The Hacker Chronicles

2.2 Honeypots

Episode Summary

While Alice navigates the wake of the HCV Orca attack, she makes a bargain with John Doe.

Episode Notes

While Alice navigates the wake of the HCV Orca attack, she makes a bargain with John Doe.

The Hacker Chronicles 

Presented by Tenable. Learn more at Tenable.com/Alice

Vote for The Hacker Chronicles in the 2nd Annual Signal Listener's Choice Award.

---

Credits: 

Starring Michael C. Hall as John Doe

And Chloe Taylor as Alice

Executive Produced by Michael C. Hall, Jerome Robert, Skyler Schmanski and Ian Faison

Directed by Rex New

Written for Audio by Rex New, Jerome Robert, & Skyler Schmanski

Story based on the Novella The Hacker Chronicles created by Jerome Robert and written by Skyler Schmanski

With

Nicole Britton as Katie

Levi Squier as Tech Support

Jimmie Yamaguchi as Ryan

Douglas Thornton as Broadcaster

The Hacker Chronicles is produced by Caspian Studios. 

Produced by Taylor Brim & Rex New.

Produced by Dane Eckerle

Supervising Creative Producer: Landon Pontius

Sound Design and Mixing by Dan Scott

Associate Producer: Mark Wolf Roberts

Dialogue Editing by Nick Canepa and Scott Goodrich

Production Support by SJ Nichols, Bradley Glanzrock, Jon Libbey 

and Dani Godard. 

Marketing Support from Dino Pasalic, Kyle Rusca, Dylan Langlois and Rockable

Additional Production Support provided by Echo Mountain Studios

Episode Transcription

Broadcaster:

The climate change protest has brought all vehicle entries to the Port of Valencia. The activists are accusing the port of greenwashing, and are calling on authorities to take action to respect their carbon neutrality commitments.

Alice:

I see what you're saying. I mean, this is not how we planned to shut the port down, but-

John Doe:

You messed up the biggest operation we've ever attempted.

Alice:

Oh, no. Your buddy Carl did not know there was an operating system upgrade to that boat's navigation systems.

John Doe:

What?

Alice:

Yeah, I think he has some explaining to do.

John Doe:

Why didn't you tell me about this?

Alice:

Because Carl asked me not to.

John Doe:

Amateurs. You care to fill me in on any other details?

Alice:

Okay. After I saw there was an operating system upgrade, I went through the code. The upgrades addressed compatibility issues with the GPS system they use. I didn't see anything that would change the way our payload works. You can talk to Carl. He saw the whole thing. He can even send you the code, everything you need. Hello? Asshole.

Katie:

Oh, Alice, why is your ringtone so that whatever that music is?

Alice:

Ugh, it's my brother. It's the third time Ryan has called today.

Katie:

Okay, well, can you please answer it, and just make it go, make that music go away. It's actually, it's the opposite of [foreign language 00:02:06].

Alice:

Yeah, sure.

Katie:

Thank you.

Alice:

Hey, Ryan. I really can't talk right now.

Ryan:

I get it. My little sister's too busy drinking [inaudible 00:02:18] spritzers in Paris.

Alice:

No, I'm not. I'm dealing with this weird thing at work right now. So sorry.

Ryan:

Here's something else you can deal with. Tell your boss you need May 12th off because Natalia and I are getting married.

Alice:

Oh God. She said yes?

Ryan:

She said yes. Alice, did I lose you? Hello? What's going on?

Alice:

No, no. I just, I can't. I just ... This is crazy news. Oh my God, Ryan, I'm so happy for you. I never thought I'd see this day.

Ryan:

Me neither. Usually I'm the one being proposed to, so you know.

Alice:

Oh God. I'm going to pretend I didn't hear that. So, whoa. May 12th, huh? Well, that's just a few months away. Really quick engagement.

Ryan:

Yeah, but when you know, you know, plus we got a great deal on the venue, and we can thank Arthur for that because he's been helping me with everything.

Alice:

What do you mean? You're getting married in Lake Placid? That's not what I expected.

Ryan:

Destination wedding baby. Ski towns are so hot right now.

Alice:

Oh God. Ryan, I'm so sorry, but my boss is calling, and I really, really have to take this. Okay. But I promise I'll call you back.

Ryan:

Oh, good. Oh, good. And remember PTO, May 12th.

