JACK: A lot of hackers act alone, do it solo, and treat it like an art form. They plan their attack,
feel for what to do next, attempt to exploit the system. They rely on their intuition to conduct
a hack but Ira does it differently. IRA: I specialize in putting together teams
of former Special Forces and intelligence officers to go after organizations.
JACK: Ira is methodical, follows a playbook, and works with highly trained people. The
jobs Ira does are bigger than what one person is capable of. He needs a crew of specialized people,
each one with a different mastery of their craft. He’s assembled one of the most elite hacking teams
in the country. Each member is incredibly skilled. They rely more on their training and what steps
are required to accomplish the task and less on intuition. The plan of attack is structured
and methodical. IRA: Yeah.
JACK: Think of it like Ocean’s Eleven. IRA: I don’t even want to call it Ocean’s Eleven
‘cause that’s kind of amateurish hours. JACK: This team is about to embark on a mission
where over a billion dollars are at stake. IRA: The first time you steal a billion dollars,
it’s a bit of a rush. After you’ve done this so many times,
it’s almost expected. JACK (INTRO): [INTRO MUSIC]
These are true stories from the dark side of the internet.
I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: I’ve been told that some of my listeners are nine year olds. Crazy, huh?
So hey, what’s up, kids? But because of this I’m gonna have to give warnings as needed
and in this particular episode it does have bad language. Sorry, kids. You’ve been warned.
I want you to meet Ira Winkler. IRA: Hey there.
JACK: Eight years ago I heard Ira talk at a security conference and he blew me away.
It’s one of those talks that I’ll never forget and I’m very excited to be able to talk to him again
because he leads a very interesting life. Ira looks at the world differently than you or I.
He’s quick to see a vulnerability either in a person or a building or a computer and exploit
it. He’s good at this because of his background. He was fascinated early on by the human brain so
he got a college degree in psychology. After getting a degree he had a hard time finding
a job. He thought maybe the US government would hire him so he took their aptitude test.
IRA: Did really well; basically, if I got a clearance I got a job. I got the clearance. They
said wow, you have really good computer aptitude. You want a computer internship? I’m like no,
I hate computers. I want nothing to do with them. They’re like, what about cryptanalysis?
It’ll be like playing games. I’m like I don’t want to look at ones and zeros all day.
JACK: But he didn’t see any better option. IRA: Finally I took a job as an Intelligence
Analyst for the National Signals Intelligence Operations Center
which was known as NSTOC which was the only room that actually looks cool in NSA.
JACK: Part of this job was to decipher encrypted messages. This is called cryptanalysis.
Here within the walls of the NSA he was learning about computer security. He was understanding what
encryption is secure and what isn’t in a very real world, hands-on way. He taught himself
how to program to do his job better but… IRA: Ironically I hated cryptanalysis. I hated
computers. My first technical computer job was programming super computers to
do cryptanalysis so that was bizarre. JACK: He eventually moved to another department,
this time doing research and development for a tactical signals intelligence.
IRA: It’s where I was running around Europe helping people
in little green trucks do stuff. JACK: Do stuff. Ira is secretive about what he
did at the NSA because he has to be. The Signal’s Intelligence is collecting information from the
enemy and the enemies are everywhere. There’s always a threat [00:05:00] brooding somewhere,
possibly in other countries planning an attack on us, or terrorist groups meeting to discuss
their next steps. Signal’s intelligence is knowing what the enemy is up to. You do this
by finding where they are and then figure out a way to intercept those conversations.
While running around in Europe helping people in little green trucks, Ira became more worldly and
started to learn how spies operate. But eventually he left the NSA and joined a contracting company.
He did various IT tasks but then one day a new contract job was given to him.
IRA: They were like well, we have a contract to find out as much about the company as possible
without breaking into their computer systems.
JACK: Basically the contract was to use social engineering against an investment bank
to see if he could get access to it. Now keep in mind this is the early 90s so not a lot was known
about social engineering at the time. IRA: I just started going ahead and basically,
my intelligence background – having worked in NSA, working with a bunch of other intelligence
agencies along the way and stuff, I just used essentially basic human elicitation techniques
to lie to people over the phone. JACK: Human elicitation is the act of getting
someone to tell you a piece of information. With his experience and intelligence-gathering
at the NSA and being a psychology major, Ira took an interest to this and did pretty good
at getting people to tell him information they shouldn’t be telling him. For instance,
he might start out by simply asking an employee for a phone number and getting it,
and then slowly asking for more and more stuff until he has a whole phone directory. Eventually
the person’s giving him loads of information that they shouldn’t be giving him.
