I dagens avsnitt diskuterar Erik Zalitis och Mattias Jadesköld tillsammans med Patrick Schlapfer på HP. Patrick arbetar till vardags med Threat research och ligger bakom HP:s senaste rapport.

Vad är det senaste metoderna som angripare använder? ”vibe-hacking” – vad är det? Hur an de komma åt kryptovaluta genom en backupfil? Och hur kan angripare använda ljudfiler för att ta sig in i datorer?

Det och en hel del annat i dagens avsnitt som är på engelska!

Inspelat: 2026-08-26 (publicerat 2026-08-30)
Deltagare: Erik Zalitis, Mattias Jadesköld och Patrick Schlapfer.
Texten skrevs och sammanställdes av Erik Zalitis. Intervjun är på Engelska.
Avsnittet presenteras i samarbete med HP.

Medan du lyssnar – Vibe hacking

Här är transkriptionen av avsnittet

1
00:00:12,654 –> 00:00:21,262
Mattias Jadesköld: I dagens avsnitt tar vi oss en titt på hotlandskapetsammans med HP. Det finns några angrepp som sticker ut under den första delen av 2026.

2
00:00:21,262 –> 00:00:42,734
Erik Zalitis: Ja, precis. Vibe hacking till exempel, och hur angripare döljer skadlig kod i ljudfiler. Rena agentfilmen. Ja, det kanske är en sanning som kan läsas ut i HP Wolf Security Threat Insights report, som släpptes för ett par månader sedan.

3
00:00:42,734 –> 00:01:01,026
Mattias Jadesköld: Det ska vi ta en titt på närmare idag, och det gör vi tillsammans med Patrik Schlapfer som arbetar som principal threat research. Vi kommer prata engelska rätt avsnitt av IT-säkerhetspodden som förutom Patrik, då består av Mattiaskö i sin vanligording. Welcome, Patrick.

Patrick enters our virtual studio

4
00:01:01,026 –> 00:01:04,558
Patrick Schlapfer: Welcome. Hey, thank you so much for having me.

5
00:01:04,558 –> 00:01:06,990
Mattias Jadesköld: Yeah, how how are you?

6
00:01:06,990 –> 00:01:11,106
Patrick Schlapfer: I’m all good. pretty good actually today. How are you doing?

7
00:01:11,106 –> 00:01:19,310
Mattias Jadesköld: Fine, thank you. We had some issues with the sound but now it seems to be working. Eric is happy with the sound solution now?

8
00:01:19,310 –> 00:01:23,662
Erik Zalitis: It’s always something is screwing up with the sound and that’s just how it is.

9
00:01:23,662 –> 00:01:33,898
Mattias Jadesköld: Right. Okay, so normally you work as threat research at HP. what do you do on a normal basis, Patrick?

10
00:01:33,898 –> 00:02:30,102
Patrick Schlapfer: I do. That’s a good that’s a good question. Well, I have the fun job to actually look through all the collected telemetry data from our different security solutions, analyze the dead data, and then find all the interesting threats and take them apart. With all the data and the analysis I do, I do then get to write interesting reports such as the quarterly threat insights report. I do also write occasional blog posts, which is published on our threat block and I also do share quite a lot of information with the community because in the end security is a game as a team so sharing is definitely caring. Besides the whole threat research part, I do work together with the defensive security research team so that we can improve security solutions and create new solutions, which hopefully also protect for from the future threats.

11
00:02:30,102 –> 00:02:34,766
Mattias Jadesköld: Right, okay, so a lot of different tasks during a day, I guess. Yeah. And where are you located?

12
00:02:34,766 –> 00:02:42,277
Patrick Schlapfer: Absolutely, yeah. I’m actually located in in Zurich in Switzerland.

13
00:02:42,277 –> 00:02:48,320
Mattias Jadesköld: Okay. Some it’s a bit big difference between Switzerland and Sw Sweden, but

14
00:02:48,320 –> 00:02:49,304
Patrick Schlapfer: Yeah.

15
00:02:49,304 –> 00:02:55,330
Erik Zalitis: They get them confused all the time, isn’t it? Like Yeah, Switzerland and Sweden the same country.

16
00:02:55,330 –> 00:03:00,950
Patrick Schlapfer: Yeah, absolutely. Quite in a different place, but both I would say very beautiful landscapes.

The making of an IT-security pro – How Patrick got started in the business

17
00:03:00,950 –> 00:03:10,168
Mattias Jadesköld: Yeah, definitely. Right. So it seems like you’ve been working with IT security for some years now, but how did it all started?

18
00:03:10,168 –> 00:04:59,008
Patrick Schlapfer: Well, that that was actually quite some time ago. So when I studied at the university, I I grew my interest in security in general. So I decided to take one or the other course in the area of security, like from cryptography to network security to to malware analysis. And I decided that malware analysis is probably the most interesting thing to have a look at because I I quite like to take apart software and understand how it works. So after I finished my degree, I actually had the chance to work as a research assistant directly for the university in a research project. So what we built back then was a dynamic malware analysis sandbox, which we created to through writing a custom Linux kernel module to basically do virtual machine introspection. I was very much into memory forensic at the time, and with the kernel module, we were able to capture the memory of a virtual machine from the hypervisor level. And therefore basically do dynamic analysis without having an in-guest agent. So that was that was the start and that was the whole fun around malware analysis. I later then decided after the research project it would be good to understand how security works in the real world outside academia. So I joined to work for a bank in security operations, and we focused a lot on incident response. but also did a bit of threat intelligence, basically taking apart and analyzing the threats we see and then share it with the community. After working for the bank, I was quite keen to understand malware even more in depth. And that’s when I actually joined HP as a threat researcher almost six years ago. Yeah, and that’s been quite an interesting journey and here we are six years in.

19
00:04:59,008 –> 00:05:06,840
Mattias Jadesköld: Right. So interesting. Yeah, you have a lot of banks in Switzerland, don’t you? So it’s a good way to start. Yeah.

20
00:05:06,840 –> 00:05:24,492
Patrick Schlapfer: Well, I mean I mean back at the time this was one of the I would probably say one of the two main companies who would hire security professionals. The other one was was the government. definitely very interesting project as well, but working for a bank was quite an interesting experience as well.

21
00:05:24,492 –> 00:05:46,552
Mattias Jadesköld: Yeah. Right, so we’re gonna dig into this annual report. It’s as Eric said mentioned in the beginning that it’s called HP Wolf’s Security Threat Insight Report. but a bit overall, w w what’s the reason why this is re report being created annually?

22
00:05:46,552 –> 00:06:40,660
Patrick Schlapfer: Well, we do collect all this valuable thread information, right? And one thing I’d like to say is that it does never represent like the full thread landscape. It’s just yet another different vantage point if we compare it to other security vendors and security companies. And therefore, with all the data we have, we thought, well, it’s very valuable information, so let’s share it with the community. First of all, it gives a lot of security awareness to share a bigger picture of the threat landscape, even on a higher level. But there are also technical lug nuggets in the threat insights report, such as interesting techniques which are used by the attackers, which actually help the security practitioners to understand those techniques and then build protections or build detections against those attacks.

We open the actual report and Patrick delves into the emerging patterns worth knowing right now

23
00:06:40,660 –> 00:06:52,770
Mattias Jadesköld: Right. So but if you compare the this report with previous ones, i is there anything that stands out? It’s a bit different or something?

