Your Security Badge Can Be Hacked: RFID Secrets Exposed | Iceman

Hi, everyone.

Welcome back to another episode of the Security By Default podcast.

I’m the host of the show, Joe Carson.

It’s a pleasure to have you all back and listening to another excellent, exciting episode.

And this is one I’ve been waiting for a long time.

We’ve been chatting.

I can’t remember how long we’ve been chatting about this, but it’s been.

It’s been a while.

So I’m really excited to have an amazing person on who’s helped me when I’ve actually been stuck here.

When you’re stuck in the ruts and you’re trying to figure and get some.

See the light in some way out, I am joined by the awesome Christian Herman, also, AKA Iceman.

And I’d love to know is like, you know, what is your origin story?

How did you get into this industry?

And I’d also love to know about the Iceman alias as well, how that came about as well.

Thank you for having me, man.

Like you said, it’s been.

It’s been a long time in the making.

But yeah, we met, was it last year at bsides Talent, Besides talent.

Absolutely.

A little bit before that.

We bumped into each other during DEFCON as well.

Yeah.

Yeah.

It’s hard to remember all the faces, but, you know, I remember when we sat in Tallinn and, you know, you had a little cute little dog with you.

Oh, my little poodle.

My poodle.

She’s somewhere around here.

I think she’s underneath.

Love that dog.

So I’m Eismer and I do RFID hacking.

That’s what I do.

And I usually is very, very intimately connected with a device called the Proxmog 3.

And it’s.

I didn’t.

Let’s see if I can rewind back to myself.

Let’s see.

How did this all started?

It started way back.

It’s like a decade.

I think I was the darkest time in my ever in my life.

And I can only describe a couple of months there as black.

That’s all I remember.

And I decided one of the process steps in your life to, you know, is to lift yourself up again and bootstrap you over again.

And I was like, so what do you like, Christian?

What do you like to do in your life?

I was like, I love computers.

I really love it.

I’ve been doing computers since I was 7.

I hacked every computer what I ever touched.

I always find it tremendously fun.

Like, I know like 8 or 12 different software programming languages, which I taught myself all over years, right?

I just love, love it.

It’s the whole mystery of computers, like, interesting.

If it’s like looking at things, you know, it’s triggers.

I just find it tremendously fun, right?

So during this time of sorrow and blackness, I didn’t find anything fun, not even computers, because I made.

When I was living together and getting kids and getting divorced, you made working with computers as your job.

And that kind of takes away the fun part of the job because it becomes job and it slowly kills the joy you have for something if you keep on doing things for money.

But I was like coming back to myself and I was like, I need to do something for myself.

Like, I spend something on me.

And I’m like, there was an article in another town on the other side of Sweden that they were talking a hacker space in Unio and they were making fuzz and making article in the newspapers about how they hacked the local bus transportation ticket system.

And they used a device called Proxmock 3 and talked about that.

And I think like RFIDs.

That’s kind of interesting.

I felt like curiosity, like, how does it work?

Be honest.

I mean, you take a card, I’m going to take just one because I have tons of them here.

Fcc.

You take one of these cards, a.

Lot of those cards, I have loads.

Of this card and you put it to a reader and something happens and I’m like, how on earth does this work?

Adam Laurie says his best magic moonbeams.

I want to know more.

So that sparked a little bit interest.

Turns out that the same bus transmit system that they had up in that town, they have it here in my town I live in on the upside of Sweden.

And I was like, maybe I should do something naughty.

Maybe I should go and get myself a hacker tool.

I never spend money on myself, right?

So like approximate free.

So I go type in on the, on their AliExpress or Google or whatever you did back then.

And it comes out this device that says Proxmo 3.

It’s $330, this thing.

And I was like, ooh, that’s a lot of money.

But I’m going to spend it for me, right?

Typing it in and you’re all excited, you know that little rush, what you get from that and then you forget about it because nothing happens, right?

It’s like you don’t get it the next day.

It takes.

It takes some weeks, sometimes even months, depending on where it’s coming from.

It takes some weeks, but then you get a miss notice saying that you got a package to, you know, pick up and you go and pick it up and go like, oh, you’re giggling, excited, you feel happy, enjoying it.

You open it up, you know, like Le Boy.

And you open it up and it’s a circuit board and two antennas.

And I’m like, now what?

I thought I could get a device.

When you do order something and you see the finalized, you know, the, the view, the picture that looks it’s all completed and then when you get something in the post, it’s like it’s the parts and you have to get into actually building it yourself.

Exactly.

All different.

Different thought process.

I’ve done a lot of software development.

Right.

Sounds like embedded.

I never done that.

So I started and I was like, I’m going to go this.

And I was on the Proxmo forums and I started ask because I ask questions.

That’s how I do things.

You know, I have no problem being wrong.

I have no problem of being false and asking questions to correct myself, to learn more and getting hinters.

So I, I did that and I was like, I’m going to do this and go like, do you have Linux?

Oh, I’m going to use Ming here.

All right.

You’re originally a Windows developer, a driver.

Yeah, for sure.

NET developer, right?

Oh yeah.

I’m like an enterprise architect designer.

I got my wall of shame up here.

I don’t can see it here on your image now, but yeah, that’s my.

NET framework.

Yeah, yeah, Yep, yep.

You know, the highest one you know, but nobody ever asked about.

And sorry for all your listeners who only listen in anyway.

So I was like, I’m gonna do this J.

And I kind of failed.

Nothing worked.

So I asked questions more.

What doesn’t work?

Am I going to have you follow the guide?

It’s like, I don’t need a guide.

I should be able to.

How much is.

I’ve done with computers for ages.

So I failed and I got very disappointed after two weeks that I did and you know, like it.

So you put it all back in in the box.

I put it up there in the corner here you can see it again.

But I have a shelf up there.

So I put it there and then it was like a hat.

It was like a cat has this hate and love relationship with you.

It’s looking down and you’re looking up and it reminds you about your failure and it’s like, it’s like it reminds you about the money you spent on it.

It reminds you about how bad you are and you felt Bad as a was, you know, I was.

This was supposed something to be something funny for me to be exciting, make me happy again.

It’s a bit of hobby that you wanted to kind of, you know, get the enjoyment back.

Because, because as you said, in this industry, you know, I have the same challenges that it’s my hobby, it’s my fun, it’s my passion.

And.

But then when that line of job overtakes it and becomes dominant and you start doing more of the things you don’t enjoy and you’re trying to find that balance back and you’re always looking for.

I think for me, I’m always looking for toys.

What can I do that will bring that passion back again that will get me excited?

Well, you’ve got kids as, don’t you?

Right?

Absolutely.

Yeah.

Yeah.

Family dive.

Family life takes tremendous amount.

It does take a lot of that time.

Yes.

Right.

You don’t get free time for yourself.

So I got two kids, you know, doing that, raising the kids as a single father then was.

Is rough.

It’s less time.

And I run my own company as a.

As a software developer.

So that takes even more time.

Right.

But you still want to have that extra little joy things.

Right.

Then you try to work out and all that stuff.

Anyway, so I’m back to the story.

