Hacker Answers Penetration Test Questions From Twitter | Tech Support | WIRED

Поділитися
Вставка
  • Опубліковано 22 тра 2024
  • Hacker and expert security consultant Jayson E. Street joins WIRED to answer your penetration test questions from Twitter. What does penetration testing entail? What are some of the most underrated physical tools used for pen tests? How can I tell if my home wifi network is compromised?
    Director: Justin Wolfson
    Director of Photography: Rahil Ashruff
    Editor: Richard Trammell
    Expert: Jayson E. Street
    Line Producer: Joseph Buscemi
    Associate Producer: Brandon White
    Production Manager: D. Eric Martinez
    Production Coordinator: Fernando Davila
    Casting Producer: Nicholas Sawyer
    Camera Operator: Cloud
    Sound Mixer: Brett Van Deusen
    Production Assistant: Sonia Butt
    Post Production Supervisor: Alexa Deutsch
    Post Production Coordinator: Ian Bryant
    Supervising Editor: Doug Larsen
    Additional Editor: Paul Tael
    Assistant Editor: Lauren Worona
    Still haven’t subscribed to WIRED on UA-cam? ►► wrd.cm/15fP7B7
    Listen to the Get WIRED podcast ►► link.chtbl.com/wired-ytc-desc
    Want more WIRED? Get the magazine ►► subscribe.wired.com/subscribe...
    Follow WIRED:
    Instagram ►► / wired
    Twitter ►► / wired
    Facebook ►► / wired
    Tik Tok ►► / wired
    Get more incredible stories on science and tech with our daily newsletter: wrd.cm/DailyYT
    Also, check out the free WIRED channel on Roku, Apple TV, Amazon Fire TV, and Android TV.
    ABOUT WIRED
    WIRED is where tomorrow is realized. Through thought-provoking stories and videos, WIRED explores the future of business, innovation, and culture.
  • Наука та технологія

КОМЕНТАРІ • 1,7 тис.

  • @lameware
    @lameware 8 місяців тому +5426

    "Every employee is part of the security team" -- This is such a good take. I wish I could get my coworkers to understand this.

    • @bpb210
      @bpb210 8 місяців тому +62

      But how do you motivate completely uninterested employees to learn about IT security? (Assuming management is also just as uninterested.)

    • @user-cj6zg5xk5u
      @user-cj6zg5xk5u 8 місяців тому +6

      I certainly sense no interest assuming management spoke up.

    • @embersaffron5522
      @embersaffron5522 8 місяців тому +110

      They probably don't get paid enough to care about their normal job, let alone security

    • @TheGuy3-D
      @TheGuy3-D 8 місяців тому

      ​@@bpb210It's a culture thing. My team sends out pretty regular phishing tests via email that we send to specific departments, or all employees.

    • @TomCruz54321
      @TomCruz54321 8 місяців тому +1

      🔖Nah man, humans are just too stůpid. In my country, everyday we got dozens of warnings about text scams and everyday hundreds of people still fall victim. Humans have been getting scammed since the caveman days and they'll still get scammed til eternity, the technology just changes but the scams stay the same. MLM scams today are just modern variations of investment scams in the early 1900s.

  • @swankeepers
    @swankeepers 8 місяців тому +2803

    As has often been said, the defenders (blue team) have to get it right every single time. The attackers (red team) only have to get it right once.

    • @basse889990
      @basse889990 8 місяців тому +117

      True, until the attackers get inside. Then they have to get it right each time to not get caught. They just need to make a single mistake to get caught by the blue team

    • @igmusicandflying
      @igmusicandflying 8 місяців тому

      @@basse889990 Truth. Makes my job much easier when your average hacker's first thought is "I'll start a cryptominer!".

    • @Thomas0x00
      @Thomas0x00 8 місяців тому +40

      @@basse889990 facts. But sadly I have often seen that eventho blue teams are able to detect, rapid containment can be incredible hard.

    • @benhook1013
      @benhook1013 8 місяців тому +1

      @@basse889990 again still much easier, its not the case that any single mistake will get them alerted. In some environments, monitoring may never pick up the attack happened, and companies only know when the data gets released or sent a ransom (this happens a lot...). Blue team has a much harder job every single time.

    • @sebastiang7394
      @sebastiang7394 8 місяців тому +34

      That’s not entirely true. Any bigger company will have multiple layers of defence. So you get through one you might get stopped on the next level. It’s usually also just about making it uneconomical to attack you. It’s like bicycle locks. There isn’t a lock that can’t be broken open in a few seconds if you have the right tools. Still if you want to protect your bicycle a bike lock is a very useful tool and if the bike next to you has a shittier lock it’s likely that bike will be stolen before yours.

  • @faithblack3851
    @faithblack3851 8 місяців тому +882

    Its amazing how much hacking occurs just by asking nicely.

    • @BlueProphet7
      @BlueProphet7 7 місяців тому +69

      Yep - most people think they are excellent judges of character, and when someone acts professional and polite while asking them for a simple innocent favor.... problems occur.

    • @sigmascrub
      @sigmascrub 5 місяців тому +20

      Not just hacking. A lot of crime is committed that way.

    • @steiner554
      @steiner554 4 місяці тому +36

      Pretending you belong somewhere also works.
      I saw a video of a guy carrying a ladder and walking into buildings like he had a job to do.
      He could go anywhere he wanted. Weirdest thing ever.

