A Small Town Hack Became a Secret Service Forensics Investigation🎙Ep. 96 The Police Station Incident

When a malware report at a small town police station fell into Nicole Beckwith's jurisdiction, she could sense there was more to the story. Over the course of months, she worked at the U.S. Secret Service to unravel a digital forensics mystery that went all the way to the mayor's office.
Visit darknetdiaries.com/episode/96/ for a list of sources, full transcripts, and to listen to all episodes.

[@phdupont2500]

That is the most insane network admin, admin service and complete lack of common sense security procedures. It just fell to that one guy who knew a little. Then the IT company was just being lazy and borderline negligent in not fixing the remote login admin.

[@radekhladik7895]

The sad thing is that they already had the VM infrastructure in place. So making a simple VM for the remote users to log in would be really easy. That is if they did not know how to safely expose the webmail to the world....

[@Only_Sleep]

This is why I’m scared to become a network admin. I don’t wanna be that guy that just got his cert and knows a little, then fucks up an entire network.

[@rickyray2794]

@@Only_Sleep Shit happens, theres always backups and if you're in my shoes and the previous sys admin didn't leave ANY documentation.. start documenting as soon as you possibly can. Instead of working with a team I run the whole IT Department for my company but I am also the only one who does IT so I have to maintain everything from servers to networking to user hardware issues.. I love what I do though. I just make sure to always do a backup/snapshot before I start screwing around with the servers and whatnot.

[@DroopyCee]

I love it when I can't find anything on KZbin and one of these gets posted.

[@jonathananderson9606]

Don't know anything about computers but I'm loving this podcast. Found you a few weeks ago and been hooked since

[@claudeyaz]

Yeah isn't the way that he tells these stories kind of feels like your buddy is telling you about the show he saw last night on forensic files? It's pretty cool..maybe a tad parasocial...but a unique show😊

[@davidflorey]

Sounds like a typical government network here in Australia- just awful and a huge waste of tax payers dollars

[@dilligaf8349]

It's depressing how much the police in Australia abuse the use of these networks to harass citizens and when the police police the police very little is done about it. Nsw cops are slops

[@kyleshuler2929]

A government wasting tax dollars?! What?!?!

[@SieTeppischfresser]

The US Navy uses NMCI (Navy Marine Corps Intranet) which is an incredible waste of money. Each call to the help desk with password issues or connection issues costs $200. Literally a password reset costs $200.

[@JeremyAndersonBoise]

Sames from everywhere USA

[@JeremyAndersonBoise]

⁠@@SieTeppischfresserI have turned them down for job interviews in the past. “Hard pass,” on many levels, for me. (I do cloud-oriented software infrastructure stuffs)

[@JH-zo5gk]

Bro its 1am. Love hate thing going here. Need to be asleep 3 hrs ago. But new episode..... can call in sick.

[@magiwarwolf1]

You ain't joking. I was just about to lay down. 😅

[@triple_gem_shining]

Scrubs, it's -70 o'clock here

[@raresoupninja]

Truth tho the man is my lullaby

[@Rachel_M_]

How did you get on the day after? All good?

[@JH-zo5gk]

@Rachel_M_ lop. Yeah I managed. Cup of deathwish helped. I do appreciate your concern, kind fellow.

[@someyounggamer]

Almost choked on my coffee when she said RDP was externally accessible. Also lucky that this was a threat actor and not a hacking team. They could've done a lot more damage.

[@fmslickful]

I'm happy i am not the only one!

[@Crowned_PvP]

my favourite example of cosmic rays affecting tech is when super mario 64 speedrunners found a video of a guy teleporting towards the end of the level by pure accident and they spent a lot of time and effort trying to figure out what had happened but with no luck and in the end they chalked it up to background radiation changing one of the bits that controlled the character's position in the map

[@Entropy67]

Actually its not so unlikely for it to be cosmic rays, after all only one bit needed to be flipped. Its not like normal people have ECC memory.

[@mycelia_ow]

Either wasn't an accident and had cheat engine or something running, or it was a weird random bug. I just highly doubt some radiation didn't crash the game or so something random, but instead gave the player a shortcut? Lmao it's hardly believable.