I’m going to go back.

So I was sitting there because I was not ready to learn.

I didn’t embrace my failure and say, be humble again.

Right.

So this is step one.

When you want to learn something, something new, accept that you’re not good at it.

Become humble.

It’s like, it’s okay not to.

No, it is.

Oh.

After six months, I was ready.

I took again and I spent so much money that I talked to myself.

I’m going to open up, I’m going to do one more try, and if it doesn’t work, then fine, I’m going to accept failure.

So I put it up and I was like, everybody talks about a guide.

I find the guide.

Step one and it compiled step two.

Flashing.

I can never flash an embedded device.

I don’t know if you’ve done that before.

That’s kind of scary.

It is scary because when it goes wrong, it goes horrible wrong.

I have no idea what I’m doing, but it worked.

Have a good day.

Okay, great.

And now I memorized all the steps because now I have done all that research.

Now I’m typing in that proxmarket number comport and proxmo client comes up and I.

Yes.

You know, the excitement and I run out to a desk and get my transport card that I had run out, smack it on the antenna, and I type in hfmf.

Dark side was it?

And I like present.

And I knew it comes up this text, executing dark side attack.

Average runtime, 25 seconds.

And on 27 second, the key comes up, and I’m like that dopamine rush of cracking the first key, and, yeah, the rest is history.

That’s why I’m here.

That rush got you excited, that it turned into a career obsession?

Yeah, it was like that.

So, yeah, so I started asking questions, and then I started doing more stuff.

And, yeah, that’s how I come intimately connected with the proxmog.

Yeah.

Oh, fantastic.

I was.

It was actually master’s students for cybersecurity in Estonia.

And it was.

I was basically, you know, helping out the university, doing, you know, some courses and workshops and stuff.

And I was asked by the.

Actually the dean, who was, you know, would I be interested in mentoring some of the students for their.

Their thesis?

I thought, oh, this is interesting.

So I was like, sure, absolutely.

So I ended up getting paired up with this former Colombian Air Force pilot.

One of the most unusual purrings.

And that purring was a change.

It was a whole change of my career.

I mean, these are the moments where you think that I’m helping someone, but in turn, they’re actually helping me.

They’re giving me new ideas.

And ultimately, the person’s thesis was actually on drone hacking.

Wow.

So that was what the thesis was about, was taking drones and understanding about the risk profile of different drones, from ultimately understanding about the power, you know, the power need for the antenna and also the signal and the energy usage.

So all of that to determine for different types of drones, how much power you needed and what type of antenna you needed to be able to hack in or over, you know, take over the drone itself during the drone hacking.

Wow.

And for me, that was interesting.

He created this prototype.

It always reminds me a bit of Cactus Man.

What’s his name?

Remember, he had the Cactus of defcon.

Dark Matter.

Dark Matter, yes.

It always reminds me because it was a very similar setup.

Not as.

Not as elaborate with his pineapples, but.

But it was a mini version of it.

And so this master’s student was doing the whole thesis I was mentoring, and we, you know, helping him from basically doing the risk Mapping side of things.

And we were, you know, helping formatting and with the side of things.

And it got really interesting because then at one point in time he had created this device which was actually used in order to analyze signals from drones.

So from the, basically the control pad to the actually receiver on the drone itself.

And it turned into that basically it was Raspberry PIs with a couple of SDR antennas set up on it that was used and then also a car battery to power it.

And then ultimately from that he decided we actually repurposed it.

I had a pen test engagement in Belgium for a transportation maritime agency.

And we decided, okay, let’s take the.

Actually the device that he had created for drone hacking and modify it slightly in order to then pick up other types of signals.

And then we kind of broadened the range to looking at things like RFID door signals, to Bluetooth, to WI Fi.

So we expanded the whole setup.

And that for me got me really interested.

And so I ended up as like, okay, you know, I end up deciding I need to get myself some of these toys.

So I looked and started with a Proxmark and I felt really bad.

I think similar to you.

I think it was maybe about a month after I got it and I’d already done my first, you know, basically cracking the keys and some cards and I think end up.

I made a mess up because I end up having a mismatch between versions on the client and the com on the version on the Proxmark.

And when I end up doing the connection and doing the update, it bricked it.

And I was so devastated.

I was, I mean, for me and because, because at the time, you know, it’s a lot of money you’re spending on, on those devices.

They’re not, you know, even the SDR side of things and the rfid, because they’re all, all very similar.

They’re all using radio in order to basically communicate.

Some are on the low frequency side, some on a high frequency, some on the ultra high frequency.

So it really comes down to the, basically the radio strength and signal.

And for me, when I bricked that Proxmark, I was so devastated.

I was like, I was so upset by myself.

And that’s why, you know, to your point is I, I felt failure.

I was like, can I do this?

And I remember that I was trying to, you know, look at all the forums and look for help.

And I, I reached out to you and you give me some, you give me some tips about what I made the mistake into, where I made the mismatched versions.

And I didn’t have the right privilege to set on it.

And I was like, okay, so how do I go through?

And there was no.

There was literally no proper documentation how to unbrick it.

There’s nothing.

Nothing.

It was like there was bits.

There was spatter pieces all over.

Yeah, if you get this far, then you can do this.

But like, there was no central way.

I ended up creating.

Creating one myself.

And I find.

So I pulled up my old.

I had a bunch of Bus, Bus Blaster and Bus Pirate sitting on my shelf that I’d done before for doing some kind of, you know, just.

Basically just reading firmware and stuff from chips.

And I thought, okay, all of this points me that I need to.

I need to pull out my old dusty Bus Pirate.

I was like, okay, here we go.

And then having to then compile the firmware and then also having him use the Bus Parrot in order to connect to the JTAG JTAG.

And then also to hit the pin 55 oils.

Remember PIM55?

You had one of those Proxmark ECs.

That was the easy one at the time as well.

But I also did.

I also had the.

The Proxmark Rdv4.

I didn’t have to do that, but the easy.

You actually had to reset the chip on pin 55.

And that was just.

And to your point.

I think when I all of a sudden got it Flash and got it working afterwards, the joy and the excitement, it was like, I did it.

I can do things.

I can do things.

It’s like when you swap the tires for the first time.

I think it is.

It’s when you’re able to actually do something.

Other people might say it’s like, oh, that’s quite easy to do.

But once you do it yourself, you feel empowered.

You feel like superpowers that just went through you.

Yes.

And I think it’s exactly what you said.

It was no documentation.

It was a scatter all over the Internet.

Right.

And it was so hard to find things or like come together.

So the Proxmo forum was the center point of information where you can actually talk about things.

But it was a kind of strange attitude there.

It’s like, you know, it’s like keeping things to itself.

You know, the.

Oh, geez, they were really hard to get into this.

You know, you were new, you know, so you weren’t allowed to know things.

I remember just to get to know people, they have to prove that you have access to a key, so they encrypt.

There was the icloss picopass key that everybody has today, that one, you know, so had to.

He encrypted his email with that key and then I have to decrypt it to prove that I had it in order to email him.

And I’m like, yeah, back in the day it was a little bit harder to get touch, in touch with people.