IRA: I’d get them to slowly give away information and then I started getting
lots of login IDs and passwords. I even got the investment bank to send me a computer
preconfigured for their VPN. That was fun. JACK: Getting people to tell him information
they shouldn’t be telling him came naturally and he realized he was good at this.
IRA: By the end of three days I had supposedly used their IDs and logins
to make financial transactions. JACK: By using just a phone and his wits,
Ira was eventually able to take over the bank. He gave a talk at a security conference and wrote an
article about how he did this. People responded in ways he didn’t see coming. They were so
impressed with his methods and abilities. IRA: Then when it got really well-publicized and
people started coming to me to do weirder and weirder stuff, they were like well, we want
you to come into our company as a temporary employee and rob us blind. So I did.
JACK: That’s how Ira’s career got started as a social engineer and penetration tester.
He was paid to test whether he could access places he shouldn’t be allowed to access,
or get information he shouldn’t be allowed to get because this is what bad guys will
try to do and companies wanted to protect themselves. As the jobs got weirder and
weirder he got better and better at gaining unauthorized access. He eventually started
getting so many jobs that he started his own security consulting company. [MUSIC]
But here’s where things get totally crazy. Ira has a background in national intelligence
and is very familiar with how spies operate. Like, real military-trained spies. He met many of them
at his time working for the government so when he started doing his own penetration testing he would
ask some of his spy friends to help him on certain missions. Over time Ira was able to build a crack
team of highly trained special agents to help him break into buildings and steal information.
Ira started taking on bigger jobs and using his crew to get into some of the most secure
buildings, buildings such as nuclear reactor facilities and banks. Ira became known as one of
the best to hire to do penetration testing because he brings a team like nobody else can.
IRA: I like to call them more espionage simulations. I specialize in putting together
teams of former Special Forces and intelligence officers to actually go after organizations like
real high-level adversaries would. JACK: Yeah. The media has called him the
modern-day James Bond. Depending on the job, he’ll put together an elite team for the task.
For instance, there’s Stu. IRA: Stu’s a former Navy seal.
JACK: He’s extremely fit, agile, tactical, and has years of training in espionage and raiding. Yeah,
raiding. He knows where to look for weak points in a structure, knows how to use a grappling hook,
and he’s good at going undetected by security. He helps Ira whenever there’s
a need for physical intrusions. IRA: Stu has an innate nature.
Frankly one time, he took advantage of a situation much quicker than
– I’m mad at myself I didn’t do this. But we were once in a security room
having our pictures taken for badges and the guard walks out. He’s like I’ve got to go to the other
room and pick up the badges. Stu’s like, Ira, lean against the door for a second.
So I go lean against the door. Stu goes behind the desk and pulls up a bunch of blank badges,
like valid security badges, and grabs them. JACK: These are some of the things Ira
tests for. Him and Stu look for physical vulnerabilities like this and report them.
[MUSIC] Then there’s Tony. IRA: Former Army counterintelligence
officer. JACK: Tony has been
trained to look for threats against his [00:10:00] country. He’s good at collecting this information
by using traditional spying techniques; gaining physical access to a building, stealing documents,
or simply doing social engineering. IRA: Tony is also good on the physical side
but we primarily used him for the telephone social engineering. He would be an intelligence
specialist in human intelligence. He was trained in counterintelligence so
he would know how to conduct interviews, he would know how to elicit information, and so on.
JACK: Tony has been trained to follow a process to get someone to divulge information that would in
essence, betray their own country. He’s tricky and clever and extremely good at what he does.
IRA: There’s a process of establishing a relationship and elevating the relationship to
the point where you get people to slowly divulge non-important information to where you slowly
raise the stake of what level of information they give out ‘til at some point they’re pretty much
over the hump and they’re screwed. JACK: Tony comes across as a nice guy
in every man, someone who you might think as a good, wholesome gentleman.
He’s calm and courteous which comes in handy when you’re trying to get information from
every day, normal people who might not even know they have valuable information to divulge,
like say, the front desk receptionist. IRA: He has this nice – you know, just a slow
speaker. He’s kind of like you expect to see when you’re driving through Kansas
and stop to ask for directions. You would swear he was a good old country boy.
JACK: Then there’s Stan. Stan is kind
of my favorite. IRA: Stan was a Colonel
in the GRU before he defected over. JACK: The GRU is Russia’s foreign intelligence
agency similar to the CIA. They’re often trained to follow spies or be deployed in foreign lands
and collect information. Stan has extensive training in intelligence-gathering.
IRA: Stan’s background, besides him being a Russian
operative, his primary target while he was in the GRU was against China. He speaks fluent Mandarin.