    • @paulb4334
      @paulb4334 4 місяці тому +17

      We think Ants are simple creatures. They trust everthing that carries a specific pheromone. In a corporate environment that's a badge and maybe a clipboard :)

    • @omarjimenezromero3463
      @omarjimenezromero3463 3 місяці тому +7

      almost every person want so act superior or feel superior, so if you act politely and as a newby looking for new things, you most probably are going to bypass a lot of human security because of that, it is something that sadly had happen to me some times i lost myself in a place, i usually end up with the staff at the staff side like a rookie, until they see that i am not of the staff and i am only lost, but at that point i am some steps of their boss, their servers or close/in to some critical building XD.

  • @ladvargleinad7566
    @ladvargleinad7566 7 місяців тому +587

    He is not a pen tester, he is a full-blown secret agent.

    • @towermonkey5563
      @towermonkey5563 3 місяці тому

      Ummm, what do you think pen testing is? It's all corporate espionage or defense against it. Secret agent literally by definition.

    • @razvanciurez
      @razvanciurez 2 місяці тому +10

      Agree! The eyebrows give him away...

    • @Zevilon05
      @Zevilon05 2 місяці тому +6

      Bond.. James Bond

    • @brodude7194
      @brodude7194 13 днів тому +3

      This "kind" of hacking is actually called Social Engineering, the reconnaissance part the guy was talking about. Look it up

  • @christatum
    @christatum 8 місяців тому +3003

    It always scares me how little we, the average non-tech people, actually know about all this stuff

    • @A-JAM75
      @A-JAM75 8 місяців тому +87

      I didn't understand a single word he said lol

    • @timmyd3819
      @timmyd3819 8 місяців тому +302

      As a software engineer, you have no idea. It's only getting worse too. Due to the user friendliness of modern day technology (think today's iPhone vs Windows XP) users are required to know less and less about their technology because it "just works". Combine that with the Internet of Things, that so many devices connect to the internet, that even hacking someone's Wifi toaster could be a dangerous exploit in the wrong hands because that gave them access to everything on your network.

    • @Noise_floorxx
      @Noise_floorxx 8 місяців тому +11

      True. I know the bare minimum but I don't trust much so that helps.

    • @TomCruz54321
      @TomCruz54321 8 місяців тому +1

      99% of people use the same username and passwords for all sites and they don't use two-factor authentication. I'm a computer programmer and a hobbyist hacker and I can into people's Instagram and Facebook accounts. There are professional hackers out there that are 100 times better than me. Yeah that's a scary thought.

    • @and_I_am_Life_the_fixer_of_all
      @and_I_am_Life_the_fixer_of_all 8 місяців тому +6

      with great power comes great responsibility.

  • @frandeep
    @frandeep 8 місяців тому +5035

    This guy communicates! Short and concise. Also...Wired...Give your editors a raise. They rule.

    • @Zero.0ne.
      @Zero.0ne. 8 місяців тому +63

      Wired Support is one of the best things on the internet. I think everything about it is perfect and I hope they never change it.

    • @Snarethedrummer
      @Snarethedrummer 8 місяців тому +9

      He's busy! Got things to do, companies to destroy...
      (or help, as this case may be).

    • @kelseykreppel
      @kelseykreppel 8 місяців тому +2

      Yes this!!

    • @odorlessflavorless
      @odorlessflavorless 8 місяців тому +14

      become a CEO before asking other companies to give them the raise.

    • @JacquelineHD2827
      @JacquelineHD2827 8 місяців тому +2

      I think he should do a whole series on how us mere commoners can better protect our S!

  • @iainh
    @iainh 8 місяців тому +169

    5:25 - The envelope trick is amazing, that's one I'd not considered before. I try to be as security conscious as possible, but I think I'd have fallen for that.

    • @ShawnFumo
      @ShawnFumo 8 місяців тому +24

      Yeah stuff like that and the email to the CEO about the conference are very scary. Not falling for random phishing attacks it one thing, but we usually aren't expecting anything that is more targeted.

    • @spg1794
      @spg1794 5 місяців тому

      - im sure that worked like a charm 20 years ago. these days a security camera will ID you dropping a weird envelope on the desk and the FBI will be at your door 5am ready to take you and all your computer crap down to the field office😅

    • @Roccondil
      @Roccondil 5 місяців тому +16

      Unless of course company execs don’t want a security cam in their office. IT and the security team might also not want cams in offices on the offchance the system gets compromised and now the intruders get unrestricted access to things they just need to lie low and wait around for. Bonus points if the surveillance system also includes audio.

    • @omegagilgamesh
      @omegagilgamesh 3 місяці тому +8

      ​@spg1794 Not all places that need good security have good security. Don't forget, leaders of companies are people, and people can be extremely stupid. That security breach that happened a few years ago with EA where hundreds of thousands of gamers' personal information was compromised? That was just a series of phone calls to get that information, and six months earlier guys like this dude told the CEO and Board that this was an extremely dangerous flaw, and they did nothing about it.

    • @tomlxyz
      @tomlxyz Місяць тому

      ​@@spg1794 even if they do get caught doesn't mean there won't be damages

  • @colinprincipe6293
    @colinprincipe6293 8 місяців тому +104

    I think the reason why email continues to be such an effective vector for attacks is because of the sheer volume of email people receive in a day. Especially in large companies where everyone is copied on everything

    • @onkelpappkov2666
      @onkelpappkov2666 7 місяців тому +14

      That is way too true. And then among all the clutter, someone sends a message about registering on a 3rd party website with your internal password, which you competently identify as an obvious phishing attempt, hah!
      Only to find out it was actually your boss and he actually wants you to do that and he tells you in person, completely oblivious about everything.