It was.

And I only knew people through the alias names as well.

I didn’t know who they were.

I still do that.

I still do, but I don’t know any.

So.

But that was.

It set off a passion for me as well.

I think I’ve gone down the path.

I’ve spent tons of money on easys, chameleons, proxmarks, antennas, flippers.

I mean I think I have pretty much most of the chameleon versions that’s out there and you know, just curious about the differences between each of them.

What the capabilities are, the portability, what types of keys can you.

Can you basically crack?

You need to know about as well because you are into that sector of red teaming and pen testing as well.

And then you need to know what kind of tools are out there and the capabilities.

So you need to buy all that shit.

Yeah.

And you need to understand it to a certain technical level, not just reading an overview and think that you can get by with it because you have touched the proxmock, you know how fiddly it could be.

You know, even if a flipper is very easy to handle with these, you know, buttons and menus, it doesn’t mean that you understand what you’re doing.

Correct.

And if you’re going to be a good pen tester, this is a second lesson is learn the tools of a trade.

Just learn them hard.

Let’s learn it.

It’s, it’s not, it’s not easy, it’s not going to be light, it’s not going to be fun all the time.

But you have to do the hard.

What do you call that English do the proper, basically, you know, homework and research.

Is it really kind of.

I would say that I think that’s one of the fundamentals.

I think that’s probably where the likes of yourself and me, we come from very different backgrounds in education, was that the things didn’t exist.

You actually had to understand and build it yourself.

You had to find out the undercover, you know, there was no easy front end tool that simply just did it all for you.

We actually to your point is we had to open the bonnet of the car and twiddle things around to understand about when things weren’t working or when there was a new noise of the day.

What the hell?

What’s that noise that’s coming from the engine?

And that’s really where you start kind of you start learning because you’re braking at the same time.

That’s how you learn.

You learn by failing and you learn again.

But it’s also this.

You didn’t have access to documents, data sheets, you know, you don’t have a mythology like now, but you have thousands of videos out there how to do things, how to run things.

And the biggest joke that was out there was like, yeah, the Proxmo can do everything, but you have to implement it yourself.

Yes.

And that was the joke.

And I never understand that as a joke until you got really into it and realized, holy crap, yes, it’s possible for this device to do it, but you have to do it.

Here is open source and that’s what’s the biggest change happened somewhere when you start, okay, well, software, I know this is my home gar, you know, I can do this.

So I’m going to do this, see, but no problem.

So I have to learn that and stop doing things, you know.

So everything you see today, you have to realize all RFID hacking tools that you have access today.

This is all the information and knowledge and hacks comes down to two projects.

One is Lib NFC and the other one is Proxmog 3.

Those are the two fundamentals, right?

Everything builds upon what’s released as open source there.

And if it wasn’t for open source, you wouldn’t have had any of this ease, ability or ease of access or ease of use like you see today.

And people go like, oh yeah, it’s easy and stuff.

No, no, it was hard earned sweat who made that happen, right?

Yes, it was because of other people who made the foundation, made it easier for everyone else because they did the hard work at the beginning.

So tell me more about when you got more involved.

You started working on the Proxmark forums and then started doing your own builds as well, kind of.

What was the steps on that and how did that get started?

It’s just fluke, I guess.

I think I just inspire.

I think I’m.

I think I just inspire people naturally by being me and what you see is what you get.

I don’t have very much a facade, right.

It’s just me.

So I have no problem asking questions and being wrong and doing things and still putting effort.

But like I said, the OGs back in the day is Very rough.

The ones who were maintaining the original Proxmog forum open source project, they were really like, protective and didn’t like my changes.

Why do you want to make it so easy for people?

They wanted you to do a signal looking at the data plot window and then manually pick up the bits and then decode it in Manchester and then know how to decompile the vegan into numbers.

Right.

Facility card numbers.

And I’m like, I know how to do it because I did the hard work, but it sucks.

And if I’m going to research a card, I don’t want to sit and do this manual labor.

But this is not a computer for me.

This is what I have a computer for.

So I started doing these things, right?

You want to automate.

You want to do things quicker.

Yeah.

To do proper research, you need to have the tools working for you, right?

So you build your tool sets your bag of tools, you have that, you have to develop it.

So that’s what it was.

I tried to be better myself and realize, okay, let’s do it, let’s start, let’s add on.

And then people done blog posts everywhere, like you said, that was scattered out.

So I started like, all right, I’m gonna pull in all this stuff everywhere and unify because I think it’s great.

Why can’t we have it in one package instead of having 15 different projects?

If you want to do that, you have to go to this one there.

And this one is not on GitHub.

This is on the other Google code.

And this is on, you know, some web page.

This is a blog post for pen testers partners.

And this was ever all over the box, right?

And I’m like, ah, let’s make it all together.

So I started doing that.

And the biggest liberation was when I realized if I fork it, I can put all of my stuff in there.

And I don’t have to be questioned about it, why I have it.

I can make it, inform it in the way that makes it better, right?

In the way that I want to work with it.

So what you see is a manifestation of how I like to work with the tool, how I expect it to work with.

And that was the beginning of what is called the Iceman fork and what I’m known for and all that, because that was people started using that one more and more because it worked and it was easier to work and had this fun stuff and it was just in one place instead of official one.

And we made this hardware protocol out before and from there on it’s.

Yeah, I just started adding more and more stuff, but it grew slowly.

So I posted many things all of a sudden.0xff, who was the administrator of the forum, he made me a moderator, but he didn’t tell me.

I didn’t know until someone mailed to me and said, yeah, well since you’re a moderator, can you fix this issue?

I’m like, what?

I don’t know.

What are you talking about?

Moderator?

And I had to go in.

I was like, oh, I’m a moderator.

Oh, thanks.

How did that happen?

Nobody tell me.

Yeah, it just happened in secret.

It’s like, like let’s look through and see who’s.

Who’s doing a lot of the work and who’s saving us lots of time.

Yeah.

Who has the right attitude.

Right.

Learning and open source and it’s.

It’s a mindset, I guess, you know, and wanting.

Willing to share and all that stuff.

Yeah.

So it’s ended up that way and I’m going to end up being an administrator at the forum.

And I got into becoming a maintainer actually for the major.

For the official repo of course as well.

But I was doing my things and having fun and I always backported everything that came on the official one.

I backported it down into mine and then for a while it was so spread.

The code base was so diverse from.

Diverged so much from official one, so it was not worth the effort to try to backport it onto official again.

And I was like, I’m not going to do it.

So I just kept on doing this.

And that is the fort that is of making what people use still today.

Right.

So if you use a Proxmox, that’s what you use.

It’s the same for me as is all my builds are using Iceman build because it was becomes.

I know where everything is.

It becomes so stable as well because when you, you know, once you have stability, that makes a big difference.

And I haven’t bricked cross my fingers in quite a few years now.

You don’t brick it anymore.

Right.

You don’t brick it.

You have help text, it acts like you want to do it reports back, it gives you hints, it uses col.

It reconnects everything of those items.

I was told that this is impossible to do.

And then I’ve proven Wrong.