[@mycelia_ow]

​​@@Entropy67 It's extraordinarily unlikely that it changed the position of a character, rather than corrupting the running software. It's probably not even possible. I think what's more likely to have happened is there was a malfunction within the game, you know a bug or something. If a ray hits a computer, stuff is getting messed up. It's not gonna do something specific like change the song you're listening to or something.

[@Rietto]

I believe there was also a commercial plane crash that was chalked up to this phenomenon as well.

[@thewhitefalcon8539]

It's often an excuse when no other explanation makes sense and the computer seems to have done the wrong thing for no reason. But it's also a real thing that does happen. If you can figure out that just one bit seems to be wrong... it *could* really be cosmic rays. In SM64 they actually figured out that flipping just one bit at the right moment would make the game do exactly what the video recording shows that it did. And they couldn't explain it any other way. That's how they came to the conclusion of cosmic rays.

[@RRonco]

I love this SETUP! STORY TIME: Cosmic rays flipping bits is a well-known, if poorly understood phenomenon. Well known by a pretty small portion of the population, poorly understood by a comparatively much larger segment of the population, in the sense that they've even heard of it at all. Atop all of us, exist an exceedingly rarified group of highly educated people with double, triple, and cross-degreed graduate level and multi decade field trained understanding of math, physics, and statistics. People who eat bowls of stats for breakfast. The precognosticators. These folks understand the effects of cosmic rays. They don't have to contemplate the rays' mysterious origins to understand that cosmic rays exist, that they cause damage, that they can even change the results of elections that use strictly voting software without paper ballots. A comic ray can flip a single bit, a single bit can change a vote, and a vote can change an election. It's trivial to map the existence of cosmic rays because of their effects and the damage they do. In fact, Victor Hess proved their existence using BALLOONS in 1912, for which he earned a Nobel Prize in 1936. Big cool balloons, not party balloons, but still, flippin' BALLOONS, 111 YEARS AGO, proved the existence of the cosmic pew-pew, pew-pew, pew-pew-pew! Proving the existence of these scary little scooters is different from directly measuring them, which we've been able to do since the first near-earth decaying-orbit satellites of the 1950s. We are unable to see lots of things with our un-assisted eyes, but we can better understand the beautiful entropies and complexities of this amazing universe with astonishingly straightforward tools. The fragility of a bit in computing is such that had we not yet detected cosmic rays prior to the Router, a Router's failure is sufficiently good at detecting their existence. Quite likely, it would not have been long before someone at a router manufacturer would have collected a Nobel Prize!

[@c128stuff]

About anyone who has run hundreds or thousands of physical servers for a sufficient amount of time and logs hardware exceptions has seen the effect of cosmic rays in for example spurious memory ecc errors.

[@PratosKS]

I started working for a nonprofit, I was hired to do basic IT work. Since I'm the only one there working in IT I run the department. Somehow became their HIPAA security officer and have to work with the IT company they outsourced their IT to. It's been a ton of work. I still haven't found all of the machines they use. Most of them are outdated. I have no idea how long the servers have been up and running. Most of their stuff is outdated. Security is horrible. It's been a nightmare trying to get everything updated while also dealing with previous incidents with ransomware. Their previous IT employees had no idea what they were doing. I mean the old IT manager left his password in the desk. His laptop had kali linux installed on it for some reason. I have no idea what he was even doing. From his documents I gathered that he had no IT certifications.

[@Dr.DevX42]

I can't wait until we have our own interview together. I have been listening to your content for so long now and I'm getting very excited about turning on the lights to this dark net of ours. They don't know where they messed up but this will be set as an example. Thank you for all the work you've done and I commend you

[@pablowentscobar]

Has the Secret Service gotten around to figuring out who left the coke at the White House? That seems like an easy one. It being one of the most "Secure" properties on Earth and all.

[@darianjcarroll]

www.secretservice.gov/newsroom/releases/2023/07/official-statement-investigation-substance-found-white-house

[@xephael3485]

No, it's more important for them to help the local citizen harassment groups

[@jssouthtx]

They know who’s it was. Just like we know everything else the Biden crime family is up to. Yet as always no one on the left will be punished

[@danielconroy9197]

I don’t know much about computers. But I love this podcast so much!