24
00:06:52,770 –> 00:09:13,346
Patrick Schlapfer: Well that’s that’s a wide question, I think. But there are definitely four I would say like well a couple different things that stand out. well if if if we look back about ten years ago or so, we were used to having those classic attacks with Word documents containing macros, which are then sent as an attachment to the user. And only with probably like one or two clicks your device was infected. Back at the time, like emotet one of the big moller families, which is luckily not not around anymore. nowadays it’s it’s quite a bit different. So from those two clicks, I would say it’s like a click to infection. This increased quite a bit. So nowadays we see that an infection requires more clicks because the user has to open a file, open an archive file, type in a password, and then open. Yeah, probably a script inside it and such kind of things. So this whole amount, number of clicks to infection increased, which also means that attackers and threat actors are focusing a lot more on social engineering. So the social engineering component in the beginning of an attack becomes very relevant for them. So they invest quite a bit of resources to make them more convincing. So the attacker actually Well, performs a specific task. Most often they try to blend in with standard business operations. So it’s very difficult for a user to distinguish between something legitimate and something malicious. Then another thing we’re seeing is that there have be has been this shared intermediate stage. Now, if we look from a higher level at an infection chain of such a cyber attack, we can probably split it into two. into three different stages. We have the initial infection with the social engineering. Then we have an intermediate stage with all the scripts which are running, basically which are responsible to then install the final payload. And then in the end we do have the final payload. And one of the things we’re seeing lately is that not only the social engineering and the final payloads are shared amongst thread actors, but also those intermediate stages. And this tells us that it’s not

25
00:09:13,346 –> 00:10:44,416
Patrick Schlapfer: This one man show where a hacker tries to target an organization, but it’s a full ecosystem of cybercrime that works together. So threat actors can go and buy malware families, intermediate stages, or also all kinds of different lures off the shelf from hacker markets or from hacking forums and such kind of things. And then there’s one thing I didn’t mention yet, but AI is of course also a part of the thread landscape and how it evolves over time, right? So one thing I can see up fr say up front is that we haven’t seen autonomous attacks as they are like shown in the movies. But attackers are making very much use of AI models to then create all kinds of different stages. For example, the intermediate stage which is responsible to install the final payload is very often created through Vibe WIPE coding or so-called white hacking. So they use a model and then they tell the model, hey, in in normal language, create me this specific infection stage, do this and that. And then it creates this very well. And it also works quite well for the social engineering engineering laws in the beginning. So if they want to create like a simple website or if they want to create a simple document or something like this. The AI models are very, very helpful for the attackers in this case. So that would probably be the four main things I would say.

The door within your computer – how hackers use remote tools to take control

26
00:10:44,416 –> 00:11:11,566
Mattias Jadesköld: Yeah, we’re gonna dig in a bit more on some topics and some of them are vibe hacking as Erik mentioned as well. But I I found three interesting topics w which from this report I think we should dive into. So let’s start with the first one. This is about remote tools that hackers are using remote tools like Log Me In or Screen Connect. How does this work?

27
00:11:11,566 –> 00:12:48,096
Patrick Schlapfer: Well, that’s a good question. So, first of all, that’s not something that is entirely new, right? we have seen such attacks in the past, like attackers using official and legitimate remote access tools to to compromise devices. That’s been around for quite some time. Now what’s different now is that we have seen quite an uptick over the last quarter, over the last half a year. So that’s something that stood out. And the second thing is that in the past, whenever I did an analysis of such an installer, I noticed that the thread actor actually modified the installer to connect to attacker control servers, right? So in this case, the whole infrastructure of the legitimate service, such as remote administration tool, is not in the whole scenario. So it’s directly connecting to attacker control servers. What they are doing now is that they take it as is and install it on a victim’s device. Now, this remote access solution then connects to the official service provided by by the application company. And therefore, it is very difficult to distinguish whether this is something malicious or something clean. And the thread actor, all he all they do is basically they have a login to this service. And then they see all the different devices which are connecting to the service, and then they can execute various different commands on the device and basically control it.

28
00:12:48,096 –> 00:12:57,034
Mattias Jadesköld: Okay. So these are all the so these are not just hacking tools, these are like normally remote tools that the hackers are using.

29
00:12:57,034 –> 00:13:58,434
Patrick Schlapfer: Exactly. And that makes it so very difficult, right? those are legitimate tools. Lots of organizations actually use those tools specifically in IT support organizations. So whenever someone has an issue with their device, they they can remote in and fix the problem directly on their device. and it it’s it’s a very similar thing for for all kinds of different software solutions or tools, such as for example, take PowerShell. PowerShell is a brilliant tool for to do like system administration. But in the end, it’s also a very common tool to be used by attackers because it has a lot of possibilities to interact with with the device in the end. So with those remote access tools, attacker are using legitimate software in a malicious way. And in the end that’s very, very difficult to figure out in a network. Because maybe the organization is using specifically such an organ such an application as well themselves.

30
00:13:58,434 –> 00:14:07,320
Mattias Jadesköld: But how how how can I prevent these type of attacks, for example, if I’m working in an IT department in on an organization?

31
00:14:07,320 –> 00:15:22,326
Patrick Schlapfer: Well it’s it’s definitely not an easy task third to attack from such an attack, yeah. it might be probably quite a boring answer, but in the end it is it is also an o an evergreen, but a and and you know this for sure, it’s like have a good inventory. I know it always sounds so easy and it never is because having like a clear and and a complete inventory is pretty much impossible. But having an idea of specific services you’re using can be quite helpful. So if you know that, hey, are you using this or the other remote access tool, then you can monitor for other remote access tools to be used within the same organization, which is probably a lot not legitimate in this case. And then the other thing is that, well, try to install software only from trusted sources. Now in those specific campaigns, thread actors are actually installing the software. So it’s not a user installing the software, but it’s a thread actor. And last but not least, if you control the admin privilege on a user device, then they have less capabilities to install such potentially malicious software on their operating system.

32
00:15:22,326 –> 00:15:31,694
Mattias Jadesköld: Yeah. Erik y you work as a pen tester. Have you ever experienced that that these type of attacks using remote tools?

33
00:15:31,694 –> 00:16:01,426
Erik Zalitis: Well, as a pen tester, I’m trying to do the same, pretty much. So I I can’t say that but as working with this SOC at the Security Operations Center, which I can help at my company, the company I work for, that is. Yeah, we we’ve seen they’re trying stuff like that. Mostly they’re trying stuff like that with phishing attacks. But of course, that’s not the only show, so to speak. So yeah, that’s a thing. No disagreement.

Your money at risk – how crypto wallets get stolen

34
00:16:01,426 –> 00:16:24,888
Mattias Jadesköld: Okay, that’s good. Okay, let’s jump to the next topic, which is also kind of interesting. a bit outside my comfort zone because it’s about crypto w wallet wallets and and restore. that it’s mentioned in the report that is false restoring of crypto wallet wallet wallets. How how does it with this work?

35
00:16:24,888 –> 00:16:34,519
Patrick Schlapfer: Well, it’s Yeah, that’s that’s definitely interesting. So did you ever lose your own crypto wallet?

36
00:16:34,519 –> 00:16:40,750
Erik Zalitis: Don’t have any trouble. That seems like a smart thing. The only way to win this game is not playing it.

37
00:16:40,750 –> 00:17:31,562
Patrick Schlapfer: Exactly. Well, definitely, definitely on my side here as well. Yeah. Well, yeah. what is it? Well, so a crypto wallet i i it’s basically the key to the kingdom, right? So it’s basically a a key that you have locally on your device. if you decide to have it locally, it’s a private key, which allows you to gain access to the whole crypto assets you have. the crypto assets themselves are actually stored on the blockchain, such as Bitcoin as an example, but the the private key is something you keep to yourself, in hence the name private key. Now, if an attacker is able to get access to such a private key, then they basically control all the funds you have on the specific blockchain, which is quite a big disaster in this case.

38
00:17:31,562 –> 00:17:38,506
Mattias Jadesköld: Yeah. Because the banks cannot help you in this case because it’s decentralized, like Bitcoin, for example.

39
00:17:38,506 –> 00:18:43,360
Patrick Schlapfer: Exactly. it’s decentralized. So there’s no help from from anyone. and if if if an attacker controls the private key, they can basically redirect all your bitcoins or whatever cryptocurrency you are you are using to yet another wallet because they have the private key and with the private key they can easily sign new transactions, which then sends the money to someone else, which presumably in this case will be a tactor in its own. That’s why our attackers are so interested in finding local crypto wallets and exfiltrating those private keys. So this is a very common technique when we look at all kinds of different information stealers. They are usually built in a modular way where they have like all kinds of different capabilities, such as like password stealing or I don’t know, browsing history stealing. And one of those modules is definitely always like crypto wallet stealers. Because a crypto wallet can contain quite a lot of money in those days. So if they get hold of one of those wallets, then well, they might be rich at some point.

