1
00:00:00,000 --> 00:00:06,780
Everyone, our next talk is Skip Tracing for Fun and Profit by Rhett Greenhagen. So let's welcome him.

2
00:00:13,460 --> 00:00:17,220
So like she said, my name is Rhett Greenhagen. If you're in the wrong track, you should still stay.

3
00:00:17,400 --> 00:00:22,440
If you've never heard a gay autistic dude from Oklahoma crack jokes, I'm pretty fucking funny.

4
00:00:22,800 --> 00:00:24,420
You're going to love it. You're going to love it.

5
00:00:25,860 --> 00:00:31,420
So my talk is Skip Tracing for Fun and Profit, How to Hide from the FBI for the Recon Village.

6
00:00:32,040 --> 00:00:35,100
First time I gave this talk, it was at DC 405 in Oklahoma City.

7
00:00:36,260 --> 00:00:39,600
It ended with, because we were given the talk at IHOP, right?

8
00:00:40,700 --> 00:00:45,140
And my best friend at the time, let's rewind just for a second.

9
00:00:45,300 --> 00:00:48,820
We're given the talk at IHOP, and I start, and the waitress walks in.

10
00:00:48,860 --> 00:00:51,740
She sees How to Hide from the FBI at the very front.

11
00:00:52,300 --> 00:00:54,340
She starts flipping the shit.

12
00:00:54,420 --> 00:00:54,620
She starts flipping the shit out.

13
00:00:55,660 --> 00:00:59,580
County Sheriff's, Oklahoma Highway Patrol, Oklahoma City Police, right?

14
00:01:00,200 --> 00:01:04,560
So they all arrive, and we're all getting patted down for weapons.

15
00:01:04,920 --> 00:01:06,820
Because it's Oklahoma, we all have concealed carry, right?

16
00:01:08,240 --> 00:01:17,340
Come to find out, my friend had assault weapons, suppressors, all the kind of illegal shit

17
00:01:18,460 --> 00:01:20,860
that you don't want to have in a vehicle when the sheriffs come, right?

18
00:01:21,700 --> 00:01:23,500
So he got labeled as a domestic terrorist.

19
00:01:23,700 --> 00:01:24,400
All that.

20
00:01:24,420 --> 00:01:24,740
All that good shit.

21
00:01:24,860 --> 00:01:28,340
So to bypass that shit, we're going to do some legal stuff.

22
00:01:28,800 --> 00:01:30,640
Let me just read through this shit just for a second.

23
00:01:31,360 --> 00:01:35,980
If you have a TSSCI HCS clearance, you're going to want to be aware that the tools and techniques session

24
00:01:35,980 --> 00:01:38,560
has been covered in certain training materials provided in my past companies

25
00:01:39,320 --> 00:01:40,660
with inside the intelligence community.

26
00:01:40,840 --> 00:01:43,080
But this has been reworked to be able to be given in a public setting.

27
00:01:43,420 --> 00:01:48,880
It can all be recreated using open source information, et cetera, et cetera, et cetera, et cetera, et cetera, et cetera.

28
00:01:49,480 --> 00:01:52,340
Working in future recovery for different state, local, and federal agencies,

29
00:01:52,620 --> 00:01:54,160
different types of legal application processes,

30
00:01:54,160 --> 00:01:57,160
such as warrants were arranged through state attorneys and such,

31
00:01:57,320 --> 00:01:59,360
or whomever was the governing authority at the time.

32
00:02:00,180 --> 00:02:02,800
Just so you know, I have no idea what any of this shit means.

33
00:02:03,600 --> 00:02:07,520
The cases covered in the talk were completed before working for my current employer.

34
00:02:07,640 --> 00:02:10,480
No state, local, federal, and or international laws were broken at this time.

35
00:02:13,600 --> 00:02:19,500
The trace was being located, investigated, although the laws change all the time.

36
00:02:19,520 --> 00:02:21,620
Please check with your SSO or FSO for details.

37
00:02:22,120 --> 00:02:23,960
Although my current work involves some sorts.

38
00:02:23,960 --> 00:02:26,420
Social media exploitation, intelligent analysis, counterintelligence,

39
00:02:26,500 --> 00:02:28,980
and other forms of infiltration in my work with McAfee Advanced Programs Groups.

40
00:02:28,980 --> 00:02:30,800
Is that of the most ethical and legal standards?

41
00:02:31,760 --> 00:02:34,740
If anyone has any legal questions, please contact my attorney, Ryan Gillette.

42
00:02:34,880 --> 00:02:35,720
I can give you details.

43
00:02:36,720 --> 00:02:38,920
Just kidding, I just made that name up out of nowhere.

44
00:02:40,520 --> 00:02:41,680
So this is my agenda.

45
00:02:41,960 --> 00:02:44,120
No one gives a shit about that, so we're just going to bypass that for a second.

46
00:02:44,300 --> 00:02:45,400
This is what skip tracing is.

47
00:02:46,080 --> 00:02:53,340
Skip tracing is taking all this information and making a huge, huge compilation of data, right?

48
00:02:53,560 --> 00:02:53,940
Right?

49
00:02:53,960 --> 00:02:56,140
From there, you're going to start to come from where the whereabouts,

50
00:02:56,200 --> 00:02:59,000
the data obfuscation, looking for misinformation, and things like that.

51
00:02:59,180 --> 00:03:03,720
The end goal from this is taking all that shit on the left and getting real-time location.

52
00:03:04,240 --> 00:03:04,660
All right?

53
00:03:04,860 --> 00:03:05,760
Easy peasy stuff.

54
00:03:09,100 --> 00:03:10,940
So, something I'm going to talk about is pivots.

55
00:03:11,820 --> 00:03:14,180
Pivoting information, stop laughing, I'm making a point.

56
00:03:16,840 --> 00:03:18,080
I'm just fucking with you.

57
00:03:19,760 --> 00:03:23,260
Pivoting information for intelligent analysis is taking one piece of unique information

58
00:03:23,260 --> 00:03:24,800
and be able to pivot to get another piece of information.

59
00:03:25,300 --> 00:03:28,860
Say, for example, Red Greenhagen, you're going to get badass under there,

60
00:03:28,960 --> 00:03:31,140
and then from badass, you're going to be able to find all other kinds of things,

61
00:03:31,180 --> 00:03:32,360
like guns and, you know what I mean?

62
00:03:32,800 --> 00:03:35,280
So, for a good example, actually, no, shit, I'm sorry, I forgot.

63
00:03:36,020 --> 00:03:37,820
What are some good pivots from this?

64
00:03:39,740 --> 00:03:40,020
Please.

65
00:03:40,960 --> 00:03:41,320
I'm sorry?

66
00:03:43,060 --> 00:03:43,340
Picture.

67
00:03:45,320 --> 00:03:46,100
Who said picture?

68
00:03:47,140 --> 00:03:47,420
Awesome.

69
00:03:47,660 --> 00:03:48,240
Got something to say?

70
00:03:50,120 --> 00:03:50,680
Anything else?

71
00:03:52,580 --> 00:03:52,860
Woman?

72
00:03:53,480 --> 00:03:54,140
What else?

73
00:03:58,080 --> 00:03:58,520
Yes.

74
00:03:59,540 --> 00:04:00,780
The time frame.

75
00:04:00,900 --> 00:04:01,780
Time frame is huge.

76
00:04:01,940 --> 00:04:02,400
And location.

77
00:04:03,040 --> 00:04:04,740
Geopolitical locations are huge in analysis.

78
00:04:05,100 --> 00:04:05,500
What else?

79
00:04:06,360 --> 00:04:07,460
All right, we're going to skip through this.

80
00:04:07,660 --> 00:04:10,040
So, reverse Google search in the avatar to find unique matches.

81
00:04:10,260 --> 00:04:15,220
This is one of the ways how stupid fucking idiots get caught.

82
00:04:15,360 --> 00:04:15,720
It's hilarious.

83
00:04:15,900 --> 00:04:18,400
These anonymous wannabes that don't even know how to install IRC,

84
00:04:18,460 --> 00:04:19,800
they have to actually do the IRC web client.

85
00:04:20,020 --> 00:04:20,860
It's fucking hilarious.

86
00:04:21,420 --> 00:04:23,240
They go and create some random,

87
00:04:23,240 --> 00:04:24,180
random avatar with their initials.

88
00:04:24,220 --> 00:04:25,720
It's just fucking tool bags.

89
00:04:26,520 --> 00:04:29,240
Unique names are also pivotal in research.

90
00:04:29,400 --> 00:04:32,240
So, the thing about Ukrania-Khrushchev is the region,

91
00:04:32,380 --> 00:04:34,080
the region of Pakistan it comes from.

92
00:04:34,820 --> 00:04:38,920
The KIS tells me that his family or his family members' ancestry

93
00:04:38,920 --> 00:04:44,380
comes from either Eastern Europe or some form of Eastern Europe

94
00:04:44,380 --> 00:04:45,480
or Middle Eastern descent, right?

95
00:04:46,040 --> 00:04:48,600
Also, key phrases and questions can be searched to cross-reference.

96
00:04:50,800 --> 00:04:53,220
For example, where's the FBI?

97
00:04:53,240 --> 00:04:56,820
Where's the perfect place to hide the nouns he uses?

98
00:04:57,800 --> 00:05:00,320
How he's using FBI in all kinds of letters and slashes?

99
00:05:00,360 --> 00:05:01,160
As stupid as that sounds.

100
00:05:01,560 --> 00:05:03,660
How he put them in order, FBI, CI, NSA.

101
00:05:04,600 --> 00:05:07,660
And the way in the, how he uses pronouns in the sentence.

102
00:05:08,020 --> 00:05:10,020
That is an awesome piece of information.

103
00:05:10,540 --> 00:05:13,520
Say if I'm using that to do machine learning in IRC channels

104
00:05:13,520 --> 00:05:17,500
and other pivotal information, I can gather a shit ton of more data.

105
00:05:18,080 --> 00:05:19,120
It might not be accurate.

106
00:05:19,180 --> 00:05:20,480
It's more percentage-based at that point.

107
00:05:20,960 --> 00:05:22,940
And another thing is the, like you said,

108
00:05:22,940 --> 00:05:25,060
the Pakistan 10 years ago.

109
00:05:25,100 --> 00:05:26,100
Why did he say 10 years ago?

110
00:05:26,220 --> 00:05:27,060
Why not five years ago?

111
00:05:27,100 --> 00:05:28,180
Why not two years ago?

