{"id":9896,"date":"2017-10-16T05:45:41","date_gmt":"2017-10-16T13:45:41","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/10\/16\/news-3669\/"},"modified":"2017-10-16T05:45:41","modified_gmt":"2017-10-16T13:45:41","slug":"news-3669","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/10\/16\/news-3669\/","title":{"rendered":"A Roundtable of Hackers Dissects the Season 3 Premiere of &#8216;Mr. Robot&#8217;"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/video-images.vice.com\/articles\/59e12e485a093d517b9acf62\/lede\/1507929765179-2_mrrobot_s3_e1_tyrell_irving_elliot_01_1920x1080.jpeg\"\/><\/p>\n<p><strong>Credit to Author: Yael Grauer| Date: Mon, 16 Oct 2017 13:33:12 +0000<\/strong><\/p>\n<p><i> Not only does Mr. Robot set the bar for dystopian hacker suspense thrillers, it&#8217;s also a great hacking show that&#8217;s true to the culture and portrays technology authentically. So I gathered some of the smartest hackers I know in a Keybase group chat to talk about the show. (The chat transcript has been edited for brevity and clarity.) This week&#8217;s team of experts include:<\/i><\/p>\n<ul>\n<li><a href=\"https:\/\/redshiftzero.github.io\/\" target=\"_blank\">Jen Helsby<\/a>: <a href=\"https:\/\/securedrop.org\/\" target=\"_blank\">SecureDrop<\/a> lead developer at <a href=\"https:\/\/freedom.press\/\" target=\"_blank\">Freedom of the Press Foundation<\/a>.<\/li>\n<li><a href=\"http:\/\/twitter.com\/jason_nstar\" target=\"_blank\">Jason Hernandez<\/a>: a technologist who studies surveillance and works in IT, and is the tech editor for <a href=\"http:\/\/nstarpost.com\/\" target=\"_blank\">North Star Post<\/a>.<\/li>\n<li><a href=\"https:\/\/freedom.press\/about\/staff\/harlo-holmes\" target=\"_blank\">Harlo Holmes<\/a>: a digital security trainer at <a href=\"https:\/\/freedom.press\/\" target=\"_blank\">Freedom of the Press Foundation<\/a>.<\/li>\n<li><a href=\"https:\/\/theintercept.com\/staff\/micah-lee\/\" target=\"_blank\">Micah Lee<\/a>: a technologist with a focus on operational security, source protection, privacy and cryptography, as well as a journalist at The Intercept.<\/li>\n<li><a href=\"https:\/\/lucyparsonslabs.com\/board\/\" target=\"_blank\">Freddy Martinez<\/a>: a technologist working on whistle blowing technologies. He serves as a Director for the Chicago-based Lucy Parsons Labs.<\/li>\n<li><a href=\"https:\/\/about.me\/geminiimatt\" target=\"_blank\">Matt Mitchell<\/a>: a hacker who leads <a href=\"http:\/\/www.meetup.com\/New-York-Cryptoparty-Network\/events\/\" target=\"_blank\">cryptoharlem,<\/a> which aims to teach basic cryptography tools in the inner city. He also trains newsroom journalists (at<a href=\"https:\/\/www.journalistsecurity.net\/\" target=\"_blank\"> Global Journalist Security<\/a>), activists &#038; human rights defenders in digital &#038; operational security.<\/li>\n<\/ul>\n<p>This week we discussed <a href=\"http:\/\/kernelmag.dailydot.com\/issue-sections\/headline-story\/16863\/plaid-parliament-of-pwning-hacker-ctf\/\" target=\"_blank\">Capture the Flag<\/a>, reverse shell tools, and Shodan.io:<\/p>\n<p><b> Yael: <\/b>Shall we talk about Stage 2?<\/p>\n<p><b> Micah: <\/b>So Stage 2 is a plan for a straight-up terrorist attack? They&#8217;re planning on taking down a whole building, with people in it and everything? Eliot didn&#8217;t know what stage 2 was until this episode, but Mr. Robot planned for it all along,<\/p>\n<p><b> Jen: <\/b>It sounds like yes, they want to blow up a building. Not sure why it&#8217;s necessary to have people inside.<\/p>\n<p><b> Freddy<\/b>: Last season they also talked about &#8220;blowing up&#8221; Evil Corp, but in season 1, Elliot said, &#8220;you can&#8217;t convince me with this David Koresh shit,&#8221; so I&#8217;m not sure. It&#8217;s possible Mr. Robot is leading it all and Elliot has no clue. But blow up\/burn down might be a small distinction.<\/p>\n<p><b> Harlo<\/b>: He does say that in this episode. &#8220;Blowing up all those people&#8221; along with docs, land deeds, etc.<\/p>\n<p><b> Yael<\/b>: And everyone&#8217;s student loans.<\/p>\n<p><b> Harlo<\/b>: I WON&#8217;T CRY IF THAT HAPPENS.