40
00:18:43,360 –> 00:18:50,954
Mattias Jadesköld: Okay, but how does it work with with restoring a crypto wallet?

41
00:18:50,954 –> 00:20:27,803
Patrick Schlapfer: Now this is this is actually the interesting part because this is this is just use as the lure, right? So imagine yourself you lost your crypto wallet on your device and now you’re quite desperate because this is a lot of money. And you want to find this crypto wallet again. so what’s the steps you take? Well, in this desperation, you probably reach out to the internet and search for tools that can recover your crypto wallets because it’s a a lot of money. And that’s basically where the users get trapped. Because the attacker set up this GitHub repository to tell the user, hey, I built this solution, and this solution will actually help you to find your lost crypto wallet on your device. In reality, in reality, it doesn’t do it. In in reality, what happens if you download this crypto wallet recovery tool is that, well, It exfiltrates all kinds of interesting and sensitive information. At some point, they do promise what they claim. They do indeed recover your crypto wallet, but they don’t give it to the user. But they simply exfiltrate this crypto wallet and send it to the attacker’s server. So besides system information, passwords and browsing data, as I mentioned earlier, they of course also collect crypto wallets. They are They they compress it in an archive file and then they send it to an attacker control server in this case. So yeah, unfortunately no crypto wallets recovery tool here.

42
00:20:27,803 –> 00:20:31,775
Erik Zalitis: All I can say is empathy is not a thing with them.

43
00:20:31,775 –> 00:20:35,119
Patrick Schlapfer: No, absolutely not. No.

44
00:20:35,119 –> 00:20:44,482
Mattias Jadesköld: But how c how can I if if I’m having if I’m worried about this, how should I avoid these type of attacks?

45
00:20:44,482 –> 00:21:45,394
Patrick Schlapfer: Well, if you actually lost your crypto wallet on your device, then yeah, it is very frustrating. I do understand this, but don’t act too fast. First of all, I would probably try to investigate well, where is this crypto wallet actually stored on the device? Like in which folder does it normally reside? And I think that’s very different depending on the blockchain you’re using. Yeah. Then in the end you have different names, right? Different file names. So what I would suggest if you actually lost it, go and search and investigate how this crypto wallet is built, where it usually resides and what the fail file name is. And then use like built in Windows tools or Linux tools if you’re if you’re using Linux to search for the files in the different folders. That’s definitely better than downloading a random application from an untrusted source. Yeah. Because yeah, well In this case, they were definitely proved to be something malicious.

ClickFix – the word you need to know

46
00:21:45,394 –> 00:22:08,640
Mattias Jadesköld: Right, okay. Let’s go to the third topic, I guess. This called ClickFix campaign. this was there was this was this some sort sort of recent attack related to clickfix. What is clickfix?

47
00:22:08,640 –> 00:22:46,112
Patrick Schlapfer: Well, ClickFix has actually been around for well, I don’t want to say anything wrong, probably one or two years now. So it’s been around for quite some time. But during this time, they did evolve the attacks and the campaigns. So ClickFix is in the end a social engineering technique. So what happens is that an attacker builds like a social net social engineering website or a social engineering image. Which convinces the user to basically paste some malicious codes into the local Windows run box and then execute malicious code.

48
00:22:46,112 –> 00:23:22,028
Erik Zalitis: I actually interesting you would say that because I actually investigated such a code a few weeks ago. and it was extremely clever. It tried to look like some kind of cloud flare warning that says please click and execute this in in the runbox. And I actually looked through the code and it was extremely well obfuscated, w sending those deobfuscator tools into some sort of eternal loop. The obfuscation level of that was like eleven out of ten. Enormously well done. Seriously.

49
00:23:22,028 –> 00:23:32,235
Patrick Schlapfer: Yeah, I I totally believe that. We have seen so many different, like specifically obfuscated scripts which are terrible to analyze and I definitely like I I do understand your frustration. I’ve spent hours picking apart like JavaScript code or BB script code, which is like it’s unbelievable what kind of techniques attackers can make use of to to obfuscate their scripts.

50
00:23:32,235 –> 00:23:46,934
Erik Zalitis: Like yeah, I know.

51
00:23:46,934 –> 00:23:53,954
Erik Zalitis: I I don’t like hackers very much, but I respect them. I y begrudgedly I do respect them.

CAPTCHAs – annoying but obviously needed

52
00:23:53,954 –> 00:25:10,008
Patrick Schlapfer: Well, in this case, I I actually have to give it to them specifically for for the idea to create such a social engineering lure, right? I mean in the past, like if you remember the good old Word and Excel documents where they tried to convince the user to click the enable button to basically run the in included VBA macros. Now this was quite basic and this this was around for probably like ten, fifteen years or so. Now, this is a totally new concept. And I I think that is quite interesting. And now if you think around, well, it’s been this Cloudflare cap cap capture you mentioned, if you think back like many, many years ago, those captures are not something that are new, right? Because in the end it’s it’s like just the idea to distinguish whether you’re an actual user or if you’re a robot or if you’re some kind of crawler accessing the website. I remember like Many years ago, like even like simple web forms had such a very simple CAPTCHA where you get like two numbers, so you have to add them together, and then you have to type in the number in a specific field and only if the answer was correct your form was submitted, basically to prevent automated attacks.

53
00:25:10,008 –> 00:25:24,450
Erik Zalitis: Yeah I remember that too, I remember that too. Th the the kind of distinction between them were there were two kinds they were super secure and no human beings could solve them, or they were very easy to solve and any hacker could solve them.

54
00:25:24,450 –> 00:25:44,846
Patrick Schlapfer: Yeah, I mean that that’s absolutely true. I mean I remember well when when you get like those other captures like hey yeah click on all the pictures which contain a mountain, click on all the pictures which contain I don’t know, a bicycle or a car. And I and I remember sitting in front of the PC like like clicking all the images and then next and then there’s the next coming up.

55
00:25:44,846 –> 00:26:12,898
Erik Zalitis: It felt like never got it right. It’s like, what the heck? That’s supposed to be a mountain, but obviously not for some reason. And another thing was back in the day of PHP BB, if you remember that forum, it had the worst capture ever. No humans could solve it because it was slanted R’s and S and X and nobody see. Is that a Y or is it a W or whatever? I can’t see it. And the hackers had no problems breaking it for.

56
00:26:12,898 –> 00:27:17,430
Patrick Schlapfer: Yeah, exactly. And and is it like is it uppercase or is it lowercase? Yeah, I I know exactly what you mean. And and and in the end, like let’s be honest, that that’s been one of the issues for the user here, right? I mean, like we can come up with so many different types of captchas that we have seen over the last, I don’t know, maybe twenty years or so that for a normal user who is not like used to work with like those captures every single day, it’s very difficult to know well, what is the next technique a company like figures out to hip to build such a capture. So like at some point it’s you have to select the mountains in another, you have to like have this like maps puzzle, like and and and whatnot. So it can very likely be that at this point you have to execute the specific commands of of of key combinations. So like pressing like Windows R, control V and enter doesn’t seem to be so far fetched. And in the end the normal user has no idea what Windows R does, does do they? So that’s very tricky.

57
00:27:17,430 –> 00:27:28,802
Erik Zalitis: Y d how do you teach people not to do stupid things when everything that’s stupid looks exactly the same way thing f way that things that are smart?

58
00:27:28,802 –> 00:27:45,110
Patrick Schlapfer: They have absolutely no idea. And and if you remember, the user went to this website for a specific purpose. They want to consume the content on this specific website. So all they want is to to get this capture out of their way so they can actually access the website they were looking for.

59
00:27:45,110 –> 00:28:13,292
Erik Zalitis: And people don’t expect that to happen because one of the things where I was checking a few weeks ago, that was like a food site, like a restaurant here in Sweden that was hacked. So it wasn’t like malicious, but it had been hacked by WordPress, if if you know, and and that kind of injected code in the JavaScript that ran this Cloudflare fake. So people weren’t expecting. I mean, you go to a restaurant site, you don’t expect to get hacked.

