There's No Way Into This Tech Company's Server Room ... Except Through the Sewer💧Episode 166: Maxie

0:00 The Cardiff giants is an interesting story.

0:02 In the Bible, Genesis 6:4, it says,

0:05 "There were giants on the earth in those days,

0:07 and they mated with people and created mighty men

0:10 of renown." This guy named George Hall was like,

0:13 "Wow, there were giants on earth." But the reverend

0:16 argued with him and said, "No, no, no.

0:17 There were never giants here." But George was like, "No, no, the Bible says so.

0:21 There's got to be a way to prove it." But George could not prove it, of course.

0:25 So, he decided to fake it.

0:27 He went to a quarry and dug up a huge block of gypsum.

0:30 Then hired some stone cutters to make the block into the shape of a giant man.

0:35 They created a rough statue of a man that was 10 ft 4 in tall.

0:39 Then George stained it with acid to make it look old and put it

0:42 on a train and took it to his cousin's farm in Cardiff, New York.

0:47 And late at night, he buried it on his cousin's farm.

0:50 A year later, his cousin went to dig a well

0:53 and hired a crew to come out and dig the hole.

0:56 and they ran into this giant in their dig.

0:59 And one of the workers immediately shouted,

1:01 "This must be an ancient burial site." And so they dug up the giant.

1:05 And the word spread that they found a buried giant.

1:10 People from all over flocked to the farm to take a look.

1:13 It was quite surprising to see a petrified giant of a man.

1:18 A lot of people believed it was a petrified human.

1:20 The Bible says so.

1:21 See?

1:22 But some thought it was just a statue.

1:23 [music] But pretty quickly,

1:25 George's cousin realized how valuable this thing was.

1:27 So, he put a tent over it and started

1:29 charging people 50 cents to come in and see it.

1:33 500 people came a day [music] to see this amazing giant.

1:38 The whole town started to profit from it.

1:40 Restaurants were filling up.

1:41 Hotels [music] were booked.

1:42 And that's when PT Barnum came.

1:44 And he was like, "Sir, I will give you $50,000 for that giant.

1:48 What do you say?" The fireman was like,

1:49 "No way." So PT Barnum hired someone to make a waxed copy of it.

1:55 And Barnum displayed this unauthorized copy at his circus and claimed it was

1:59 the actual giant [music] and charged people to come see his fake replica.

2:04 A year later, George Hall came out and said this whole thing was a hoax,

2:07 that he's the one who buried it there.

2:09 But while it didn't prove that giants roam the earth,

2:12 it did make his cousin pretty wealthy.

2:15 And that's how scammers would get you in the 1860s.

2:24 These are true stories from the dark side of the internet.

2:30 [music] I'm Jack Reider.

2:33 This is Darknet Diaries.

2:36 [music] [music] I want you to meet Maxi.

2:51 Uh, my name is Maxi Reynolds.

2:54 She grew up in Scotland and had an itch for adventure when she was young.

2:57 She knew she wasn't fit for a sort of sit down,

2:59 do a lot of paperwork, office type job.

3:01 No, her head was always up in class, looking out the window,

3:05 dreaming of far away lands that she could visit.

3:07 I left home at a really early age, about 15,

3:10 and I had no idea what I was going to do, what I wanted to do.

3:15 And so I tried everything and I was ending up, you know,

3:18 working in bars and as a cleaner and all

3:20 these sorts of things and I just thought,

3:21 no, this isn't for me and I want a job where I can travel and see the, you know,

3:26 outside of Scotland.

3:27 So I went to a university in England,

3:32 which is somewhat retro being a Scottish person,

3:36 and I got a degree in underwater robotics.

3:40 She was hoping this degree was her ticket to travel.

3:43 maybe if you're going to be operating underwater vehicles,

3:46 you'll get to go to some pretty far away places.

3:48 So, she started applying to every company

3:50 she knew that used these remote operating vehicles.

3:53 And I couldn't get a job.

3:54 And it was because I was female.

3:57 The reason why this was a problem is because sometimes she'd have to go out

3:59 to sea in small vessels or be stationed on some kind of platform at sea,

4:03 which also had small living quarters.

4:05 And the problem was that these companies required men and women

4:08 to have separate cabins and they simply couldn't accommodate her because

4:11 a lot of these cabins had four beds in them and they

4:13 didn't have any single bed cabins that she could be in.

4:16 And there just wasn't enough women to fill up a sleeping cabin.

4:19 So she just didn't get the job.

4:21 I was told this same story over and over.

4:24 But that didn't stop her.

4:25 She kept applying at places and eventually

4:28 a Norwegian company finally said yes to her.

4:30 finally got a Norwegian company to accept me and they said,

4:33 "If you get your private pilot's license, we will take you on." So,

4:38 I went to a bank in Scotland and asked

4:40 for a career development loan and I got my private pilot's license.

4:45 Well, now this pilot is different than ROV pilot.

4:47 This is air.

4:48 Yes.

4:48 This is a small.

4:50 Yes.

4:50 So, I can fly a Cessna although I haven't in America.

4:52 I can do that.

4:54 And so, they it was supposed to be quite similar.

4:56 And then I called the company back and said, "Hey,

4:59 like I've got this." and it took it takes months.

5:01 So, and I was getting further and further into debt.

5:04 So, I um called them back and said, "Hey,

5:07 I've got this." And there had been this change of management and they were like,

5:10 "It's not actually we don't know why they said that.

5:13 It's not a private pilot's license you need for a plane.

5:15 It's we're we're more like as an ROV pilot.

5:18 It's closer to a helicopter." So, I changed my name.

5:23 I went back to the bank in Scotland,

5:25 got another career development loan and went

5:27 back and got my PPL for helicopters.

5:30 Then I went back to them and said, "Okay, I've got this, but listen,

5:34 like no more surprises and can I have a job now?" And they

5:38 took me on and it was it was sort of life-changing [music] for me.

5:42 This job required her to travel a lot.

5:44 North America, South America, Europe, Asia.

5:46 She got to travel the whole world [music] while

5:48 working as an underwater ROV pilot and sometimes flying helicopters.

5:52 So [music] I lived in Venezuela for a while.

5:55 I lived in Trinidad.

5:57 I have been to sort of everywhere [music] from Nigeria to Australia.

6:02 A lot of coastlines.

6:03 So I've seen a seen a lot of water.

6:05 While she was doing this work,

6:06 she started getting more [music] fascinated with it.

6:09 Computers became her passion.

6:11 She was enrolled in remote learning courses and was

6:13 able to get a degree in computer science.

6:15 Then she took a month off work and landed in Los Angeles,

6:18 California, just to take a break for a while.

6:20 But she fell in love with LA.

6:22 And while there, she started going to a gym to exercise and work out.

6:25 One of the people that I was training with in the gym was a stunt man.

6:29 And I was I sort of begged him to please like,

6:32 let me hang out with you, let me be cool, too.

6:35 So, um, eventually he sort of he got me some training

6:40 in stunts and he actually got me one of my first jobs.

6:44 She was in a few independent films, did a few stunts for them.

6:47 She got an opportunity to be in House of Cards,

6:50 and she did a stunt for them, but they decided not to use it for some reason.

6:53 While that was cool, it was also short-lived because while it's exciting,

6:57 she didn't see it as a long-term career.

6:59 I studied quantum computing, and it was really difficult.

7:03 It was it was it was extremely difficult for my feeble mind,

7:08 but it was really enjoyable, and I I loved it.