112
00:05:28,360 --> 00:05:29,680
Why not my mom's house?

113
00:05:29,900 --> 00:05:30,440
Why Pakistan?

114
00:05:32,300 --> 00:05:33,580
And again, the one month ago.

115
00:05:33,720 --> 00:05:35,060
It means it was posted one month ago.

116
00:05:35,260 --> 00:05:36,420
Why one month ago?

117
00:05:36,840 --> 00:05:38,000
And what does he post?

118
00:05:38,060 --> 00:05:38,620
Post passants.

119
00:05:38,820 --> 00:05:40,820
So if you're creating a timeline of his posts,

120
00:05:41,220 --> 00:05:43,680
so say, for example, fuck, fuck, fuck, fuck.

121
00:05:45,040 --> 00:05:47,720
How to hide, where would I hide from the FBI if I did this?

122
00:05:47,860 --> 00:05:50,600
Oh, and another month later he posts, why would I do this?

123
00:05:50,640 --> 00:05:51,340
And et cetera, et cetera.

124
00:05:51,420 --> 00:05:52,700
Building a timeline of information like this

125
00:05:52,700 --> 00:05:53,560
is amazing.

126
00:05:54,420 --> 00:05:57,180
So about me, this is the places where I come from.

127
00:05:57,320 --> 00:06:00,120
My first job and a bunch of other random shit.

128
00:06:00,900 --> 00:06:03,220
I currently work for McAfee Security Advanced Programs Group

129
00:06:03,220 --> 00:06:04,480
as a senior threat and malware researcher.

130
00:06:05,460 --> 00:06:07,960
My entire career has come from the U.S. intelligence community.

131
00:06:08,320 --> 00:06:09,940
I've never really had a job in the private sector

132
00:06:09,940 --> 00:06:11,320
because I got fired.

133
00:06:13,040 --> 00:06:17,460
So this is why you don't let Marines create your slide deck.

134
00:06:18,540 --> 00:06:20,560
I have no idea what some of these things means.

135
00:06:23,080 --> 00:06:25,380
I used to have bigger tits than most women.

136
00:06:26,380 --> 00:06:27,420
You did not put that.

137
00:06:28,580 --> 00:06:29,420
Humble eats a rocket.

138
00:06:29,480 --> 00:06:30,060
No, I got that one.

139
00:06:31,300 --> 00:06:34,800
But this is why you don't let Marines create your slide deck.

140
00:06:37,160 --> 00:06:39,240
So talking about myself for a second because I love talking

141
00:06:39,240 --> 00:06:40,340
about myself, just kidding.

142
00:06:40,760 --> 00:06:43,480
I was diagnosed with Asperger's at age 11.

143
00:06:44,500 --> 00:06:45,480
Didn't really fit into school.

144
00:06:45,600 --> 00:06:46,400
Didn't really understand things.

145
00:06:47,840 --> 00:06:49,940
My mom actually came home with a computer one day

146
00:06:49,940 --> 00:06:52,600
and best thing that ever happened to me.

147
00:06:52,700 --> 00:06:54,880
I taught myself C, taught myself all kinds of things

148
00:06:54,880 --> 00:06:55,860
within a certain amount of time frame.

149
00:06:56,900 --> 00:06:59,540
Now, having Asperger's in a very, very small town,

150
00:06:59,600 --> 00:07:01,700
like living on a dirt road and like you're graduating class

151
00:07:01,700 --> 00:07:03,820
from high school being like four, you don't really get

152
00:07:03,820 --> 00:07:04,520
that much information, right?

153
00:07:05,300 --> 00:07:07,660
So if you don't know what autism is or Asperger's,

154
00:07:07,660 --> 00:07:08,760
I got some examples for you.

155
00:07:09,700 --> 00:07:13,020
So this is what my mom thinks of people with Asperger's.

156
00:07:13,420 --> 00:07:15,620
This is what I think someone with Asperger's is like.

157
00:07:17,020 --> 00:07:18,100
And if you're a Democrat,

158
00:07:18,420 --> 00:07:20,100
this is what you think Asperger's looks like.

159
00:07:20,460 --> 00:07:20,820
.

160
00:07:22,720 --> 00:07:25,760
So my brother's actually the one who got me started in this.

161
00:07:26,660 --> 00:07:28,360
I was 14 years old.

162
00:07:28,500 --> 00:07:33,680
He was working with US Marshals for fugitive recovery.

163
00:07:35,280 --> 00:07:38,560
One day he came to me and this is after I got in trouble

164
00:07:38,560 --> 00:07:39,040
with law enforcement.

165
00:07:39,160 --> 00:07:42,280
He said, help me find this chick.

166
00:07:42,960 --> 00:07:44,460
I said, no, that's okay.

167
00:07:44,640 --> 00:07:47,780
So he gave me some cash and he went and bought me a video game.

168
00:07:47,920 --> 00:07:48,960
I was like, fuck yeah.

169
00:07:49,260 --> 00:07:49,700
.

170
00:07:50,960 --> 00:07:52,680
Took me 30 minutes.

171
00:07:52,700 --> 00:07:58,920
I thought, there's no way I'm going to find this chick.

172
00:07:59,020 --> 00:08:00,600
There's no way, absolutely no way.

173
00:08:01,500 --> 00:08:04,160
So I started thinking, if I was a white piece of trash

174
00:08:04,160 --> 00:08:08,180
and only had $400 and I had to go from location A to location B,

175
00:08:08,280 --> 00:08:10,760
which was actually pretty far, and get a hotel room,

176
00:08:10,960 --> 00:08:13,240
knowing she was trying to get away from the US Marshals

177
00:08:13,680 --> 00:08:16,680
in the city she was, I was thinking, this bitch has got to,

178
00:08:16,680 --> 00:08:17,740
she's got to get out of state, right?

179
00:08:18,180 --> 00:08:20,540
So I start calling, so I do a Google Map, right?

180
00:08:21,220 --> 00:08:22,640
And in the API I start filtering.

181
00:08:22,640 --> 00:08:26,860
I start filtering by cheap hotels along the route from location A to location B.

182
00:08:27,100 --> 00:08:30,220
I swear to God in my mother's life, the first hotel I called, she was there.

183
00:08:34,180 --> 00:08:36,960
So I, so I called and they transferred me to the room and the, and the,

184
00:08:36,960 --> 00:08:39,760
and the phone rang, and they picked up the phone.

185
00:08:39,840 --> 00:08:40,540
I fucking hung it up.

186
00:08:40,620 --> 00:08:41,720
I had no idea what I was doing.

187
00:08:41,820 --> 00:08:46,000
Like this is, this is, this is, and I called my brother and I said, oh, hey,

188
00:08:46,020 --> 00:08:46,560
by the way, she's there.

189
00:08:46,940 --> 00:08:47,620
She said, how'd you know?

190
00:08:47,860 --> 00:08:48,560
Oh, I called her.

191
00:08:48,960 --> 00:08:49,880
You did what?

192
00:08:51,720 --> 00:08:52,620
So my brother.

193
00:08:52,640 --> 00:08:55,460
My sister at the time was living, was living a long, long, long ways away.

194
00:08:55,620 --> 00:08:57,100
But I was actually living in the city where she was.

195
00:08:57,740 --> 00:09:01,240
So I, so we went there and there she is.

196
00:09:01,360 --> 00:09:02,380
I couldn't believe it.

197
00:09:02,400 --> 00:09:04,920
I was like, lady, you are so fucking stupid.

198
00:09:08,080 --> 00:09:09,500
So this is about what I do now.

199
00:09:10,180 --> 00:09:13,040
I currently work with three Marines that have black faces.

200
00:09:14,080 --> 00:09:15,280
And, no, I'm kidding.

201
00:09:15,860 --> 00:09:21,540
No, my current team is, was comprised of three Marines, myself and Dave Marcus

202
00:09:21,540 --> 00:09:22,240
from .

203
00:09:22,640 --> 00:09:25,740
The Marines have multiple combat tours.

204
00:09:26,000 --> 00:09:29,960
They all came from a background of intelligence, capture-kill missions, special forces.

205
00:09:31,380 --> 00:09:35,600
The multiple agencies that we work with all together, like the Joint, Joint Intelligence

206
00:09:35,600 --> 00:09:40,320
Directive, INSCOM, which is Information Security Command, First I.O., Special Operations

207
00:09:40,320 --> 00:09:42,520
Command, FBI, NSA, DIA.

208
00:09:44,000 --> 00:09:46,260
So this is actually where we currently work out.

209
00:09:46,520 --> 00:09:50,180
So this is the, the special operations mythology that's currently used.

210
00:09:50,460 --> 00:09:51,740
It talks about, like.

211
00:09:51,740 --> 00:09:55,040
So if you talk about the special operations stuff on the side, things like negotiating

212
00:09:55,040 --> 00:10:01,160
settlements, larger and minor military conflicts, right, and the things underneath is like

213
00:10:01,160 --> 00:10:03,180
propaganda, subversion.

214
00:10:03,900 --> 00:10:07,600
So the things where APG operates at is on the, in the red.

215
00:10:08,660 --> 00:10:11,460
Infiltrating foreign hacking groups based on the, based on the military's code.

216
00:10:11,600 --> 00:10:13,740
So we profile foreign computer hackers based on the military's code.

217
00:10:14,020 --> 00:10:19,740
We infiltrate those groups, build psychological profiles, do all kinds of interesting things.

218
00:10:20,860 --> 00:10:21,380
So.

219
00:10:21,380 --> 00:10:24,060
So I'm going to try and go through this, the tools and techniques part.

220
00:10:25,440 --> 00:10:28,300
One of, one of my most popular, my favorite tools is Maltego.

221
00:10:29,520 --> 00:10:33,920
Maltego allows me, with different APIs, to import information and share with my team.

222
00:10:35,260 --> 00:10:39,220
Casefile is actually another tool outside of Maltego that allows me to work on a, on

223
00:10:39,220 --> 00:10:42,560
a, on a nice canvas and be able to share things with other members of my team.

224
00:10:42,760 --> 00:10:44,940
And they can, they can see my notes, I can see their notes, right.

225
00:10:46,960 --> 00:10:49,900
Cool thing about this is I can input from multiple sources.

226
00:10:50,360 --> 00:10:51,160
Multiple sources.

227
00:10:51,380 --> 00:10:55,060
I think the last time I checked was a hundred and twenty-eight, a hundred and twenty, under

228
00:10:55,060 --> 00:10:57,000
two hundred, over a hundred, all right.