60
00:28:13,292 –> 00:28:45,190
Patrick Schlapfer: No, not at all. That’s definitely the case. And it’s been the case for so many different websites, especi especially like like in in industries which are not that close to IT and are even further away from IT security. All they need is they need to have a simple website to show what is going on within their organization, to promote like the daily dish or something like this. So so that’s definitely a good target for an attacker and definitely difficult for a user to understand. That something is wrong on this website.

Clicking images to prove you’re human isn’t an easy task for everyone

61
00:28:45,190 –> 00:29:01,870
Mattias Jadesköld: Yeah. And as a user is it’s kind of stressful because a lot of things is on stake because in the beginning they say if you don’t succeed in this capture, you’re not human. It’s like i if I if I can’t find all these mountains or traffic signs, then I’m then I’m a robot, obviously, or something.

62
00:29:01,870 –> 00:29:26,348
Erik Zalitis: The problem is also you can expect people to be the same, but they aren’t. I mean that’s to say some people may actually be old and they have problems understanding these things because they don’t they don’t have the skills. Some people may have some kind of mental deficiency, making it possible impossible for them to solve the captions. This is not the level of playing field.

63
00:29:26,348 –> 00:29:30,059
Patrick Schlapfer: Yeah, absolutely agree with that. Yeah.

64
00:29:30,059 –> 00:29:39,022
Mattias Jadesköld: about this clickfix campaign that was mentioned in the report, there was something about malicious code within a sound file. How how does that work?

65
00:29:39,022 –> 00:31:54,882
Patrick Schlapfer: Exactly. Well, if we look like quickly at the evolution of those click fix campaigns, it’s that basically what happens is that the attacker copies malicious code into the clip port of the user. Then the user wants to fulfill the capture, so they press the key combination like Windows R, Ctrl V and turn. That’s basically how they execute the malicious code, right? And in the beginning, The thread actors always use PowerShell because PowerShell is just so common. You execute PowerShell, you can supply an encoded command in base64, and then the whole device is infected. Now, of course, various different solutions which build detection in A-B systems actually kept up and improved their detection and are therefore able to block such an attack. But yeah, attackers usually find a way around it. So what the attackers did is instead of launching PowerShell, they decided to use MSHTA. And MSHTA is very often used to display those help messages if you press F1 in an older program. It it shows up and then you have a library of all kinds of different documentations. But what you can do in this case, you can also simply supply an HTML document which contains script code, which is then Executed on the host system because there is simply no sandbox. So what the thread actor did in this case is that they simply put in the command line MSHTA and then a link to a sound file. Now, this is not actually a sound file, but it is just using the extension of sound files. And the reason here is that if you look at the web gateway logs, which is something the Security Operations Center usually does. Then they will realize that okay, a sound file was downloaded to the specific device, but it doesn’t suspect anything malicious. Now, in reality, the sound file is actually a script file. In this case, HTML file contained with JavaScript. An MSHTA doesn’t really care what kind of file extension you’re using. So you can use like any kind of like

66
00:31:54,882 –> 00:32:36,790
Patrick Schlapfer: Sound file or picture or movie file, it simply executes and renders the files in HTML within this box. And that’s basically the a trick we see quite often used by thread actors, basically assigning either a wrong file extension or assigning double file extensions. So for example, if a user by default hides file extensions, then there tricked with a double extension to think that an executable file might be a PDF or that an executable file might be a Word document or something like this. So this is quite a common technique used by Chad Actor nowadays.

67
00:32:36,790 –> 00:32:46,892
Erik Zalitis: That seems old, doesn’t it? I mean the whole thing with double extensions is like ”I love you”, virus days. That’s still a thing you should. Yeah.

68
00:32:46,892 –> 00:33:50,135
Patrick Schlapfer: Yeah, it’s it’s super old. I mean like so many techniques are so super old and they still work nowadays, which is to me on the one hand quite surprising. But on the other hand, like we didn’t solve the simple security problems probably as an industry. And that’s that’s quite difficult. How do you teach a user to not click on a specific file? Like We usually get also the question, well, if you have this archive file which is distributed by an attacker, and within this archive file there’s a script file, such as like JavaScript or VPS. Why should a user open this specific file? Because it’s not a document, is it? Well, in the end, the user has no idea, right? The user has no clue whether this is an actual document or if this is a script file or or or if this is an executable file or whatever. A normal user doesn’t even know what a script file is. And that’s how we have to look at it. And that’s why we have to build like technical protections against such attacks.

69
00:33:50,135 –> 00:33:51,674
Mattias Jadesköld: Yeah.

Nothing new under the sun – hackers find new use for old attacks

70
00:33:51,674 –> 00:34:09,144
Erik Zalitis: This is kinda scary because nothing of this feels new. It feels like you’re using very old technology onto the user because I do believe that many of those health file files is that f really used anymore? Isn’t that kinda a legacy component?

71
00:34:09,144 –> 00:34:57,570
Patrick Schlapfer: That that is a really good question. And I so in new applications, if you press one, you’re usually redirected to a website, right? Yeah. I still imagine that there are quite a lot of older applications which do have this helper function implemented through MSHTA. but yeah, that’s that’s actually a really good question. I haven’t come across many of those, but certainly MSHTA is still part of the operating system, which makes it in in in some sense even more dangerous for an organization, because an organization might lose track of such an executable, and therefore they don’t track it anymore in their detections and then in their protection mechanisms and therefore open yet another hole and attack infection vector for threat actors.

72
00:34:57,570 –> 00:35:24,462
Erik Zalitis: was thinking about is it using the Trident engine? That’s like Internet Explorer. Could it be that old? I mean that’s a thing to just like thinking about because Windows such as it is has a lot of legacy code, stuff that was around in the nineteenth and the 2000s, such as it was. And that is not secure. And a lot of it is kind of abandoned but still for some reason works.

73
00:35:24,462 –> 00:36:37,670
Patrick Schlapfer: Totally, totally agree. I mean, if you remember, it’s it’s a long time ago, but to be honest, we’re still seeing them. Remember the equation editor exploits? Like where you had like a malicious RTS document, and then there was a a vulnerability within the Word’s equation editor and the thread actor was actually able to well, exploit this vulnerability and download and execute the file from a remote server. Now, this has been legacy code for a very long time. And this has been on Windows system for ages. And in the end, Microsoft actually got rid of this whole equation editor because they had a very new version in new office installations. But nevertheless, we still see attackers using this specific exploit and targeting all kinds of different users. I I believe myself that this equation editor is gone on most devices nowadays because that’s been like twenty seventeen actually. But for some reason they’re still using it. So probably there is still one or the other device which contains this equation editor and therefore is still vulnerable to this exploit.

From observing to protecting – how do you get there?

74
00:36:37,670 –> 00:36:45,314
Mattias Jadesköld: Right. And how how do I prevent these attacks from happen for me?

75
00:36:45,314 –> 00:38:41,698
Patrick Schlapfer: Well, to prevent such a click fix attacks is certainly not something that is easy, right? in the end well well, you’re on Linux, even though well if you’re around Linux you do have different distributions and you have like like T shortcuts and so on. In the end it’s it’s very difficult also for a user to understand. But nevertheless, I think this this whole concept of the social engineering technique should be part of like an awareness program where you tell the users how to behave. in the end, however, this doesn’t solve the problem, right? Awareness is just one aspect, but you have to have a technical solution to protect the users. So one thing I I can think of is that in most cases they use Windows R, which opens the runbox. Like a normal user in everyday work, they don’t use the runbox at all. So what you can do is you can use group policies, for example, to disable the runbox entirely. An alternative solution is that, well, if you have a secure browser, so so HP basically has this kind of isolation technology where we embed a browser within a micro VM, and there you can disable the clipboards from being used by the website. Because a normal website can usually simply write to the clip port if the user clicks a button. There is different permissions you can also set in an in a regular browser, but as far as I know, in most cases it is very difficult to determine from reading from the clipboard, which is very sensitive and can be restricted, to writing to the clipboard, which is often not possible to restrict by the normal user or in the normal browser. So there were various different approaches to protect from such an attack. And I think in the end it has to be a combination of all of those.