7:11 This turned her attention to new technologies and companies.

7:14 At some point, she got a job for a company in Australia and moved there.

7:19 My first entry point into both social engineering really and pentesting

7:24 was in Australia and I worked for a big company down there.

7:26 They gave me a shot on their graduation team for for cyber security.

7:31 This company had penetration testers,

7:33 people who try to break into a building or a network to test the security of it.

7:38 She got to watch one of these pen

7:39 testers work by monitoring their activity through cameras.

7:43 And I was witnessing a a pen test but with this social engineering component.

7:50 And it was a guy.

7:51 He was a he was a really good hacker.

7:54 And he had gone into the network of one of our targets and he

7:58 was opening all of the security doors and automated doors for one of the team,

8:03 the cyber security team.

8:04 And they were just walking through and they were filming the whole thing.

8:07 and you know it was being broadcast live back to us and it was amazing and I was

8:11 thinking okay this is a good job this is the kind of job that I would like to do

8:17 being a physical penetration tester seemed like just

8:20 the thing for Maxi breaking into a building

8:22 acting like a spy that seemed really fun she asked if she could do that and

8:27 they were like well your luck is in because we have to test

8:32 them without these technical capabilities so we're just doing a physical pen

8:38 [music] would you like to be involved?

8:38 And I jumped at the chance.

8:40 So they gave her an assignment which was to try to get

8:43 into a company and film what they were working on inside it.

8:47 And to start figuring out how to get in, penetration testers often use OSENT,

8:51 which is just gathering data on a target through open public searches online.

8:56 So she does a little OSENT and starts learning about the company more.

8:59 They had some very interesting IP.

9:03 They were a transport company and they were building some unique

9:07 uh buses and large transport vehicles within this um whole complex.

9:14 So my job was to get into there past reception, past all security,

9:20 get in and look at all of the assets and the IP.

9:25 And I didn't need to, you know,

9:27 hack any computers or even plug into any computers.

9:31 It was it was simply to get in and to essentially have a look around.

9:37 How fun, right?

9:38 Can you get into this factory, take a few photos of what they're building,

9:41 and get out without them knowing you're a spy?

9:44 As she starts learning more about this company,

9:46 she found out that they had some big connections with Sweden,

9:49 as in some of their offices were located in Sweden.

9:53 If you squint your eyes and you were very far away from me,

9:56 I could probably pass as Swedish.

10:00 So, I had decided and no one stopped me.

10:03 I'd like to point out I decided that I was g

10:06 I was going to um pretext or or present myself as like

10:10 a Swedish ambassador for this for this company and I had

10:14 the CEO's name and some other top execs names and things like that.

10:20 She does have blonde hair,

10:21 but even though she may be able to pass as Swedish looking,

10:25 there's no way she's going to sound Swedish.

10:27 Not with that Scottish accent.

10:29 So her plan was just to put yah

10:31 on the end of everything and hope they didn't notice.

10:34 No.

10:34 And it gets worse because so even I cuz they're they're Australian, right?

10:38 They're not idiots.

10:39 So I was thinking that will never work.

10:41 But that was her plan and she decided to go forward with it.

10:44 She liked the idea of acting like someone else.

10:47 So she was set on being the Swedish ambassador for this company.

10:50 Walk in, tell them she's from the Swedish branch

10:52 and she's just flown in to inspect the building.

10:55 But in order to do that, she's got to look the part.

10:57 So, she takes a trip down to the local clothing store,

10:59 buys a new outfit, something that would make her look like an executive.

11:03 I bought a clipboard and I looked professional and I had

11:05 like a little briefcase and I was really trying to look professional.

11:10 She's all set, ready to go in.

11:11 Outfit on, camera rolling.

11:14 Deep breath.

11:15 Let's go.

11:18 [music] So, I go in to reception and I approach

11:20 the receptionist with like a warm smile and I'm,

11:24 you know, being as as nice as I can be.

11:26 And I said, I'm here for this.

11:30 I'm here for this appointment and this is what

11:32 I want to do and this is where I'm from.

11:34 And [music] she said, okay.

11:36 And I was like, what?

11:38 It was that easy.

11:39 This doesn't make sense.

11:40 But, you know, I'm not going to get in my own way.

11:43 So I followed her and she took me to this little

11:46 room just sort of directly behind reception and I was

11:50 greeted by this adorable little old lady and there was

11:55 one other person in the room but we didn't really talk.

11:57 So I had to present ID which is another

12:00 stumbling block and I got to talking to them.

12:04 So they asked me why I was there again

12:06 and all those things and they said they weren't

12:08 expecting me but it wasn't a problem and I

12:10 thought well this is really easy this is great

12:13 and I gave them my ID and I had an Australian ID at the time and they said

12:18 you're from Sweden and you've got an Australian ID

12:21 and I said yeah and I've got a dodgy accent.

12:23 I I went to school in the UK so I tried to get

12:25 around it like that and it works beautifully and I don't know how.

12:28 So I got in.

12:31 Okay, at this point she's doing pretty good

12:32 passing as this Swedish person from another office.

12:35 She got into the building.

12:36 Check.

12:37 Past reception.

12:38 Check.

12:38 And past the two people that she was handed off to.

12:41 Check.

12:41 Check.

12:41 Check.

12:42 Now she's in and she's trying to film things, take pictures of what's going on.

12:46 There's an engine room.

12:47 That looks interesting.

12:48 Film that.

12:49 So, she goes in closer to take a look.

12:51 And I was walking towards one of these large engines and this man was walking

13:00 towards me with I think it was like two other men and he stood out.

13:04 He had this beautiful blonde hair and these big blue

13:07 eyes like completely [music] stereotypical um like Nordic look and he

13:14 came up to me and he said something in a language

13:17 I don't understand but immediately guessed correctly this is Swedish.

13:23 I'm supposed to be Swedish.

13:24 I don't know any Swedish.

13:26 So I'm racking my brain for the limited amount of Norwegian that I know.

13:30 And um he whatever he said I kind of just looked and I felt my body

13:36 get tense and I felt like the my brain says open up like let me cannonball

13:42 into hell this is torture please no and so I said to him yeah and he

13:48 looked at me like okay baby that that doesn't make sense but okay and then he

13:55 repeated it and so I tried the one word I could remember in Norwegian which is

14:01 nigh for no cuz if yes didn't work then maybe no would maybe one of my dumbest

14:08 moments but um so then he quickly just understood like this isn't right and then

14:16 security was called they they had a very

14:18 prompt security team they came I was detained

14:22 oh no she was caught this is every pentester's fear but just because she's

14:27 caught doesn't mean it's over maybe she can somehow Oh, get out of trouble.

14:31 Convince security that everything's fine.

14:32 Or at least just try to leave the building without being caught more.

14:35 She tried to change the story.

14:37 No, no, I'm I'm not from Sweden.

14:40 I'm just working with the Swedish team.

14:42 I'm based in England.

14:44 So, they asked to see her ID again, and it just wasn't checking out.

14:48 They were very confused by the whole thing.

14:50 At that point, she just couldn't see any way out of it.

14:53 So, she pulled out her get out of jail free letter.

14:56 This is a letter that all penetration testers have

14:58 that gives them authorization to do what they're doing.

15:01 Has a phone number on it, which is typically the head of security

15:03 and says who actually authorized her to sneak in.

15:06 So, they call the number on it and the head of security says,

15:09 "Yep, this is all a planned test.

15:10 Uh, good job for catching her."