[@triple_gem_shining]

Well maybe now you know a little bit more 👨‍💻😷

[@zxyxxyz]

This was a very fascinating story!! One of my favorites so far and would love to hear more from her!! She's a Badasss

[@cody1541]

I love telling people about bit flips. I love space and tech, so it's fun to talk about how things that happen so far away can mess with our equipment on Earth

[@graog123]

9:00 Holy shit. If I lost 10 months worth of customer data for an organisation as important as a police station I would be fired on the spot. That is absolutely astounding to me how incompetent the IT crew at the station must've been to not notice their backups weren't verifiable for almost an entire year.....

[@chrimony]

I'm willing to bet the majority of backups are not verified, no matter the size or importance of the org. It's one of those things that *should* be done, but there's no consequence for not doing it until that one day you need those backups. It's also not trivial to do correctly.

[@kyleshuler2929]

How incompetent? Two words: Government Employee.

[@ElinWinblad]

Reminds me of nasa losing the shuttle info 😂 they admitted to

[@tdtrecordsmusic]

OOO , JACK !! you forgot to ask what version of windows !! !! !! Bet is was SVR 2001 or similar LOL ... was it NT ? omg

[@______4790]

Jack, if you havn't seen Veritasiums video "the universe is hostile to computers" its a must watch!

[@mendodsoregonbackroads6632]

Nice username. Does that refer to 4790.2 by any chance?

[@______4790]

No it does not. Just a random slew of numbers. Awesome subaru though! I've got a 23 impreza hatch @@mendodsoregonbackroads6632

[@mendodsoregonbackroads6632]

@@______4790 Nice! Basically the same car with a few updates.

[@magicphred]

Of course they had to teach her, they couldn't pick any of the men who actually knew what they were doing. I just love when intentional bias is potrayed favorably

[@campkohler9131]

Great episode! One would think that the her first recommendation would be to remove all the unrelated crap from the server room in order to limit physical access to authorized personnel. I was wondering how long it would take for her to quit the government and set up her own shop, so that she could make some real money.

[@VitalTechnology_]

It's 3 pm somewhere. Thanks, Jack!

[@triple_gem_shining]

Yeenus

[@Christina2tw]

Cosmic rays can crash a computer by changing a 1 to a 0 but I can’t blame my bad mood on the current astrological sign. Darn 😅

[@N4CR]

Cosmic rays can flip bits and is why ECC is used in critical applications.

[@brad885]

On the cosmic ray thing, It happens more than you think. Voting machine gave a candidate an extra 4096 votes. space shuttle computers crash. I'm pretty sure printers are a magnet for them though.

[@thewhitefalcon8539]

it might not be actual cosmic rays, but random bit flips, yes. Another source of random bit flips is extremely tiny traces of radioactive material that contaminate everything, including the plastic that the chips are made with, then decay and sometimes hit a bit just like a cosmic ray does.

[@dhanrajbharadwaj3891]

Put blanket on it no ray enter🤣

[@Watchdog_McCoy_5.7x28]

Must've been mass cosmic rays blanketing democrat cities during the 2020 election....

[@scribebat]

Hm. i've run into 'snoughs' before - a cross between a sneeze and a cough, but can't say i've ever run into a 'scraugh' before - a cross between a scream and a laugh. i'm just glad it wasn't actually the mayor, would have added a whole 'nother dimension to it.

[@joeyunlockstheworld]

I wonder how many career changes Jack is responsible for because one is happening rn lol

[@Cozza1313]

True indeed, have just moved over to IT a few months ago

[@WillOnSomething]

29:15 No, their help was needed yesterday before the attackers got access to the network. I'm sure there are plenty of MSPs that are competent and can detect and mitigate security issues swiftly, but a lot of them just neglect their client's infrastructure until the client calls to complain.

[@saadhusain1]

I bet some of those "sudden acceleration " in cars could be because of spurious radiation. You have 10 million cars over 10 years and some of them may be because of radiation.

[@whatwhat9519]

thats a good one. i'm going to start using that excuse at school instead of the usual destruction from a K9 which actually happened twice. one in high school where my dog got ahold of the homework and another time in college where somebodies dog/wolf hybrid had fun with her textbook

[@thewhitefalcon8539]

I just logged into the school's domain controller to check my email.