76
00:38:41,698 –> 00:38:45,644
Mattias Jadesköld: All right.

77
00:38:45,644 –> 00:38:48,682
Mattias Jadesköld: Any idea, Erkc? How to print this?

78
00:38:48,682 –> 00:39:37,964
Erik Zalitis: Yep, that’s the problem. Should you teach people not to do dumb dumb stuff? Should you lock their computers down? Depends on. I mean, when people are taught not to do stuff, the hackers kinda mutate the attacks. So they don’t look like what the people were taught not to do. And secondly of all, all those mechanisms also suffer the same fate. Basically put, everything looks good now, but the hackers always evolve the attack. Try something a little bit differently. It passes through whatever you lock down. That that’s a problem. It’s very hard. You can of course say don’t do stuff that feels wrong. If it feels like the gut feeling is like this is weird. Should I really click? Should I really really do this? If the website says click this and this combination, is that really a good thing to do? I I think that’s the b only thing you can do, basically.

79
00:39:37,964 –> 00:39:54,590
Mattias Jadesköld: Yeah. Right. So yeah, a lot of interesting topics that you can read more about in this report. And and that is public available, right, Patrick. So I can we can share this this the link to the report

80
00:39:54,590 –> 00:40:23,370
Patrick Schlapfer: Exactly. Yeah. The report is available on on our on our blog websites. There is also there are all kinds of other blog posts we usually publish around like different malware campaigns, but around all kinds of other security topics as well. If people are interested to have a look there as well. And there’s actually a new report coming, probably mid end September, which will be published pretty soon. So I’m actually doing the analysis at the moment for this specific report.

HP’s report – something you can count on coming out often

81
00:40:23,370 –> 00:40:26,434
Mattias Jadesköld: I thought this was an annual report, but no, okay.

82
00:40:26,434 –> 00:40:53,166
Patrick Schlapfer: No, it’s actually a report we do four times a year. right. So we usually try to cover like each quarter of the year. so we’re doing this for a couple of years now. So having the capability to actually look back, hey, how did everything like start like seven, eight years ago? And how does it look today? How did the thread landscape change? And there were definitely a few quite interesting changes, as I mentioned earlier in this talk.

83
00:40:53,166 –> 00:40:58,770
Mattias Jadesköld: But I hope this was not outdated information that we just gave.

84
00:40:58,770 –> 00:41:31,495
Patrick Schlapfer: No, no, no, no. No, no. Definitely not outdated. I I think like most of those, like most of those techniques are being used by thread actors for quite a long time. I mean what what you mentioned earlier is that thread actors adapt very, very quickly to smaller techniques. So they try to get around your protection mechanism. They try to trick their user into installing something. But in the end, over the long term, that the techniques and tactics stay more or less the same if we look at a higher level at it.

85
00:41:31,495 –> 00:41:40,758
Mattias Jadesköld: Yeah. Right. Is there anything you would like to add? what we miss?

86
00:41:40,758 –> 00:42:05,068
Patrick Schlapfer: I think we did quite cover quite a lot of different topics. Yeah. So doesn’t come anything specific to mind. just have a heads up when you’re seeing the next capture, if it’s a real one or if it’s a fake one. Don’t affect yourself with malware. Yeah. Don’t go and search for your lost crypto wallet with fake tools. yeah, stay safe out there.

87
00:42:05,068 –> 00:42:15,310
Mattias Jadesköld: Yes. Good. thank you so much, Patrick Schlapfer, that you for joining IT-säkerhetspodden.

88
00:42:15,310 –> 00:42:19,544
Patrick Schlapfer: Thank you so much. It’s been a very interesting discussion. Thank you for having me.

89
00:42:19,544 –> 00:42:22,544
Erik Zalitis: Thank you much.

(Denna transkription är automatiskt genererad och kan innehålla felhörningar)

Länkar – AI

• HP Wolf Security Threat Insights Report: June 2026

Felaktigheter

Inget att rapportera denna gång. Kommentera gärna om ni inte håller med om hittar fel i något vi sagt.

Inlägget #334 – Angripare tar till ”vibe hacking” dök först upp på IT-säkerhetspodden.

Avsnittet heter #100 – Säkerheten i HP SureClick
Det spelades in 2020-10-25 och lades ut 2020-11-15.
Deltagare: Erik Zalitis och Mattias Jadesköld
Show notes skrivna av Erik Zalitis.

Vi är ju normalt inte en ”videopodd”, så detta har varit en utmaning för oss. Jag har jobbat med ljudet och Mattias med bilden. Så här vårt första videoavsnitt där vi båda deltar. Vi kan inte lagra stora filer på Libsyn där vi skickar ut våra poddar, så avsnittet med video finns på YouTube och det med ljud finns där poddar finns (eller på denna sida).

HPs dator har ett antal säkerhetsfunktioner och vi har valt att gå igenom dem en och en för att se vad de klarar och var de inte räcker hela vägen.

Så till HP SureClick. Det lovar att den kan göra att din webbläsarsession körs i ett säkert läge, eller en ”detonationskammare” som jag kallar det. Effekten av en attack är att webbläsaren inte öppnar en väg in till resten av datorn, vilket annars kan leda till att ransomware får fotfäste, kryptobrytare får köra eller datorn kan tas över. När du stänger webbläsaren, raderas allt i den, vilket också avbryter all körande skadlig kod. Men allt du gör i webbläsaren i sig är inte säkert om någon tar över den och det du håller på med. Vilket kan vara banktransaktioner eller sessioner mot andra servrar eller ditt tillgång till ditt Facebook-konto.

Dessutom fungerar SureClick enbart med den inbyggda säkra webbläsaren som är en Chromium-klon vilken HP själva uppdaterar… ibland… Den äldre versionen av HP Sureclick lovade uppdateringar varje halvår. Detta är sällan och mycket oroande. När vi började testa, kunder Mattias konstatera att versionen av Chromium som du måste använda var 10 versioner efter den senaste som släppts. Chromium är ju också vad ”Google Chrome” är byggt på och den webbläsaren är troligen den mest eftertraktade att hacka för cyberbrottslingar.

Mitt under testet kom en ny version som lovar fler uppdateringar, men också tar bort stödet för alla andra webbläsare än den säkra.

Rutan ovan finns i tillägget som är installerat i riktiga Google Chrome, som du kanske laddar ner och installerar på datorn, och det lovar dig säkerhet… Men det är inte sant, du måste klicka på ”Open new Secure Browser window” för att den säkra webbläsaren ska starta. Direkt vilseledande och garanterat att få folk att tro att de är säkra när så inte är fallet. Katastrofalt dåligt!

Borde man överhuvudtaget tillåta att köra saker utanför denna SureClick-funktion? Jag påpekar i avsnittet dumheten med ett säkerhetsskydd som man slår av och på hela tiden beroende på vad man gör.

Mattias valde att ställa upp SureClick mot det 15 vanligaste säkerhetshoten just nu. Vi går igenom dem steg för steg och snackar om de som är relevanta för diskussionen. Det är värt att notera, som jag skrev i början, att SureClick bara är EN av många funktioner som skyddar maskinen. Vi kommer givetvis ställa upp de andra säkerhetsfunktionerna mot hoten. Så i sin helhet kan datorn hantera fler hot än vad SureClick i sig själv klarar av. Men denna lök ska ju skalas, så det är vad vi gör i detta avsnitt.

Inlägget Show Notes för #100 – Säkerheten i HP SureClick dök först upp på IT-säkerhetspodden.

Episode: #54 MafiaBoy Michael Calce
Published: 2019-12-01.
Participants: Mattias Jadesköld, Erik Zalitis och Michael Calce
The text was written by and summarized by Erik Zalitis.