15:12 We had like this sort of laugh after it and even the security guy was like,

15:17 "Why would you pretend to be Swedish?" I was like, "I don't know.

15:19 I'm Scottish." He's like, "I can tell and you don't look Swedish." I was like,

15:23 "I know." That was Max's first pen test where she tried to break into buildings.

15:28 But she loved it.

15:29 This was adventurous, adrenalinefueled.

15:32 You need to keep your wits, be quick on your toes,

15:34 and know all about computers all at once.

15:36 She felt like this is where she was meant to be.

15:38 This was cool.

15:39 And decided to pursue a career in pentesting.

15:42 She did a number of penetration testing engagements while in Australia,

15:45 learning new techniques and getting official training on how to get better,

15:49 reading a bunch of books on how to improve.

15:51 And one of the things that intrigued her was thinking like an attacker.

15:54 That attacker mindset was something she spent a lot of time thinking about.

15:58 How do people with bad intentions act?

16:01 Soon it was time for another penetration test.

16:03 Still, while she was working for a company in Australia,

16:06 the company I worked for was working with the local

16:10 government in in the city that we were in.

16:12 And I won't say the name because I don't want any further embarrassment.

16:16 Now, penetration tests are not always physical.

16:19 In fact, I'd say most of them are just done over a computer.

16:21 Like the penetration tester might be outside the company and just trying to hack

16:25 their way into the company through the internet

16:27 or sometimes companies will just invite the penetration

16:29 tester right into the building and give them a desk and a network jack

16:32 and say go for it from the inside because even if you get into the network,

16:38 there should be layers of security which should

16:40 still keep you from getting into important things.

16:42 That's called defense in depth.

16:45 So, this was a pen test on a local government office.

16:48 And with this one, they invited her to come into the building and plug

16:52 into a port and see what vulnerabilities she could find from within the company.

16:56 She wasn't alone on this one, though.

16:58 There were two other people with her.

16:59 And the two other people were very experienced network penetration testers,

17:03 and she was still learning how to do this.

17:04 So, she was shadowing them and watching what they were doing.

17:10 So I wasn't a noob, but I was [music] this was my first job in cyber security.

17:16 I have a very technical background.

17:18 Building ROVs, [music] flying them or um steering them,

17:22 I suppose that's all technical.

17:24 Even stunts [music] are technical to a certain degree.

17:28 This was a step further because I [music] there no physical components to it.

17:32 That's why it was so difficult for me.

17:35 I [music] it's all on screen and like Linux

17:38 is its own beautiful scary world [music] for me.

17:42 So I was still getting to grips with this whole world and all

17:47 of the [music] commands and what these things meant and how to undo things.

17:51 And they all sat down, pulled out their laptops and plugged into the network.

17:55 She [music] starts by firing up a network vulnerability scanner.

17:58 I got to run the Nessa scan which was not the most technical

18:03 job in the world but it felt good at the time and I got

18:06 to [music] look at what vulnerabilities were there and I got to go

18:10 and see [music] exploits for those and I got to like run end [music] map.

18:17 These are fine basic tools to start with.

18:19 It'll scan the network for known vulnerabilities.

18:21 They're easy to use and typically benign as in they're not

18:24 going to cause any trouble on the network just by running them.

18:27 And when you run these tools, it's [music] not hacking.

18:30 It's just to try to find what's hackable.

18:32 And she wasn't exactly sure how to hack into this company.

18:36 [music] When you're rammed experienced pentesters who love

18:39 their job and these two loved everything [music]

18:41 that every like line they wrote was um sort of like a piece of art for them.

18:47 They loved it and they they really like got this high [music] out of it.

18:51 And that's contagious.

18:53 So I started to think like this is amazing.

18:56 This is so cool.

18:57 [music] look how far we'd ran.

18:58 And one guy um one of the guys that I was there with got

19:02 a call from [music] one of our points of contact and he was saying

19:05 I can see you in the network and it was this big game and it

19:08 was [music] fun and it was interesting and I got caught up in that.

19:11 So after seeing all the cool things

19:12 that those other penetration testers were doing,

19:14 Maxi wanted to have some fun too.

19:16 How far could she get into this network?

19:18 She saw there were vulnerabilities on certain systems on her scan

19:23 and she tried to exploit those vulnerabilities and get

19:25 into those systems [music] because there's a sort of high you

19:27 get from getting into a computer when you shouldn't be able to.

19:30 And she was making [music] progress.

19:32 She got into a few systems and she was

19:34 looking around making notes on how she got in.

19:37 She would look over her shoulder and always see

19:40 those other [music] penetration testers many steps ahead of her.

19:42 So she kept looking around to see what else she could get into.

19:45 [music] I found my way to some internal environment

19:52 and I hit the kill switch on a city's worship play.

19:59 She accidentally typed the wrong command into the wrong computer

20:02 which controlled the flow of water to the whole city.

20:07 The person I was with immediately saw

20:10 within the network that wait, that wasn't right.

20:12 I will assume that he was sort of with me like following me

20:16 throughout the network and could see a lot of what I was doing.

20:19 And then I was thinking, yeah,

20:21 this isn't I don't think that was maybe good, right?

20:25 And so I looked at him and I could sort of see

20:29 on his face and he comes over to me and he says like,

20:31 "What did you do?" And I, you know, you can look at your history quite quickly

20:36 and I still had quite a lot on screen.

20:38 And I showed him and he put his head in his hands and I was like, "What?

20:42 Is it really bad?" It was really bad.

20:45 Shutting off the water to the whole city.

20:48 Showers, faucets, sinks, even toilets were not functioning citywide.

20:53 Her two other penetration testers immediately tried

20:55 to figure out ways to fix the issue.

20:57 One was looking at how the system operated

20:59 and if it was possible to just turn it

21:00 back on, but you don't want to just do that if it's going to cause a problem.

21:03 The other pentester immediately phones the point of contact

21:05 letting them know this is a major problem.

21:07 Maxi was sort of in shock and incredibly embarrassed.

21:10 She took her hands off the keyboard and just waited.

21:14 I was detained by security guards and they they were not very pleased.

21:22 Now, this is a completely different situation

21:24 from the last time she was detained by security.

21:26 The last time she had a get out of jail free card.

21:29 This time they knew that she was supposed to be there.

21:30 In fact, it was her point of contact that called security on her.

21:34 She was authorized to be there and do

21:36 this, but this was not supposed to be disruptive to the organization.

21:39 Not only was it disruptive to the organization,

21:41 but it was disruptive to the whole town.

21:43 So, they wanted to at least get her recount

21:45 of the matter recorded so they had it for later.

21:48 I go down to a windowless room and I'm questioned.

21:53 [music] And all of a sudden, one of the sort of accusations,

21:56 if you want, was that I was a Russian spy.

21:59 And I was thinking, how did we get there so quickly?

22:02 like what happened?

22:04 Apparently, [music] she spoofed her IP at one point to make herself look like

22:07 she's coming from Russia to try to test to see if they could detect that.

22:11 But that was just very brief.

22:12 And she was definitely not a Russian spy.

22:14 But this was becoming scary now because it

22:17 wasn't just a confession of a mistake she made.

22:19 It was like they were treating this more like an investigation.

22:22 So I was held there for like a couple

22:25 of hours and of course the police were called.

22:27 The police had to be called.

22:29 I didn't have any ID on me.

22:31 I had my work card, but that doesn't really matter cuz it it's just a photo.

22:35 [music] I could have printed it myself.