    • @mikeconleyphotography
      @mikeconleyphotography 6 місяців тому +5

      The reason is HTML email, which effectively hides what’s actually in the message data. Links are disguised and lead to bogus sites. Another disaster we can thank Microsoft for.

  • @AndorranStairway
    @AndorranStairway 8 місяців тому +1427

    His hot take is 100% accurate. Phishing is by far the most popular and effective way to penetrate an environment. It is far more tedious and cumbersome to develop sophisticated malware than it is to get an ignorant person to scan a QR code.
    If everyone developed basic knowledge on how to identify phishing emails, there would likely be over a 90% reduction in cyber crime out there.

    • @gman4141007
      @gman4141007 8 місяців тому +54

      Im so happy seeing someone say this. I've been saying the same thing every time something gets "hacked." i don't even call phishing hacking because it's more like a scam.

    • @benhook1013
      @benhook1013 8 місяців тому +4

      Ah you again pretending to know what your talking about. Hot take, huh? This line has been said and has remained true for over 10 years, if anything thinks this is new information you truly have no idea about IT security. (which makes sense give your other inane comments trying to call out other people)

    • @AndorranStairway
      @AndorranStairway 8 місяців тому +65

      @@benhook1013 yeah I do know what I’m talking about since I hold both CISSP and OSCP. All I did was agree with his statement, but you went on a tangent about “new information”, which I never said it was. I’m guessing you’re just an internet rando “IT security” or sysadmin wannabe who thinks using wireshark makes him Mr Robot? 😂🤡

    • @darksnow1111
      @darksnow1111 8 місяців тому +1

      ​@@benhook1013 Is your iq low or are you simply ignorant?

    • @Skank_and_Gutterboy
      @Skank_and_Gutterboy 8 місяців тому +5

      Yep, scan a QR code or click a link that says, "Click here to learn how to avoid scams..."

  • @Skooozle
    @Skooozle 8 місяців тому +299

    I love that his job title on his Microsoft badge is "hacker".

    • @GeekGamer666
      @GeekGamer666 4 місяці тому +13

      Didn't even look at that, that's hilarious.

    • @et9120
      @et9120 3 місяці тому +36

      ​@@GeekGamer666 yep, and that's the lesson, most people aren't actually checking.

    • @benoitbvg2888
      @benoitbvg2888 3 місяці тому +2

      ...but he presents himself as a "penetration tester"...

    • @ThePlayerOfGames
      @ThePlayerOfGames 3 місяці тому

      ​@@benoitbvg2888 watch Jayson E Street's DEFCON presentations, as they've said above; many peeps are only looking at the surface level without even properly seeing what's in front of them

    • @omarjimenezromero3463
      @omarjimenezromero3463 3 місяці тому +1

      @@benoitbvg2888 how much people know what a "penetration tester" do? and how much people only assume that is a thing of informatics wich they do not want to talk?

  • @isabellek1692
    @isabellek1692 7 місяців тому +84

    If this guy had an internship or some certification program I would 10000% sign up for his program

  • @callumb4980
    @callumb4980 8 місяців тому +49

    Why do all pen-testers look like they were kicked through the Las Vegas strip

    • @SobeCrunkMonster
      @SobeCrunkMonster Місяць тому +1

      great way to describe it lol

    • @uuuultra
      @uuuultra 13 днів тому

      through?

    • @hdtv2296
      @hdtv2296 2 дні тому

      Because defcon (big hacking convention) is in las vegas

  • @humane123
    @humane123 8 місяців тому +1410

    I am a security engineer and I loved every bit of this video.

    • @sreyashkanjilal4929
      @sreyashkanjilal4929 8 місяців тому +4

      hey , i really want to know something. Can you tell the process to become a penetration test/ hacker ??

    • @matt8239
      @matt8239 8 місяців тому

      Skillset. Learn as much as you can and get good at it. @@sreyashkanjilal4929

    • @danny9350
      @danny9350 8 місяців тому

      ​@sreyashkanjilal4929 Learn I.T. Helpdesk and Networking first. Then pivot into focusing on network security.
      Security gigs are an "after 5-10 years of experience" career.

    • @duplicake4054
      @duplicake4054 8 місяців тому +3

      Me too! I'm an ethical hacker/pentester

    • @JimBob1937
      @JimBob1937 8 місяців тому +1

      @@sreyashkanjilal4929 , nope, that's not a youtube block, I think it's a person removing replies, curious if the channel moderator is removing such posts.

  • @isaacheng6898
    @isaacheng6898 8 місяців тому +503

    I'm in college for cybersecurity engineering right now and this video was great, this guy explains a lot of these concepts very well for people who aren't familiar with the field

    • @mattc9598
      @mattc9598 8 місяців тому +1

      what are the requirements for getting into that field? I understand hardware far better than software, can barely code without using AI, but have thought about it. My local college says you need an degree in IT first, but they don't offer that sadly

    • @warlock8593
      @warlock8593 8 місяців тому

      ​@@mattc9598don't worry about the degree nonsense. You can learn software Online. You will be confused at first, but don't worry. Just use online resources.

    • @Kokose
      @Kokose 8 місяців тому

      ​@@mattc9598 interest in the field, mostly. As long as you're passionate you don't even need university to start as an analyst, I highly recommend researching certificates and requirements and just studying for those.

    • @RealWorldMaverick
      @RealWorldMaverick 8 місяців тому +1

      ​@mattc9598 what field exactly? It? Engineering? IT is very broad so if you can provide some additional information I may be able to point you in the right direction. What stuff are you interested in?