While you listen – MafiaBoy Michael Calce

When the curious boy Michael Calce, who later got known as ”Mafiaboy” on the Internet, got his first computer as a six year old, he probably didn’t know that in a few years he would have created the first BotNet taking down some of the most vital web sites at the time. They were Yahoo, CNN, eBay, Amazon and Dell.

– ”They are here”, said his father one day over the phone. Michael´s childhood home in  Quebec, Canada was soon filled with FBI agents.

We talk with MafiaBoy about his early years, his change from black hat to white hat and the global threats of today. He also shares a ”Matrix secret” never told at any other place.

Transcript

Mattias Jadesköld (00:08.033)
So today another international IT-security podcast, an English episode because we have Michael Calce here with us, or probably more known as Mafia Boy, a former computer hacker who’s launched several DDOS attacks in two thousand against internet’s biggest sites at that time. Welcome.

Michael Calce (00:30.562)
Thank you for having me.

Mattias Jadesköld (00:32.334)
So, okay you have hacked CNN, eBay, Yahoo and Amazon, but now you’re a security specialist and author as well.

Michael Calce (00:41.026)
Yes, I since the attacks I devoted my life to raising awareness around this topic and I authored a book that discusses my story and I use sort of that platform to to help companies, individuals and governments.

He learned about hackers and hacking at a very early age

Mattias Jadesköld (00:57.24)
All right. But okay, let’s go back in time a bit. Can you please tell me how everything started?

Michael Calce (01:03.146)
Sure. My journey started out at a really young age. I was six years old when I got my first computer and I was nine years old when I accessed the internet for the first time. And I was quickly exposed to this community of hackers. I found it on my journey when I was looking for pirated software. And as it turns out, hackers ran the distribution of this pirated software.

So I wanted to gain quicker access to it and I decided at this point that I should become a hacker. All right. And I joined on an IRC network of EFnet, which is Internet Relay Chat, and there was tens of thousands of hackers and I devoted my time to becoming the number one hacker.

Mattias Jadesköld (01:47.446)
Yeah. But how how how was your first experience when you received your computer? You you I I read that you received it at your father’s house and when you opened it up and how it was like a new world for you or something.

Michael Calce (01:59.458)
What an amazing feeling. Honestly, I remember like it was like yesterday. I my dad put the box in front of me and he said, Here you figure it out. And I couldn’t wait. I plugged it in, powered it on. I heard all the beeping noises and churning sounds and after it booted in the system just sat there and it was waiting for me to input a command. And that’s when I realized at that very moment I am the master of this device.

How he came into the dark side of the Internet

Mattias Jadesköld (02:26.198)
All right. But h how come you came into the the dark side, so to speak?

Michael Calce (02:31.87)
Yeah, that was not intentional or planned, but at a certain point I wanted to buy video games and pieces of software for my system, and I wasn’t sure if my dad was gonna give me his credit card, especially since a lot of video games and software were expensive. So I needed to find a way to illegally download this stuff, which was known as ”warez” back in the day, which was pirated software. And

I couldn’t I found it but I couldn’t get immediate access to it. I would ask the automated bot to give me the program that I wanted or the game that I wanted, but it would put me in a huge queue order and I was on a 14.400 modem. So I wasn’t gonna get this this game or software that I wanted for a very long time. Then when I realized that hackers were the ones distributing it, that’s when I decided I’m gonna go into the dark side.

Mattias Jadesköld (03:25.738)
Alright. Yeah, y I I’ve heard that you you also used social engineering only as like ten years old kid who who described yourself as an administrator of the American online community and can you nine years old.

Michael Calce (03:44.556)
Yeah, I was actually nine.

Big difference there. Of course. So when I was on America online (AOL) for the first time, it was actually given to me as a 30 day free trial period. And again, same issue, wasn’t sure if my dad was going to give me his credit card to stay online and reinstate the AOL internet service. So I needed to find a way to continue online without paying for it. That’s when I had access to a program known as AOHELL.

Which granted me the ability to simply appear as an administrator to other AOL users. Because the administrator are administrators on America Online, their name was in a different color.

Erik Zalitis (04:28.898)
You were also w capable to throw people off AOL I mean.

Michael Calce (04:33.592)
Right, in the same program there was the ability to punt a user which would basically sever their internet connection to AOL. And I think that was my first actual interest in hacking and kind of having that power and capability. So I needed to find a way to stay online and I use this administrative capability to fool other users, convincing them that I was an administrator to give me their login and password.

Mattias Jadesköld (04:48.748)
Right.

Mattias Jadesköld (05:03.36)
Okay. And but you are most f famous for hacking, one of the major sites as that at that time, as I started with. How did you do that?

How mafiaboy became a member of a Russian hacker group at a very young age

Michael Calce (05:16.59)
So in the late nineties when I was a part of a really well known elite Russian hacker group that went by the name of TNT Force, when I joined them I became under fire by denial of service attacks by other hackers that were trying to take out me and other members.

Mattias Jadesköld (05:35.559)
The TNT group, they recruited you, right.

Michael Calce (05:38.648)
Yeah, they recruited me at the age of twelve.

Erik Zalitis (05:41.262)
Did they know that?

Michael Calce (05:43.078)
No, nobody knew anybody’s age online. Right. to be fair, even in the private channel of TNT, like two of the main members were literally from Russia and I didn’t understand half of the things that they were saying ’cause it was broken English and r mixed with Russian and so it was an interesting experience, but I had access to some of the brightest minds in the world in terms of technology.

Mattias Jadesköld (06:10.66)
Yeah, and and about the dis distributed…

Michael Calce (06:13.848)
So when I joined them, I I again I became the focus fire of the other hacker groups and other hackers. And denial of service was really potent style of attack used at this point in time. So I decided I decided to start using D DOS attacks against my competition. Now the problem was when I wanted to launch a large scale attack, nobody nobody was able to do so because we had limited resources.

And and our actual physical computer was, you know, a Pentium one thirty three or something similar. so I needed to find a way and create a concept that would solve this problem. That’s when I decided to hack into thirty thousand plus networks and combine them all into one network and created a massive, the probably the world’s first ever denial of service botnet. So no one had ever seen this.

Mattias Jadesköld (07:08.366)
Okay, so you actually you actually planted the malicious code y by yourself? Alright, okay.

Michael Calce (07:14.261)
Absolutely.

Erik Zalitis (07:15.975)
Did you write the program yourself?

Michael Calce (07:17.942)
Yeah, so I used a variation of several programs. The main one that I used for the majority of my attacks were my own creation and I used a co author which went by the name of Sinkhole, who was a a hacker from another group that wasn’t a rival to us, but and he was a very close friend of mine. And I also sampled some other programs that were being created in the space. There was one known as Stacheldracht, which means ”barbed wire” in German.

yeah. so I’ve sampled with other people’s technology that and software that they were creating, but the program that I created was the most effective.

Mattias Jadesköld (07:59.178)
All right. So h how did you have time for all this to to program? W I mean you w went to school and did some sports and okay.

Michael Calce (08:06.892)
I didn’t sleep very much. Yeah. it was interesting ’cause I still maintained somewhat of a social life. Like I balanced it out. I played soccer, I played basketball and I hacked all night, every night.

Mattias Jadesköld (08:25.218)
Okay. And and what w what sites did you did you hack? Yeah, I mentioned a f some of them.

Bringing down the Internet – but not doing it silently enough – what Mafiaboy learned the hard way

Michael Calce (08:31.276)
Yeah, Yahoo, eBay, CNN, Dell, Amazon.

Mattias Jadesköld (08:36.076)
And and no one was on to you like you you didn’t at the beginning.

Michael Calce (08:40.206)
I was the the you know, I fell victim to my own ego at this point. Right. I was young, I was fifteen years old, you know, and I started boasting to other hackers in the community that I was the one responsible for these attacks and the FBI started to catch up on that.

Erik Zalitis (09:00.042)
by the time wasn’t it so that there were very little protection on sites for DDoS attacks?