He also reads Chinese and all that before he came to the US where he was obviously focused on
targeting US intelligence-type stuff. JACK: Stan came to the US to collect data on
US government and report it back to Russia. He’s a masterful spy. He would often go to Washington
DC and hang out in bars. He’d ask someone for a cigarette and start a conversation.
He’d learn they work for a government agency; no surprise in Washington DC. But over time Stan
would build trust with that person and get them to divulge government secrets.
IRA: Stan was referred to me as one of the most successful GRU agents targeting the US in history.
Stan literally gets people to betray his country under penalty of death,
which is a different level of social engineering than getting somebody to give up a password.
We use him to target an organization the way a real foreign operative would,
because everybody thinks of spying like James Bond but the actual traditional espionage is
done by spies like Stan. What they try to do is they try to find access to people with information
and get them to divulge it either knowingly or unknowingly to him. This is kind of like,
I don’t even want to call it Ocean’s Eleven ‘cause that’s kind of amateurish hours.
JACK: Stu, Tony, and Stan have had training in some of the most advanced places in the world
and have enough experience to have mastered their craft. This is just some of the members
of Ira’s team. Their combined skills make them potentially one of the most
advanced hacking teams in the world. IRA: I just know them from my intelligence
background but here’s the difference between somebody who goes around, I’m a social engineer;
it’s like you know these people if they get caught they just give the get out of jail free card.
You’re talking about Stan, who was in China being monitored, who had radioactive powder put on his
doorknob so it was easier to track him. Stan knew any moment in time he could be pulled off the
street, tortured, and killed. Stu, Navy seal; he knows any point in time, he gets captured,
he’s dead. We’re talking about people who have a fundamental aversion to be captured, not because
they’re afraid they’ll have to pull out their get out of jail free card and it’ll be embarrassing.
We’re talking people who know to do this because their lives depended
on it. JACK: [MUSIC]
As Ira’s reputation went up as an elite pen tester, he got a contract from one of the
biggest companies in the world. IRA: Global 5 company.
JACK: They wanted him to do an espionage simulation against them
to see how vulnerable they are. Now, a Global 5 company is worth hundreds of billions of dollars
which means the company has a lot to lose. One thing in particular that would cause
a lot of financial damage is all the research and development information.
It’s the stuff like the source code for their systems or all the technology they’re
coming out with in the next few years. IRA: That was our primary target, to prove we
could get access to all the RND data. JACK: If this were to be stolen by another
competitor [00:15:00] or government it could cost them billions of dollars.
Ira’s job was to find as many weaknesses as possible to help secure them.
IRA: Primarily it was just, I hate to say it, grab ‘em by the balls and squeeze.
JACK: Ira started researching and planning the mission. He first figured out the location of
the RND department which turned out to be in a small town in the middle of nowhere. He
used Google Maps and other tools to learn more. There was a fence around the whole property
and stationed guards to restrict people from being able to drive in. He determined the building was
going to be locked and the data he was looking for would be in their computer operations center.
He was able to make some phone calls and figure all this out pretty quickly. As he sized up the
job he knew he was gonna need some help so he assigned Stu, Tony, and Stan to the mission. All
four of them fly to the small town where the research and development office was located.
The team arrives one by one; the ex-NSA agent, the Navy seal, the Army counterintelligence
officer, and the Russian spy. IRA: Tony ironically was responsible
for following Russian spies around Europe while he was in the army. It was kind of funny to have
him stay and working on the project together. I flew in late at night and all I wanted was a
stupid bottle of water that the hotel didn’t have so I’m driving around trying to – in this little
strip mall type of place and all of a sudden, I’m driving around late at night, and I look in
my rear-view mirror and there’s a car behind me. I was driving pretty slow, which is unusual for
me ‘cause I was looking to see what stores might be open. Anyway, I moved over to let the car go
by me and then the car moves over with me. Then it’s like, am I being followed? So I switched
lanes once again and the car follows me again. I’m like, I’m being followed. [MUSIC]
Most people think okay, speed off. That’s not what you do when you’re being followed
in the real world. One of the gas station – open up with a little Quick Mark in it.
Basically I’m driving and I do make the sharp turn like I’m gonna drive past,
and I make the sharp turn into the gas station, pull my car up to where I can
get out of the car and go straight into the door of the Quick Mark, blocking everything.
What happened was the car pulls behind me. It turns out to be an unmarked police car.
I’m kind of relieved it’s a police car. The cop gets out. I go what the hell were you following
me for? He’s like, why were you cutting over? I go ‘cause I was being followed.