Alice:

May 12th. Wait, do I even get vacation time? Oh, forget it. One challenge at a time. Hey John.

John Doe:

I spoke to Carl.

Alice:

And?

John Doe:

He confirmed your story. It turns out that he was not CC'd on a few work emails. It's pathetic. So much for an insider.

Alice:

Did he send you the code?

John Doe:

Yes, you made the right call. As for why it didn't work, we'll figure that out in time.

Alice:

And you could say sorry.

John Doe:

I could do a lot of things, Alice, but the reality is that sometimes we have to swallow a camel.

Alice:

Swallow a camel? I don't know what that means, but sounds painful. Anyway, I need to ask you a question.

John Doe:

Yes.

Alice:

Well, I just got off the phone with my brother, and he's getting married on May 12th, so I'm going to need to take some time off to travel. And I'm family, and there's probably some things I've got to do for it. I don't know, but I don't know how this blackmail slash indentured servitude thing works, but I got to ask. Okay, are you doing that thing where you hang up but don't say bye?

John Doe:

No, I'm just looking at your brother's social media. I don't see anything about an engagement.

Alice:

I really wish you wouldn't keep tabs on everyone I know.

John Doe:

Well, how do I know this is an ploy for escape?

Alice:

It's going to be a little difficult to fake my brother's wedding.

John Doe:

I don't have time for this. Listen, our contact at Interpol recently messaged me. She has a new job for us. Have you heard of a British football team called Wakefield City, or as you would call it, soccer?

Alice:

No. Competitive sports are a breeding ground for fascism.

John Doe:

Always quick with the quip. You kids. Well, the team was purchased a few years ago by a Russian oligarch named Andre Novakov. Her contact at Interpol believes Andre is using the football club to launder dirty money.

Alice:

Okay. I'm not super up on world events, but I know enough to ask how is a Russian oligarch allowed to own a soccer team right now?

John Doe:

Well, after Russia's invasion of Crimea in 2014, Andre renounced his Russian business ties. It was a very public showing. He left billions on the table, and settled in the United Kingdom. If you want to watch a man pat himself on the back for 90 minutes, you can watch the documentary he hired someone to make about himself.

Alice:

Okay, so what?

John Doe:

So our contact thinks he is lying and still knee-deep in Russian affairs. Andre has invested quite a bit of money in Wakefield City. Of course, governments around the world have looked into Andre. They think he's on the up and up. But when someone has enough money, their own image is a commodity. Our contact at Interpol believes that Wakefield City is the most logical place to begin.

Alice:

Okay. But what I don't get is why he would use a soccer team to launder money. I mean, can't he just buy art and luxury condos like a normal super rich Russian?

John Doe:

Well, remember what we say, Alice. Our targets are most vulnerable where they're most comfortable. For Andre, a football team isn't just a business, is a trophy, a toy, a chance for him to live out his teenage fantasies of football glory. He trains with the athletes. He's promised millions to upgrade their team's pitch. He even paid for his backup goalkeeper's wedding.

Alice:

Whoa.

John Doe:

You should be careful who you let do you favors.

Alice:

Oh. My brother needs a boss like that.

John Doe:

Yeah, funny. Look, all that is to say is the one place where he is going to be security lazy, for lack of a better term. Tell you what, Alice. I believe in balance, and for every stick there must be a carrot. You get into Wakefield City and get domain domination in three days, and I'll give you two weeks of PTO as they say in the corporate world.

Alice:

That's awesome. Wait a minute though. A carrot and a stick? I'm a horse to you now? Do you eat those too, or just camels?

John Doe:

I could have picked any equine. I picked you. Remember that.

Alice:

Hello? I hope he chokes on that freaking camel. Okay, get this done in three days, and you will get more guaranteed vacation time than most Americans. Shot going up to the cyber criminal life. But this is going to be tough. Wakefield City is a big company, even if they're a soccer team. Let's find out what they're worth. Maybe I get an idea of what I'm up against. Wow. The team's valued at $540 million. Apparently though that's the middle of the pack for a British football team in whatever this Premier League is. And according to LinkedIn, this team has 433 employees. Man. Well, that's 433 targets to start with. Okay? What's our strategy here Ableton? No, that's not going to work. That'll take too much time, and I don't have time. Oh wait, how did I snag that pharmaceutical executive? Oh, yeah. It was pretty easy. He was always posting on LinkedIn, and all I had to do was send a phishing email saying there was a new LinkedIn influencer program.