Michael Calce (09:07.252)
Absolutely. It was more of a a lot of it came down to certain packet types. There was packet filters in place. And it was also when you look at a giant like Yahoo, the amount of bandwidth that they had available to them in comparison to everyone else was literally scary. So you needed massive amounts of bandwidth. But even to this day there’s you know, I mean there’s obviously Cloudflare, you have solutions and stuff, but

Mattias Jadesköld (09:30.187)
Yeah.

Michael Calce (09:36.654)
The denial of Service will always remain potent.

Mattias Jadesköld (09:39.404)
Yeah. But when you saw the news, as a fifteen year old kid, you saw the news that these sites were hacked and there there was a cyber attack going on, what did you think? Is this me? Did you know that it was you or

Michael Calce (09:54.17)
I knew it was me, trust me. And pretty much crapped my pants at that point. you know, being a fifteen year old kid and sitting on a couch and watching live TV and watching the president of the United States, well sorry, the former president of the United States, Bill Clinton, go live on TV and convene the first ever cybersecurity summit based on what you did, that’s a lot to to digest.

Mattias Jadesköld (10:20.754)
yes. Yeah. It’s more like a it’s big difference between like a normal fifteen year old.

Michael Calce (10:27.638)
Yeah, some of my friends would have fun on Halloween, throwing an egg at a house or a toilet paper in a tree. And you know, I was shutting down major ecommerce sites.

A bad call – the news you don’t want

Mattias Jadesköld (10:37.326)
And I read that you were at a friend’s house watching movie and your father called like 3 a.m. in the morning. Yeah? What happened?

Michael Calce (10:45.166)
You have very good intel.

So when they actually came to place the arrest, I don’t know if it was strategy on their part or they just made a mistake because I know they were monitoring my house.

Mattias Jadesköld (10:57.966)
How how do you need all that?

Michael Calce (10:59.65)
Because so there’s a provider that provides all the internet and well, the majority of the internet in the TV in my area, which was known as Bell. Like based after Alexander Graham Bell who created the telephone. So that’s our basically they have pretty much a monopoly. There’s only one other company that competes with them. Anyways, they were always at the end of my street in plain view, I could see them and they were there every day.

all night and the truth is is like if your internet or your T V went down in that in that time frame, like they they would take like a week to come fix it. And here they were every single day, every night, in front of my house. So I mean it was it was pretty obvious.

Mattias Jadesköld (11:45.206)
Yeah.

Erik Zalitis (11:45.834)
It’s like they say, it’s not paranoia if they’re really out to get you.

Michael Calce (11:49.614)
That’s that’s that’s exactly accurate.

Mattias Jadesköld (11:53.204)
Okay, so b back to that call during night, what did your father tell you?

Michael Calce (11:57.718)
So it was a Friday night, which was strategic, which I’ll get into in a little bit. my father called me, it was approximately three AM and he said, – ”Michael, they’re here for you” and as you know, I asked who’s there, I knew exactly just from the tone of his voice what he meant. And of course the FBI and the RCMP, which is the Royal Canadian Mounted Police, were raiding my house and taking every piece of electronic and they requested that I go to the end of my friend’s street.

And wait to be picked up to be arrested.

Mattias Jadesköld (12:30.09)
Okay, so you gotta ride home at least.

Michael Calce (12:32.682)
I gotta ride home waiting in the dark at three three fifteen, three thirty AM at this point.

Mattias Jadesköld (12:38.978)
Your parents reacted to that? Did didn’t they suspect anything or… No?

Michael Calce (12:43.178)
I had spoken to my father prior and I let him know that I was the one responsible for these attacks, which was not an easy conversation, but I needed to prepare and he was shocked but at the same time was responsive and said we need to seek legal counsel so we went to see a lawyer friend of his and we started to prepare ourselves.

A bad day in court for Michael Calce

Mattias Jadesköld (13:08.266)
Okay. And you went to court?

Michael Calce (13:10.88)
I did. After the arrest took place, which was about four and a half months after the attacks took place in February of 2000.

Mattias Jadesköld (13:20.206)
So were you in custody for four months then?

Michael Calce (13:22.644)
No no, I mean that it took them four and a half months to actually from the time of the attack that took place to actually arresting me, to place the arrest. So after they arrested me so they arrested me on a Friday because they wanted me ’cause you can’t see a judge until Monday. So it was strategic on their end that they wanted me to stay inside lock up and I guess get a taste of

Mattias Jadesköld (13:30.893)
okay.

Mattias Jadesköld (13:43.758)
Yeah.

Michael Calce (13:50.294)
what prison would be like over the weekend.

Mattias Jadesköld (13:53.417)
okay. Did that ev affect you or anything during that weekend? No.

A story just for us, Mafiaboy tells us something special

Michael Calce (13:57.794)
Not work. in fact I’m gonna give you a interesting piece of information here that I don’t talk about too often, but when they arrested me, they took me to their head office in the downtown area of Montreal, and this was literally like right out of the scene of the Matrix. Okay? Okay. I was in a waiting room with just a desk and a chair, and an agent came in the room and took a stack of folders

And slapped it on the desk and he said, This is what we got on you. So you’re either gonna start talking or you’re gonna go to jail for a very long time. And I remember just giving him the finger. But it was literally like right out of the Matrix when they first pick up Neo.

Mattias Jadesköld (14:48.43)
All right. And then you were sentenced to eight months in…

A verdict? A slap on the wrist

Michael Calce (14:54.004)
Yeah, so the trial lasted a year and eight months. And I pleaded guilty to over fifty five accusations and I received a sentence of eight months in a group home facility and a two hundred fifty dollar fine.

Mattias Jadesköld (15:08.142)
Two hundred and fifty. It’s not that much, but because I read that that it was all you did the damage for over one billion dollars. Two billion dollars. Two billion dollars. Okay.

Michael Calce (15:16.59)
But that was the maximum penalty per Canadian law to a juvenile. Huh? So I got lucky in that sense for sure. If I was over 18, those companies would have been able to sue me civilly and then I’d be in debt for the rest of my life.

Mattias Jadesköld (15:20.342)
Okay, so that’s not

Mattias Jadesköld (15:31.339)
yeah. But I guess during that time people didn’t know so much about these type of crimes. Even the FBI or something or

Michael Calce (15:38.41)
Laws were literally written and passed based on the attacks that I launched. Yeah.

Mattias Jadesköld (15:42.584)
Yeah. But somewhere during this sentence you became more of a s some sort of white hat, so to speak.

On the Internet, is crime victimless? How Mafiaboy came back to the light side

Michael Calce (15:50.412)
Yeah, I mean through the process and through the transition, like here’s the thing I’m not actually a bad person. I was never a bad person. A a hacker at this point in time was more of an explorer, exploring uncharted seas. Now it’s very easy to go down the wrong path because also on a computer, you don’t really get a sense of what’s right or wrong. Yeah. I feel like if you do a physical crime

There’s more of an an immediate sense of remorse, whereas online you push a keyboard and you push a button, you don’t really like feel what’s happening. so you don’t get that immediate response, but I wanted to do good with my life and I realized that I wanted to raise awareness and I wanted to educate companies, individuals, governments in every way that I possibly can.

Mattias Jadesköld (16:43.35)
Yeah. Yeah, it it feels more like you started your hacking more of a curiosity or maybe it’s communicate with others in tech technology.

Michael Calce (16:54.71)
I just like puzzles and problem solving and that’s very parallel to what hacking was. Yeah. Understanding assembly code and understanding stack and memory address allocation and kind of putting all these pieces of the puzzle together. Yeah. Was was what I really enjoyed.

Mattias Jadesköld (17:11.694)
Okay, so we take it to present time, what you do right now.

Michael Calce (17:16.396)
So I am the president of Optimal Secure, which is a penetration testing firm. I also have an award winning book, which is ”Mafia Boy, How I Cracked the Internet and Why It’s Still Broken”. Yeah. I

Mattias Jadesköld (17:29.656)
2008 or 2009?

Michael Calce (17:31.906)
The book? Yeah. Yeah. Two thousand eight. my god, is it ever? I mean basic rudimentary like protocols haven’t changed, right? Like TCP/IP, like the stack, like it’s all the same stuff. The fundamentals are still there. We’re just tacking on security as an additional layer now, but it’s like building a house, right? If your foundation is not sound, then it doesn’t matter how pretty the house is on top of it.

