Over the years I have acquired many tools and tricks used to gain entry to a target office. At DEFCON 23 I got a lot of questions regarding my custom pack, and the gear inside.

While I cannot share every detail (that would give away too many trade secrets), I have dissected the general pack here for your perusal.

Read More


I found a massive Key Space Reduction Attack on locks sold by Home Depot. The flaw lies in their procurement process, rather than the locks themselves, and enables an adversary to reduce the possible key codes for locks based on the time of shipment, identified by the approximate time of install. For commercial settings where building permits indicate construction time lines, this can give a significant advantage to an attacker in that he may use an actual key and not leave a trace. The flaw is caused by the Home Depot’s processes, not their lock vendors who have urged them not to refuse randomization.

Read More


I found a spreadsheet containing a nuclear materials database credential on Google. The technique used was very simple, but I have to wonder why such a document misplacement was overlooked. Maybe people are afraid to tell them they just stumbled upon a nuclear system fearing they might get disappeared. Well, I decided to contact them and hilarity ensued. The database was relatively benign, but the saga went on for a little longer than it should. This also resulted in my first interview for a major publication, The Guardian.

Read More

I had a nice time being interviewed by The Guardian regarding my disclosure of a password leaked from the Nuclear Regulatory Commission. While the NRC insists that this is a non-issue (and in the case of this protected system was the case), it exposes a deeper and more fundamental problem regarding how  systems are secured in the first place. First, the fact that this one file and nothing else in that directory was visible indicates Discretionary access controls rather than Role-based or mandatory. Furthermore, it shows that this type of problem can lie unsolved for years and affect more systems than people realize.

The Guardian: Carry On Leaking: When Corporate Security Goes Really, Really Wrong


The convention was fairly productive and wildly entertaining for me this year for a multitude of reasons. First, I did not go to a single talk. Instead, I decided to go the video and slide route so I could focus on the villages, interacting with others (who knew socializing could be fun), and getting into trouble. I acquired various tools, talked with several interesting people, helped empty a significant amount of alcohol from the various bars, and may have had my share of wireless mayhem in the 2.4 GHz spectrum.

More details and photos to come as I lazily update everything.