22:38 And I kept saying to them, you know,

22:39 if you let me go back to my apartment, I can get my passport for you.

22:42 I'm British and I'm not a spy and you can

22:44 contact my employer and I'm actually here with two people.

22:47 And I kept [music] going and they didn't want to hear it.

22:50 And that's okay.

22:51 That's kind of their job to to do to [music] not believe me and to, you know,

22:56 look for the worst because they've got to protect themselves against the worst.

23:00 And eventually that at [music] some point I said to them

23:05 like I need a can I have a glass of water?

23:08 And the look is would would have been enough

23:10 to like you know turn most people to stone.

23:13 And I was thinking yeah that was not an ideal question.

23:16 And then eventually my employers at the time called in and it did get sorted

23:23 and I narrowly escaped um essentially what

23:29 would I think you would call it prosecution.

23:30 I I escaped any legal action because of that and I was on the graduation team.

23:36 That lent me some credibility in the fact that okay,

23:39 she doesn't know what she's doing and it's okay and my employer

23:44 didn't fire me and I will be eternally grateful for that.

23:49 [music] She doesn't know how long the water was out that day.

23:56 It could have been hours, minutes, seconds.

23:59 It doesn't matter.

24:00 The fact that it could be shut off and it

24:02 did get shut off is why the police had to respond.

24:05 But she narrowly got out of serious trouble from that one.

24:08 But this sort of [music] baptism by fire is

24:11 how we learn the most important lessons in life.

24:13 I mean, knowing firsthand what kind of true

24:15 power a penetration tester has is profound.

24:18 And this feeling sometimes flips back and forth, too.

24:21 Sometimes you feel completely blocked with no access [music] to anything,

24:24 and it makes you feel dumb.

24:26 And other days, you feel like with a single keystroke,

24:28 you can wreck this entire business.

24:30 It almost reminds me of visiting a barber and getting an oldfashioned shave.

24:34 the barber has this razor and they're shaving your neck with it.

24:38 You feel very vulnerable in that situation.

24:41 And I think many companies do feel vulnerable

24:43 when they allow a penetration tester to come in.

24:46 Who knows what they saw or took.

24:49 In my last job, we had a penetration tester come in and see what they could do.

24:52 And they were able to crack 25% of all our passwords companywide.

24:56 That's like thousands of passwords.

24:58 Of course, I read the report to see whose passwords got popped,

25:01 but it only contains statistics, not passwords or usernames.

25:05 And it made me think, you know,

25:07 this pentester is walking out of our building with a bunch of our passwords.

25:12 I've never felt more vulnerable at work before.

25:16 We're going to take a quick ad break here,

25:17 but stay with us because Maxi is going to tell

25:19 us about a penetration test story that changed her life.

25:24 Making some big mistakes on past pentests did

25:27 not make Maxi back down from pen testing.

25:30 Instead, she doubled down.

25:31 She was fascinated by the power of the pen tester,

25:34 but more so the attacker mindset allured her, but she had to leave Australia.

25:39 Well, yeah.

25:39 So, I'd come back from Australia,

25:41 my visa had run out, um, moved back to the States.

25:44 My model in life is like, if I'm free to do it,

25:47 and I want to do it, then I will do it.

25:50 I kind of always want to be infatuated with what I'm

25:53 doing and focused and I'm okay if whatever the thing is

25:57 that I want to do changes and it has obviously but I

26:01 want to love what I do because functionally right we'll I'll live

26:05 for 70 years maybe I'll live to 90 but functionally I've got

26:09 max 70 good years and I want to do well we might

26:13 do two interesting things a year so I've got 140 interesting things

26:17 that I'll do in my life that doesn't sound like a lot.

26:20 So, I just always wanted to do the things that were most interesting,

26:24 that would give me the most sort of interesting, exciting experiences.

26:28 And for her, the thing that excited her the most was red teaming,

26:31 penetration testing, social engineering,

26:33 physically breaking into buildings was just a thrill to her.

26:36 So, she looked for more jobs doing that.

26:39 So, I was hired on a sanctioned red

26:42 team contract to test this high security logistics company.

26:46 And there were two testers that were booked.

26:48 It was a large company, but they wanted the two of them to try

26:50 to get into one of their satellite warehouses.

26:52 They told her, "Look, there's a locked fence around this whole property.

26:56 Security alarms are on the doors.

26:57 There's security cameras watching the whole property.

27:00 There's active security patrols at night." And they just

27:03 wanted to prove that she could get to them.

27:05 They didn't want her to do anything to those machines.

27:07 And they gave her a little USB device and said, "Hey,

27:09 if you can actually get to it, plug it in and take a picture that you got there,

27:13 and this will prove that you made it." because uh presumably if

27:16 somebody wanted to get a customer list or shipment list or whatever,

27:19 it would be just as easy for them to plug in a USB device,

27:22 grab the stuff and unplug it.

27:24 So, they asked her to see if she could do that.

27:26 So, her and her coworker take a drive out to this facility

27:30 during the day and just drive by just to look at the place.

27:33 And uh well, driving by is too quick.

27:35 You can't see anything.

27:36 So, they decided to get out and just walk down the sidewalk

27:39 and go around the whole property just to see what they can notice.

27:42 Any points of entry?

27:44 Are there any areas where the cameras aren't pointed?

27:48 When we had kind of gone around the very edge

27:53 of the perimeter was like metal fence like chain link fencing.

27:56 So the chain link fencing had just it wasn't it was years old,

28:02 probably decades old and so it was a bit

28:04 rickety so you could just kick the edge up.

28:06 So we knew that.

28:07 They took some other notes and got an idea of what the place was like.

28:10 There's a twostory warehouse building with loading

28:13 docks and sort of two parking lots.

28:16 One normal one with big transport trucks and cargo trucks and a second one

28:20 that had a chainlink fence around it with many more of those big cargo trucks.

28:26 We're talking eight wheelers here, the big trucks.

28:28 This warehouse would load stuff onto them and then they deliver it.

28:32 So, they leave and decide to come back at 900 p.m.

28:36 But Max's coworker called her up.

28:38 He's like, "I'm sick." And I was like, I hate you.

28:42 You're not I know you're not sick.

28:43 You're hung over.

28:44 But anyway, last minute he gets sick.

28:46 So the scope allowed for a solo run.

28:48 So I was like, I'm going to do it.

28:50 She waits until night and then drives back to the facility at 9:00 p.m.

28:53 By that time, the place was all closed and there should be

28:55 no workers there and just those security patrols that she was told about.

28:59 I then parked behind a tree line outside of the logistics [music] park.

29:04 I was keeping away from, you know, the the lights.

29:10 I [music] was staying where the the shadows fell in.

29:14 Okay, it's go time.

29:15 I like the quiet approach of being on foot myself, too.

29:17 You can hide easier, change directions more quickly, be more stealthy.

29:22 So, come up um through a tree line off to the side of the whole complex.

29:27 [music] Moving pretty slow.

29:29 I'm far enough from the walls to see the whole facade.

29:32 I'm close enough to spot like opportunities and I do the usual first pass.

29:37 I don't force anything.

29:38 I don't touch anything.

29:40 She passes by the building.

29:41 The classic first pass gives you plausible deniability, right?

29:45 If you don't touch anything or don't go on the property,

29:48 [music] you can just say you're passing by if anyone asks, but it's quiet.

29:53 There seems to be no signs of life inside.

29:55 No [music] noise, no doors open, no lights on.

29:59 And there were a lot of trucks in the parking lot,

30:00 but all of them were dark and quiet.