    • @pin65371
      @pin65371 8 місяців тому

      @@RealWorldMaverick exactly.. you dont really need a degree or even much technical knowledge to get into penetration testing. That is part of it but there are also people that specialize in the social engineering side of things. I would love to get into physical penetration testing. I listen to Darknet Diaries and that side of things honestly seems like a fun job. You are getting paid to get access to buildings and areas you shouldnt have access to.

  • @baller4life395
    @baller4life395 8 місяців тому +10

    Need more of this! Definitely my favorite speaker and content thus far. Educational and entertaining

  • @M1NML
    @M1NML 7 місяців тому +6

    This was spectacular. The way Jayson communicates shows his mastery over the subject

  • @EK-rz2xp
    @EK-rz2xp 8 місяців тому +677

    This guy is great. I'd love for him to return with more QA!

    • @johnmiller9931
      @johnmiller9931 8 місяців тому +29

      He's a very well-known name in the space. If you search his name on UA-cam, you will find tons of speaking events that he's done over the years. It'll keep you busy for a while.

    • @EK-rz2xp
      @EK-rz2xp 8 місяців тому

      Oh man, you right. I'm about to binge right now lol. Thanks, @@johnmiller9931

    • @ulalaFrugilega
      @ulalaFrugilega 6 місяців тому

      @@johnmiller9931thx!

    • @zephyrp8836
      @zephyrp8836 3 місяці тому

      Hes done presentations at Defcon, he's very entertaining

    • @yasirhashmi165
      @yasirhashmi165 Місяць тому

      WHT is his name

  • @tommyakesson8858
    @tommyakesson8858 8 місяців тому +265

    Talked to a guy in IT connected to banks.
    The hackers can scope people so well.
    A CEO had his kid at a school. A major incident happened at that school. Within less than an hour they had sent a very official looking e-mail to the CEO with a link, that they said was for more information about the schools reaction amd which children were affected.
    So they had scouter the CEO and his family, and set alerts to if media wrote anything about things such as the childs school.
    Kinda scary

    • @lollubrick
      @lollubrick 6 місяців тому +12

      or they played a role in whatever happened

    • @KMKZE-ho5wk
      @KMKZE-ho5wk 3 місяці тому

      I worked at a high class hotel for some time and had to prepare a report where I wrote everything down I could find on the internet about our guests. You wouldn't believe how much info you get about millionaires/billionaires, just by googling them.

  • @bulwulffcristole3235
    @bulwulffcristole3235 8 місяців тому +18

    I'm CEH/OSCP myself and I have to say the information that was put out here is awesome. Way to go, and very well articulated. Lots to learn for those willing to - keep it up!

  • @rootofskynet
    @rootofskynet 8 місяців тому +1

    great explaining, jayson!
    we need a part 2 of this.

  • @HoldFastFilms
    @HoldFastFilms 8 місяців тому +272

    One time I had to argue with my manager that the request to provide server credentials to a vendor is 100% a pen-test and I was not going to oblige. We argued for days over it and I did not budge and of course it turns out it was a pen-test. Sadly, this was in an IT department and IT management is pretty clueless when it comes to this and just "want things done".

    • @LivingGuy484
      @LivingGuy484 8 місяців тому +35

      You definitely could have rubbed that in their face, great job!

    • @TomCruz54321
      @TomCruz54321 8 місяців тому +34

      Not knowing technology is one thing, but people who brag about being computer illiterate is another thing. They lash out at people helping them with security advice. I see it everyday on Reddit; *"I don't need your security advice! I don't believe in this computer mumbo jumbo! I don't believe in all these threats! You people are just being paranoid!".*

    • @JJs_playground
      @JJs_playground 8 місяців тому +20

      Did you get promoted?

    • @WarriorOfPiece
      @WarriorOfPiece 8 місяців тому +28

      Is kinda sad and pathetic that some IT managers have 0 knowledge of basic cyber security measures

    • @onkelpappkov2666
      @onkelpappkov2666 7 місяців тому +3

      ​@@WarriorOfPieceThe Jen Barbers of the IT world. People persons.

  • @Sonicgott
    @Sonicgott 8 місяців тому +239

    Even as a computer professional, and computer sales person for over 20 years, this video is still quite informative. Take the heart the information this gentleman has posted. It could save you and your company a lot of time.

  • @deelanmj
    @deelanmj 7 місяців тому

    This has to be one of my favorite Support videos on Wired (the others being Mortician Support and Doc Support). More of this, please! Very educational and enlightening.

  • @gregmgm06
    @gregmgm06 8 місяців тому +3

    Good job Jayson! Hope to see you on more of these videos! Very informative.

  • @ferryvantichelen6521
    @ferryvantichelen6521 8 місяців тому +116

    We have the rule if someone does not lock their laptop and walks away, it's fair game to send "I'll bring cake tomorrow!" in the company wide Slack channel. It's not much, but it's a start of some education about security. And cake.

    • @MLBlue30
      @MLBlue30 8 місяців тому +12

      I was told there would be cake but it was a lie. Taking my stapler was the last straw, so I burned down the building.

    • @pathosmathos6529
      @pathosmathos6529 3 місяці тому +7

      Clever! We used to change people's languages.

    • @5bars3g36
      @5bars3g36 3 місяці тому +2

      Ctrl-shift-Right (on Intel integrated graphics machines) is another good one for messing with people who leave their computer signed in.

    • @orngjce223
      @orngjce223 Місяць тому +1

      Same way Rickrolling has been one of the best ways to teach people to be cautious about which links you click.