229
00:10:58,160 --> 00:11:00,140
Another amazing tool is Palantir.

230
00:11:00,280 --> 00:11:01,440
Palantir is an amazing tool.

231
00:11:01,720 --> 00:11:06,000
I actually use it for counterintelligence investigations for, for, for intelligence

232
00:11:06,000 --> 00:11:06,400
agencies.

233
00:11:07,080 --> 00:11:13,640
I remember one case, I was using Palantir, and our end goal was to find the person or

234
00:11:13,640 --> 00:11:15,620
persons that was leaking the material from the agency.

235
00:11:17,140 --> 00:11:18,400
I requested everything.

236
00:11:18,780 --> 00:11:20,280
I requested DLP logs.

237
00:11:20,420 --> 00:11:21,360
I requested batch access logs.

238
00:11:21,360 --> 00:11:22,360
I requested CAG logs.

239
00:11:22,580 --> 00:11:28,880
I swear to God, I swear to God, I requested receipts in digital format from the restaurant

240
00:11:28,880 --> 00:11:30,280
within the federal agency, right.

241
00:11:31,160 --> 00:11:34,880
Every single unique piece of information, Palantir ingested it.

242
00:11:35,220 --> 00:11:39,740
And created a timeline of when the information could have been accessed, the chances and

243
00:11:39,740 --> 00:11:42,660
percentage of the person who could have taken it, and then spits out one name.

244
00:11:43,360 --> 00:11:45,900
Palantir is an amazing, amazing tool, if you have money.

245
00:11:47,600 --> 00:11:51,340
NetGlove is a very, very, very under looked tool.

246
00:11:52,160 --> 00:11:57,300
Palantir, not Palantir, I'm sorry, NetGlove, NetGlove is one of my favorite tools.

247
00:11:57,980 --> 00:11:59,200
Absolutely one of my favorite tools.

248
00:11:59,560 --> 00:12:02,220
It's own engine, be able to make modifications, be able to build other tools.

249
00:12:02,580 --> 00:12:04,460
This is, this is my bread and butter.

250
00:12:05,580 --> 00:12:08,900
From that we got Python, because you have so much information you need to, you need

251
00:12:08,900 --> 00:12:09,520
to automate, right.

252
00:12:10,240 --> 00:12:13,100
From Python you got the Google Maps API, we'll talk about more later.

253
00:12:14,060 --> 00:12:19,000
The social engineer tool kit for mostly exploitation, cloning of websites, sending fake SMS messages,

254
00:12:19,220 --> 00:12:19,560
shit like that.

255
00:12:20,940 --> 00:12:21,340
Okay.

256
00:12:21,360 --> 00:12:25,040
Mike Mazzelli's website is phenomenal.

257
00:12:26,240 --> 00:12:27,000
Absolutely phenomenal.

258
00:12:27,460 --> 00:12:34,280
His tools and techniques on the site, specifically on like the custom tools, they're so amazing,

259
00:12:35,400 --> 00:12:37,520
it, I can't explain in words how amazing it is.

260
00:12:37,580 --> 00:12:41,440
I think all together he has about a thousand, two thousand tools, like, like if I put an

261
00:12:41,440 --> 00:12:44,300
email address in the tool kit and I click search, it's gonna come back with a profile.

262
00:12:44,720 --> 00:12:49,600
Phone number does the forget password, comes back with a picture, it's, it's absolutely

263
00:12:50,260 --> 00:12:50,600
amazing.

264
00:12:50,600 --> 00:12:53,160
I can't say any better things about it.

265
00:12:54,440 --> 00:12:59,060
Tools and techniques, the Google Alerts, a lot of APT groups and crimeware groups will

266
00:12:59,060 --> 00:13:03,440
use Google Alerts for like hashes, hashes, call settings, things like that, or real

267
00:13:03,440 --> 00:13:03,720
names.

268
00:13:04,500 --> 00:13:08,280
A lot of the, a lot of the groups outside of advanced percentage threat actors will

269
00:13:08,280 --> 00:13:11,940
have, they're like, their hashes of their new exploit kits are now on their pin on

270
00:13:11,940 --> 00:13:12,400
Google Alerts.

271
00:13:12,560 --> 00:13:16,180
Because they want to know if someone's searching for their, searching for that hash, they want

272
00:13:16,180 --> 00:13:19,280
to know if, oh my God.

273
00:13:19,460 --> 00:13:19,760
Oh my God.

274
00:13:19,760 --> 00:13:20,100
Oh my God.

275
00:13:21,320 --> 00:13:21,800
Oh my God.

276
00:13:21,820 --> 00:13:25,320
Handles, unique, unique API calls.

277
00:13:25,620 --> 00:13:26,020
Anything.

278
00:13:27,200 --> 00:13:27,680
Anything.

279
00:13:27,960 --> 00:13:29,320
Google Alerts is amazing, right.

280
00:13:29,500 --> 00:13:32,900
And footprinting Google Alerts to see that the new hashes they're putting up is also

281
00:13:32,900 --> 00:13:33,900
a very, very awesome technique.

282
00:13:34,900 --> 00:13:36,620
So these are the some cases that I liked.

283
00:13:37,140 --> 00:13:38,460
I put two on here.

284
00:13:40,600 --> 00:13:41,660
So the first one.

285
00:13:44,320 --> 00:13:46,320
So this guy.

286
00:13:46,760 --> 00:13:47,240
Uh.

287
00:13:49,340 --> 00:13:52,180
So, I, so, what I first started with was, I

288
00:13:52,180 --> 00:13:55,280
had his real name, his criminal history, all the

289
00:13:55,280 --> 00:13:56,880
other things that came up with this case, right.

290
00:13:57,560 --> 00:14:00,840
So, from the real name, and I believe his

291
00:14:00,840 --> 00:14:03,880
phone number, I came along with the jkidding31 at yahoo.com.

292
00:14:04,260 --> 00:14:06,400
From the email address, I put in Maltigo.

293
00:14:06,580 --> 00:14:08,880
I'm sorry, actually not Maltigo, I put in, in,

294
00:14:10,000 --> 00:14:11,420
actually no, it is Maltigo, I apologize.

295
00:14:11,760 --> 00:14:13,780
From that, I see his Steam profile, which is

296
00:14:13,780 --> 00:14:14,360
an online gaming.

297
00:14:14,800 --> 00:14:19,660
From the Steam profile, Steam profile, and the merging

298
00:14:19,660 --> 00:14:21,780
of the phone number gives me five contacts that

299
00:14:21,780 --> 00:14:22,260
I never knew about.

300
00:14:22,500 --> 00:14:24,360
So that has an additional five contacts that I can use.

301
00:14:25,700 --> 00:14:30,280
Come to find out, he's playing, I take his Steam

302
00:14:30,280 --> 00:14:32,760
profile along with the numbers and I see his friends,

303
00:14:32,960 --> 00:14:33,480
right.

304
00:14:33,960 --> 00:14:36,000
So I use his Steam ID and look, look, look up his

305
00:14:36,000 --> 00:14:36,400
Steam ID.

306
00:14:36,580 --> 00:14:38,420
From his Steam ID, I find out he's playing Guild Wars

307
00:14:38,420 --> 00:14:38,640
2.

308
00:14:38,860 --> 00:14:41,380
From Guild Wars 2, I find the server he plays

309
00:14:41,380 --> 00:14:42,620
on, along with the people he plays on.

310
00:14:43,100 --> 00:14:44,920
And I find the guild he plays with.

311
00:14:45,060 --> 00:14:46,720
Come to find out, they're looking for a healer.

312
00:14:47,140 --> 00:14:48,860
I don't know what the fuck a healer is.

313
00:14:49,000 --> 00:14:50,420
I've never played MLBG in my life.

314
00:14:52,040 --> 00:14:53,780
Real men play Counter Strike Source.

315
00:14:53,960 --> 00:14:55,180
I don't care what you have to say.

316
00:14:56,400 --> 00:14:59,360
So from there, I bought a character that was a healer,

317
00:14:59,440 --> 00:15:01,440
and went, I think I watched like maybe a one or two

318
00:15:01,440 --> 00:15:02,900
YouTube videos trying to figure out how to play a healer.

319
00:15:03,240 --> 00:15:04,680
And I teleported to him in game.

320
00:15:06,440 --> 00:15:10,820
So from that, so from that, I'm like, yo guys, what's

321
00:15:10,820 --> 00:15:11,160
going on?

322
00:15:11,180 --> 00:15:11,820
You need a healer?

323
00:15:12,620 --> 00:15:14,980
I swear to God, I was the best healer in that

324
00:15:14,980 --> 00:15:15,240
game.

325
00:15:16,020 --> 00:15:17,160
I swear to God.

326
00:15:17,580 --> 00:15:20,440
Guys were like, dude, you got 112 hours?

327
00:15:20,700 --> 00:15:22,520
I was like, I've just bought this fucking account.

328
00:15:22,860 --> 00:15:24,460
Are you guys really that fucking stupid?

329
00:15:24,620 --> 00:15:26,400
I'm literally right clicking, one, two.

330
00:15:26,500 --> 00:15:27,420
Right clicking, one, two.

331
00:15:27,480 --> 00:15:28,240
Fucking idiots, dude.

332
00:15:30,220 --> 00:15:33,560
So, so the warrant falls under his name, right?

333
00:15:34,380 --> 00:15:36,960
He's, he's dumb enough to host a fucking ventrilo server

334
00:15:37,440 --> 00:15:38,560
from his own computer.

335
00:15:40,720 --> 00:15:41,440
That means.

336
00:15:41,440 --> 00:15:43,040
That means I own him.

337
00:15:43,660 --> 00:15:47,960
So I couldn't get access multiple times to the ventrilo,

338
00:15:48,060 --> 00:15:51,040
so I wrote an exploit to actually denial of service

339
00:15:51,040 --> 00:15:53,340
to the ventrilo server, which was a remote procedural call

340
00:15:53,340 --> 00:15:54,700
to the actual web client.

341
00:15:55,440 --> 00:15:57,740
So taking that down, and this was actually planned.

342
00:15:58,280 --> 00:15:59,820
And you have to keep in mind there's a lot of things

343
00:15:59,820 --> 00:16:01,760
I'm taking out of my slides for, for OPSEC reasons.

344
00:16:02,540 --> 00:16:04,840
But from that, I invited them all to a Steam call.