30:02 No regular cars there.

30:03 [music] But surprisingly, she didn't see any security patrols.

30:09 So, [music] since she's around the back of the building,

30:12 she starts jiggling door knobs and windows to see if any of them will open.

30:15 [music] And everything obvious that you would look at to gain entry was a no.

30:21 So, doors, no.

30:23 Hatches, couldn't see them.

30:24 Gramm windows, they didn't open.

30:26 and they were just double pane windows.

30:29 Um, so yeah, so you know, good security is frustrating in some sense.

30:35 Um, but it was this like corrugated all of the warehouses

30:40 in the area were these corrugated sort

30:42 of um steel structures or metal structures.

30:47 And this the warehouse that I had,

30:51 there was sort of this grass alley in the back at the back of it.

30:56 and um its neighboring warehouse also had stacks of pallets.

31:01 So there was just these stacks of pallets

31:03 all the way like through this almost alley

31:07 and there was this high stack of pallets

31:12 that kind of touched it was within four 3 4t

31:16 of a second floor window that was just

31:18 this little it was like a little rectangular window

31:22 but it was open and I was like oh that sounds like a great way to get in there.

31:26 So, kind of moved a couple of palettes start to climb

31:30 up these other [music] like this other high stack of palettes.

31:34 Um, and most of them have kind of been um like secured to one another.

31:38 So, it's they're still a little rickety.

31:40 It wasn't like I I wasn't feeling very confident

31:43 that they wouldn't crash to the ground, but they didn't.

31:47 I'm, you know, pretty light on my feet.

31:49 I'm built I am built for speed and not power.

31:52 Um, so I do end up getting to the top, poke my head through.

31:59 While the building looks two stories tall,

32:01 it's really just a single story, but just with really tall walls.

32:05 So when she looks down, it's straight down all the way to the warehouse floor.

32:09 That's not good.

32:10 That's too high to jump down.

32:12 So she looks around and notices that the walls are made of like a lockboard.

32:17 It is essentially is pegboard.

32:18 [music] So pegboard is basically, if you aren't familiar,

32:23 it's steel or aluminum sheet in and it's

32:26 got this regularly spaced like square or round holes

32:30 that you you basically put on walls in warehouses

32:33 usually and then you hang like heavy tooling on it.

32:36 So I'm [music] looking at this lockboard peg board and I'm like,

32:41 "All right, well climbing down [music] it, you know,

32:44 grav gravity is your friend." So,

32:45 it's like fingers in and got my little sneakers on and I I actually get down.

32:50 It's It wasn't as difficult as you think.

32:53 Okay, she did it.

32:54 She got into the building.

32:55 Nice.

32:56 Now, her objective is to simply see if

32:58 she could get into those computers in the building.

33:00 So, she looks around for them.

33:01 They were easy to find since the monitors

33:03 were on and they were glowing in the dark.

33:05 Get to the terminals and they're all they're all open.

33:10 It was It was beautiful.

33:12 you know when in movies the they're like ah the [laughter]

33:17 like the heavens light I was like this is great

33:20 so they were yeah they were all unlocked and so I

33:22 connected this approved device I snapped the required photos um you

33:27 know proof I could touch one attack I would want

33:29 to touch and then I felt about the exit and I was

33:32 like I looked at the pegboard and I was thinking well

33:35 cuz climbing up is a little bit different than climbing down.

33:39 Okay, so climbing out the way she came was not going to work.

33:42 She looked around for another way out.

33:44 There are a lot of doors.

33:45 She She's inside.

33:46 She could just open one up and walk out.

33:48 No, wait.

33:48 Hold on.

33:49 That's not going to work because they're security alarms.

33:51 And she looked around the doors and yes, they were armed.

33:54 Okay, [snorts] scratch that.

33:55 You can't open those doors.

33:57 It would trigger noises.

33:57 And since she hasn't had any security on her yet,

34:00 she doesn't want to get their attention now.

34:02 So, she looks around for other points of exit.

34:04 It was a loaden door that wasn't in the best shape.

34:07 So a loading door like a like a dock where

34:09 the truck backs in so it can get whatever the load

34:12 is it can it can get into the warehouse and you

34:15 don't always need a forklift and so on so forth.

34:17 So it was um it was it was essentially that.

34:20 So it was on a pulley system and it wasn't attached to an alarm

34:26 which was mental for what they you know for how secure they wanted to be.

34:32 Um, so yeah.

34:33 So I I kind of it was a little bit buckled

34:36 at the side and maybe that's why it wasn't on the alarm.

34:38 I'm not sure, but little pulley system pull the chain up just enough

34:43 to sneak out and I get back to my car through a forest,

34:48 which is by far, by the way,

34:49 the worst part of the story for me because I do not like insects.

34:55 But um, so yeah.

34:56 So then I I back to my car or I think I'm roughly back

34:59 to my car and I phoned my point of contact and our report was a success, right?

35:05 Like I got in, I've managed it.

35:07 I've got the photos.

35:08 I'll write you a report.

35:10 And he listened and he was like,

35:12 I want to [sighs and gasps] issue a scope change.

35:15 A scope change?

35:16 This means the client wants to change what he wants her to do.

35:20 I guess he was impressed that she was able to do

35:22 everything he tked her with and wants her to try more.

35:25 So he says to her, "You know all those moving trucks in our parking lots?

35:29 See if you can steal those trucks." And she's like,

35:33 "I don't know how to hotwire a truck." And he's like, "No, no, no.

35:35 See if you can find the keys to any of them.

35:37 And if so, take them." And I was like, "All right,

35:40 let's do it." Cuz 140 interesting things in my life, this might be one of them.

35:45 She walks back through the woods, cursing at all the spiderw webs that she

35:49 comes across and then looks at the facility.

35:52 There are a lot of trucks here.

35:53 And they're the big trucks, like the long trucks, you know,

35:57 they've got 20 to 40 foot containers on the back.

36:00 And I've never driven one of them.

36:02 Some are parked inside the fenced area, and some aren't.

36:05 She starts with the trucks that aren't in the fenced area.

36:08 Step one, see if the door is unlocked.

36:10 The first one she tries, the door is unlocked.

36:13 Wo.

36:13 So, she opens it, gets in the driver's seat.

36:16 She looks at the ignition.

36:17 The keys were not there.

36:18 But to her surprise,

36:19 the key was sitting right there in the cup holder in the center console.

36:23 A little bit humorous.

36:24 I'm like, eight billion people on the planet.

36:27 I'm the best driver.

36:28 So, what I'm going to do is I'm going to move all these trucks.

36:32 I'm not going to worry about it.

36:33 Reversing that truck.

36:34 I was like, I'm going to have to leave this here

36:36 cuz I'm I'm not going to be able to do this.

36:38 So, yeah.

36:38 So, I took them up just other end of the culdeac almost.

36:42 It was like a little sort of um quiet area,

36:46 a little logistical parking spot, I guess.

36:49 So, I just parked them all up there.

36:51 [music]

36:52 She parked it about a/4 mile away and then ran back to get another truck.

36:57 The keys were not consistently controlled and the fleet wasn't

37:00 consistently parked on the inside of the secure [music] perimeter.

37:04 So, basically, it just became this live demonstration of risk.

37:08 One after another, she was able to find keys for these trucks.

37:11 So when a driver comes back to this area and it's past hours,

37:16 they they sometimes leave the keys like they'll leave them

37:19 under mud flaps or just actually inside of the truck.