The guy couldn’t argue with me. He goes well, you were driving kind of, you know, you were
driving below the – I go when is driving below the speed limit an area of concern? Like, a crime?
It was kind of funny but I was calling out the cop for following me.
JACK: The squad begins the mission. First they scout the building and watch what people are
wearing as they come and go. They notice which points of entries there are and how traffic flows.
Then they regroup to put clothes on to physically blend in with other employees.
Ira puts on a shirt with the corporate logo on it. They suited up and got ready
and at last, they’re all set. It’s now go time. All four of them get in
the car and drive to the building. IRA: We ended up going there. They had a
campus-like setting for their RND center. JACK: There was a guard gate to get onto the
campus with actual guards checking everyone coming through. But there
was a lot of traffic that morning. IRA: Everybody was just lined up coming off
the main road and stuff. You hold up something that looks like a badge and they don’t check.
Nobody wants to slow down the morning rush hour. They just waved us through.
We knew where their computer operation center was so this was like day one.
Drove everybody in and then we’re like okay, let’s get in. I told everybody yeah, hold on a
second. Let’s just stand here by the door. JACK: The team waits around acting inconspicuous
while Ira forms a plan. He tries the door; it’s locked. He thinks maybe he can tailgate someone in
and waits for someone to come out. IRA: Then I started hearing somebody come
out. There was a crypto-lock on the door and I just started acting like I’m pressing buttons.
The guy goes out, holds the door open for me, I and my team go in. They quickly orient themselves
in the building and start heading to the computer operations center. They act like they belong,
walking deliberately but not too fast, scanning the room but careful not to be obvious.
They try to blend in and go unnoticed. They eventually found the room they were looking
for and gained access to it. Once there… IRA: We find out that all their critical servers
were left logged on as admin. Pretty much, we just added a new .rhost entry for when we had control
over, so we were able to basically get a trusted relationship on all of the critical servers
within the room without causing any significant damage. Then the technical operation was done.
While we were walking around though, [00:20:00] Stan was walking – he’s like what are these
Chinese-American dictionaries doing on the shelf here? I’m like have you seen
US colleges lately, Stan? Sarcastically. Stan’s like I’ll look into this. Anyway,
we were done day one where Stu and I were like, we physically compromised
every – the critical information we needed. JACK: They head back to the car with the feeling
of mission accomplished. But Ira’s done this so much he doesn’t really get excited anymore.
IRA: Well, the first time you steal a billion dollars it’s a bit of a rush.
After you’ve done this so many times it’s almost expected. Frankly, it was really
unclimactic to actually take over control of all their computers in the RND center.
JACK: There were still a couple more objectives that the team wanted to do. Tony made some phone
calls and was trying to get people to tell him usernames and passwords over the phone.
IRA: Of course, Tony was able to get information right and left.
JACK: Stan was doing what spies do; he was going around town doing a
counterintelligence assessment. Basically he was looking around for anything suspicious.
Ira began compiling his findings in a report, showing exactly how much damage he could have done
to the company with what he found. But because the team finished early they had a few days with
nothing to do in this small town. IRA: We had time to kill. We drove around,
looked at different restaurants and so on, and figure out where we’re gonna go.
A couple days later, after I go – I remember, I’m like done. I moved on to a different project while
Stan was doing his counterintelligence assessment of the area. Calls me up two days later, goes Ira,
there are black duck eggs on the menu. I’m like, what the fuck? Is this what we’re paying you for?
He’s like Ira, my naïve American friend, he goes don’t you know black duck eggs, delicacy China.
Then you start putting it together. He goes Ira I go to Chinese restaurant number
one that we drive past. Chinese restaurant number one; people friendly, food not so good.
I go, Chinese restaurant number two, walk in, menu written only in Chinese. Delicacies you can’t get
in San Francisco let alone this little piece of shit town in the middle of nowhere. I start
talking to them in Mandarin and they get very, very worried. What funny Russian guy
doing talking fluent Mandarin? Then he’s like Ira, this special menu only Chinese people would
appreciate. Number two, you hold meeting there. They give you free meeting room
and then they give you big discount if you want to hold meeting there.
I’m sure there must be recordings. JACK: Stan started adding up all the signs.
This restaurant was very unusual but only someone fluent in Chinese culture would
recognize how unusual it was. IRA: Stan essentially found the
Chinese intelligence operation operating across the street.
JACK: A Chinese intelligence operation in the middle of this small town,
directly across the street from the research and development center of a Global 5 company
led Ira and the team to one conclusion; it’s a high probability that this Chinese restaurant
was there to steal trade secrets from the company and send them back to China’s government agencies.