345
00:16:05,320 --> 00:16:07,240
Because I knew if I did a Steam call, I can get

346
00:16:07,240 --> 00:16:07,660
their IP addresses.

347
00:16:08,280 --> 00:16:11,420
So from a Steam call, I used set plus the Google API.

348
00:16:11,420 --> 00:16:14,360
To create a phishing link, which I had already planned

349
00:16:15,060 --> 00:16:17,360
to get all their IPs of the people and the members

350
00:16:17,360 --> 00:16:17,900
in the channel, right?

351
00:16:19,080 --> 00:16:22,820
So from that, I do, I also do a part, I also

352
00:16:22,820 --> 00:16:24,680
do a wire shark to be able to capture the IPs

353
00:16:24,680 --> 00:16:25,160
in Steam chat.

354
00:16:26,440 --> 00:16:27,300
I'm off Steam chat.

355
00:16:27,360 --> 00:16:27,480
I'm sorry.

356
00:16:27,560 --> 00:16:28,040
Steam voice.

357
00:16:28,140 --> 00:16:28,380
I apologize.

358
00:16:28,620 --> 00:16:29,780
This is back before it was patched.

359
00:16:30,560 --> 00:16:32,920
So one IP address was actually in Lawton, Oklahoma.

360
00:16:33,940 --> 00:16:36,660
From there, I do a master merge, which actually, it's a,

361
00:16:36,660 --> 00:16:38,660
it's a Python script to merge all the information I currently

362
00:16:38,660 --> 00:16:41,400
have to try and filter through Facebook, cell phone records, things like that.

363
00:16:41,420 --> 00:16:42,600
To be able to get this one IP.

364
00:16:43,480 --> 00:16:46,760
From there, I find a Facebook friend of his also lives in Lawton, Oklahoma.

365
00:16:47,940 --> 00:16:54,760
From there, the guy has a phone number literally posted on his, on his, on his Facebook profile.

366
00:16:55,080 --> 00:17:00,260
So from there, I use set to send him a text message saying, yo, dude, what's cracking?

367
00:17:00,440 --> 00:17:01,160
Are we still up for night?

368
00:17:01,580 --> 00:17:03,120
So when, you gotta think about it like this.

369
00:17:03,680 --> 00:17:08,100
If they're living together, and he gets a weird text message from the guy's phone number

370
00:17:08,100 --> 00:17:09,380
that doesn't really match up.

371
00:17:09,980 --> 00:17:10,720
You know what I mean?

372
00:17:10,740 --> 00:17:11,260
He's gonna think.

373
00:17:11,420 --> 00:17:13,260
That doesn't, that doesn't, that doesn't add up.

374
00:17:13,840 --> 00:17:17,740
So whenever you're doing something like this, and I'm not a legal authority, please keep

375
00:17:17,740 --> 00:17:23,940
in mind, it needs to, it needs to match as possible to the type of conversation that

376
00:17:23,940 --> 00:17:24,340
we would have.

377
00:17:24,660 --> 00:17:27,960
Whenever you don't have things like, so there's some things I didn't have, like, I didn't

378
00:17:27,960 --> 00:17:30,540
have access to his email yet, I didn't have access to his Facebook private messages yet.

379
00:17:30,980 --> 00:17:33,540
So you gotta make it as bland as possible.

380
00:17:33,740 --> 00:17:40,620
So I think I said like, are we still on the, no, I said something like, hey, what's up?

381
00:17:40,620 --> 00:17:41,340
And he responded.

382
00:17:42,860 --> 00:17:48,260
And I think the conversation went like, something like, yeah, yeah, I'm, I'm still home.

383
00:17:48,340 --> 00:17:49,040
Are you coming home tonight?

384
00:17:49,200 --> 00:17:49,680
Something like that.

385
00:17:49,780 --> 00:17:50,540
So I knew they were living together.

386
00:17:51,420 --> 00:17:56,140
So from that, there's the message I sent, and I got the physical address, and there's

387
00:17:56,140 --> 00:17:57,400
the news article of him being arrested.

388
00:17:58,700 --> 00:18:04,040
The, the tactical team requires, specifically, state, federal, state agencies require two

389
00:18:04,040 --> 00:18:06,560
unique pieces of information to be able to verify the location of the target.

390
00:18:07,100 --> 00:18:10,600
So if you just say, oh, hey, I got this dude's IP address from, from, you know, from, you

391
00:18:10,600 --> 00:18:14,140
know, Wireshark, or, or, they're gonna be like, okay, we need another piece.

392
00:18:14,480 --> 00:18:15,080
Does that make sense?

393
00:18:15,380 --> 00:18:16,100
So at least two.

394
00:18:17,480 --> 00:18:21,220
So these are the possible counters he could have done, other than being completely stupid.

395
00:18:22,100 --> 00:18:25,500
I swear to God, in vitriol, he was talking to people about how he was on the run.

396
00:18:25,940 --> 00:18:27,100
I swear to God.

397
00:18:27,360 --> 00:18:31,720
He was like, yo, dude, yo, dude, I'm on the run, I'm, I'm, I'm a felon.

398
00:18:31,980 --> 00:18:32,800
I'm, I'm on the run.

399
00:18:33,160 --> 00:18:33,920
I'm so smart.

400
00:18:34,500 --> 00:18:37,360
And the thing is, whenever you're doing stuff like this, you've gotta record everything.

401
00:18:37,540 --> 00:18:38,260
You have to record everything.

402
00:18:38,720 --> 00:18:39,840
Everything you do is recorded.

403
00:18:41,560 --> 00:18:44,000
And I'm talking about on my end, whenever you're doing a skip trace, right.

404
00:18:44,900 --> 00:18:48,100
And some of the conversations, dude, I swear to God, he was a walking meme.

405
00:18:50,840 --> 00:18:55,720
One of the biggest things on here is, where's that, completely removed all social

406
00:18:55,720 --> 00:18:56,180
media accounts.

407
00:18:56,420 --> 00:18:58,140
He had multiple social media accounts.

408
00:18:58,400 --> 00:19:02,060
That's why I made it so easy, putting a lot of stuff to Palantir and spitting out names

409
00:19:02,060 --> 00:19:02,500
and phone numbers.

410
00:19:03,540 --> 00:19:04,460
So another case.

411
00:19:04,900 --> 00:19:06,880
You might not agree with what I do for work.

412
00:19:06,940 --> 00:19:09,460
You might not agree with the tools and techniques that I use.

413
00:19:10,500 --> 00:19:12,340
But let's, let's, let's use an analogy.

414
00:19:14,820 --> 00:19:16,900
I respect Chinese actors.

415
00:19:16,980 --> 00:19:22,340
I respect, I respect, I respect hackers, right.

416
00:19:22,420 --> 00:19:25,220
I respect the guys that I go after, right.

417
00:19:27,340 --> 00:19:30,560
I think it was Abraham Lincoln, I might be wrong, and please, God forgive me if I'm wrong.

418
00:19:30,680 --> 00:19:36,260
The person who said, one man's freedom fighter is another person's terrorist, right.

419
00:19:36,300 --> 00:19:38,600
There's always, there's always good and evil on both sides.

420
00:19:39,740 --> 00:19:44,520
But if you can't agree with me that there is absolute evil in this world, you are fucking

421
00:19:44,520 --> 00:19:44,840
ignorant.

422
00:19:45,720 --> 00:19:47,560
There is absolute evil in this world.

423
00:19:49,620 --> 00:19:58,260
This guy, um, let me get a drink.

424
00:20:03,480 --> 00:20:04,420
This piece of shit.

425
00:20:05,900 --> 00:20:07,420
Oh, no, no, wait before you start laughing.

426
00:20:08,540 --> 00:20:08,940
Oh, no, no, wait before you start laughing.

427
00:20:08,940 --> 00:20:11,080
He is, he, he is at home.

428
00:20:11,280 --> 00:20:15,140
He meets this chick on a, on a dating app, right.

429
00:20:15,500 --> 00:20:16,320
She has a kid.

430
00:20:17,120 --> 00:20:18,700
They move in together along with the kid.

431
00:20:19,280 --> 00:20:22,600
They were, they were, they were living in the house for about a nine month time period.

432
00:20:23,200 --> 00:20:26,420
He was molesting her child for four months.

433
00:20:26,780 --> 00:20:31,100
And by, by molest, I mean the absolute most horrific things you could possibly imagine.

434
00:20:34,040 --> 00:20:38,800
Whenever, whenever the boy went and told his mom, he killed him.

435
00:20:38,820 --> 00:20:38,920
He killed him.

436
00:20:40,260 --> 00:20:43,400
In the most inhumane way you could possibly imagine.

437
00:20:44,780 --> 00:20:46,300
There is absolute evil in this world.

438
00:20:47,920 --> 00:20:53,260
So I started with this on full information, social address, phone number, plus some pre-texting

439
00:20:53,260 --> 00:20:57,580
because the investigators that already did the work gave me, gave our team the case files

440
00:20:57,580 --> 00:20:59,120
of the people who they, who was interviewed.

441
00:20:59,400 --> 00:21:01,460
People known, known, LLCs, things like that, right.

442
00:21:03,000 --> 00:21:08,060
So taking that, um, this was the first, this was the first graph with, uh, Google accounts,

443
00:21:08,060 --> 00:21:10,220
form accounts, and a bunch of disinformation.

444
00:21:10,900 --> 00:21:17,060
From that, I go into Palantir and I see his burners that are still associated with his

445
00:21:17,060 --> 00:21:18,440
account right here, right.

446
00:21:18,640 --> 00:21:22,260
And then the two computers, which actually this is inaccurate because the two computers

447
00:21:22,260 --> 00:21:22,980
were actually one.

448
00:21:23,640 --> 00:21:26,800
He was just trying to change his MAC address, so that, a little bit of that's inaccurate.

449
00:21:27,600 --> 00:21:34,560
So I used master merge with all, with all the information that I had to try and combine

450
00:21:34,560 --> 00:21:35,500
it into one and narrow it down.

451
00:21:35,700 --> 00:21:37,940
He had a ridiculous amount of misinformation.

452
00:21:38,900 --> 00:21:39,380
Ridiculous.

453
00:21:39,940 --> 00:21:42,460
He was telling people, actually it's on my next fucking slide.

454
00:21:43,060 --> 00:21:49,060
He was telling co-workers, the, the chick he was banging, he was talking to, uh, random

455
00:21:49,060 --> 00:21:54,100
people, neighbors, uh, past employers, he was telling everyone something different.