  • @Imshady69
    @Imshady69 8 місяців тому +174

    I was an IT Security Admin for a big restaurant group. We had to go through PEN testing every year. I don't miss it one bit

    • @sreyashkanjilal4929
      @sreyashkanjilal4929 8 місяців тому +1

      hey , i really want to know something. Can you tell the process to become a penetration test/ hacker ??

    • @jameslarosa2396
      @jameslarosa2396 8 місяців тому +33

      I don't know how you guys sleep at night having to worry every minute about someone hacking into the systems you need to keep secure.

    • @duplicake4054
      @duplicake4054 8 місяців тому

      @@jameslarosa2396 Most of the time, we don't

    • @myname-mz3lo
      @myname-mz3lo 8 місяців тому

      you have to be really good at researching things on the internet instead of asking people for help thats step one lol@@sreyashkanjilal4929

    • @xbabu142x
      @xbabu142x 8 місяців тому +20

      I like to call it PEN15 testing and throw in as many phallic facsimiles as I can get away with in the report while playing dumb.

  • @ironcity4182
    @ironcity4182 8 місяців тому +7

    I enjoyed your video. I’m older going back to school at Devry for IT and Networking. At the moment got online classes dealing with Cisco security. The other wire, wireless and optical. There’s so much to learn and it’s getting more interesting as I get deeper into the tech world. I’m still on the surface while getting a solid understanding.

  • @quietstar09silver50
    @quietstar09silver50 8 місяців тому +89

    Annual pen testing reminds you it is best to not trust anyone and treat everything as suspicious. This was another good reminder to be careful online.
    Spear-phishing scares me the most. Some attempts are very hard to spot.

    • @keithd.2722
      @keithd.2722 8 місяців тому +23

      People in the security industry tend to express this a bit differently - "trust _BUT VERIFY"._

    • @GreyAzazel
      @GreyAzazel 8 місяців тому

      I've been spear phished more than a few times. Some of them are very convincing. It does make me wonder about the security of a platform like LinkedIn in conjunction with the standard first.lastname@companydomain. If email wasn't as easy to guess I think that would decrease phishing attacks of all kinds.

    • @alexandermacneil4430
      @alexandermacneil4430 8 місяців тому

      Phishing has become even more effective now that non-English speaking hackers can leverage LLM such as ChatGPT to write more convincing emails!

    • @julianakarasawa315
      @julianakarasawa315 5 місяців тому +11

      Absolutely true 😂 annual pen testing was the only time I got commended for being grumpy and telling front desk "I'm not expecting anyone, send them away" when red team tried to use me to get physical access to the building under the guise of a visit

    • @MaskedDeath_
      @MaskedDeath_ 3 місяці тому

      ​@@julianakarasawa315 They're probably going to treat that as a competition for you guys haha

  • @juliusnovachrono4370
    @juliusnovachrono4370 8 місяців тому +144

    This video is genuinely hilarious yet fascinating at the same time.

    • @AsiaDanceScene
      @AsiaDanceScene 8 місяців тому +9

      I think you spelled 'terrifying' wrong...

  • @labelleza211980
    @labelleza211980 7 місяців тому +4

    I'm still amazed on how this guy can articulate all this information for anyone to understand!

  • @levelupgoddess9289
    @levelupgoddess9289 3 місяці тому

    Love how informative this is. I watched it three times then shared it.

  • @Sunflowersarepretty
    @Sunflowersarepretty 8 місяців тому +103

    Never would I ever pick a USB no matter how tempting it feels. Also loved it when asked "how to rob a bank" and he said that he knows but wouldn't tell 😂

    • @smnsmnsmn
      @smnsmnsmn 8 місяців тому +24

      Jason has done a talk at Defcon called “Steal Everything, Kill Everyone, Cause Total Financial Ruin!” where he breaks into a building using a piece of cardboard. Cannot recommend it enough.

    • @Squant
      @Squant 8 місяців тому +14

      I'm the opposite. I'd never ignore one and honestly, I'm surprised Jayson said he would. It seems far more plausible he's got a bunch of secure burner laptops he can use to plug them in and find out what other people are trying to hack with.

    • @geshkigal
      @geshkigal 8 місяців тому

      @@smnsmnsmn he's also gone on the Darknet Diaries podcast, Ep. 6

    • @lolwtnick4362
      @lolwtnick4362 2 місяці тому

      cause he doesn't know. it's much easier to rob a armored vehicle than it is to rob a bank.

  • @anwarfaridshahudin6305
    @anwarfaridshahudin6305 8 місяців тому +82

    3:19 He's being real here 😂😂😂
    Report & documentation is the most challenging part of any job.

    • @bikeny
      @bikeny 8 місяців тому +8

      Yeah, I felt that one, too. When I was programming back in the day, 'What do you mean I have to document every single line of code?' And don't get me started on flowcharts. I had hair back then, and there were times I was pulling it out. It's all gone now, so who know what caused the baldness. At least my salt and pepper beard is working.

    • @alihms
      @alihms 8 місяців тому +4

      True. What's the most difficult part of a PhD program? Thesis write-up - not the research part of it. I know a few guys who did not complete their doctorates because of it.

    • @ShawnFumo
      @ShawnFumo 8 місяців тому +1

      @@bikenyThankfully the "document every line of code" is a bit less common now, but there is plenty of other things that are difficult to get through.

    • @realStinger
      @realStinger Місяць тому

      I hate writing reports man. Most boring part of hacking.

  • @ArthurZakaryan23
    @ArthurZakaryan23 8 місяців тому +1

    Really well explained video and it's amazing when he breaks down all the various tools he uses and how easy it is to be hacked with any number of those tools.