Always by implementing it slowly and slowly and slowly.

I’m like, what are you talking about?

It was never impossible.

What?

It’s like, I’m not going to do this.

And that’s the whole thing.

That’s number three I wanted for people to listen into.

Don’t listen too much on your heroes, you know, or.

Just because it says something in a data sheet doesn’t mean that it’s true.

You know, that’s the back tech, you know, that’s how we hack things.

You know, the data sheet selects a documentation and then you just do your own fucking thing with it with fuzzing and you do.

You try new things and whatever and all of a sudden you end up doing weird, crazy shit that was not possible before.

And voila, you’re a hacker.

Absolutely.

I mean, I think also it was a big change as well.

I mean, you look at, even the last 10 years, lots of, you know, once the technology has advanced so much, it’s used in almost everything today from like packaging and shops basically to my, you know, 3D printer has RFID tags to determine basically what’s the filament in the.

Actually in the printer itself.

Everything today is expanded just from years ago.

What was basically the key card to get on a bus or to get on a train or to open your front door, where it was more about access controls then to now it’s more about data sharing and sensors and everything else.

So it has expanded quite a lot.

I think some of the foundational work that you’ve done also brought a lot more people into the interest.

At the same time, the technology is kind of getting more broadly used everywhere that at the same time you have a lot more people coming in with diversity and different backgrounds and different skill sets, and then expanding it even further into newer ideas and newer devices.

So I do think, you know, a lot of the work that you did was pinnacle into one is also bringing the broader community into it as well, and more ideas and more basically sharing and knowledge.

And I think one of the best things also for me was when the forum moved to Discord.

Yeah, like Discord now.

Yeah.

Where it was used to be in, you know, it was a little bit kind of in GitHub.

And then we had.

The forum.

Yeah, forum, one of those.

It was almost static.

No one was interacting and communicating and it wasn’t in real time.

You know, you’d be looking at posts that, you know, got really dated.

And then the GitHub was pretty.

I mean, it was pretty good, well structured.

I have to Say it was.

It was well structured and it was good.

But then also you could sometimes get lost between pages, you know, if you weren’t backlinked properly.

And Discord kind of, I think that made it for me was the difference where that’s what brought me into the community and to know other people much better and to interact and even be able to chat properly.

So that definitely moving to Discord for the community was.

Was a game changer, I think in the whole time.

Just around before COVID hits.

Just around there it was.

People like the kids, my kids at home were using Discord and like.

And a lot of people was asking, why don’t you exist on Discord?

I’m like, I don’t want to be on any damn kids place.

You know, like.

And then everybody was like, what?

That’s exactly.

I want to be on Snapchat.

Heart Big.

We got a forum.

And then I realized we, like you said, oh, static and people was not interacting in the same way.

And then I tried Discord because I tried Slack.

I was on some interesting RFID hacking slacks to lives.

And that was nice, but I just, I dislike Slack.

It’s.

It’s like teams and whatever.

And I was.

I don’t like it.

Right.

And we tried Discord and Manual.

So simple.

We just set it up also free and you can have video calls in it, audio calls, chats, photos, share.

It’s like, oh, this is perfect essentially.

Yeah.

And row so you can get that, you know, and you can just do this.

And it’s like the searching is pretty good now as well as well.

So that’s one thing for me is that when I got in Slack searching history, it was also one of the problems as well.

I do a lot of my documentation in OneNote and OneNote searching was horrible, you know, when you did any special characters now that all of that was fixed and also in Discord as well.

And now I can go back and look a lot, search easier for things that, you know, I couldn’t find or remember or this piece of documentation or somebody mentioned something about a key maybe six months or a year ago.

The search is so much better and so much easier to go through.

Oh yeah, that really helps.

But so many people, the young ones today, they really don’t like searching.

They ask the question again and again.

And again, you know, and the AI floss, slop, you know, God.

Well, I don’t know English.

So I use AI to Translate AI can tell.

Yes, of course, sir, I can do that.

And when it comes to text, I’m like, no.

It’s like, oh, I don’t know if it’s lazy or if it’s just their way of solving a problem that they think that they’re doing it fast.

I think the problem, I think, I think one of the things is that they might as technology and everything changes so fast today.

They think sometimes maybe that something three months ago is not valid anymore.

I think just the evolution of change.

Maybe they’re just looking for the latest and greatest or maybe the, you know, updated information.

But I’m from a world where, you know, things are five years ago still work today and they’re still valid.

That’s the funniest thing actually.

We spend a lot of time with our, the Proxmo source code.

You can actually just put this Source code recompile for 256 flash memory and it will work today.

I mean, I mean, I jokingly say it’s yes.

How about that for sustainability, right?

Backwards compatibility, making sure old devices are still actually operational and valid.

You know, I do move to the Mini and the Comedian still just from mobility perspective.

But the Proxmark, if I need something more complicated or more cracking or more power.

But it really comes down to the kind of, I guess the, the mobility side of things that you’re looking for, you know, moving around.

We were talking about you doing Pentas and red teams and being aware about things.

Right.

Knowing your tools.

Another part of, another side of that is that you also need to know that the apps that you’re using, you have to remember that the Flipper and Flipper app is developed by Russian.

Yep.

Company Pavel and Anna.

Pavel and Anna, exactly.

No shade on them.

But you know, it is what it is.

The same goes for, you know, where does your files go when you upload things.

Same goes for the Chameleon that’s developed by Chinese group.

Right.

So when you do things and say we’re going to use this tool in a pen test, you better inform, you know, you better know that the app you’re using to control those and you have an offline cracking part or when people take a cloner that has online capabilities, same problem there.

You take it up and you have to realize, you have to do your research and understand does this Phone, home or not.

Because in the worst case, this device or this app we’re using to talk to the device with will send that credential data for cracking in a place most likely where you not want your customers data to be in.

Absolutely, absolutely.

I think most of them are benign in when looking at it and use open source and all that stuff.

But with that said, it’s you who has to inform your customers which tools you use and what the downside with it.

Something I want to stress for people who’s professional in this game.

Absolutely.

I think you bring up a really important point is that when using any tools that you really understand about basically the supply chain of those tools and ultimately how they’re created, a lot of times for me, even like the Flipper, I actually have to have a completely separate laptop and a separate network just to basically use it because I will not let it on basically my open network and my other devices.

I actually have whole separate segregation in order to be able to use it and understand it and kind of see.

How well if you have customers like Interpol.

Yeah.

So and intel also as well.

In addition to that, when I’m traveling because I do travel a lot and I’ve had situations where I get a flight cancellation and now basically I get rerouted and I’m now flying to a country where, you know, maybe they may not have laws or they have laws that actually make it illegal as well.

So it gets into.

Also as a pen tester and you’re using tools for different, let’s say, activities and campaigns, you also have to know the legal side of things as well.

A spicy frustrate.

So for me, sometimes I actually had to put them in a package and post them home or if it was software based, I had to go and completely either upload it to a cloud environment or to my own personal environment and wipe it from my machines.

So I’m not traveling through airports or through, you know, potentially if I, if I went through an airport, that’s one thing.