This restaurant may have been used to recruit employees of the company and
help gather information. Often temp employees are converted to spies,
being there for only a short time means you’re less likely to get caught. Or perhaps they would
simply record all conversations that took place in that restaurant, hoping to catch secrets
or something more sinister. IRA: What they do is they set up a social
situation where people come in, see that they can read the special menu. They talk to them, say
my friend, I see you like our special menu. Are you from China? Are you here on a VISA? Do you
have family back there? Would you like your family to stay alive? Is your loyalty to this temporary
employer or is your loyalty to your motherland? You know, a whole bunch of stuff like that.
That’s how Chinese intelligence operations acts and there’s been multiple times Stan has found
Chinese intelligence operations operating out of Chinese social clubs in different areas and so on.
Stan comes up with these what-the-fuck moments but he’s good at what he does.
Oh yeah, and he goes oh, by the way, I was followed.
I go how do you know you were followed? He goes oh, they were not very good. I go
why weren’t they very good? He’s like well, I think I find them, I start making lots of right
turns and they keep following me around the block. Then I made a U-turn and they’re not very good. I
go why aren’t they very good? They hit a pole when they went to make a U-turn to follow me.
I go I just hope they weren’t corporate security or we’re screwed. [MUSIC] We reported it to the
security manager and the CSO and the CSO was like what the fuck am I supposed to do about China?
I’m taking care of their computers. JACK: This Chief Security Officer has seen
a lot of pen test reports, but not even in his wildest imagination was a Chinese intelligence
operation even a possibility. IRA: We’re like well, you should talk
to the FBI, find out if the FBI knows this or whatever. The guy was like, I don’t know. Stan,
because of his situation, he obviously has to stay in touch with the FBI so Stan informed the
FBI [00:25:00] about the operation. JACK: But there’s one last step,
the biggest one. Ira needs to present his findings to the CEO
in a way that the CEO can understand. IRA: In this case what happened was, after
three days I’m like okay, here’s your mergers and acquisitions data which is worth billions because
of the negotiation points that you would have. If other companies knew what you were targeting
and so on, again, it could ruin things. Here’s your new technologies coming out in three years,
we have full control of your entire network. Again, I was showing him the business value of
all the loss of the vulnerabilities found. ‘Cause there’s a difference between finding
vulnerabilities and demonstrating the potential cost of the vulnerabilities that matters.
JACK: This is another thing that impresses me about Ira; he doesn’t simply put in the
report what is vulnerable but he gives a clear dollar amount to the CEO of how much a theft
like this could cost the company. When the CEO sees vulnerabilities in terms of dollar amounts,
action happens much quicker because they’re speaking the same language.
IRA: In this case all the research and development, frankly China would have loved to
get their hands on it if they didn’t already have it. If you were going to ask me, I’ll bet China
did have it by that point in time. JACK: Years later the company gets a new
CSO and Ira asks him about the Chinese intelligence operation
across the street. The CSO told Ira… IRA: Oh yeah, we actually made a dozen
arrests out of that restaurant. JACK: The FBI was able to dismantle this Chinese
intelligence operation. This could have went on for years if it wasn’t for Ira and his team,
a squad so good that they can blend into their surroundings anywhere in the world,
disappearing into crowds, gathering information. Not acting like James Bond and shooting up the
place and making a scene, but instead they’re more stealthy and they might be the one asking you for
a smoke at the bar or calling you up and asking for help. Perhaps the next time you go out you can
start looking for anything out of place. Someone might be acting too nice but also asking a lot
of questions or you might notice that guy in the corner of the Chinese restaurant eating alone with
a Russian accent. The spies are among us. JACK (OUTRO): [OUTRO MUSIC] You’ve been listening
to Darknet Diaries. If you liked Ira’s story and want to hear more, you’re in luck.
He wrote numerous books. Spies Among Us is one of the books he wrote which has great stories just
like this one. He tells the story about how his team was able to steal nuclear reactor plans in
under three hours. He’s currently in the process of updating that book so look for a newer version
of that soon. If you want to know more of how to protect your company from attacks like this,
check out the book Advanced Persistent Security.
You can also go to securementum.com to learn more about what Ira does. If you want to know
more about Stan check out the book Through the Eyes of the Enemy. It’s Stan’s autobiography and
Ira actually helped co-author the book. Links to these will be in the show notes. This show
is made by me, Jack Rhysider. Story editing is by Stephanie Jenz. Some songs were made
by Wesley Slover and the theme music is made by the esoteric Breakmaster Cylinder. Also please
visit darknetdiaries.com/donate to help support this show. It really means a lot to me. Thank you.