  • @KarmaK1984
    @KarmaK1984 3 місяці тому +1

    I’m not in the field of IT and watched this out of curiosity. He explained things so well and I understood a lot more than I thought I would! Really interesting!

  • @Luunchb0xxx
    @Luunchb0xxx 8 місяців тому +96

    So many great things going on in this video. Great explanations in plainly digestible terms of what can be opaque and jargon littered subject matter. Not only is the presenter genuinely excited by some of the questions, he obviously wants to share. Makes the content all that more authentic and enjoyable. This dude seems like he'd be a great co-worker and colleague!

  • @austinhoff66
    @austinhoff66 8 місяців тому +104

    I don’t know how you find these people but keep it up. Such great communication with so much to learn

    • @myname-mz3lo
      @myname-mz3lo 8 місяців тому +16

      he is verry famous and does conferences and talks all the time .

    • @ruk2023--
      @ruk2023-- 8 місяців тому +5

      Google "Who is the number one expert in the field that I'm interested in" and then hire them.

    • @error.418
      @error.418 8 місяців тому +5

      he's given about 1000 talks at DEFCON

    • @Spaids2
      @Spaids2 7 місяців тому

      Looks like hes part of defcon, lot of notorious hackers go there

    • @aqwandrew6330
      @aqwandrew6330 5 місяців тому

      whats defcon?@@error.418

  • @nicolavolpe531
    @nicolavolpe531 8 місяців тому +7

    This is one of the best of this series, together with Burial Support. 😂
    This guy kept me glued to the screen wanting to know more about what he had to say

  • @seclilc
    @seclilc 4 місяці тому +4

    I know Jayson personally, and he’s just an incredible human. So happy to see him here ❤

  • @sebastian04368
    @sebastian04368 8 місяців тому +25

    Out of the best videos I have seen on Wired. I hope to see a second part with that same guy. He is quite clear in the way he speaks and you can also tell he knows quite a lot 😃

  • @igmusicandflying
    @igmusicandflying 8 місяців тому +144

    Thanks for the blue team love! We love you right back, even if we don't always show it.
    Also: clipboard + hi-vis vest is also an amazing pen test tool. Bonus points if you have the metal clipboard with storage. And practice a bored, slightly disgruntled (not full on angry) look. 30 bucks at Amazon and a few basic acting chops go a LONG way to getting you into places you shouldn't be.

    • @error.418
      @error.418 8 місяців тому +8

      just go ahead and credit Deviant Ollam, please

    • @DreamsInHD
      @DreamsInHD 8 місяців тому +3

      That’s real. Go Blue Team!

    • @RogueCylon
      @RogueCylon 6 місяців тому

      He knows who pays the bill.

    • @igmusicandflying
      @igmusicandflying 6 місяців тому +5

      @@error.418 sure, why not, even though I've done this as far back as the 1980s and I'm not the first to do it.

    • @Glitchunlocked
      @Glitchunlocked 5 місяців тому +8

      @@igmusicandflying Some people are too young to realize not everything originates on the the internet lol.

  • @supremeleaderkoko
    @supremeleaderkoko 7 місяців тому +18

    More of this guy please. This stuff is so prevalent nowadays

  • @pudniskool
    @pudniskool 8 місяців тому +1

    Please bring this guy back frormore interviews. super interesting and a great speaker.

  • @PrestonMcNair
    @PrestonMcNair 8 місяців тому +51

    I’ve been a fan for a long time, read his book during my undergraduate studies. Clear, concise, and to the point.

    • @SyjaneTV
      @SyjaneTV 8 місяців тому +2

      How come your YT is verified with only 517 subs ?

  • @matt8239
    @matt8239 8 місяців тому +38

    as a security tech, it feels almost illegal releasing this video lol.

    • @XSemperIdem5
      @XSemperIdem5 8 місяців тому +28

      The bad guys already know the tricks anyway. This is serving as education so other people know what to be wary of.

    • @matt8239
      @matt8239 8 місяців тому

      of course, was more of a joke. But lots about this video easily entices the wrong crowd @@XSemperIdem5

  • @0num4
    @0num4 8 місяців тому +24

    The weakest part of your network is always the human element. Train your people on what to expect, and train them to raise the red flag when something seems at all suspicious.
    I've been in this industry for 20+ years and even I've had pen testers get through my defenses. It was a valuable lesson: even a professional isn't beyond making mistakes. And it didn't happen again.

    • @l33tninja1
      @l33tninja1 7 місяців тому +7

      Treating them with common decency also helps since they will actually care what happens. You treat them like crap they won't care about their job and so won't take actions as readily if they see something wrong. It becomes a "not my problem" situation.

    • @0num4
      @0num4 7 місяців тому +2

      @@l33tninja1 100% !! Respecting your people is a must.

  • @apu889
    @apu889 8 місяців тому +3

    I love this guy so much! He explaining things in easy way as possible

  • @schelletick8105
    @schelletick8105 8 місяців тому +10

    Your comment that, Every employee is part of the security team, is something that will always be embedded in me now, thank you so much

  • @Howtosurviveamerica
    @Howtosurviveamerica 8 місяців тому +58

    If only more concepts were as quick and easy to understand as this was. I’m in cybersecurity wanting to branch out and this was the information I needed before I got started. Thank you

    • @myname-mz3lo
      @myname-mz3lo 8 місяців тому

      this info is available everywhere online lookup network chuck or david bombal

  • @reubenk7331
    @reubenk7331 7 місяців тому

    Dang that was a really good video! I have heard little snippets of what pen testers do but this was really good!