But then if you’re forced to leave that airport through immigration, then that becomes, you know, I’ve had situations where I got rerouted through Canada and I had the question of, okay, now I have to decide what I’m going to do with all this stuff that’s in my bag because, you know, Canada might see it as, you know, offensive, illegal tools.

Yeah.

So I have two stories to share with you.

That one of them is some years ago, two, three years ago.

Two, three years ago, when this debacle about Flipper being a hacking tool.

It’s not.

And we tried to whitewash it.

I know but it’s a Swiss army knife of multiple tools bulge into.

It’s just this.

They took six open source projects for hacking and they made a very nice form factor for it.

And that’s what it is, it’s a hacking tool.

And they only, you know, you can whitewash as much as you want.

That’s what people want to use it for.

So the government came up with it again.

So the customs and tsa there’s a note sending out to five eyes and it says if you get in for question or the question to open and see your phone, if they see the flipper app installed on your phone, you will be sent to secondary or the next step where you have to, you know, where we’re going to look into if you have that device onto you and then might take it.

And of course we have to question, you know, why do you have this device?

You’re not allowed to fly with it either.

In that case, if it marked you that and then you will be forever marked in the database saying that.

Yeah.

So that’s the first story.

What people don’t understand.

Well, I don’t know.

I had it in my hand luggage.

I used, I used to travel like that until I got that get a copy of that message.

And then I understood people give me a heads up about things.

I was like, okay, thank you.

The next head up I got is I didn’t do conferences before, right.

So I sat home at my office here and I just had a Proxmox and people was wondering how can you make so much like, well, I have a Proxmo.

Yeah, but whatever gear do you have?

I have a Proxmark, that’s what I have.

And was like, okay, do you active on hacker conferences?

No.

So I was like, maybe I should go out to a hacker conference.

So I started going to hacker conferences and meeting hackers.

What was your first one?

What was the first, let’s say, you know, hacker conference you went to.

Oh wow.

That was just when we dropped the order before and we went to Black Alps in Switzerland.

Okay.

That was the first one that was scariest.

Yeah, that was nerve wracking.

It’s a pretty good community in Swiss.

That’s actually I get to meet some.

Really good people and turn out some of the people from the forum was there.

So we’re sitting at my hotel room and he was showing me how he could, you know, listen to.

He made a makeshift EM probe for his Oscilloscope so he can sniff traffic.

And like thought I was just super great.

That was the beginning of conference experiences.

You’ve been to conferences much more than I ever have you.

So eventually I ended up going to defcon.

Right?

The whole roads lead to DEFCON sooner.

Or later, at some point we all end up in hacker summer camp with 40, 40,000 other people that we.

Many of them are like us and many of them are not.

But.

But the diversity is good.

Out of the 30,000, I would say maybe 400 is like us, but Vegas is Vegas.

It’s a fucking nightmare in that sense.

Yeah, it’s grown up kindergarten.

I don’t know what you think about Vegas, but it’s crazy.

So I got called out by the Ricks from the RF Village.

So was asking me if I wanted to do a talk.

And you know, I was like, you know what?

You’re paying for my flights.

Nope, we don’t have that.

Okay, fuck it.

But we turned out we got the RV4 and we got some money for that.

So we were able to fly into DEF CON and be there because we have to be in defcon.

And that was my first real exposure to people who been using the Proxmark and things like that before.

And people like, oh, yeah, you, Iceman.

Wow, I want to shake your hand.

I want to buy your beer.

Who are you guys?

What are you talking about?

And it’s like, this is very odd.

It’s like, I just do some Proxmo stuff.

What are you talking about?

And people’s like, yeah, we know about me and do things.

I’m like, I have no idea.

Anyway, fast forward that DEF CON stories.

I’ve been to DEFCON several times and doing talks, I end up a couple years ago, I get a note saying, you know, you know, how about the.

You know how in Vegas that you get this paper sent out to the hotels saying, I remember that paper.

I remember it comes out every year.

Yep, both chains does it.

The big ones, you know, the two big ones.

And they send it out to all the hotels.

There’s a paper saying, watch out for these kind of devices on the rooms.

The room cleaning where you have to look in your room every third day, you know, if you see hacker stickers, you know, make sure that you inform us about the security on the premises.

So people are telling me like, yeah, you know, that the Proxmark is considered, is considered a burglar tooth.

Yes.

I’m like, say what?

I’ve been having tons of Proxima years.

It is so funny, because I think I actually have one of the printed sheets here somewhere in my office.

Of all the devices that was actually.

Was going around.

Yeah.

Last year was like this.

So this year as well, you know.

Yeah, yeah.

So I see.

What I try to do is I try not to stay in the recommended hotels.

I try to stay a little bit.

Not near Black Hat, not near defcon, but somewhere that is like, you know, a little bit off the strip.

So it’s like you don’t.

The hotels that tend to like, if you’re not going to be near defcon, then all the hotels in that area are checking everything.

So I try to get something this little bit off.

And then I also stopped bringing a lot of stuff with me as well.

You know, even my soldering kit.

I was like, okay, I’m not.

Because at the moment.

Because they can actually, you know, you can get fines if you’ve been fined soldiering in the hotel room because.

Oh, man.

Because this was smoking.

Oh, yeah, you can get the smoking.

Yeah.

They will throw you a cleaning charge on that.

But absolutely.

I remember all those.

The device that was on that list, it’s just like, you know, I always have laugh because even my kids.

My kids have lock picks and everything I’ve got.

It’s actually when I put the defcon this year, my son was like, I don’t like my existing lockpick set because it’s like really flimsy and it’s all bent and stuff.

I want a professional one.

So what I had to do was I had to bring both of them back.

Professional lockpick sets.

It’s almost like a fidget for them, like something that they just play with.

And actually that’s really nice because it all started for that.

It started with my son was coming to the office and I actually had.

He was wanting to play PlayStation all the time.

I was like, no, you can’t do.

You have to do something productive.

I put the controller in a box and put a padlock on it, said, okay, if you can get the controller out of the box, you can play PlayStation.

And he got really good at picking the lock and then he moved on to hack the box from that and bug bounties and everything else afterwards.

Yeah, they do love.

They love, you know, getting into a lot of the tools and toys and the Proxmark side of things.

So me and my son’s.

We’ve actually built one using Arduino.

Wow.

From that side.

So, you know, really kind of getting into the manual side of things.

But.

But you’re right, is that, you know, these like all tools, they can miss it being misinterpreted for anything.

You know, a hammer can be a burglar tool, a crowbar, a burglar tool.

But it’s not the only purpose of it.

They, they, yes, they can be used.

For me, what I use a Proxmark for is to clone and copy cards so I don’t have to pay ridiculous fees for the office rental company where they’ll charge you if I want a second key from my office, it’s €50.

I’ve got all the stuff here to create my own card or to create backups or to really be curious about how things work as well.

So maybe you can make them better.

So it’s not the only purpose.

I think that’s what the myths from a.

They get misinterpreted, especially from people who don’t understand them.

It comes both ways, right.

It could be like a knife could be used for good and bad.

So if you take implants, like biohackers, they use this RFID implants very much.