456
00:21:54,400 --> 00:21:58,760
I mean, one, one was talking about how he went to Missouri.

457
00:21:59,060 --> 00:22:03,880
He actually went to Missouri, took pictures, and that's, that's a, that was like, that's

458
00:22:03,880 --> 00:22:05,920
a six, seven hour drive just to do misinformation.

459
00:22:06,680 --> 00:22:07,460
He, uh.

460
00:22:08,040 --> 00:22:09,060
Fake, no one cares about that.

461
00:22:09,220 --> 00:22:14,760
The Ontario stuff, he was setting up VPNs on Gmail addresses every time, making sure

462
00:22:14,760 --> 00:22:15,440
it came from Ontario.

463
00:22:15,760 --> 00:22:17,560
Using a VPN service that didn't actually look like a VPN.

464
00:22:17,860 --> 00:22:21,820
So whenever I DRC it, or NS, I, it would look like it was a legitimate computer.

465
00:22:23,120 --> 00:22:27,260
He was paying people in Kansas money to lie, right.

466
00:22:29,080 --> 00:22:32,420
So actually, I learned a lot about, I actually learned a lot about myself in this case.

467
00:22:32,860 --> 00:22:36,740
It's not, I'm not, I'm not an egotistical person, but it, you start to think, you start

468
00:22:36,740 --> 00:22:37,140
to think.

469
00:22:39,660 --> 00:22:42,740
People don't know there's people like me doing these type of things.

470
00:22:42,920 --> 00:22:43,740
Does that, does that make sense?

471
00:22:45,380 --> 00:22:48,640
And the amount of information, it, it was, it was unreal.

472
00:22:48,900 --> 00:22:49,580
It was unreal.

473
00:22:49,800 --> 00:22:56,680
I've never, I, so, I think I've done maybe, maybe around 200 cases altogether of things

474
00:22:56,680 --> 00:22:57,080
like this.

475
00:22:57,240 --> 00:23:02,460
I've never seen the amount of, I mean, I, I guarantee you, 200, 200, 250 fake social

476
00:23:02,460 --> 00:23:05,420
media accounts, like actually legitimate set up, phone numbers, everything.

477
00:23:06,100 --> 00:23:11,880
So, I found his, I found his Gmail address, game controller's Gmail address.

478
00:23:12,160 --> 00:23:15,520
And one of the things he was checking was actually looking at the last known IP address.

479
00:23:15,740 --> 00:23:17,260
So I actually had to match it, right.

480
00:23:18,000 --> 00:23:21,420
So from there, I go to, take out the google.com and download all the stuff.

481
00:23:22,260 --> 00:23:26,360
From there, so if you're not familiar with google.takeout.com, you can actually download

482
00:23:26,360 --> 00:23:26,840
all your information.

483
00:23:27,880 --> 00:23:31,660
The things I'm looking at is location history, his Google searches, and his Google voice,

484
00:23:31,800 --> 00:23:32,080
right.

485
00:23:32,840 --> 00:23:33,540
Location history.

486
00:23:33,540 --> 00:23:37,980
If you've got your phone in your pocket, it's, it's, it's recording your walking, it's

487
00:23:37,980 --> 00:23:41,100
recording your, your driving, it's recording your bus, you know, you know what I mean.

488
00:23:42,000 --> 00:23:45,840
His Google searches, every Google search history that, well, I'm sorry, not every search Google

489
00:23:45,840 --> 00:23:48,680
history, I apologize, but his Google search history as of the time, right.

490
00:23:49,960 --> 00:23:54,620
From there, I narrow it down to eight contacts, a location history, which he has saved on

491
00:23:54,620 --> 00:23:56,240
his phone, and his Google searches.

492
00:23:56,420 --> 00:23:59,440
From this, it was very apparent that he was needing money bad.

493
00:23:59,840 --> 00:24:01,380
And I mean a lot of money.

494
00:24:02,480 --> 00:24:07,160
So, the address, come to find out, this is where he was living, and the contact phone

495
00:24:07,160 --> 00:24:09,080
numbers in the Albany, New York, and recruiters, random associations.

496
00:24:09,480 --> 00:24:12,560
He's trying to find a job, trying to, trying to speak to recruiters.

497
00:24:12,620 --> 00:24:17,560
He did a lot of Google searches, like on monster chemical engineering, monster job.

498
00:24:17,920 --> 00:24:19,540
He's looking for money bad.

499
00:24:19,680 --> 00:24:24,080
Like he's spending his entire day not just looking for work, right.

500
00:24:25,160 --> 00:24:30,700
So from there, I do a master merge, and then I find his resume that he's using on monster.com,

501
00:24:30,700 --> 00:24:33,800
from his, from his resume, I find out what kind of job he's looking for, so I use, I

502
00:24:33,800 --> 00:24:38,360
use set to clone a website that was, it's popular, I think it was in like Europe or

503
00:24:38,360 --> 00:24:38,860
something like that.

504
00:24:39,200 --> 00:24:41,800
But I changed some of the phone numbers, I changed some of the things on the website.

505
00:24:42,900 --> 00:24:45,100
So from there, I went and created a monster profile.

506
00:24:53,920 --> 00:24:55,120
Actually, I didn't change that slide, I apologize.

507
00:24:55,820 --> 00:25:00,680
Some of the things on that slide talks about the, I forgot to edit it out.

508
00:25:00,700 --> 00:25:00,900
I apologize.

509
00:25:01,580 --> 00:25:05,740
Some of the things on the slide talks about how you want the information to match the

510
00:25:05,740 --> 00:25:09,260
resume as closely as, as, as much as possible, not be like, oh, this is too good to be true.

511
00:25:10,480 --> 00:25:13,900
A lot of things talking about working in a small team environment.

512
00:25:14,240 --> 00:25:17,240
People that are on the run do not want to work on a large team.

513
00:25:17,600 --> 00:25:21,020
The more people you talk to, the more chances you have of getting caught, right.

514
00:25:24,740 --> 00:25:29,880
So from there, I post, I post the, post the monster article.

515
00:25:29,880 --> 00:25:33,480
Within a certain amount of hours, I think it was six, five or six hours, get a response

516
00:25:33,480 --> 00:25:33,760
back.

517
00:25:34,120 --> 00:25:37,460
So get a response back, I sent him a response back with a malicious PDF.

518
00:25:37,700 --> 00:25:43,560
It was talking about things like what, what the job posting's like, things, things that

519
00:25:43,560 --> 00:25:44,620
we were looking for, right.

520
00:25:45,560 --> 00:25:47,540
From that, I just verified his IP address.

521
00:25:48,120 --> 00:25:51,940
And we actually had to hire a voice actor in the bottom right corner.

522
00:25:52,080 --> 00:25:57,360
The voice actor acts as a go-between to where if they start calling, if he starts calling

523
00:25:57,360 --> 00:25:59,860
the number to, to act like a monster.

524
00:25:59,880 --> 00:26:00,880
Like hey, I want this job, I need more information.

525
00:26:01,160 --> 00:26:04,920
They have a script they follow to try and set it up, because voice actors, I mean, I'm

526
00:26:04,920 --> 00:26:05,420
not a voice actor.

527
00:26:05,880 --> 00:26:08,460
I mean, I have, I might have a sexy voice, but that's as close as I'm gonna get.

528
00:26:10,000 --> 00:26:16,520
So the thing, so what I won't discuss is why the, why the apprehension team would not go

529
00:26:16,520 --> 00:26:16,980
to the house.

530
00:26:17,180 --> 00:26:18,300
I, I can't discuss that, I apologize.

531
00:26:18,860 --> 00:26:22,580
But they wanted to set it up to where he would go to this location, right.

532
00:26:22,800 --> 00:26:26,900
So we have the voice actor tell him to go meet at this location at this time and to

533
00:26:26,900 --> 00:26:27,460
wear nice clothes.

534
00:26:27,640 --> 00:26:28,960
Like a legitimate interview.

535
00:26:28,960 --> 00:26:36,100
And that's where, that's where NYPD and the other state, and the state law enforcement

536
00:26:36,100 --> 00:26:37,620
and future recovery team is actually waiting.

537
00:26:38,580 --> 00:26:42,260
So this is the actual, this is actually the time all together.

538
00:26:44,020 --> 00:26:49,080
From the very first to the very end, this shows all the misinformation, the things

539
00:26:49,080 --> 00:26:49,840
that misled, right.

540
00:26:51,200 --> 00:26:52,680
It took a lot of time.

541
00:26:53,200 --> 00:26:57,640
One of the biggest things that happens whenever you're doing skip traces at Target is whenever

542
00:26:57,640 --> 00:26:58,340
you're working with a.

543
00:26:58,340 --> 00:27:02,580
Specifically, like, local law enforcement or state law enforcement, they'll want you

544
00:27:02,580 --> 00:27:06,100
to turn it into Crime Stoppers, and then from Crime Stoppers they'll get the trip

545
00:27:06,100 --> 00:27:06,760
and then work together.

546
00:27:07,320 --> 00:27:11,900
That keeps the, that keeps the legal processing stuff just, it's, it's more helpful to the

547
00:27:11,900 --> 00:27:12,360
tracer, right.

548
00:27:12,500 --> 00:27:13,700
Specifically the tracer on the team.

549
00:27:15,320 --> 00:27:16,860
These are the possible counters.

550
00:27:21,980 --> 00:27:23,920
I mean, these are pretty self-explanatory.

551
00:27:27,240 --> 00:27:28,000
Yeah, I mean.

552
00:27:28,040 --> 00:27:28,320
Yeah.

553
00:27:28,340 --> 00:27:32,560
Another good thing is whenever you actually see law enforcement is not to assault them

554
00:27:32,560 --> 00:27:33,720
and do stupid crap, right.

555
00:27:35,380 --> 00:27:39,020
Also one of the biggest things whenever he was trying to apply for visas in other countries

556
00:27:39,740 --> 00:27:41,340
was he was actually using his real name.

557
00:27:41,900 --> 00:27:47,240
Whenever you have access, specifically to, like, LexisNexis and other things, like,

558
00:27:47,280 --> 00:27:50,060
those type of databases, you can see the failed attempts, right.

559
00:27:50,200 --> 00:27:53,140
So that's another huge thing trying to find, trying to find someone.

560
00:27:54,100 --> 00:27:55,260
So this is actually my outro.

561
00:27:55,900 --> 00:27:58,260
Some things I would explain if you're, if you're planning on going on the run.

562
00:27:58,260 --> 00:28:00,940
It's to read A Hundred Ways of Disparently Free.