Mattias Jadesköld (17:34.378)
Is it still broken internet?

Human being, the biggest risk according to Calce

Mattias Jadesköld (18:01.25)
So when you’re doing this sic security risks assessments and and things like that, w what what are the what are the common things you you find as a vulnerability t in the companies? Human beings.

Michael Calce (18:12.504)
Human beings. Yeah. Yeah. I put human beings right at the top. there’s a severe lack of education in the space. Companies are not doing enough to put their employees through cyber resilience training. And human beings are just gullible. So it’s very easy to manipulate a human to do what you want.

Mattias Jadesköld (18:30.36)
Yeah.

The pentesting role

Mattias Jadesköld (18:35.672)
Can you give us an example of how how you

Michael Calce (18:38.274)
I mean look obviously the traditional, you know, spearheaded fishing vectors have existed for a while, but I go above and beyond that. I like physical type of breaches as well and don’t just rely on remote technology. Meaning I’ll gain physical access to a building by abusing a supposed level of authority over someone, by misrepresenting who I am, whether I’m from a

electrical company or I’m a VP from another region and give me access to this now. And people don’t question authority.

Erik Zalitis (19:14.85)
Yeah. I think it was kinda cool when you told me you had a uniform from a Canadian electrical company.

Michael Calce (19:22.946)
Yes. I mean dress up is part of the environment and you need to act apart and look the part. It’s it’s it’s a combined tactic.

Mattias Jadesköld (19:35.454)
So that’s one part you actually do right now. Dress up when you’re doing vulnerability…

Michael Calce (19:42.954)
Look, obviously I cater to what my clients needs are. Yeah. It really depends on the type of testing that they want because I offer a wide array of services. Yeah. But absolutely in a lot of instances they want me to test the physical access to the building as well.

Mattias Jadesköld (20:01.09)
How how often do you succeed breaching the the companies? One hundred percent. Okay. Yeah. All right. So if we look on a global level, what what are the biggest risks c right now? Because it’s a bit different between fifteen year old kid and and today we have

Michael Calce (20:04.662)
One hundred percent.

Michael Calce (20:17.623)
Yeah.

So the times have changed and we’ve incorporated technology in more and more of our lives. The government uses more and more technology as well. I think the biggest issue right now is probably in my mind, nation state sponsored attacks. And and doing damage to critical infrastructure. So we saw an attack a few years ago that took place against the Ukrainian power grid. So just imagine, you know, your your power is taken out because of a hacker.

Solving the crisis – no clear answer on how to do this

Mattias Jadesköld (20:50.786)
Yeah. And h how how can we prevent this? How can we face this?

Michael Calce (20:56.554)
There isn’t one easy answer. It’s a collective that we need to all come together. Governments, enterprises, people, we need to view security as a holistic approach. Yeah. I think overall people don’t understand the importance of security. I feel like some governments lack in security. And I think that we need to put security at the very top because if you look at

How technology has taken over our lives. It is literally an extension of our fingertips. Babies are born and by the age of three they have a tablet in their hand. Yeah. This is the world that we live in. And the fact that nobody bothers to read up on security or basic measures, I think that’s a big problem.

Mattias Jadesköld (21:43.618)
But do you think we are on the right track, that people are getting more and more aware of the…

Michael Calce (21:49.004)
Not really. I’d like to think so, I’m hopeful that we can get to that place, but based on my experience, I feel like still people might hear about it or they might read about it, but they’re like, ”Eh, I’m not a target. Yeah. Nobody’s focusing on me”. When in reality, like that’s not how things work. Hackers are mass scanning, just having an IP address you’re at risk. Just having a name and an identification, you’re at risk.

Mattias Jadesköld (22:17.1)
And you are a target. Yeah. Even though you don’t even if I see myself I only have a computer, I don’t have any…

Michael Calce (22:18.465)
Everyone is a target.

Michael Calce (22:25.656)
Doesn’t matter the data, you have a name, you have I don’t know what they use here in Sweden, but we have social insurance numbers. I’m sure you have you know a number, a birth number associated to you. I could steal that information, go buy a car in your name, make fake identifications and there’s just a plethora of of how you could manipulate that situation. So many ways.

Can can Zero trust networking help?

Erik Zalitis (22:49.359)
But but do you think do you think that things like s zero trust networks and stuff, is that something that could mitigate the situation and make it better?

Michael Calce (22:59.766)
Look, there’s a lot of hopeful ideas that I’m that I’m looking towards. I think that there’s definitely steps in the right direction that are being made. But I would almost like to see some governments intervene and pass more legislation. For instance, there’s a lot of vendors and creators of technology that release things that are that have known vulnerabilities in them, but they’re still allowed to do so because their their mentality is rushed to market.

And you’re just a consumer, you’re buying the product, right? You want the newest iPhone, you want the newest gadget. Or smart fridge, sure, why not? people are sold on this there’s like a panic and hysteria that people like they freak out if they don’t get the latest gadget. And the reality is a lot of these vendors and creators of these products, they will release these products knowing that there is vulnerabilities in them and they and they they’ll just say, okay.

Mattias Jadesköld (23:33.741)
Or fridge.

Michael Calce (23:58.05)
We’ll release a vendor patch for that later. This mentality needs to stop. Security should be at number one and you shouldn’t be so I would like to see some form of governance that you have to meet a certain criteria or compliance before you’re allowed to release a product.

Mattias Jadesköld (24:15.082)
Like a s smart fridge or something. Yeah. Yeah, you told me about your friend in the in the medical care who who was worried about pacemakers. Can you explain?

Michael Calce (24:17.134)
Smart fridge, smart TV, everything is getting hacked.

Hacking can be lethal

Michael Calce (24:27.266)
Yes.

So, I mean th there’s there’s a lot of concepts around like the medical devices and what ifs and and my friend wanted to put that to the test and was able to to breach over a million pacemakers and for example incorporate ransomware on them, meaning you would need to pay a fee in Bitcoin or your heart stops ticking.

Mattias Jadesköld (24:51.144)
Okay. Well that’s a bit scary.

Michael Calce (24:54.452)
I know. It goes beyond that. They’re they’re making devices in hospitals now where a doctor can remotely administer drugs to you. That device has already been hacked. So now you can purposely make the person overdose on drugs remotely.

Mattias Jadesköld (25:04.653)
Oof.

So what’s the plan right now, Michael?

Mattias Jadesköld (25:11.382)
Okay, before we end I’d like to know a bit b what what’s going on next. You gonna stay here in Sweden until over the weekend and so on? Yeah.

Michael Calce (25:18.112)
I’m here over the weekend. I’m excited. I’ve been loving my stay here so far. It’s a gorgeous city and it reminds me a lot of Canada. The people are very friendly here. seem like some friendly type of Canadian type of mentality. Gorgeous city. I’m I’m looking forward to exploring it and I’m I’m very intrigued because it seems like there’s a lot of tech offerings here as well and I’m I’m curious to to look around. Right.

Mattias Jadesköld (25:44.152)
So anything anything anything new from your company that’s going on or

Michael Calce (25:49.086)
Look, I mean I’ve I’ve assumed the role of chairman for the security advisory board for HP and I think that that’s a critical role and a critical position I have to help shape you know a Fortune 50 company worldwide and and what their goal and their mission is and and help them achieve that. So that’s what I’m working on right now.

Mattias Jadesköld (26:09.046)
Right. Okay. Thank you so much.

Michael Calce (26:11.822)
Thank you very much for having me. I appreciate it.

(The transcript was automatically generated and may contain errors)

An episode of Flashback, tracks from the past based on this interview

Länkar – MafiaBoy Michael Calce

• Wikipedia about Michael Calce
• An episode of Flashback, tracks from the past based on this interview

Errors and omission

Please report any errors or omissions to us at info@itsakerhetspodden.se.

Inlägget #54 MafiaBoy Michael Calce dök först upp på IT-säkerhetspodden.