And they really want to hack the cards and tags and then clone it onto, you know, illegal cards to have it with them because that’s how they want to roll.

And I have an implant as well that’s, you know, that circumvent the whole idea of a card being secure if you can clone goes hand in hand.

Right.

But back to that hotel story.

It was.

Was kind of funny because I was invited for a bug bounty event and I was there and I was informed that proxmog was a burglar tool.

And I was like, hey, you know, I have a bunch of them.

You know, that’s what I’m known for.

So I was like, yeah.

And I ended up speaking to one of the managers at the hotel and is like, so, you know, is that going to be an issue?

And my dude goes like, we know who you are.

It’s not a problem.

It’s like, okay.

It’s one of those things.

Yeah, we’ve already, we’ve already done the research.

We’ve seen you, we’re watching you say.

You’re one of the good guys.

Stay that way.

It’s like, okay.

I think that’s the difference though, is that going to any tool is that it’s the intention of motives that we all have.

Yes.

And that’s the, I think that’s the difference, you know, between calling it a burger tool is because, you know, the person who’s using it for that purpose Some people might be using it for the purpose, but you know, their motives and their intentions are very different from those who are understanding technology.

Making it better, making it more secure, making it more difficult and at the same time also educating people on, you know, how to use it properly, how to implement and configure it properly.

Because I find a lot of times is that organizations and businesses and people use technology, they just don’t configure correctly.

And that’s what creates the risks.

They use the same ID across hundreds of keys or they just didn’t configure it basically in order to make sure that it has basically a unique key in the background or something, you know, that’s more using a version of the card which is more difficult to crack or more challenging.

So misconfigurations.

And I think educating and making that aware makes a big difference.

Yeah, I think you raise a very fair set of questions and use cases for things.

And all of them are valid, several of them.

Right.

And I am for one of those people who’s like, you know, it’s open source, make it work, make a copy of it so you don’t get vendor locked in.

But also who are you if you are in a position to buy a system from a vendor, how do you analyze it?

How do you verify their claims?

Right.

You need to know the, know how the tool setting for that because you know, modern days.

And then you need to do the right decision making based on it, you know, to see what is the actual risk involved here.

Because in the end of the day, all the management and all this buying and selling is about risk management.

You know that, I know that.

It’s nothing else.

Doesn’t matter how well you write your pen test report.

The people in the management gonna go like, interesting that you can burglarize that one.

Nice.

Great.

So what’s the actual risk?

Yes.

And you.

I’m.

I’m pretty sure that you’re quite good at evaluating risk.

That’s actually, that’s, that’s our job today is risk evaluators, different skill sets but, but just reevaluate risk.

Yeah, but you need to know a whole heap of things, technology wise and tool wise in order to be able to analyze that risk by just the word of mouth or knowing people who to ask.

And then the next step is actually trying to do it yourself.

Right.

But I am on that far end when I develop the tools that you guys work with.

So that’s the difference.

Right.

So if people wonder what I do.

Yeah, I hack things because I’m making the tools, I’m making things better.

And that enables people to do trainings for people.

It enables people to tell other companies if it’s good or bad, all of that.

So yeah, so my reputation in this field of hacking is based on that side because that’s what I do.

I mean, I guess people like that.

Absolutely.

You’re helping us create the tools that evaluates the risk that we use in order to determine is this actually what the vendor or organization said they were doing and then be able to hold them accountable when it’s not true.

So that’s important.

So a question.

What are you doing today?

What are you working on today?

You’ve been doing a few different types of conferences this year.

What’s the fun stuff that you’re working on at the moment?

I was not supposed to do very much conferences this year.

I was supposed to do relaxing and stuff.

It’s been a nightmarish, extensive, excruciating, hard working this year.

Many parts.

I’ve been doing a lot of research for the Black Hat Asia Talk we did and then starting up the company that I’m starting up.

You started a new company just recently.

Oh, it’s a year old.

But the web page is out now.

Aurora Sec is out there.

Yes.

It’s like now, now we exist, we have, we have a web page.

So yeah, that’s it.

But this.

And then I have a private nature.

My son needs to do an operation for some surgery and I said I’m going to take off time to make sure that I can be there when you recuperate from it.

And that got postponed.

And I have a, it seems like I have a tendency to not be able to say no properly.

So I went to Y, I went to Troopers.

I’m going to go to Balkan now in two weeks and then I’m going.

We talked about Balkan last time.

Yeah, it’s a great conference in, in Serbia.

And then I’m going to do some live hacking events in.

Yeah.

And which I can’t talk about.

And then I’m going to be in Saint Con.

You went a couple of years ago to Stone.

I’ve been the last two years in Stone.

I would love to go to Senkon.

It’s a hardware place.

It’s really nice.

It’s, it’s, it’s really odd.

It’s, It’s a small, two, 200 people family, a lot of kids and all that and everybody’s soldiers and hacks hardware.

I’m like, are you kidding me?

It’s like, this is like, we’re so friendly, everybody there.

And there’s a magnificent nature there as well.

It’s like.

Yeah, there’s some.

It’s Salt Lake City, south of it.

Yeah, Salt Lake City is there.

So the, the conference is in Provo.

Provo.

You wouldn’t.

So my former, former, former former employer, their headquarters was in Provo.

Yeah, It’s a big black box, right?

I’ve spent.

It is.

There is a big black box.

It’s a big black box in Provo.

Yes, yes.

With.

Yes.

A big building with lots of power getting used.

A lot of power getting used there.

So.

But yeah, I spent, I spent a year of my life in Provo.

I know, I know the place so well.

Yeah.

Because my former employer was Altiris and Altiers was started out of a lot of people who came from Novell and Novell of course, started in Provo and American Fork and all those places.

So my bosses were based there and I would travel spent.

I think I looked at my Marriott hotel nights.

It was 360 plus days in Provo at the Marriott Hotel in Provo.

So I still have, I still have my membership card for the comedy club there.

So there’s a comedy club in Provo.

And also.

Yeah, java beans, which came and went a few times because they’re not very welcoming to coffee and caffeine.

No, no, no, not caffeine.

It’s a fantastic place.

Yeah, it’s amazing place.

Yeah, I like it.

So, yeah, so I’m doing that.

I was also gonna, I applied for, I applied for code blue in Japan.

Okay.

And then I promised to do a talk for Hack the Hills in Melbourne, Australia.

But I most likely have to cancel those two occasions because the surgery has been.

Oh, the surgery’s gonna be around that time.

Okay.

So I’m gonna be able to do that.

So.

Yeah.

And then I hope to relax a.

Little bit and have a, have a little bit, you know, of time for yourself, you know, because that’s what we need in this industry.

We tend to always be on the forefront.

You know, it never sleeps, it never ends.

It’s constant.

If you were to sit and look at the forums you were sitting, look at all the research has to be done.

We’d be working 247 and non stop.

So it’s always important to find the time to, you know, to, to focus on, on the, the hobby yourself, you know, the things that you want.

You know, I always say that sometimes important to have hobbies outside of what we do a little Bit kind of, you know, that’s completely left to the field in order to really sometimes take the mind off things.