[@whatwhat9519]

i just remember that a co-student in college that i would sit next to in class who i guess was a hacker and accidentally did something and crashed the router/server/thing that just happened to be in the class closet and he just randomly closed his laptop and put it in his pack then told me he wasn't doing anything as a bunch of IT(?) guys rushed in to check out the closet

[@amzakambou6762]

hi Jack Rhysider thank you for this podcast and thanks to NICOLE TOO i want to get forensics tools that you mention in this podcast where can i donwload the saft version

[@mattweger437]

Cosmic rays and tin whiskers are are the engineering equivalent of "we have no fucking idea"

[@MikeHarris1984]

Wtf.... they log into the DOMAIN CONTROLER to check email from home?!?!?!! Admin creds for the domain are the same?!?!?! Wtf?!?! Holy effin hell!!!!!!!! Thier IT dept needs to be all fired!!!!!!!!

[@mycelia_ow]

I'm wondering how in the heck they got their job in the first place.

[@radekhladik7895]

Funny thing is how used we got to the fact that software contains bugs. And we do not blame the original author of the software but the administrator for not securing it. In an ideal world it should not matter whether the remote desktop is exposed to the internet or not. It has an authentication mechanism, so it should let in only the authorized users.... And instead of pressuring the author of the software to fix their bugs, we pay another vendors ton of many to provide us with software that is (hopefully) less buggy to secure access to our networks. Ofc I do not mean the situation where admin rights are shared and used for non admin tasks.

[@havetacitblue]

Suspicious0bservers explains galactic cosmic rays...among other things. Back in the 80s, a data center kept having crashes. It was located next to MIA - the radar system would cause a state change in the machine.

[@ElinWinblad]

Hi observer 👋

[@extrememiami]

Solar bit flip. Not sure why no one really knows about this. Good harddrives and NASA use error correction and detection software.

[@michaelkrochonis1619]

The cadence & content leads me to believe this guy is emulating Radiolab that said, he does it very well.

[@domdirector]

Employee: "I went, met with them, told them I like computers" Employer: "Ok, you'll start tomorrow, free training, from taxpayers money" Where do you find these kind of opportunities, I'm from easter europe, they are interviewing the crap out of employees for a "flip the burgers" type of job.

[@thewhitefalcon8539]

You have to be related to the mayor.

[@WesHale]

Do you like computers?

[@ElinWinblad]

You gotta apply for jobs you are not qualified for. If you apply for jobs you are qualified for they won’t hire you because if you already know the stuff why arnt you apply at higher level jobs

[@JeremyAndersonBoise]

Wireshark shoutout, so useful for debugging complex web service request graphs

[@michaelbasher]

Your video has inspired the thought.. Maybe question: shiny sides of the pyramids reflecting beams of sunlight outwardly toward the ozone allowing cleansing the air etc.?

[@seputinen]

Im happy i live at the countryside, if there ever is a massive solar flare, similar to a EMP, no worry, Boyscouts and farmer's/hunter's will save the day :) A faraday cage might help though :P Just need to go back to the roots, until things get fixed. Like powershortage at big winterstorm's :D

[@7_of_9]

Most companies only care about the sale then you are at your own after that

[@solowri5100]

Welp, looks like I'm not sleeping tonight either. Very cool episode.

[@ralieghwhite9076]

Whoa! I just moved from Hoover, Alabama! That’s wild!

[@tdtrecordsmusic]

also, don't you just love the line >> yeah, i need an admin account... B/c I'm important...

[@countvonthizzle9623]

Cosmic rays? For years, I had assumed all the problems with my Windoze computers were caused by penguin farts......

[@therealblurrybarber]

Some tier 1 help desk clown told you space rays?? What?!?!? Cosmic rays??? Come on man... i couldn't imagine telling my tier 1 to tell the client it was space rays coming down through their roof. Wtf

[@bearb1asting]

At work dealing with a system hard down. Perfect thing to listen to.

[@mattweger437]

It was probably an unshielded microwave or someone with a high powered jammer driving by

[@kwisin1337]

Just past 420, needed some sweet DD... Thanks man.... ECC for the win... long history in this bit..

[@texasdevops3831]

Y’all do realize that every single decision is being made based on incentives, right? Every one of these should-haves meant license cost and manhours for admins and SOC monitoring. What I’m constantly surprised by is how the majority of folks seem to think that there’s no price tag for everything.