  • @ninocharmaine-theserenadin497
    @ninocharmaine-theserenadin497 Місяць тому

    Absolutely Loved this.

  • @57thorns
    @57thorns 8 місяців тому +32

    I believe the right thing to do if you catch someone with a "get out of jail free card" is to escort them back to a public area, and wait for the person that will actually release them. However, in a real situation, there is always the threat of violence.

    • @Roccondil
      @Roccondil 5 місяців тому +1

      Either that, or call your boss who should be high enough to be able to directly call whoever is apparently responsible for the unknown person.
      Because as mentioned in the video, the numbers might be false and the answering party might give excuses why they can’t appear in person to validate the intruder, while the person you are detaining is putting pressure on you because you are costing the company precious time and money…

    • @halfsourlizard9319
      @halfsourlizard9319 3 місяці тому

      Call people?! Is it 1965 or something?!

    • @Roccondil
      @Roccondil 3 місяці тому

      ​@@halfsourlizard9319 yeah. phones didn't get tossed out in 1966.
      Or what do you think that little rectangular device in your pocket is meant to be used for?

  • @jesuslovespee
    @jesuslovespee 8 місяців тому +18

    the social engineering god himself. best talks of all time were done by this OG

  • @BlueMoon_Night
    @BlueMoon_Night 2 місяці тому

    I love these so much...Sometimes you get really good experts that know how to explain stuff simply and efficiently...so good

  • @Only1WithAnE
    @Only1WithAnE 2 дні тому

    This was super informative

  • @SV27
    @SV27 8 місяців тому +5

    Give this guy a show!

  • @kasnitch
    @kasnitch 8 місяців тому +15

    I did learn something important ... don't mess with a skilled IT person . Be well .

  • @labelleza211980
    @labelleza211980 7 місяців тому

    Great video! Very informative and well explained, in plain terms. We need more videos like this!!

  • @wisteela
    @wisteela Місяць тому

    Awesome. Great information and advice.

  • @enchantro
    @enchantro 8 місяців тому +18

    This is one of the scariest things I’ve seen about the times we live in!😳

    • @myname-mz3lo
      @myname-mz3lo 8 місяців тому +9

      ethical hackers hack so you dont get hacked if anything this is reassuring to know that there are more people like him than bad hackers out there .

  • @harshithas5024
    @harshithas5024 8 місяців тому +6

    Learned a lot! Great video, love the answers. This was so much more than I expected! Would love to see him answer more questions in future episodes!

  • @billcoutts9107
    @billcoutts9107 7 місяців тому

    One of the most useful videos in a long time. Cheers

  • @phamnguyendungnhan6720
    @phamnguyendungnhan6720 7 місяців тому

    Amazing tech/test tool. This is the 1st time I see watch, pen that are actually a camera. Thank you for the content!

  • @lawrencefrost9063
    @lawrencefrost9063 8 місяців тому +44

    Penetration Tester... They gotta figure out a new name for that profession.

    • @magicvibrations5180
      @magicvibrations5180 8 місяців тому

      We gotta ban any word that people choose to sexualize now? Penetration testing is the best description of what they're doing.

    • @3xpl0i79
      @3xpl0i79 8 місяців тому +4

      I personally like it better than "Hacker"

    • @keithd.2722
      @keithd.2722 8 місяців тому +4

      "Vulnerability documenter" just doesn't have the same ring to it.

    • @Sabbagery
      @Sabbagery 8 місяців тому +3

      How about “Penetrator”?
      wait

    • @duplicake4054
      @duplicake4054 8 місяців тому +1

      Well, at least it's true, you test to see if you can penetrate computers. I prefer 'ethical hacker' or 'cybersecurity analyst' more though

  • @jestangames
    @jestangames 8 місяців тому +5

    i remember there being a thing with apple's calendar. you could inject code when sending a schedule request, this wouldnt be a problem since you need to accept it first. but apparently if you send a schedule request for a date in the past, it automatically puts it in the target's calendar and it could run the code

  • @Crunchbite86
    @Crunchbite86 8 місяців тому

    The single most interesting video wired has done in years. Great stuff!

  • @teema.everythingtech
    @teema.everythingtech 8 місяців тому +1

    Really loved this

  • @ANAbiNader
    @ANAbiNader 8 місяців тому +23

    I cant believe that I'm a 38 year old mom giggling at "penetration tester"

    • @SchwarzeRitter
      @SchwarzeRitter 8 місяців тому +8

      Doesn't matter. Just let the giggle out. It feels good!

    • @vectoralphaAI
      @vectoralphaAI 8 місяців тому +2

      Wow you're beautiful for a 38 year old mom.

    • @ANAbiNader
      @ANAbiNader 8 місяців тому +2

      Aaaw...thanks mate :)

    • @unwantedwank666
      @unwantedwank666 8 місяців тому +1

      glad im not the only one lmaoo

  • @BananaNinja
    @BananaNinja 8 місяців тому +3

    this dude really knows his stuff & just hearing him talk about some of the tools he uses and things he's done gets me excited

    • @martinkuliza
      @martinkuliza 4 місяці тому

      LOL
      that means you're a beginner
      and that's fine... we all start somewhere
      but... TELL TALE SIGNS and all that
      don't get me wrong,
      Excitement is good and it gets you motivated
      but one day you will look back at this comment and say to yourself
      "i was stupid" LOL
      we all do it

  • @zax8961
    @zax8961 8 місяців тому

    Superb video - excellent communicator!

