vulnerability. You can speak to whoever your integrator was about that. And he's, hey, Steve. He brings this guy. Come here. Can you show him what you did to that door? And I was like, yeah.
Darknet Diaries
134: Deviant
They went through the, like, probably six to eight foot thick concrete wall. They just boreholed. You can actually see three slightly overlapping, kind of like MasterCard logo interlocking circles, boreholes of about a 12-inch diameter, maybe. And they just chewed through it over time, getting through the wall.
Darknet Diaries
134: Deviant
Do you want to show it at your office? I'll pop your office. So I'm just popping doors open. And it bugged him out. And they said, oh, my God. And that became the story of the day at the office. Not the sysadmin who quit, but this kid who came in and opened all the law partner's doors.
Darknet Diaries
134: Deviant
You should do a training at Black Hat. I want you to propose a Black Hat training about lockpicking. And I was like, no one's going to pay money for that. He said, no, trust me, trust me. You know, I think it'll be hot. You should do it. And yeah, so that became my career was a law firm who quit and a dear friend who said, hey, people pay money for this knowledge.
Darknet Diaries
134: Deviant
Those two forces together really kicked off the idea of doing physical security consulting for me and my main colleague through all this has been Babak Javadi. He and I have more than one company at this point doing training, consulting, advising, and I get to break into safes on army bases. It's quite a career, all from a few little things that you trip over as opportunities.
Darknet Diaries
134: Deviant
Someone did the math, and I think they said one of the few people who's talked more than I was the late and wonderful Dan Kaminsky. But again, I just would say yes to everything, and I would drive or fly just because I love talking about this. So yeah, it's well in excess of 300 or 400. That was the last time we checked, and that was years ago.
Darknet Diaries
134: Deviant
And they crawled all the way through, did everything they did, and crawled all the way out. Just kind of army crawled through this sandwich-shaped hole. Wow.
Darknet Diaries
134: Deviant
So yeah, this is the elevator hacking talk. This is the talk that we were told had to be on Sunday. Because... Because reasons.
Darknet Diaries
134: Deviant
It sounds silly, but I love that you said it, not me. But it's true. There's even a talk I made about this phenomenon. I call it Eyes of a Thief. And corporate audiences kind of like that one because you walk them through just galleries of images and videos. And I say, well, here's what you see. Now here's what I see.
Darknet Diaries
134: Deviant
And I zoom in and I say, here's this exploit, that exploit, bang, bang, bang, bang, bang. And my wife is very used to the phenomenon of us walking down a city street and she'll be talking, she'll turn. And I'm two steps back because I paused to pivot and take one picture of this building or that car or this fixture or this device. And I'm, oh, that's going in the slides.