He clicked and boom, spearfished. I bet one of these 433 will take the bait. Nope, not you. Not you. Oh, that person hasn't posted in weeks. Come on dude. I want to know you. Definitely not. This can't. What is going on with your nose, dude? Oh man, Alice, chill out. That was rude. No good options just yet. Ah, here we go, Anish Patel. Looks like he's trying to be an HR influencer on LinkedIn. Huh, not going to lie. Anish, this nursing room you just helped build at Wakefield City looks great. Must be awesome to be a mom working at Wakefield City. Go, moms. You know, I'm really sorry, Anish. You seemed like such a nice guy. But your need for validation is just begging for someone like me to come along. Now, time to grab one of my spearfishing templates and tailor it to a Anish.

A little fluff here. A little ego boost over there. This email's going to look like it came from LinkedIn headquarters itself. I mean, "You're invited to participate in a survey for influencers." Clearly you are one Anish, but really you're giving me your information. God, Ableton, remember when this shit made your stomach turn? What happened to you? John Doe was right when he caught me. He said spearfishing is the oldest trick in the book for a reason. Because we all think we're special, even you Anish, and sent. He clicked it already. I don't know how you already filled that out. Okay, Anish, you really need to find validation somewhere else. But let's send you that booby trapped PDF about our influencer program seeing how trigger-happy you are.

I'm sure you'll have opened it in the next, right on cue. Damn, Anish, you're a walk-in cybersecurity safety hazard. But thanks because I'm in now. Let's get domain domination. Okay, enumeration done. That's a fairly welcoming IT environment right there. Thank you very much. Wait, I have access to another account? I didn't even have to move laterally. I could dump an IT admin's credential right from Anish's machine. It was stored in his security account manager, which means this admin very recently and very carelessly logged into Anish's computer. And here's another privileged account? Nope, something doesn't smell right. This is too easy. It's like someone wants me to find these accounts. All right, I'm not falling for this. Where's that burner phone?

Tech Support:

Hello?

Alice:

Hey, tech support. How's my favorite nihilist doing?

Tech Support:

What is this saying? The simulation we call existence is coined for us one day at a time. Just a pitiful, pithy way for us to make the march to the end of our lives tolerable.

Alice:

Yeah. God, we talk at least what every few weeks? And I've noticed you've been kind of down for a while, and not in the life is meaningless kind of way.

Tech Support:

I've worked with a few Danes, and the Danish people have saying, "Sometimes you have to swallow a camel." It means, oh, well things didn't go the way I wanted them to, but I'm just going to live with it. Sometimes I look back at my entire life, and I'm just swallowing one camel after another. I'm choking on the humps.

Alice:

That's so funny. Someone told me that today. Huh. Anyway, I've actually got an issue of my own I need to talk to you about, since you're tech support for my hacking kit.

Tech Support:

Be my guest.

Alice:

Okay. Well, I'm trying to get domain domination in my target, but these admin accounts that I'm seeing, they're just too easy to get access to. They're like, I think they're honey pots.

Tech Support:

Fake accounts with domain admin controls that are designed to trap you, when you get access to them, the company's IT team knows they're dealing with a hacker, and they kick you out.

Alice:

I, yeah, I know what a honeypot is, but thank you. However, I've seen a lot of them in this system, like never seen so many everywhere I look.

Tech Support:

Oh, that's tough.

Alice:

Yeah, and I only have three days. I'm wondering if there's some kind of tool I can use to identify what's legit versus what's honey.

Tech Support:

That's something I've never thought about. That would be an excellent addition to the exploit kit.

Alice:

Oh, wouldn't it? It'd be really helpful right now.

Tech Support:

Well, unfortunately [inaudible 00:14:44], I think you're going to have to do this manually and use your common sense. You'll have to consider each account, and ask yourself if it's just too obvious. The more difficult the account is to access, the more likely it is to be authentic. Just tread carefully, or your shoes could get very, very sticky.

Alice:

That's going to take forever.

Tech Support:

Oh, I thought you said you had three days, not eternity.

Alice:

Ha ha. Very funny.