37:23 It was incredible how many keys she found in and around these trucks.

37:27 Sometimes they were still in the ignition.

37:28 Sometimes they were on the seat.

37:29 Sometimes they were in the, you know, the visor, the sun flaps.

37:32 Sometimes they were in the mud flaps.

37:34 And sometimes they weren't there at all.

37:35 Some trucks were locked and she couldn't get into or move them.

37:39 She thought about climbing back in through the window

37:41 of the building and looking for the keys inside,

37:43 but she already proved she can get in there.

37:45 Maybe it's just better to try another truck instead.

37:48 After taking the ones from the unsecured parking lot,

37:51 she wanted to get into the fenced area and try to take one of those.

37:53 She remembered where you can lift the fence up and get in there.

37:56 So, she scurries under the fence and looks at the trucks inside.

38:00 Sure enough, same story.

38:01 Keys were typically in and around the trucks there, too.

38:04 So, she hops in one, finds the keys, starts it up, and starts to drive out.

38:08 but realizes, "Oh, wait.

38:10 This fence is locked." She gets out, looks at the padlock.

38:14 She thinks about picking the padlock.

38:16 That did not work.

38:17 And I was like, I bet there's a key for this someplace.

38:19 And I'm thinking, do I go back inside?

38:21 Do I climb up the pallets, climb down the gr, look for the keys?

38:25 And I was thinking, you know what?

38:26 This is probably proof enough.

38:27 This is bad enough because the report is going to say,

38:31 well, I couldn't break into your secure perimeter.

38:33 Why don't you park your trucks in there?

38:35 By 2:00 a.m., she had stolen a bunch

38:37 of trucks and felt like she accomplished the mission.

38:40 Security never stopped her.

38:41 There was no one around all night.

38:43 So, she goes back to her car and calls her point of contact and says,

38:46 "She stole the trucks." He's like, "Wow, okay, great.

38:50 Hey, can you come into the office in the morning

38:51 and tell us how it went?" She's like, "Sure,

38:54 but let me sleep first because I'm exhausted." So,

38:58 she goes home and then the workers start coming to the warehouse in the morning.

39:03 day shift did arrive and they didn't notice anything was

39:06 wrong for like a fair amount of time when I

39:10 think it like how I would say it maybe is

39:13 it took a beat for the penny to drop for them

39:16 and yeah headquarters finally called and my contact I think

39:21 walked them through the findings and eventually we gave a report

39:25 and you know where was security they're supposed to have 24-hour

39:30 roll in security where was it cuz I didn't see them.

39:34 Like, why were there pallets?

39:35 Why were there unlocked windows?

39:37 Why weren't the loading bays connected to the alarm system?

39:41 Things like that.

39:42 Like, it was, you know, treat keys like access badges, not souvenirs.

39:49 Did you have to give like a debrief to that uh facility and say,

39:53 "Hey, by the way, you if you're wondering what happened, let me tell you."

39:57 Not to the facility.

39:58 So, I I didn't go back to that facility.

40:00 We I gave it to my like to their headquarters essentially.

40:04 We went in and we gave a presentation um and a report and you know as is

40:10 all it's always the case people's sort of mouths

40:14 drop and I think their tummies probably dropped too.

40:16 Um they're like how has this how has this happened sort of thing but

40:20 yeah but it's it's another thing to be like wait who did this?

40:23 Oh we hired this person Max to do it.

40:26 this guy Max [clears throat] is must it must

40:27 be a jerk to be breaking in and all this.

40:30 And then if you were to actually show up and be like, "Hi,

40:33 I'm Maxie [clears throat] and I'm the one who stole all your tracks."

40:36 I'm so sorry.

40:38 You have to you have to be soft with them.

40:40 Like, well, maybe that's just personality.

40:43 Maybe that's a a preference of mine,

40:47 but stylistically, I think be soft with them.

40:51 They do not know for the most part that our industry exists.

40:57 Yes, they know that there are, you know, bad actors out there,

41:00 but they don't know that some of us are making a career out

41:02 of it and you have to go in and you have to be soft.

41:05 It isn't their fault.

41:06 There there's that's what it is to run a company.

41:09 Not everything's safe.

41:10 Um, you can make it a little harder for people, but that's our job to tell them.

41:15 And I just think tell them that in the most direct but soft way possible.

41:21 you don't it's not a blame game.

41:23 And so yeah, I I went to headquarters and I was like,

41:25 "Hi guys." It was I think you might have heard what happened.

41:29 Um and like so yeah, so now on my resume I've got,

41:32 you know, expert climber and uh truck driver.

41:36 She did a lot more penetration tests and got so serious

41:39 about it that she wrote a book called The Art of Attack:

41:42 Attacker Mindset for Security Professionals.

41:45 Yeah.

41:45 Well, here's what I'd say about my book.

41:47 I'm going to explain it.

41:49 If you don't like the sound of it, just buy it for somebody you don't like.

41:53 If you do like the sound of it, it was on me.

41:56 You should buy it.

41:56 It'll be great.

41:57 [laughter] No, in all seriousness, it's called The Art of Attack.

42:01 And it's central argument is that in order to design defenses that truly work,

42:08 security professionals must adopt this quotequote attacker mindset.

42:13 and its basic position is that simply focusing on tools,

42:18 networks or policies is completely insufficient.

42:21 It's necessary but it's not sufficient.

42:23 So understanding how an attacker thinks, how they strategize,

42:27 manipulate, persist is fundamental to building resilient systems.

42:33 And I would probably finish on it by saying the skills of a good attacker

42:40 are the same skills that a I want as a person going through life, normal life.

42:47 Also the things that I would teach and will teach to my children like grit,

42:51 determination, we're goal orientated, resilient, so forth, so on.

42:56 They are cognitive skills that we need and how you apply them

43:02 is what matters and that is basically the premise of the book.

43:09 Somewhere in her life she went on a penetration

43:12 test that changed the whole trajectory of her life.

43:15 It was probably the most highly strung uh

43:19 you know tensioned job uh of my career.

43:24 was for a company that we've all heard of and that we

43:27 all use and [music] we had their internal red team accompanying us.

43:34 This company had a big data center and they

43:36 wanted to see if they could get unauthorized access inside.

43:40 Now, I don't know if you've ever gone into one of these data centers,

43:44 but sometimes these things are extremely secure.

43:47 I've seen them where there's like a big fence around

43:49 the company and just to get into the parking lot,

43:51 you have to go through a gate guard and they'll check

43:54 your ID and make sure that you're authorized to be there.

43:56 And then when you finally park your car

43:58 and get to the front door of the building,

43:59 the front door is locked and so you need a badge to get in.

44:02 Forget about any open windows.

44:04 They don't open ever.

44:05 Then upon walking in, there's a security guard watching what you're doing,

44:08 but you're only in the lobby.

44:09 You're not even in the data center part of the building yet.

44:11 To get in there, you need a second key.

44:13 And sometimes they do an eyeball scan to verify your identity.

44:16 And there are man traps,

44:17 meaning there's only one person allowed through at a time so they can check you.

44:20 But then once you're in the data center,

44:23 there's sometimes a cage around the server racks you

44:25 need to get to, and you might need a third

44:27 key to get into those and maybe an extra

44:29 form of identification like a fingerprint scan or something.

44:31 [music] In short, it's extremely hard to sneak into a data center.

44:36 There are actually on this job armed guards patrolling

44:39 this perimeter and there are vehicles that are scanned for anomalies.