Someone told me at Y camp now, the real summer, summer hacker camp, it’s like you have a real tense in Europe, you know, and instead of Vegas, someone tell me that, well, Iceman, you like, you always go to, you know, you’re like, conference junkie.

It’s like, well, it’s kind of fun to go to conference.

I get to hang out with Hackatham, you know, I get to hang out with great people.

People.

I mean, end of the story, you know, Talking to great people makes yourself feel so good about things, what you do, and you can share knowledge and you just.

And you just think and you have fun.

And they are people who understand your motivations.

Right?

They.

They.

Because they have the same, similar.

Yes, right, Right.

So we all have a passion for something, right?

So sometimes I’m like, you know, and if I do a talk, I do a talk usually because they pay for me to get there.

So it’s not bad.

So it almost becomes like my holiday in one way.

But I also need to not do anything.

And when I do that, I prefer to lay on a beach and do absolutely nothing.

And I don’t even have a computer with me.

And I sometimes could even have a physical book.

Yeah, a proper book.

Or just music.

Oh, music is good.

Yeah.

What do you listen to?

For me, I’m a big Blink 182, blur, old school, Nirvana.

So I’m a kid of all kinds of.

My kind of childhood was more 80s, early 90s rock, alternative.

So.

So my old playlist that I pull up once in a while from 90s early rock.

That’s great music from then.

It’s really good.

Red Hot Chili Peppers.

Red Hot Chili Peppers, yeah.

So even more.

I do like Imagine Dragons, Mumford and Sons.

I’m going to One Republic concert soon.

It was one of the next ones.

So I do like, you know, it’s a little different.

It’s more kind of, you know, pop type of, you know, alternative.

But it’s.

It’s.

It’s good.

That’s one of the things.

It brings you joy.

You know, I listen to a lot of music in that sense, you know, because I want to be in the zone.

And that feels great, to be in the zone.

It’s a hard concept to explain to people who don’t do software development.

But Zone is a special place.

What we love a zone is the place when.

When I’m.

When I’m writing, when I’M doing the kind of.

After I’ve done the research, I. I need to get it out of my head.

Yeah, I put some, you know, usually it’s either kind of electro music, you know, something.

No lyrics, no lyrics, just beats.

So.

And even, sometimes even going to some of the, you know, good old DEFCON media library as well.

Oh yeah, Soma, guys.

Yeah, Kampf, he does this DJ thing at sync on all that stuff.

So it was great.

So he, you know, it’s like, come listen to Soma.

It’s like, okay, so tune in there.

I have another friend who does that this spring.

I was like, yeah, God, I feel, you know, wear it worn out.

And he was like, yeah, when I do that, I listen to music.

Yeah, I like progressive trends when I do this.

And he’s like, I got you covered, man.

So he keeps on sending me this playlist and like, ah, here’s some good beats for you.

You’re not great.

You’ll have to shirt.

Well, let’s, let’s add it to the, the show notes.

You have to share it with me so.

Because that’s something I do.

I do enjoy a good playlist, you know, even for me when I go on snowboarding, I need to have something.

You know, I’ve got my helmet on.

I’ve got basically I’ve got my speakers in the helmet it.

And I’m just on the hill.

I’m just like, okay, just.

It’s just mountains in Estonia.

There’s no mountains in Estonia.

But I have to go to Finland or Sweden.

So next year, next year’s a Finland trip to get some, some good hills.

Are you going to go to Disa Bay?

I’ve been talking with you.

Yes, I, I’m going to do submissions because the call for papers open at the moment and I do plan to go to Disa Bay.

That is the plan.

Cool, cool, cool.

I might give a training workshop there.

So, yeah, what it’s going to be.

About, it’s going to be basically probably hacking gamification.

You know, how to get started, how to take notes, how to improve your skills, how to find the right people to help you.

So getting into the gamification side in order to improve your skills.

Cool.

It’s a lot of gamification, isn’t it?

There’s a lot of gamification.

So I, for me, I run the community for Baltics in Finland for Hack the Box.

So every now again I’ll do some type of live walkthroughs, different machines once in a while.

Do you do that on stream, not live on stream.

No, because otherwise you’ll see.

You’ll see me like hitting the table or getting frustrated.

Yeah, it’s.

It’s important.

I got some feedback about my talks about them.

And we go like, yeah, we like that you’re genuine.

But I also think it’s great that you talk about when you fail doing things well, that’s.

So when I had, I had the conversations with Stoke and John Hammond and we went through this whole conversation and we talked about sometimes when we’re showing like one of my favorite conferences that I remember watching, it went online, which was colonelcon and Colonel Con.

It was the one year where they actually streamed it all live and they had on Discord, they had the live stream I think they were doing on Twitch or something like that.

And for me it was one of the best because when they were doing the hacking gamification that basically John would get a challenge and Joe grand would also get a challenge and they didn’t know what they were going to get.

And when they were going through and they had solved those puzzles and challenges, it really showed you that one you’re failing.

You know, the failing part of it, it really highlighted that.

And for me, that was one of the best.

So if you ever get the chance, I’ll actually put it in the show notes as well.

Go back and look at the kernel Con.

And yeah, it was with Joe Grant.

There was John Hammond was on.

There was Chris, who does the Ida Pro Ghidra.

And it was.

It was really good.

It was really good because it really got to the point because sometimes when you do edited videos, you show it all successful, how it should be done.

But what you don’t tend to show is, you know, this is what I kind of like is that the failures, especially when even IPsec’s doing it.

I like his style because he also shows here’s the rabbit holes.

But you don’t get the sense of how deep those rabbit holes are.

That’s the missing part.

And for me, yeah, you’ll probably see me going down deep down a rabbit hole and getting really frustrated.

And then my style is I know a guy who will go and help of this rabbit hole.

So I end up using my connections to help me solve, solve things as well, which is what the real world is.

Yeah, but that’s how you need to do it, right?

So you need to do those things.

You need to have connections and people who can help you up and who you can balance ideas with.

So I do have a YouTube channel as well.

And I sometimes livestream my failures when I code.

And I sit endlessly staring at screens and we’re like, what am I doing wrong here?

And then six hours later, a few.

Moments later, you still haven’t moved.

Are you live?

I suppose.

No.

Oh, yeah.

That would be classic.

To really show the proper.

The full length of stirring it a problem and then stirring it at a different way.

Maybe it’s going to change, but it’s like that.

It’s hard to explain the problem solving process because that’s what we’re into right now.

Yep.

How do you overcome problems?

And for me, I heard what I remember is a story from the Naked Chef, Jamie Oliver, and what he was doing.

He was a biggie on things for 10 years ago, and he was doing things and he was so frustrated.

He was doing something for the community, for the schools and making.

Yeah, I remember.

Yeah.

And he was super frustrated because he can’t get on with it.

And he’s like, I can’t think.

I bake a bread.

Right.

So he stops doing that and he stopped baking and kissing that bread.

You know, the dough thing.

And.

And I really took to heart with that because when I don’t, when I get stuck, I start coding something, just whatever.

I take up some old RFID cards and hack some old stuff.