  • @CitroChannel
    @CitroChannel 7 місяців тому +5

    Please bring this guy back for multiple sessions! He's a great communicator with a lot of interesting insight and legit experience in cybsersecurity!

  • @GleaMDMK
    @GleaMDMK 8 місяців тому

    Fantastic video. Thank you.

  • @gran-roan
    @gran-roan 8 місяців тому +28

    This video is so concise, clear and relevant, that it really needs a 2nd part

    • @aetch77
      @aetch77 8 місяців тому +4

      Google him, his talks are not usually so technical.

    • @gran-roan
      @gran-roan 8 місяців тому

      @@aetch77 Thanks, will do

  • @KaiHolden.
    @KaiHolden. 8 місяців тому +16

    'Penetration Testing' sounds crazy💀

  • @_neovek
    @_neovek 8 місяців тому

    WOW great video!!! Always very interesting to ear someone with experience in the field !

  • @meischoice
    @meischoice 6 місяців тому +1

    Very great episode! Even more people need to watch this. It shows how easily people could be taken advantage of. It shows how socal engineering tactics are so easily performed.

  • @N0ENEMIES
    @N0ENEMIES 8 місяців тому +9

    Im not even a pen tester or "hacker" but I've always enjoyed Jayson Street's talks.

    • @N0ENEMIES
      @N0ENEMIES 8 місяців тому +3

      Lmao, a USB audit 😂

  • @ruk2023--
    @ruk2023-- 8 місяців тому +4

    Making computer hacking interesting is no small task. I love his firewall analogy.

  • @95jonnyboy
    @95jonnyboy 28 днів тому

    I thoroughly enjoyed this video

  • @loktar1234
    @loktar1234 8 місяців тому

    Thank you, very informative.

  • @AllNamesWereAlreadyTaken
    @AllNamesWereAlreadyTaken 8 місяців тому +25

    Awesome guy (you instantly feelhis passion about what he is doing) I love listening to him eventough its kinda scary !

    • @myname-mz3lo
      @myname-mz3lo 8 місяців тому

      how is it scary ? he hacks companies so that bad people dont .. its reassuring more than anything to know that there are more good hackers than bad ones

    • @AllNamesWereAlreadyTaken
      @AllNamesWereAlreadyTaken 8 місяців тому +1

      @@myname-mz3lo it's scary how easy some tricks are and how vulnerable everyone is.

  • @garcipat
    @garcipat 8 місяців тому +17

    Very cool and scary at the same time. Thank you

    • @myname-mz3lo
      @myname-mz3lo 8 місяців тому

      he is making things safer how is it scary lol ??

    • @Squant
      @Squant 8 місяців тому +1

      @@myname-mz3lo Because attacks happen constantly, every single day? I'm not scared personally, but you're talking like crime is a small-time problem. It's big.

    • @garcipat
      @garcipat 8 місяців тому

      @@myname-mz3lo its scary how few things you need to break into such high systems.

  • @arbolfest
    @arbolfest 7 днів тому

    It was a great watch. I learnt a lot about security not only for a working place, but even life itself.

  • @felixcervantes7215
    @felixcervantes7215 3 місяці тому

    Awesome video. Thanks

  • @rio197
    @rio197 7 місяців тому +3

    Finally! A cybersecurity expert that we deserve!

  • @clearmenser
    @clearmenser 8 місяців тому +7

    The expert, Jayson E. Street is a great communicator. Check out his talks, there's tons.

  • @theElrin
    @theElrin 8 місяців тому

    Thank you for a great wad of info!

  • @31446963048
    @31446963048 8 місяців тому

    Appreciate the info

  • @EyesOfByes
    @EyesOfByes 8 місяців тому +11

    6:14 #MaxFosh managed to get into the major security convention in Las Vegas, with this trick among others. He wasnt detected. He. Snuck. In. To. A. SECURITY. Convention :D

  • @rudynikoiaddo
    @rudynikoiaddo 8 місяців тому +6

    This guy is spot on. I want to be like this guy.

  • @resawohlrabe2749
    @resawohlrabe2749 8 місяців тому

    I clicked thinking I wasn’t going to be interested, but ended up watching the whole thing. Thanks- this was pretty darn cool!

  • @AfricaEric
    @AfricaEric 4 місяці тому

    This guy is awesome. Bring him back for an encore

  • @jier9904
    @jier9904 8 місяців тому +8

    love how they still call it twitter, nobody wants to call it X lmaoo

  • @seanhulbert8385
    @seanhulbert8385 8 місяців тому +9

    A lot of good tools here, we use to make all of our own tools. One thing he didn't mention 95% of the telco rooms are outside the building and once you have access to the MPO/DMARC you have ultimate access to their phones and Internet access.

  • @DeformedMonkeys
    @DeformedMonkeys 8 місяців тому

    More of this guy. He’s awesome

  • @MohamedAhmed-xg1br
    @MohamedAhmed-xg1br 8 місяців тому

    Great video very informative

  • @rerenaissanxe
    @rerenaissanxe 8 місяців тому +5

    "I'm in"
    this man is great!

    • @circeus
      @circeus 8 місяців тому +3

      he *said* you gotta say it *properly*

  • @Inscyght
    @Inscyght 7 місяців тому +6

    As a penetration tester, I can confirm this is solid information. Good high-level answers to every question.

    • @biggusdickus8452
      @biggusdickus8452 14 днів тому

      High level answers explained in low level vocabulary as well.

  • @Yhoshua_B
    @Yhoshua_B 7 місяців тому

    Really great video!

  • @ericc6820
    @ericc6820 6 місяців тому

    This is fantastic. More content like this!