Tech Support:

Yeah, I thought I would add some levity. Hearing you laugh cheers me up. I must admit. But sadly, when the laughter ends, sense of void begins again.

Alice:

Oh, have you ever thought maybe you just need a vacation?

Tech Support:

I don't see much purpose to leisure when I have no purpose whatsoever.

Alice:

Okay. But it's nice to embrace not having a purpose for a few days. I'm just saying.

Tech Support:

Thank you for your input.

Alice:

Thank. Okay. You're welcome. Talk to you soon.

Tech Support:

Goodbye.

Alice:

Ugh, that was dark. I'm really worried about him. Okay, time to get to work.

John Doe:

Yes.

Alice:

Hey, it's your horse. I just wanted to let you know I got domain domination in Wakefield City.

John Doe:

I'm impressed. You got domain domination in less than two days.

Alice:

Yes sir. And I'm sending you the credentials now. There you go. But there is one thing.

John Doe:

Yes.

Alice:

Well, as we've both established, I have domain domination, which means we can move through Wakefield systems laterally as an administrator. I mean, we could even take control of their stadium scoreboard, but Andre uses his own machine, and we don't have admin privileges on it. So in other words, we can't get into his computer, but we have access to Wakefield City's mail server. So we can still read the emails Andre sends and receives from his Wakefield City email address, which is definitely something.

John Doe:

It is. Reading his emails is an excellent start. So let me know when you want to begin using your PTO.

Alice:

Yeah, I had a question about that. So PTO stands for paid time off. So what do I get per day? Hello? Ah, come on. Anyway, Katie, are we doing wine night?

Katie:

Of course.

Alice:

I feel like celebrating.

Speaker 1:

You have one new message. To play your messages, press one.

Ryan:

Alice, Natalia and I just got your flowers, and I've got to thank you so much. They are, well, I'll be honest with you, Alice. I don't really understand flowers, but I'm pretty sure that these are beautiful. At the very least, orchids are Natalia's favorite flowers. I have no idea how you knew. How did you know? And good intel for me too, so. Well, thanks for doing me a solid sis.

Alice:

Wait, what? Flowers? I did not send Ryan and Natalia flowers. Oh, that's one line too far John.

John Doe:

To what do I owe this pleasure?

Alice:

Oh, cut the BS John. Did you send my brother flowers?

John Doe:

To celebrate his engagement on your behalf, but more importantly, I had to make sure you were telling the truth.

Alice:

Just leave him out of this. Okay?

John Doe:

Family is everything Alice. And you've been so busy with work. You haven't gotten Ryan and Natalia a single gift.

Alice:

John, stay away from them. They have nothing to do with you.

John Doe:

If they know you, they have everything to do with me.

Katie:

Alice.

Alice:

Yeah.

Katie:

Are you still coming to Wine Night? I invited some Spanish beatboxers I saw on TikTok.

Alice:

No, I'm sorry. I can't make it. Something just came up with work. Okay. It's an emergency.

Katie:

Okay, well, if things change, you know where to find us.

Alice:

Yeah. We'll know where to find you, and so will he.

 

 

The Hacker Chronicles, presented by Tenable. Learn more at tenable.com/alice. Starring Michael C. Hall as John Doe, and Chloe Taylor as Alice. Executive produced by Michael C. Hall, Jerome Robert, Skyler Schmanski and Ian Faison. Directed by Rex New. Written for audio by Rex New, Jerome Robert and Skylar Schmanski. Story based on the novella The Hacker Chronicles, created by Jerome Robert and written by Skyler Schmanski with Nicole Britton is Katie, Levi Squier as Tech Support, Jimmy Yamaguchi as Ryan, Douglas Thornton as Broadcaster. The Hacker Chronicles is produced by Caspian Studios, produced by Taylor Brim and Rex New, produced by Dan Eckerle. Supervising Creative Producer is Landon Pontius. Sound Design and mixing is by Dan Scott. Associate producer is Mark Wolf Roberts. Dialogue editing by Nick Canepa and Scott Goodrich. Production support by SJ Nichols, Bradley Glanzrock, Jon Libbey and Dani Godard. Marketing support from Dino Pasalic, Kyle Rusca, Dylan Langlois and Rockable. Additional production support provided by Echo Mountain Studios. Learn more at tenable.com/alice
www.caspianstudios.com