They Hired Me to Steal a Shopping Cart Full of Human DNA Darknet Diaries Ep. 160: Greg

AI-generated summary — may contain inaccuracies. Not a substitute for the full episode or professional advice.

👤 Who Should Listen

• Aspiring cybersecurity professionals and penetration testers curious about unconventional career paths and real-world hacking tactics.
• Red team leaders and security managers seeking creative approaches to vulnerability discovery and comprehensive security assessments.
• Executives and board members in organizations handling highly sensitive data, such as genetics or financial information, who need to understand advanced physical and digital threats.
• Individuals fascinated by the human element of hacking, social engineering, and stories of overcoming adversity in the tech world.
• Anyone interested in the evolution of cybersecurity and the unconfirmed, yet plausible, anecdotes of corporate espionage.
• Managers looking to build high-performing security teams who may consider unconventional talent that prioritizes results over traditional qualifications or appearances.

🔑 Key Takeaways

1. 1.Greg Linares was arrested at 14 for creating a macro virus in Excel that changed his grades and attendance in high school, making him the youngest person in Arizona arrested for a computer crime [13:42, 16:54].
2. 2.While at cybersecurity company eEye, Linares initially found a 'zero-day' in Microsoft Office 2007 that only triggered with a debugger attached, nearly costing him his job due to company embarrassment after a press release [39:53, 40:58].
3. 3.To save his career and the company's reputation, Linares and his eEye team worked for three consecutive days to find a legitimate zero-day vulnerability, eventually succeeding with an exploit in Office Visio [43:07, 46:16].
4. 4.During a challenging red team engagement, Linares and his coworker, on the verge of failure, used ARP poisoning to sniff a plain text credential for a build system, allowing them to roll out code to production that marked customer credit card data as '*stolen last four digits*' [62:08, 63:13].
5. 5.Tasked with exfiltrating DNA data, Linares used a hollowed-out printer and a shopping cart full of hard drives purchased from Best Buy to covertly remove petabytes of sensitive genetic information from a client's facility over several days [68:09, 70:42].
6. 6.In a physical penetration test against a venture capital firm, Linares gained entry by climbing a tree to a balcony, prying open a security door, using a cloned badge, and disarming an alarm with a stolen code from an employee's onboarding email [88:22, 89:27].
7. 7.To maximize the impact of his physical intrusion, Linares hacked Axis security cameras to black them out and left 'I stole this' sticky notes on the CEO's valuable paintings, demonstrating complete compromise and eliciting a furious but impressed response from the CEO [84:14, 90:54, 93:41].
8. 8.Throughout his career, Linares has maintained his distinct goth appearance and refusal to adhere to dress codes or traditional educational paths, believing his skills and results speak for themselves, often leading to recurring engagements or full-time employment with clients he successfully 'hacks' [73:55, 95:50].

💡 Key Concepts Explained

⚡ Actionable Takeaways

• →Master fundamental Layer 2 network attacks, such as ARP poisoning and DHCP spoofing, as Greg emphasizes their continued effectiveness in uncovering vulnerabilities in modern environments [80:11].
• →Implement stringent access controls and unique, strong passwords for network infrastructure like routers, as default or easily brute-forced credentials can compromise entire networks [79:07].
• →Conduct comprehensive physical security assessments that include simulating insider threats and external intrusions, as digital defenses can be bypassed by creative physical attacks [57:48, 88:22].
• →Regularly audit and update firmware for all network-connected devices, especially security cameras, to patch known vulnerabilities like buffer overflows and prevent easy exploitation [84:14].
• →Enhance employee onboarding security protocols to ensure sensitive information like alarm codes, badge IDs, and network credentials are not easily discoverable through email or unsecured internal documentation [80:11, 81:13].
• →Educate staff on social engineering tactics and the importance of secure practices, as seemingly innocuous information (like a Wi-Fi password on a whiteboard) can provide crucial footholds for attackers [77:00].
• →Invest in advanced security monitoring and incident response capabilities that can detect and react swiftly to both digital intrusions and physical security breaches, even if cameras are tampered with [61:02, 84:14, 92:36].

⏱ Timeline Breakdown

Best of this topic

Listen to Full Episode