[@orbit308]

I was kinda expecting the mayor to be dirty and working with a cartel like in Reacher or something... ehh , always enjoy your stories though. Keep it up! 🤘

[@ray-mc-l]

how come the new eps arent showing up in my podcast feed? jack!!?! help!!

[@KillaMilla0513]

I called backup for officer safty 😂😂😂.. I thought I seena gun so I shot the computer while screaming put your hands up

[@WesHale]

"It's coming right for us"

[@JeremyAndersonBoise]

“Spurious Emissions” was my nickname in 9th grade, weird.

[@rico0057]

Will u ever make a video about joker stash or about unicc the retirement they had .

[@felixvara8467]

LMAO This is episode is a good one 👍 its such a suspense thriller

[@phillydee3592]

Ha ha ha Geez giving everyone admin access is a BIG no no!!

[@buckfush187]

These are my favorite episodes

[@mystorymenzi7726]

Imagine a company in the USA saying no to the freaking Secret Service!?

[@BassSuperPower]

Cosmic rays causing a bit flip were suspected in Quantas flight 72, which almost crashed after the autopilot caused several erroneous nose-down commands mid-flight. The flight eventually landed in Australia, but there were several injuries as a result of this.

[@DataJuggler]

Next time I have a bug in code I have written, I am going blame to cosmic rays.

[@robs3405]

Almost to 100 eps. Crazy how time flies.

[@Archangelsword]

Special emissions from space AKA Starlink..😂

[@ant_nfts]

amazing podcast

[@Mitch-e3r]

Over the last year I've been dealing with hijacking. I can't get rid of it. I've tried everything. 3:24 3:26 3:26 3:26 3:26 you see them numbers. Google says if I have a box to the right on my comment box. They say that someone has admin control over my phone. It's a pixel. So I been through so many devices and email addresses trying to break free of this. But I can't. I need help. The crazy thing is that it could have been from bf covid or just from last December. Im not sure bc I've lost control over emails starting back to 2018 or 2019. I can't get help from anyone

[@mattanimation]

hearing the level of ignorance displayed by some of the people in this episode broke my brain...

[@MrSoandSoPlaysMC]

I'm blown that that many people are given admin credentials to remote into a server to check their email. This is mind blowing stupid. At minimum, if you're lazy at minimum keep a separation of admin and standard users. Whoever designed the network should never touch a production server ever again.

[@2012YoutubeWasBetter]

As a network security enthusiast in ohio, where can i submit my resume for this?

[@noanyobiseniss7462]

Cosmic Ray bit flip is why Servers have ecc memory.

[@fookingsog]

Or dirty power from not having well maintained UPS Power backup!!!

[@rubenverster250]

Oh yes, everytime my build fails in the CI/CD pipelines for some weird, inexplicable reason, I just say a Neutrino must've hit it :P

[@-CmonMeow]

cpu clock is too high for the voltage, can cause random failure in random place, used to do full compile of linux kernel on RPI and get random failures, the clock was just barely unstable, wouldn't notice otherwise

[@Netbase2000]

DO LAW ENFORCEMENT INTERVIEWS AGAIN. tHIS IS SO INTERESSTING

[@comosaycomosah]

gosh this one was so good

[@lyledal]

I'm guessing they didn't want to cooperate because LIABILITY.

[@sebastiank1714]

Sadly, Sadly her audio is not as clear as previous guests you had.

[@AndrePelservr2]

Parity RAM if I remember correctly 🤔

[@PedroSanchez-sq9kt]

Bros got the cyber rizz this episode

[@thestig007]

LOL, domain controller accessible from RDP over the internet. Crazy.

[@eddieweaver7570]

CAN YOU PLEASE DO A KZbin PODCAST ON THE KGB THE COMPUTER AND ME, YOU WILL LOVE THIS I PROMISE

[@folkishappalachian6827]

They reached out and gave me a special agent offer a few years back, i said no lol Time in the navy kind of ruined any desire to ever work directly for the government again Id rather contract where i have the freedom to quit any time

[@xlasingx]

..jack: "the art bell, of the cyber age".. ..would luv to hear th pip boy ver of this..

[@hsahtaw2211]

Reupload episode?

[@ttpechon2535]

Why were they logging into the server then opening a browser to check their email? Why didn't they just open up the browser on their computer instead?