563
00:28:01,040 --> 00:28:02,060
It's a really, really great book.

564
00:28:02,340 --> 00:28:07,360
How to Steal a Job talks about how to act within an environment where you're on the

565
00:28:07,360 --> 00:28:07,520
run.

566
00:28:09,480 --> 00:28:12,480
And then special links to my parents.

567
00:28:12,680 --> 00:28:18,760
My parents actually helped me, helped me actually be able to, what's the word, what's the word?

568
00:28:19,520 --> 00:28:21,960
Operate within an environment, right.

569
00:28:23,180 --> 00:28:27,700
Dave Marcus, Natalio, Matt, Sean, Ann, Wally, Black Days.

570
00:28:27,780 --> 00:28:28,240
All of them.

571
00:28:28,240 --> 00:28:32,140
Irwin, Irch, members of unallocated space, which allowed me to work this talk out with

572
00:28:32,140 --> 00:28:32,320
them.

573
00:28:32,960 --> 00:28:34,620
Dan Borges, and all, shut up.

574
00:28:35,560 --> 00:28:37,980
And all the shit talkers who said it wasn't working.

575
00:28:41,520 --> 00:28:42,180
Any questions?

576
00:28:52,180 --> 00:28:52,820
Got to say a few?

577
00:28:54,420 --> 00:28:58,220
So you said that APTs will tend to set up Google Alerts, right?

578
00:29:00,480 --> 00:29:03,200
Like for like new explicates, new malware samples, things like that.

579
00:29:03,260 --> 00:29:06,640
So where to see if they come up with new intel reports or say, or like buyer's toll comes

580
00:29:06,640 --> 00:29:07,620
up and says, oh, hey, there's this.

581
00:29:07,780 --> 00:29:07,980
Right.

582
00:29:08,180 --> 00:29:08,560
Things like that.

583
00:29:08,880 --> 00:29:10,720
What do you think, is that anomalous?

584
00:29:11,560 --> 00:29:17,500
I can't think of, I can't think of a normal reason for me, an average person, to like

585
00:29:17,500 --> 00:29:19,320
set up a Google or for a specific hash.

586
00:29:19,780 --> 00:29:20,100
So.

587
00:29:20,180 --> 00:29:23,320
So for like a private citizen, you'd want to do something like your social security

588
00:29:23,320 --> 00:29:25,420
number, your phone number, your real name, right?

589
00:29:27,620 --> 00:29:28,200
You need people to be able to do that.

590
00:29:28,200 --> 00:29:28,680
You need people to be able to do that.

591
00:29:28,980 --> 00:29:31,200
And you also, you want to tie it to more than just one.

592
00:29:31,320 --> 00:29:34,700
So say, for example, if you do like your social and your name, you're going to get a better

593
00:29:34,700 --> 00:29:36,540
percentage hit if you were just doing a social.

594
00:29:36,900 --> 00:29:37,260
Right.

595
00:29:37,480 --> 00:29:37,500
Right.

596
00:29:37,660 --> 00:29:43,860
So I was thinking, like, if you were Google, would it make sense to, this is sort of a

597
00:29:43,860 --> 00:29:44,140
.

598
00:29:44,140 --> 00:29:44,700
Oh, did you?

599
00:29:44,780 --> 00:29:50,440
Would it make sense to, like, say, if somebody is setting up Google Alerts for

600
00:29:50,440 --> 00:29:55,600
hashes, like, maybe they might be APTs and maybe you might want to, like, flag their

601
00:29:55,600 --> 00:29:57,540
account or whatever to see if they do anything.

602
00:29:57,860 --> 00:29:58,000
See.

603
00:29:58,100 --> 00:29:58,180
Yeah.

604
00:29:59,160 --> 00:30:03,020
I'm not going to talk on that subject because that's a TTP, but that's a very, very good

605
00:30:03,020 --> 00:30:03,500
line of thinking.

606
00:30:05,880 --> 00:30:06,280
Questions?

607
00:30:06,620 --> 00:30:07,540
I love questions.

608
00:30:07,620 --> 00:30:07,880
Come on.

609
00:30:08,560 --> 00:30:09,740
You can ask me where I got this shirt.

610
00:30:11,300 --> 00:30:11,700
Sir?

611
00:30:11,820 --> 00:30:12,480
Where did you get the shirt?

612
00:30:13,660 --> 00:30:21,460
So that information from Google that you fed into your tools, was that privileged information

613
00:30:21,460 --> 00:30:23,360
that you had access to in Google channels?

614
00:30:24,200 --> 00:30:27,140
So all that stuff was covered in the, in the very first slide.

615
00:30:27,260 --> 00:30:28,180
You have to understand that, you know, it's, it's, it's, it's, it's, it's, it's, it's, it's,

616
00:30:28,180 --> 00:30:30,600
I'm trying to think how to word this.

617
00:30:31,940 --> 00:30:37,220
It takes, whenever we do things through legal channels, it takes a great amount of time.

618
00:30:37,360 --> 00:30:39,760
So I'm still planning on what to do once the information comes back.

619
00:30:40,040 --> 00:30:45,240
So like now, we're doing, doing the warrant for information goes through Google and they'll

620
00:30:45,240 --> 00:30:46,220
send us whatever things we need.

621
00:30:46,800 --> 00:30:47,200
Does that make sense?

622
00:30:47,580 --> 00:30:50,240
But these cases, these cases happened several years ago.

623
00:30:51,760 --> 00:30:52,160
Sir?

624
00:30:52,340 --> 00:30:55,220
All the tools you talked about with the exception of Palantir are they open source

625
00:30:55,220 --> 00:30:55,580
and free?

626
00:30:55,760 --> 00:30:56,160
I'm sorry?

627
00:30:56,360 --> 00:30:58,160
All the tools you talked about with the exception of Palantir are they open source

628
00:30:58,180 --> 00:30:59,160
and free?

629
00:31:02,860 --> 00:31:03,400
Yeah.

630
00:31:03,920 --> 00:31:04,360
.

631
00:31:06,500 --> 00:31:07,040
Yeah.

632
00:31:08,400 --> 00:31:08,940
Questions?

633
00:31:09,540 --> 00:31:10,080
Sir?

634
00:31:12,740 --> 00:31:13,720
Oh, thanks, sir.

635
00:31:14,680 --> 00:31:15,820
You're not bad looking yourself.

636
00:31:17,320 --> 00:31:18,640
Shut up, I was cracking a joke.

637
00:31:20,860 --> 00:31:21,400
.

638
00:31:21,400 --> 00:31:21,640
Okay.

639
00:31:31,740 --> 00:31:34,340
So, I hate to be disrespectful.

640
00:31:34,620 --> 00:31:36,180
I mean, I love giving talks, right?

641
00:31:36,520 --> 00:31:37,800
There are some things that I can't say.

642
00:31:38,340 --> 00:31:40,380
But can you re-ask the question in a way

643
00:31:40,380 --> 00:31:42,300
if you were on a team, how to manage legends?

644
00:31:45,360 --> 00:31:46,160
I don't drink alcohol.

645
00:31:46,900 --> 00:31:49,180
But if you re-ask the question, I'm being serious.

646
00:31:49,180 --> 00:31:51,960
If you re-ask the question, how to manage legends

647
00:31:52,340 --> 00:31:54,000
within an environment, I'll be more than happy

648
00:31:54,000 --> 00:31:54,440
to answer the question.

649
00:32:03,560 --> 00:32:05,000
I'll ask the question for you.

650
00:32:07,160 --> 00:32:09,640
If you had multiple legends, and you were working

651
00:32:09,640 --> 00:32:10,800
in a team environment, how would you do it?

652
00:32:11,000 --> 00:32:11,920
Dude, no fucking problem.

653
00:32:11,960 --> 00:32:12,860
I have no problem answering that question.

654
00:32:13,760 --> 00:32:16,200
So, one of the biggest things, specifically

655
00:32:16,200 --> 00:32:18,600
in the CTA5 from DI Mythology,

656
00:32:19,180 --> 00:32:21,600
is you have, say, if I die.

657
00:32:22,000 --> 00:32:24,240
Someone needs to be able to pick up that work and carry on.

658
00:32:25,300 --> 00:32:28,480
So, our legend will compromise the type of nouns, pronouns

659
00:32:28,480 --> 00:32:31,380
we work with, like, full chat logs to see how I talk.

660
00:32:31,460 --> 00:32:32,600
Like, the type of words I use.

661
00:32:33,120 --> 00:32:34,660
Like, the type of lies that I say.

662
00:32:35,500 --> 00:32:37,440
The VPN address that I use, right?

663
00:32:37,660 --> 00:32:40,000
And so, where that legend can go from, look,

664
00:32:40,100 --> 00:32:42,280
person A to person B, and they can continue the mission.

665
00:32:42,600 --> 00:32:43,300
Does that make sense?

666
00:32:43,860 --> 00:32:44,220
Awesome.

667
00:32:44,400 --> 00:32:45,400
Good fucking job, dude.

668
00:32:47,880 --> 00:32:48,480
Question, sir.

669
00:32:49,180 --> 00:32:52,160
How many monitors do you have in the desk?

670
00:32:52,360 --> 00:32:54,580
And what resolution are you trying to make?

671
00:32:58,100 --> 00:33:02,060
So, I have co-workers in the room, so I can't lie.

672
00:33:04,000 --> 00:33:05,560
But, I have a shit ton.

673
00:33:05,620 --> 00:33:06,160
It's embarrassing.

674
00:33:07,440 --> 00:33:11,220
No, like, I have the Dell four-split, right, on both sides.

675
00:33:11,760 --> 00:33:14,640
Because I do a lot of Linux work.

676
00:33:14,880 --> 00:33:16,860
And then I've got a shit ton of monitors.

677
00:33:16,920 --> 00:33:17,680
It's fucking embarrassing.

678
00:33:18,820 --> 00:33:20,080
So, sir.

679
00:33:20,340 --> 00:33:23,880
You mentioned that the bad guys relatively don't realize

680
00:33:23,880 --> 00:33:27,240
that there are youth that exist out there, right?

681
00:33:27,980 --> 00:33:28,420
Yes.

682
00:33:28,520 --> 00:33:32,680
How many youths are there, and are there going to be more of youths

683
00:33:32,680 --> 00:33:34,060
to catch more bad guys?

684
00:33:37,000 --> 00:33:38,240
Do I have time still?