44:43 like it is a very in terms of security

44:46 the very robust comprehensive site um and you know inside everything

44:52 it's a data center everything is controlled um temperature humidity

44:56 are controlled to the decimal the power and the fiber run

45:00 through you they're redundant there's blast proof like conduits every

45:05 corridor every door every bite is sort of like logged

45:09 but once you're in you're in and nation state actors will

45:14 will get in and they're willing to do what it takes.

45:16 And so that was that was our job.

45:18 Well, she decided to try going right in through the front gate.

45:21 So she just drove her car right to the security checkpoint and acted

45:24 like she was supposed to be there and talk to the guard.

45:27 Hello.

45:28 Yeah, we're visitor.

45:29 Yeah.

45:29 Like, hi, can we, you know, we're here to do this?

45:32 Cuz your Osen can find you some of those entry points.

45:36 Like if they're doing immersion cooling, we know there is maintenance required

45:39 on immersion cooling for the fluid for instance.

45:42 So you go out and you're like, "Here, we're here to do this." And you,

45:46 you know, you some sites that will work and they'll be like, "Oh, okay.

45:49 Um, we just tell the right person or here,

45:52 wait here." They were like, "You're not on the list.

45:54 You're not coming in." Okay, so there's a list.

45:57 This is a clue.

45:58 Maybe she could get on that list.

46:00 Who maintains that list?

46:01 What if she called acting like the maintenance team and says they

46:04 have to do a fluid change or something and they're coming out?

46:07 So we we tried to get on that list.

46:10 We tried to call ahead.

46:11 We tried to spoof phone calls so that it looked

46:14 like we were calling from hopefully the right point of contact.

46:17 It wasn't working.

46:18 There was too many checks.

46:20 They were comprehensive.

46:22 They were robust.

46:23 They were sharp.

46:25 And so we were like, how are we going to get in here?

46:27 And it's like, [gasps] you know, sort of a bit like they've built a wall.

46:32 Do we dig under it?

46:33 Do we go over it?

46:34 Like it wouldn't have mattered.

46:35 It was the sensors, the security, they were on top of it.

46:40 And so we're like, all right, what do we do?

46:49 Time to step back and think about [music] some sort

46:51 of out of the box way to get into this data center.

46:54 One way to try to think through something like

46:56 that is just to learn more about this company.

46:57 [music] Maxi was curious how the building was built.

47:02 So we actually went to the [music] municipalities.

47:06 We'd gotten some like almost you could think of them as blueprints

47:11 and we figured out that [music] there was in fact a sewage line.

47:15 Sewage lines are too small and would be way

47:17 too disgusting for [music] a person to go into.

47:19 However, they sometimes run through underground tunnels that are accessible

47:24 by service workers like a smaller pipe inside a big tunnel.

47:29 So, she traced where the lines leave the property.

47:32 It sat at a point where we could get

47:36 to another access point through basically a a junction.

47:40 Well, it's worth a shot to try.

47:42 So, they drive over to where they expect there

47:44 to be a manhole which is off the property.

47:47 And if their calculations are right,

47:48 these pipes would lead right into the data center.

47:51 But the question is,

47:52 will there be a service tunnel also leading to the data center?

47:56 So, they pried open the manhole lid and looked in.

47:59 it was big enough to crawl down into.

48:01 So they did and then they saw a tunnel going towards the data center.

48:07 So they crawled through it and it's a long,

48:12 shall we call it journey from one access point,

48:15 one manhole to the other, but we have to do it.

48:18 It's not glamorous.

48:19 It was not enjoyable, but we got through it.

48:22 Sure enough, it led them right to the data center

48:25 and then make our way up into the site and then into the data center.

48:31 They got in, snapped a few photos to prove they were in there, unauthorized.

48:35 And then they called the security team to tell them

48:37 they got in and the security came and was like, "What?

48:40 How did you get in here?" And so our report was, "Your guy's security is bob on.

48:48 We we hate it.

48:50 It was amazing.

48:51 you didn't let us in here.

48:52 We weren't able to phone ahead.

48:54 We weren't able to forge documents.

48:55 We weren't able to do any of the things that we would try to do ordinarily.

48:59 We couldn't have created a diversion to, you know,

49:02 have security take their eyes off of the gates to get through.

49:06 They weren't looking.

49:06 It wasn't it wasn't going to happen.

49:09 We got into your data center through a manhole

49:14 for a sewer line and that was the bulk of our report.

49:18 the that the the rest of it was going, but it kind of didn't matter to them.

49:21 They're like, "Yeah, but you still got in." But this made Maxi think even more.

49:26 If a data center wants ultimate security so

49:29 nobody ever gets in, how could they improve this?

49:33 And that's when it occurred to her.

49:35 And I was like, well,

49:36 if you want to keep them that safe, you put them underwater.

49:39 An underwater data center.

49:42 Could that even work?

49:43 Then I started to think, "Oh, is that did I just have a good idea?" Amazing.

49:49 So I called my old boss who I used to work offshore for and with.

49:54 I was like, "Hey, what do you what do you think of this?" And he's like,

49:57 "I've actually thought of something fairly similar and I had this like

50:01 autocad drawn at this point." He tweaked it, tweaked the design.

50:04 I was like, "Would you consider working with me?

50:07 Here's what I want to do.

50:08 I want to I want to put data centers underwater.

50:11 I want to do it in a modular fashion and I want to do it cuz it keeps them safe.

50:16 So, the two of them got busy designing and building modular

50:19 underwater data centers where you load up the servers into what looks

50:22 like a small shipping container that's watertight and she will then drive

50:26 them down to a safe spot on the bottom of the ocean.

50:30 It's also a lot cheaper to do.

50:32 So, it's about 80% less expensive in terms of in terms

50:35 of capex to get compute underwater the way we do it.

50:40 I I don't know anything about underwater data centers.

50:43 This is all new to me.

50:44 So, I didn't even know this was possible or even this was happening.

50:47 But you're telling me this is something you've made.

50:50 This is something we've made.

50:50 This is something we've we've done, performed,

50:53 and and now there are actually a lot of companies.

50:56 Is there like a long like extension cord that goes to these things to keep them?

51:01 There essentially is.

51:02 So what's really interesting about the subt environment and we touched

51:05 upon it earlier is that everything you and I use one way

51:10 or another um so there are power cords under under the water

51:15 that's how we you know that's how we light up oil

51:17 and gas platforms that's how we manage to eat on them

51:20 and things like that and there are also countries that export so

51:24 France exports power to Denmark we that's a long lady cable

51:30 to do that for them So there's actually a lot of subc cables.

51:35 There's also a lot of subc cables for there's like 700 cables

51:39 or something like that, maybe more now that carry this internet signals.

51:43 So they they pulse the light.

51:46 So you don't have to lay your own cables.

51:47 You can just tap tap off some of the stuff that's there.

51:50 Yeah, it depends where we're So if we're in a port,

51:52 then we might extend from an onland substation.

51:56 If we're further offshore, then we'll splice the power cable, put it in wet.

52:01 So, we've got offshore they're wet mates wet mate cables.

52:05 So, we'll they look like headphones with a mic jacks on them.

52:09 Like they look like that.

52:10 They're just really big ones of that essentially.

52:12 We plug them into our units or our units look like

52:15 20ft shipping containers and they we put them on the subsec floor.

52:20 We secure them there through guide posts,

52:23 lock them in, uh, plug in the power, wet,

52:27 wet mate the power, and do the same for the fiber, and then it's up and running.