[@randykitchleburger2780]

Weak default wifi passwords are my (hash)cat's favorite. Especially spectrum.

[@xCheddarB0b42x]

I knew I would need Error Correction Check memory CompTIA A+ knowledge at some point in the future. The future is now.

[@nomadshiba]

always be aware of cosmic rays and solar flares, have backups in Faraday cages, have encrypted printed qr codes for important data that are not too long. i believe banks still use tapes, if im not remembering wrong? and microsoft was building an undersea datacenter too i guess, if im not remembering wrong

[@Jszar]

Yep, banks and governments use tape for backups. They're cheap, compact, have a use-life not set by number of writes (as SD cards do), and are stable for years in off site storage.

[@girl4632]

Could anyone point out the issues that data privacy and problem it could coz when spammer get my basic info. And wht do these big tech gonna do with my data wht the actual threats. How much I try to figure out the issues of data privacy on internet I get example and point tht only feels like once in a blue moon. So it would be a favour if anyone list all the things that could become threat to me due to data. Not only threat by scammer and social engineer but by big tech and government too. Whenever I think of scammer I think social tactics looks better in books not practically possible in reality than I see example and ask but how just by this they fooled.

[@benjaminharper7626]

In the elections on 18. May 2003 there was an electronic voting problem reported where one candidate got 4096 extra votes. The error was only detected because she had more preferential votes than her own list which is impossible in the voting system. The official explanation was "the spontaneous creation of a bit at the position 13 in the memory of the computer".[1] One likely explanation for the error was a single-event upset caused by a cosmic ray, which the voting system did not protect against.

[@JeremyAndersonBoise]

Astrophysics don’t care. Honey Badgers wish they were as badass as cosmic rays.

[@Aera223]

or wasn't it caused by radiation from the water where the machine was being built?

[@xephael3485]

Yeah right... you do know ECC memory is a thing and calculations can be run concurrently in different threads with CRC comparison to verify data integrity?

[@mnxs]

​@@xephael3485indeed, but as I've understood the story, those things just hadn't been done/accounted for. Cosmic rays fking with computers is _such_ a peculiar and niche issue - I mean, there even seem to be no shortage of people doubting the phenomenon to begin with - that it's kinda understandable that they hadn't foreseen it at the time. I'd bet voting machines have ECC memory and all other sorts of redundancies and integrity checks in computation and storage now.

[@dovinsveto]

ID10TS .. my gawd .. #1 good job Nicole ... #2I had this samething happen on my investigation for a state ... couople years back .. do they know that there are 1 billion toolls scraping for this?.. Answer is no .. Im amazed these people have any power

[@MrsCyImsofly]

They have a lot more work to do and haven't gotten very far.

[@occamsrazor1285]

44:52 It also calls into question the CoC on evidence....

[@lamerdan]

BOFH excuse generator - Solar Flares

[@noanyobiseniss7462]

Haha, inept systems admins, thats what you get when you hire through nepotism.

[@ryany4326]

Cosmic rays can’t f up computers? You’ve seriously never done any episodes on friggin EMPs?!?!

[@Netbase2000]

A police netword acessable from the internet. Yikes.

[@whorton4]

While interesting, I really don't trust people that begin every other sentence with, "so. . ."

[@Netbase2000]

There is a famous bit flip in a super mario speedrun

[@darcynappa2500]

Sounds like an episode of scooby doo

[@neoncyber2001]

When i realised that the mayor a city councel had the admin password. it made me almost physically ill. i have seen similar things so many times. i had to just stop the podcast and calm down.

[@palehorseman1572]

My problem, still being green to the whole cybersecurity network and career path, is that 90% of this is common sense. MFA, VPN, GRC, and least privilege are to me, just that. common sense. The underlying issues is that security is an afterthought. Entire networks are built for fortune 500 companies (if not higher) without any foresight into security. I mean, come on! You adopt the technology to make your company grow but you don't take any steps to make sure it's secure?! Doesn't take someone with a degree in network or IT to figure that out.

[@backtoback6213]

She's a cyber hero I'm glad she's on our side u go ma'am 😎

[@anthonystanley7147]

Everyone will help when it comes to this but when someone really needs help everyone looks the other way. This shit is funny asf but it also shows the reality of people nowadays