685
00:33:41,420 --> 00:33:43,680
When I was younger, I didn't know what skip tracing was.

686
00:33:43,900 --> 00:33:45,720
I had no fucking clue what skip tracing was.

687
00:33:46,200 --> 00:33:48,940
I read an article on Wired Magazine,

688
00:33:48,940 --> 00:33:49,720
by Michelle Gomez.

689
00:33:51,520 --> 00:33:52,240
OG gangsta.

690
00:33:52,440 --> 00:33:55,880
Like, old-school hacker type, but she didn't know she was a hacker.

691
00:33:56,720 --> 00:33:59,180
I hate to say this, and oh my God, I can't believe I'm saying this,

692
00:33:59,320 --> 00:34:02,180
but I heard a quote a long time ago from Jason Street.

693
00:34:02,320 --> 00:34:05,080
He said, some of the best hackers in the world don't own computers.

694
00:34:05,740 --> 00:34:06,840
I thought he was just full of shit.

695
00:34:06,900 --> 00:34:07,900
I never really cared.

696
00:34:08,060 --> 00:34:09,260
I was like, it's Jason.

697
00:34:09,720 --> 00:34:10,320
I'm just kidding.

698
00:34:10,940 --> 00:34:13,980
And I was thinking, holy shit, he's right.

699
00:34:14,920 --> 00:34:17,680
Some of the best hackers in the world are not technical.

700
00:34:17,820 --> 00:34:18,420
Don't own computers.

701
00:34:18,420 --> 00:34:22,720
They don't, they do machine sculpting, they do, fuck, I don't know,

702
00:34:22,780 --> 00:34:24,320
just, I'm going to bullshit something, I don't fucking know.

703
00:34:25,880 --> 00:34:29,440
But, I see how she worked, and I see how,

704
00:34:29,780 --> 00:34:30,920
she's actually supposed to be my guest.

705
00:34:31,120 --> 00:34:32,060
She actually wasn't able to make it.

706
00:34:33,460 --> 00:34:35,100
I see how she worked, and I see how I work,

707
00:34:35,120 --> 00:34:37,160
and I see how I come from a hacker background,

708
00:34:38,580 --> 00:34:40,000
and I want to do something good for my country.

709
00:34:40,440 --> 00:34:40,900
You know what I mean?

710
00:34:40,940 --> 00:34:43,300
I want to do something good for, I want to serve my country.

711
00:34:44,080 --> 00:34:47,580
I see how she did it, and she's the exact same way she went,

712
00:34:47,580 --> 00:34:48,540
just, she just had different routes.

713
00:34:48,720 --> 00:34:50,380
Like, she knows how to find boats,

714
00:34:50,540 --> 00:34:53,840
she knows how to do, like, huge tankers that are being stolen, right?

715
00:34:55,760 --> 00:34:57,580
It's, it's a very niche thing,

716
00:34:58,260 --> 00:35:01,660
but this work helps me do more intelligent analysis to track other,

717
00:35:01,720 --> 00:35:03,020
it's pretty much the same, same thing.

718
00:35:03,500 --> 00:35:04,220
Did I answer your question?

719
00:35:04,600 --> 00:35:05,260
Because I kind of rambled.

720
00:35:05,420 --> 00:35:05,500
Not really.

721
00:35:07,340 --> 00:35:10,340
So how many people do sort of what you do,

722
00:35:10,460 --> 00:35:12,440
and are there going to be more,

723
00:35:12,600 --> 00:35:14,760
because it seems like it's a pretty efficient way of finding people?

724
00:35:15,260 --> 00:35:17,180
So, through all the work from,

725
00:35:17,180 --> 00:35:19,040
from law enforcement that I worked with,

726
00:35:19,580 --> 00:35:22,140
I think I met two or three actual hackers.

727
00:35:22,960 --> 00:35:26,080
A lot of them are, like, former military

728
00:35:26,080 --> 00:35:27,360
that know how to use database searches,

729
00:35:27,540 --> 00:35:28,520
and they have the analytical thinking,

730
00:35:29,560 --> 00:35:32,500
but they don't know how to do things like getting an Xbox Live IP address,

731
00:35:32,660 --> 00:35:34,220
getting things, like the technical side of it.

732
00:35:34,340 --> 00:35:34,840
Does that make sense?

733
00:35:35,080 --> 00:35:36,080
Did I actually answer that time?

734
00:35:36,760 --> 00:35:38,340
Dude, I apologize, my mind's racing.

735
00:35:39,780 --> 00:35:40,180
Sir?

736
00:35:41,000 --> 00:35:42,700
Can you tell us anything about,

737
00:35:42,960 --> 00:35:45,040
have you ever encountered somebody

738
00:35:45,040 --> 00:35:47,000
who you just could not track,

739
00:35:47,180 --> 00:35:50,600
or how about, like, the hardest person you ever had to track down?

740
00:35:50,700 --> 00:35:51,480
If you'll give me your phone number.

741
00:35:54,240 --> 00:35:54,560
Yes.

742
00:35:55,220 --> 00:35:55,540
Yes.

743
00:35:57,180 --> 00:35:58,140
Three cases altogether.

744
00:35:59,020 --> 00:35:59,940
Two of them killed themselves,

745
00:36:01,240 --> 00:36:03,820
and one, it wasn't that,

746
00:36:06,480 --> 00:36:07,420
I'm trying to think how to word this.

747
00:36:08,320 --> 00:36:09,800
I'm trying to say legal, I sincerely apologize.

748
00:36:09,960 --> 00:36:11,240
There's a list of things I can and cannot say,

749
00:36:11,360 --> 00:36:12,780
and there's, like, only four things I'm supposed to be saying.

750
00:36:15,120 --> 00:36:17,160
It wasn't, it wasn't the fact that I could,

751
00:36:17,160 --> 00:36:17,860
I couldn't find him.

752
00:36:17,940 --> 00:36:20,080
It was the fact that we couldn't legally apprehend him.

753
00:36:20,200 --> 00:36:20,640
Does that make sense?

754
00:36:21,580 --> 00:36:23,860
Like, like, everything I do is on a team environment,

755
00:36:24,000 --> 00:36:25,660
and I swear to God, for every hacker on our team,

756
00:36:25,760 --> 00:36:26,600
there's four fucking attorneys.

757
00:36:27,160 --> 00:36:27,740
You know what I mean?

758
00:36:27,920 --> 00:36:30,200
And sometimes, it comes to an art of,

759
00:36:30,640 --> 00:36:31,440
the attorneys are saying,

760
00:36:31,620 --> 00:36:32,760
no, it's going to break international law.

761
00:36:33,040 --> 00:36:34,680
Even, even if they send me to, like,

762
00:36:34,680 --> 00:36:36,460
Galapagos Islands, to where I can do most of my work,

763
00:36:36,500 --> 00:36:37,800
to be able to, to be able to stay legal,

764
00:36:40,440 --> 00:36:42,100
sometimes, like, most international law is not written.

765
00:36:42,620 --> 00:36:42,940
Right?

766
00:36:44,320 --> 00:36:45,160
It's always been,

767
00:36:47,620 --> 00:36:48,580
dude, I'm sorry, my,

768
00:36:51,180 --> 00:36:53,340
one of the big, biggest things in intelligence

769
00:36:53,980 --> 00:36:55,760
is doing your, doing your steps.

770
00:36:56,160 --> 00:36:58,040
What you did to start with, and where you went,

771
00:36:58,180 --> 00:37:00,940
and whatever, as long as, even if I don't find them,

772
00:37:01,040 --> 00:37:02,260
and I can give them to someone else,

773
00:37:02,400 --> 00:37:04,980
they can match it, and carry on the mission.

774
00:37:06,800 --> 00:37:09,440
But, sometimes, you just can't break the law.

775
00:37:09,660 --> 00:37:12,480
And the law is so particular about one certain area,

776
00:37:12,600 --> 00:37:14,720
specifically, like, on passports, and from foreign countries,

777
00:37:15,460 --> 00:37:16,780
that sometimes you just say,

778
00:37:17,520 --> 00:37:19,740
this is where, I know this is where his last known location was,

779
00:37:19,760 --> 00:37:20,400
and there's nothing else I can do.

780
00:37:20,760 --> 00:37:21,460
And it sucks.

781
00:37:22,580 --> 00:37:23,120
It sucks.

782
00:37:24,260 --> 00:37:24,920
Thank you, sir.

783
00:37:26,120 --> 00:37:27,240
Anything, any other questions?

784
00:37:28,060 --> 00:37:28,420
Sir?

785
00:37:28,660 --> 00:37:29,000
I got one.

786
00:37:29,220 --> 00:37:31,820
You mentioned earlier how the person you tracked down,

787
00:37:32,640 --> 00:37:36,280
I think, like, several hundred AACs for one individual.

788
00:37:36,440 --> 00:37:37,220
Yes. Yes.

789
00:37:37,520 --> 00:37:40,860
How did you track, that's the part where, I guess,

790
00:37:40,880 --> 00:37:42,360
what, 35, pretty quickly?

791
00:37:43,060 --> 00:37:44,520
Oh, my, I'm sorry, my talk, actually,

792
00:37:44,580 --> 00:37:46,580
I was told I was given 30 minutes from 45 minutes.

793
00:37:46,680 --> 00:37:47,120
There was a,

794
00:37:47,120 --> 00:37:48,580
I talk kind of fast.

795
00:37:48,900 --> 00:37:50,040
So all I'm trying to figure out is, like,

796
00:37:50,040 --> 00:37:53,640
when you went through, and after you start tracking at one, two, three,

797
00:37:53,700 --> 00:37:55,560
like, how did you gather all of those?

798
00:37:57,120 --> 00:38:00,080
So, gather through mostly closed source sources,

799
00:38:00,220 --> 00:38:02,220
a lot of OSINT, a lot of other things,

800
00:38:02,300 --> 00:38:04,460
but what the master merge does for me is say,

801
00:38:04,640 --> 00:38:06,360
oh, the creation date of this Twitter account

802
00:38:06,360 --> 00:38:07,940
doesn't match the time of this Gmail.

803
00:38:08,760 --> 00:38:11,260
Or, this douchebag was here, but not here at this location.

804
00:38:11,460 --> 00:38:14,740
Or, his passport entered this country at this time, but didn't,

805
00:38:14,740 --> 00:38:17,100
so it's really good for finding misreported,

806
00:38:17,100 --> 00:38:17,300
information.

807
00:38:19,060 --> 00:38:19,460
Yeah?