So I get into flow, try to do some improvements, whatever, and then I’m in there, and then I’m not here, here, I’m in there in that.

Yeah, you’re in the kind of the frame, but you’re, you know, looking at a different problem.

Sometimes looking at a different problem can give you a bit of, let’s say, you know, maybe if I tried this.

Yes.

And that’s.

That would be the number four takeaway for us.

So for everyone in the audience, how do you stay up to date?

Where’s your learning?

What types of things?

And when you’re not, you know, sitting on the beach listening to good music?

How can the audience get in contact with you if they have questions?

Is the Discord Channel the best way?

Don’t contact me anymore.

I’m just joking.

No, I’m always reachable in that sense.

So Discord is a great place to now learn and to search and look at the PIN messages.

If you want to get stuck, it’s always there.

Ask questions and the community will answer them, you know, but for me, by now, I’m very blessed.

I have an.

A tremendous network of people that I Can talk to, chat with and it keeps on flowing in.

I spoke to the, to a guy who’s been in a central organization for tools and he said, when you’re at that barnacle of the top part there in the pyramid, everything flows to you.

The information always comes to you.

So I’m at that point now, but information comes to me more.

But I devour Internet like x and LinkedIn since x is, you know, since the whole travesty with X.

It was a nice info bubble before, which I like, I remember how it was.

You went to X, you had this filtered bubble was great.

You got all the hacks, you got.

All the knowledge, you got the things you, you were interested in.

Yes.

And you got it smack on you.

You got it four hours later, right.

That was yours.

You know, that was the best thing.

You was always aware.

And that spread, right?

So that spread out to Mastodon.

That spread out to blue Sky.

That’s.

But.

And also LinkedIn today, right?

People use LinkedIn to sell hacky stuff.

I’m like, what the.

But there’s Warrior.

It’s on Sl.

Lack.

It’s on signal groups.

I am seeing so many signal groups everywhere and it’s.

And Discord servers ever.

It’s so spread out.

So if you want to have knowledge, just go and join.

If you interest, I say focus on one thing.

Focus on a device.

Focus on one.

If you want to do web hacking, great, go and start looking for web hacking on, on, on YouTube and you will find tons of great channels.

Eric is one of them.

Then you have Ben, whatever you call and Nahamsec.

Yeah, Nam Zach.

Yeah, exactly.

He does great as well.

You look at those and then in the end of the day you have to start doing physical.

You have to open the trunk.

Right.

Fiddle with it.

And then you do that.

And then maybe you start doing some burp suit or whatever and you start looking into that and then you start looking at the issues and then you start, oh, here’s a Discord server that talks about this and that’s.

And then you have an entry into there.

And then you have an interest, you have some knowledge.

You ask questions.

Never be afraid asking questions.

And if you have an asshole attitude towards you, that’s a lousy server.

And then you just drop that server because that’s.

It’s not worth your energy.

Yeah.

You know, that’s one of my, one of my recommendations.

Always never be afraid to ask for help.

Yeah.

Ask for help.

Yeah.

If you struggle.

It was always.

It’s probably even sometimes I’ve I’ve had that failure over the years is that I, I try to.

I try to figure it out myself and not myself alone.

Like.

Like I started off with.

Same.

Same.

I started off with the books, Mark.

It was like, like, I can do this.

Yeah.

At some point I’ll feel.

But I need to get, you know, how to get back on the road again.

And it’s a community and not being afraid to go and ask for help, that it gets me back on track.

And I always regret not doing it earlier because I think I wasted a lot of time in the past of, you know, I’ve wasted.

I think even when I was doing my oscp, I wasted too much time doing it solo.

Yes.

And I realized that, yes, I needed help and I was fortunate enough to find the right people who could point me in the right direction.

But I think if I look back, the lesson to my younger self was don’t be afraid to ask for help.

It will.

It was just a waste of time.

And a final note on that one man is also, if you don’t know how to involve and get people shy and all that stuff, you know how hackers are sometimes, not always the social things.

Doing a talk is really hard.

But involve yourself in a village like.

So if you go to a defcon, which is super expensive, but they have lots of villages, choose one or two, you visit a bunch of them and then go and sell.

You go and ask them, say, hey, can I volunteer?

Can I, can I help out?

And then it starts rolling.

Right.

You’re willing to put in the effort and then people take, you know, the open arms and just bring you in.

Awesome.

And you meet a lot of amazing people at the villages, so.

Oh, yeah.

And always willing to give back as well.

They’re always willing to give the time to you.

Yes.

So.

So question for yourself.

Any plans to write a book at all or to take your knowledge that you’ve got and put it, put it somewhere which would then, you know, kind of.

I should write, shouldn’t I?

You should.

Yes.

I think, I think that’s what I’m trying to get to is you should write.

Maybe I should.

I’ve been bouncing my idea of thinking I need a ghostwriter.

I mean, I’m not good at writing as, as you are, you know, but it’s.

I think you, you know, for you, you’ve probably taken a lot of documentation.

You’ve.

You’ve taken your notes.

It’s getting someone to take the.

I’m hoping.

I mean, looking at the.

Okay.

Looking at GitHub and looking at all the other place you’ve done, you’re probably code as your documentation taking, I mean, taking that and taking a lot of the, you know, the things you’ve written, forums and talks.

You can, I’m pretty sure you could put a.

Get a ghostwriter or get a copywriter at least that will take all of that and put it into a format that, you know, would be storytelling and educational.

Yeah, I think it’s a great idea and I would look into it, I think.

Yeah.

And I would ask you for helpers.

I’m always willing to help.

So, Iceman, it’s been fantastic having you on the show.

I really always enjoy.

This is my favorite part of the week.

It honestly is.

And I do, you know, miss meeting you up in person.

So hopefully we’ll be able to catch up at some conference in the near future and have a good couple of drinks.

I have a surely my dog poodle somewhere.

Ellie’s around here somewhere.

I’m sure she, she misses you as well.

So she’ll, you know, so send her her thank yous and, and many thanks for taking the time today.

It’s been much appreciated.

What’s the best way Discord for the audience to connect with you?

Discord is the number one place if you want to do.

I’m on Twitter, I’m on YouTube, so.

Yeah.

Okay.

And any final, any final words or comments to the audience you like to leave them with?

What?

Hack the planet, man.

Oh, for me, you know, I have to watch hackers at least once a year.

I’m very thankful for you to, you know, to interview me and having you on your excellent show, it’s always a pleasure speaking to you and I do enjoy you.

You are one of those clever people and you go like, huh, interesting.

Thank you.

Thank you.

It’s people like that I surround myself like you that.

That makes me who I am.

So, so it’s.

That’s.

That’s the person I am, is.

That’s my, my community and sphere that really inspires me.

Me.

I think that’s a good thing to say to finish off with.

Surround yourself with people.

That makes you feel better.

Absolutely.

That makes you a better person and makes you enjoy life and have fun.

Absolutely.

So thank you.

Thank you.

It’s been a pleasure as always.

So everyone stay safe.

Take care.

Tune in every two weeks for the security by Default podcast until the next time.