<\/p>\n<p><b> Freddy: <\/b><a href=\"https:\/\/www.techworm.net\/2014\/11\/redhack-hacks-turkeys-electric-distribution-company-website-delete-bills-worth-1-5-trillion-turkish-lira.html\" target=\"_blank\">https:\/\/www.techworm.net\/2014\/11\/redhack-hacks-turkeys-electric-distribution-company-website-delete-bills-worth-1-5-trillion-turkish-lira.html<\/a><\/p>\n<p><b> Yael:<\/b> Yeah, I think Mr. Robot wanted to blow it up and Elliot wanted to stop that, which is why he got shot. Why aren&#8217;t they having a discussion about tactics? How to blow up the building with nobody in it?<\/p>\n<p><b> Freddy:<\/b><a href=\"https:\/\/www.techworm.net\/2014\/11\/redhack-hacks-turkeys-electric-distribution-company-website-delete-bills-worth-1-5-trillion-turkish-lira.html\" target=\"_blank\"> <\/a>Sounds like they were going to burn down the building (IMHO) and not blow it up. I don&#8217;t know why Darlene said that. Hacking the UPS (uninterrupted power supplies) sets off a fire, no?<\/p>\n<p><b> Jen:<\/b> Ah yeah, you&#8217;re right. UPS fires can&#8217;t melt steel beams, though.<\/p>\n<p><b> Harlo<\/b>: Well, it&#8217;s all in this bin file, you see.<\/p>\n<p><b> Yael<\/b>: Elliot is freaking out when he finds out plan 2 is taking place and he&#8230; calls 911 and hangs up, turns on some bug scanner, and gets on a laptop that&#8217;s been unattended for a week?<\/p>\n<p><b> Freddy<\/b>: I thought it was a white noise generator<\/p>\n<p><b> Micah<\/b>: His laptop, like all computers in this show, was running <a href=\"https:\/\/www.kali.org\/\" target=\"_blank\">Kali Linux<\/a>. Well, not all computers, but all h4x0r computers.<\/p>\n<p><b> Jason<\/b>: Kali is easy for a producer to put on a bootable disk and plug in as needed.<\/p>\n<p><b> Yael<\/b>: Well, Elliot DOES use Protonmail, so he lost his hacker kewl a long time ago, at least with me. I bet he wouldn&#8217;t even use Keybase chat.<\/p>\n<p><b> Harlo<\/b>: Somebody get Kor on the phone and tell him about Qubes.<\/p>\n<p><b> Matt<\/b>: Yeah, I wanna see Qubes OS. No shade to the collection of tools by offensive security but not everyone is rolling with Kali on their box.<\/p>\n<p><b> Jen<\/b>: Yeah, they should show Elliot&#8217;s Kali AppVM if they really want to be realistic.<\/p>\n<p><b> Jason<\/b>: Also, you can run Kali in Qubes.<\/p>\n<p><b> Matt<\/b>: Maybe it&#8217;s a VM (<a href=\"https:\/\/en.wikipedia.org\/wiki\/Virtual_machine\" target=\"_blank\">virtual machine<\/a>), which is why he didn&#8217;t change the background to a picture.<\/p>\n<p><b> Micah<\/b>: Kali is pretty sweet for offense tbh, especially because it has all the patched Wi-Fi drivers for monitor mode, packet injection, and all of that.<\/p>\n<p><b> Yael:<\/b> I was going to tell Elliot that if you call 911 and hang up, they usually think you&#8217;re kidnapped. I wonder what a better thing to do after &#8220;accidentally&#8221; calling 911 would be.<\/p>\n<p><b> Jen<\/b>: Probably being like, &#8220;my kid was playing with the phone, sorry!&#8221;<\/p>\n<p><b> Matt:<\/b> In NYC you can call and hang up, nothing will happen. I have done it before. No call back. Nada. You dead.<\/p>\n<p><b> Jason<\/b>: Also, we can imagine the state of the 911 network is less reliable than present day, where 911 just goes out for half the country for 3 days because someone forgot to renew a domain name.<\/p>\n<p><b> Yael<\/b>: Oh, somewhere before this scene Dark Army was talking about how Elliot&#8217;s dad used to work for them and now Elliot does. Was this the first time that was stated explicitly?<\/p>\n<p><b> Matt<\/b>: YES. I liked the scene where they say they use Elliot (and his dad) for their focus.<\/p>\n<p><b> Freddy<\/b>: If he was working for them, how come they were broke? Crime pays.<\/p>\n<p><b> Micah<\/b>: It sure sounds like the Dark Army is planning on killing Elliot when they&#8217;re done with him.<\/p>\n<p><b> Jason<\/b>: I just don&#8217;t get the motive for anybody on the Dark Army.<\/p>\n<p><b> Freddy<\/b>: Presumably they have connections with People&#8217;s Republic of China and are interested in geo political hacking.<\/p>\n<p><b> Jason<\/b>: I guess&#8230;why hasn&#8217;t Taiwan been invaded then?<\/p>\n<p><b> Yael<\/b>: It&#8217;s not them simply trying to inflate the price of Ecoin?<\/p>\n<p><b> Matt<\/b>: Well seems from season 2 Dark Army became more than hackers with masks, they had guns, poison pills, and connection to China.