808
00:38:19,820 --> 00:38:20,220
Questions?

809
00:38:20,620 --> 00:38:20,840
Ma'am?

810
00:38:22,160 --> 00:38:22,960
One question.

811
00:38:23,240 --> 00:38:24,020
I'm just fucking with you.

812
00:38:29,840 --> 00:38:30,240
Yes.

813
00:38:42,260 --> 00:38:45,920
As silly as it sounds, and I, I hate to play the autism card,

814
00:38:46,420 --> 00:38:46,960
but I,

815
00:38:47,000 --> 00:38:47,080
I,

816
00:38:47,080 --> 00:38:48,340
I am very bad at putting things down.

817
00:38:49,020 --> 00:38:51,360
I am very, very, very bad at putting things down.

818
00:38:51,820 --> 00:38:55,580
Like, uh, the, uh, the, uh, uh, Hoover, the second case.

819
00:38:56,320 --> 00:38:59,360
Um, oh, I wanted, I wanted to fucking destroy his life.

820
00:38:59,760 --> 00:39:04,440
That was actually the last case where the agency would tell me the story,

821
00:39:04,980 --> 00:39:07,780
because we learned our lesson, because Rhett is emotionally retarded.

822
00:39:07,920 --> 00:39:08,420
All right?

823
00:39:10,200 --> 00:39:11,480
It's very hard for me to put things down.

824
00:39:11,700 --> 00:39:14,940
And I will, that's one of the reasons why I spent 510 hours on that one case.

825
00:39:15,380 --> 00:39:15,780
Right?

826
00:39:16,400 --> 00:39:16,800
It's,

827
00:39:17,080 --> 00:39:18,220
it's very hard for me to put things down.

828
00:39:18,220 --> 00:39:21,280
Um, one of the, one of the rules that I'm trying to follow now is,

829
00:39:21,420 --> 00:39:25,220
if I find three unique pieces of information that don't tie together to two

830
00:39:25,220 --> 00:39:27,240
information that I've confirmed, I say, okay, done.

831
00:39:27,400 --> 00:39:28,580
I, I record it.

832
00:39:28,640 --> 00:39:30,800
I say, here it is, Marines, and, you know what I mean?

833
00:39:31,360 --> 00:39:32,240
What was your second question?

834
00:39:38,500 --> 00:39:44,240
I sincerely apologize, but I won't answer that question.

835
00:39:45,780 --> 00:39:46,360
I apologize.

836
00:39:48,900 --> 00:39:49,220
Questions?

837
00:39:51,180 --> 00:39:51,500
Sir?

838
00:39:56,380 --> 00:39:56,700
Um.

839
00:40:03,060 --> 00:40:04,740
To be absolutely honest with you, I'm not going to answer that question.

840
00:40:05,620 --> 00:40:05,940
Um.

841
00:40:08,240 --> 00:40:10,860
My best friend, um, actually has an OSCP and OSCE.

842
00:40:11,660 --> 00:40:12,260
Extremely intelligent.

843
00:40:12,780 --> 00:40:13,200
Extremely intelligent.

844
00:40:13,320 --> 00:40:13,840
Love the guy to death.

845
00:40:14,760 --> 00:40:15,080
But.

846
00:40:16,060 --> 00:40:16,380
He's.

847
00:40:16,380 --> 00:40:21,340
He's, I see how he can take a pen test mindset, and be able to go into an intelligence life,

848
00:40:21,420 --> 00:40:23,120
uh, intelligence, uh, field.

849
00:40:23,520 --> 00:40:23,880
Right?

850
00:40:24,880 --> 00:40:27,260
If you have the hacker mindset, you've got the fucking hacker mindset.

851
00:40:28,120 --> 00:40:28,700
You know what I mean?

852
00:40:29,000 --> 00:40:32,740
It's, it's an experience thing that comes with time.

853
00:40:33,260 --> 00:40:33,820
You know what I mean?

854
00:40:34,340 --> 00:40:36,960
It's not about, it's like, it's like trying to study for the OSCE.

855
00:40:37,180 --> 00:40:38,340
You can't study for the OSCE.

856
00:40:38,400 --> 00:40:39,760
It's an, it's an experience thing.

857
00:40:40,440 --> 00:40:41,040
You know what I mean?

858
00:40:41,700 --> 00:40:45,580
I'm, I'm, like, like I said, um, I'd go dox dudes and anonymous that think they're hot

859
00:40:45,580 --> 00:40:45,780
shit.

860
00:40:46,860 --> 00:40:47,860
No, I'm, I'm being serious.

861
00:40:47,920 --> 00:40:49,220
That's actually one of the first things I started doing.

862
00:40:49,640 --> 00:40:52,880
Um, I can't stand people who go after private citizens.

863
00:40:53,100 --> 00:40:54,200
I can't fucking stand them.

864
00:40:54,560 --> 00:40:58,260
You don't call yourself a hacker and go after people who can't defend themselves.

865
00:40:58,520 --> 00:41:02,620
Like, older couples, um, there was a, there was a dude that was living with his, with

866
00:41:02,620 --> 00:41:04,780
his parents that his, because his credit was shot, because he went to.

867
00:41:06,460 --> 00:41:10,820
In my own personal opinion, not speaking for my employer, hackers who call themselves hackers

868
00:41:11,440 --> 00:41:15,660
and target personal lives to ruin them just for money, you can get the fuck out of here.

869
00:41:16,380 --> 00:41:17,320
And that's my own personal opinion.

870
00:41:17,440 --> 00:41:18,120
To me, that's not a hacker.

871
00:41:18,240 --> 00:41:22,480
A hacker is someone who strives for knowledge, tries to, uh, dude, I'm rambling, I apologize.

872
00:41:23,360 --> 00:41:25,140
But, uh, no, seriously.

873
00:41:25,380 --> 00:41:28,180
Uh, some, some, there's, there's people out there, there's groups out there, and I'd

874
00:41:28,180 --> 00:41:31,200
start just going through, I'd learn what doxing's all about.

875
00:41:31,600 --> 00:41:34,180
Um, difference between illegal doxing and legal doxing.

876
00:41:34,360 --> 00:41:34,940
You know what I mean?

877
00:41:35,080 --> 00:41:35,840
And keep it to yourself.

878
00:41:36,160 --> 00:41:36,820
And just practice.

879
00:41:37,480 --> 00:41:41,600
Uh, that's actually one of the, uh, my niece, actually, and I'm actually not rambling, I'm

880
00:41:41,600 --> 00:41:42,600
actually on, on topic now.

881
00:41:44,240 --> 00:41:45,640
Um, my niece, um.

882
00:41:46,380 --> 00:41:47,100
Had some things happen.

883
00:41:47,160 --> 00:41:47,860
I love my niece to death.

884
00:41:48,180 --> 00:41:49,140
Absolutely love her to death.

885
00:41:49,320 --> 00:41:51,060
She's a pain in my ass, but I fucking love her.

886
00:41:51,800 --> 00:41:53,860
Um, she had, she had some bad things happen.

887
00:41:54,220 --> 00:42:00,680
And this guy, actually from, from, from Tulsa, Oklahoma, a hacker, which didn't even know

888
00:42:00,680 --> 00:42:05,160
what, didn't even know how to spell Python, um, was just fucking with her.

889
00:42:05,480 --> 00:42:06,400
I couldn't believe it.

890
00:42:06,620 --> 00:42:09,640
Like, I go read this guy's Twitter and his Facebook, he's talking about how he's dropping

891
00:42:09,640 --> 00:42:11,140
O-Day and all these CVEs.

892
00:42:11,140 --> 00:42:13,420
I'm like, dude, you're a fucking tool bag.

893
00:42:13,900 --> 00:42:15,060
You're a fucking tool bag.

894
00:42:15,220 --> 00:42:16,360
You're using, you're using.

895
00:42:16,380 --> 00:42:17,320
You're using whitepeople.com.

896
00:42:17,460 --> 00:42:18,260
Not whitepeople.com.

897
00:42:24,120 --> 00:42:28,620
The, the, the, the fucking, the white, the whitepages.com, right?

898
00:42:29,160 --> 00:42:31,840
And I'm thinking, I'm done.

899
00:42:32,060 --> 00:42:32,720
I'm fucking done.

900
00:42:35,060 --> 00:42:36,020
I need a Xanax.

901
00:42:36,100 --> 00:42:36,700
Just give me a second.

902
00:42:37,920 --> 00:42:38,540
Go say monsieur.

903
00:42:39,260 --> 00:42:39,680
I'm good.

904
00:42:39,860 --> 00:42:45,660
Um, have you encountered any, I don't know, for lack of a better term, worthy adversaries?

905
00:42:45,680 --> 00:42:46,240
Someone who.

906
00:42:46,380 --> 00:42:49,160
Who is, has extreme skills and has.

907
00:42:49,420 --> 00:42:49,780
Absolutely.

908
00:42:49,920 --> 00:42:50,620
Covered their trails.

909
00:42:50,760 --> 00:42:51,120
Absolutely.

910
00:42:51,440 --> 00:42:53,300
Can you tell us a little bit about what you've seen?

911
00:42:55,160 --> 00:42:55,520
Um.

912
00:43:00,480 --> 00:43:02,340
I sincerely apologize, but I can answer that question.

913
00:43:02,880 --> 00:43:04,040
I, I sincerely apologize.

914
00:43:05,360 --> 00:43:06,220
I would love to.

915
00:43:06,300 --> 00:43:07,100
I would absolutely love to.

916
00:43:08,500 --> 00:43:09,140
But I apologize.

917
00:43:09,620 --> 00:43:10,800
So, if we are out of time.

918
00:43:10,960 --> 00:43:11,420
Find me outside.

919
00:43:11,920 --> 00:43:12,680
We'll take a break.

920
00:43:13,900 --> 00:43:14,380
I'm sorry?

921
00:43:14,600 --> 00:43:15,340
It's out of time now.

922
00:43:15,360 --> 00:43:15,580
All right.

923
00:43:15,600 --> 00:43:16,000
Thanks, sir.

924
00:43:16,780 --> 00:43:17,260
My God.

925
00:43:18,040 --> 00:43:18,520
Man.

926
00:43:18,520 --> 00:43:18,860
Society kills me.

927
00:43:18,900 --> 00:43:19,380
Come on.

928
00:43:19,820 --> 00:43:20,380
Gotta song, man.

929
00:43:20,460 --> 00:43:20,940
All right.

930
00:43:21,200 --> 00:43:21,680
Next question.