52:31 And we can do about 3 megawatt in a unit just now,

52:35 which is meaningless to most people,

52:36 but uh, that's kind of what we need just to do small amount of compute.

52:43 And yeah, we we sent them on the sea floor.

52:46 But what if uh what about maintenance and stuff

52:48 like you need to change out a hard drive?

52:51 Yeah.

52:51 So there's a few ways that we perform maintenance.

52:54 So it's it's actually not that much different than than um online.

52:58 So what I will say is the maintenance

53:00 cycles are reduced because there's no dust, right?

53:04 We've got the the servers are filled or are surrounded by this dialectric fluid.

53:10 So there's no dust, there's no debris, there's no people jostling the cables

53:16 and those are the biggest factors in maintenance.

53:20 That's why compute goes down 18% of the time.

53:23 We don't have that then.

53:25 But you know it happens.

53:26 We do have to maintain.

53:27 There's some fault.

53:28 So we do that a few different ways.

53:30 If one server fails, it kind of doesn't matter.

53:32 We'll load balance.

53:33 We'll shift the load and it'll go to some

53:36 other server or some other site that we have.

53:39 Um if a whole rack fails, it may fail in place and again load

53:47 balancing or if a rack fails and it's important

53:51 depending on what the client depend on who

53:54 the client is and what the client is doing.

53:56 We may have to bring the unit up and it takes

54:00 we we guarantee you can do it within about 12 hours.

54:03 Um so we've got a vessel at site.

54:08 the vessel goes picks the unit up with an ROV because

54:13 that's my background and that's how I knew how to do it.

54:16 So, picks it up, put it on deck, we drain it, we do the fixes.

54:20 You can also do them remotely a lot of the time.

54:23 Um, so it really just depends.

54:25 But then it it it doesn't cost any more time and it doesn't cost

54:29 anymore in terms of the financials and and before people like come for me.

54:37 It does not heat the water.

54:39 We are not heating the oceans.

54:41 So I have to say it.

54:44 So water warms up more slowly than air and it can actually hold more heat.

54:50 So the specific heat of water is higher than most other substances.

54:54 And what that means is that it absorbs

54:56 more heat before its own temperature increases by 1°.

55:00 So say it another way, water needs about four times as much energy to raise its

55:05 temperature by 1° C as the same mass of air does.

55:10 So what we've measured in our testing is that the water

55:13 heats up by about a thousandth of a degree,

55:16 which is statistically insignificant, and that's within a meter of the unit.

55:21 You put a data center on land, first of all,

55:24 you have to use air conditioning to cool it for the most part.

55:28 That's what people are doing.

55:29 So about 40 to 50% of all the power

55:32 that that data center is pulling is used to air condition.

55:37 And then that is pushed out as heat and then

55:40 the ocean has to take that cuz that's our heat sink.

55:43 The ocean takes that and now you're warming the oceans.

55:46 So, it's like a very unintuitive but very

55:50 like scientifically proven method of getting rid of heat.

55:53 Put it into water.

55:55 And so, yeah.

55:56 And I imagine if someone does try to pen test this place or break into it,

56:00 as soon as they open the door,

56:01 it just gets flooded and then all the computers shut off.

56:04 You can't open the door.

56:05 So, it's like you would basically our biggest threat is like a sub,

56:09 you know, like a a Russian sub maybe.

56:12 Let's see.

56:13 So, what happens is you have you need a sub or you need a vessel

56:18 with an ROV attached or maybe if we're if we're uh like a shallow depth,

56:24 you could use a diver, but a diver is not going to be able to do anything.

56:26 You can't pull a door open because of the pressure of the water.

56:29 So, basically, you couldn't really pen test it without getting a vessel,

56:34 an ROV, or a bunch of divers or a submarine.

56:38 And good luck to you.

56:39 I don't even know how I would do that.

56:41 And if anybody's going to pen test it,

56:43 it's going to be me because that is a that is a fun job.

56:45 But um basically, let's say a a nation state sub came along.

56:52 Great.

56:53 It would have to connect it and it would have to pull it off

56:57 of its security mechanisms that we've got sort of uh fastened to the seabed.

57:04 And once you'd done that, you would basically self-destruct the data that was

57:10 on the servers cuz now you've ruined the housing that that is,

57:15 you know, keeping them safe from the the water and the pressure of the water.

57:19 So physically they are very very secure.

57:24 Digitally they're it's the same footprint like you pentest

57:27 the same way you would any other server data center company.

57:33 Incredible.

57:33 I think I'm stunned by that sort of thing.

57:35 I mean, I my brain goes into weird directions here.

57:39 Like, um, is it are there laws offshore where you can host things

57:44 that aren't legal in this country or whatever and all this sort of stuff?

57:47 And now now suddenly I I like this idea of pirated websites or piracy.

57:55 Is there's piracy in the sea as well?

57:57 Like this my brain is just goes in all directions here.

57:59 That's right.

58:00 Yes, there are maritime laws.

58:02 very difficult to enforce them and you rely on satellites to some level.

58:08 You rely on like boats to police but the ocean is vast.

58:13 So it is very difficult to enforce.

58:16 So basically we're counting on people doing

58:19 the right thing and that doesn't always work.

58:22 So what we do is we make sure that we're in the green.

58:26 So we colllocate with existing assets offshore

58:30 whether it be in national or international waters.

58:34 Every country has an EEZ an economic zone essentially

58:39 and that's about it goes from coastline to about 12 miles

58:43 out and then just a little further out from that you

58:46 start to get into what is essentially international waters.

58:51 You can do what you want inside of them.

58:53 Who's going to stop you?

58:54 but we choose not to as you know an American company and so we colllocate

59:01 with other assets in the area um usually

59:05 like offshore wind platforms or rigs or anchored boats.

59:11 So yeah I I think subc is definitely part of the the future for data centers.

59:27 A big thank you to Maxi Reynolds

59:29 for coming on the show and sharing these stories.

59:30 You can learn more about her underwater data center at subccloud.com.

59:35 If you want to get a book, it's called The Art of Attack, Attacker Mindset.

59:39 It's the one with the chess pieces on the cover.

59:41 If you like the show, if it brings value to you,

59:43 consider supporting the show by giving directly to the show.

59:46 It helps keep ads at a minimum.

59:48 It keeps the lights on here, but most of all, it tells me you want more of it.

59:51 Not only that, but you'll get bonus episodes

59:53 and an adree version of the show, too.

59:55 So, please visit plus.darknetdiaries.com.

59:59 That's plus.darknetdiaries.com.

1:00:02 Thank you.

1:00:02 The show is made by me, the packet tickler,

1:00:04 Jackie Cider, editing by Control Alt Delight, [music] Tristan Ledger.

1:00:08 Mixing by Proximity Sound,

1:00:09 and our theme music is by the mysterious break cylinder.

1:00:12 I have a bad habit of doom scrolling social media,

1:00:15 but lately I've been trying to break it

1:00:17 by confusing the algorithm as much as possible.

1:00:20 I'll play like long recordings of fog horns blaring or I'll watch

1:00:24 curling matches from 2006 or I'll just search for like the most

1:00:28 bizarre things I can think of like can I legally marry

1:00:31 a ghost in Ohio or a baroque interpretations of dialup modem sounds?

1:00:38 Can you potty train a squirrel using jazz?

1:00:42 Not because I'm interested in those results,

1:00:44 but because I like tossing the algorithm a bag of trail

1:00:47 mix and just watching it chew on that for a while.

1:00:51 This is Darknet Diaries.