<\/p>\n<p><b> Freddy<\/b>: Bureau 121 <a href=\"http:\/\/www.businessinsider.com\/north-korean-hackers-working-in-china-2015-1\" target=\"_blank\">hacks for [North Korea<\/a>], but I think is physically in China.<\/p>\n<p><b> Matt<\/b>: They want political gain in Washington and financial gain via Ecoin, but seems the end game is much bigger. In season 3, they go from world&#8217;s smartest motorcycle\/Uzi gang to dominant world players.<\/p>\n<div data-iframely-id=\"JBA8CuI\" class=\"article__embed article__embed--iframely\">\n<div style=\"left: 0; width: 100%; height: 0; position: relative; padding-bottom: 56.2493%;\" data-iframely-smart-iframe=\"true\"><iframe  src= width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <\/div>\n<\/div>\n<p><b> Yael<\/b>: So, let&#8217;s talk about the NSA building.<\/p>\n<p><b> Jason<\/b>: The Intercept <a href=\"https:\/\/theintercept.com\/2016\/11\/16\/the-nsas-spy-hub-in-new-york-hidden-in-plain-sight\/\" target=\"_blank\">had an article on<\/a> it while ago. Full of international telephone switches and NSA hardware.<\/p>\n<p><b> Freddy<\/b>: Henrik Moltke is a beast at finding these NSA buildings.<\/p>\n<p><b> Micah<\/b>: So, while the rest of NYC had a power outage lasting for days, the hackerspace was throwing a raging party, and it also happened to be during a major CTF (<a href=\"https:\/\/ctftime.org\/ctf-wtf\/\" target=\"_blank\">Capture the Flag<\/a>).<\/p>\n<p><b> Yael<\/b>: It&#8217;s on the way from Elliot&#8217;s apartment to the world&#8217;s loudest CTF qualifier.<\/p>\n<p><b> Harlo<\/b>: WITH THE WORST MUSIC<\/p>\n<p><b> Micah<\/b>: &#8220;The only hackerspace with dedicated fiber connections.&#8221;<\/p>\n<p><b> Freddy<\/b>: LEFT. The only hackerspace left.<\/p>\n<p><b> Matt:<\/b> OH, I love how hackerspaces feel like a techno club. And hackers are beautiful!!!<\/p>\n<p><b> Jen: <\/b>That seems like a very annoying environment to work on a CTF with like 10 bros behind your computer as you&#8217;re trying to figure something out.<\/p>\n<p><b> Jason: <\/b>They should have just gone full HACKERS and had someone on roller skates.<\/p>\n<p><b> Freddy:<\/b> Nobody sits around and yells during CTFs unless it&#8217;s crash and burn, where if you fail programming (after first compilation) you have to drink.<\/p>\n<p><b> Yael: <\/b>That was way too frickin&#8217; loud for a CTF. And I don&#8217;t think you&#8217;re allowed to get help from randos. DQed.<\/p>\n<p><b> Matt: <\/b>Well at cyber security awareness week (CSAW) at NYU Poly is a big one that is pretty quiet, but at <a href=\"https:\/\/motherboard.vice.com\/en_us\/article\/xygxn4\/chaos-communication-congress-a-very-german-hacking-conference-5886b73a9848b145c38b3f06\">CCC<\/a> it&#8217;s loud.<\/p>\n<p><b> Micah:<\/b> Have you ever been to the <a href=\"https:\/\/motherboard.vice.com\/en_us\/topic\/def-con\">DEF CON<\/a> CTF area, with incredibly blaring music and huge animations on projectors all the time?<\/p>\n<p><b> Matt: <\/b>Yeah DEF CON is loud all the time, all day, every day.<\/p>\n<p><b> Yael<\/b>: I was at the CTF area at the last DEF CON and it was hidden behind the stage and very quiet. Unless I&#8217;m just not remembering the dub step; there was a lot of alcohol involved. I do remember having long conversations with the team putting it on, though, so it couldn&#8217;t have been that loud.<\/p>\n<p><b> Freddy:<\/b> The music at the hackerspace has to have loud beats, personally, I hack to only trap music.<\/p>\n<p><b> Harlo:<\/b> That was some skrillex shit.<\/p>\n<p><b> Freddy: <\/b>Some people hack to ambient noise. For example, I like <a href=\"https:\/\/open.spotify.com\/user\/dondemon\/playlist\/3upJSeV6lAHhMTuraNg5J4?si=Ln8sSgEC\" target=\"_blank\">this playlist<\/a> with the Blade Runner soundtrack on it, too.<\/p>\n<p><b> Yael:<\/b> No Eno Ambient Music for Airports for you.<\/p>\n<p><b> Micah:<\/b> BTW for readers out there who don&#8217;t know, Capture the Flag is incredibly fun.<a href=\"https:\/\/ctftime.org\/\" target=\"_blank\"> This website<\/a> lists upcoming CTF challenges around the world, many of which are open to anyone on the internet.<\/p>\n<p><b> Yael:<\/b> And if you&#8217;re not a hacker, just do <a href=\"http:\/\/www.puzzledpint.com\/\" target=\"_blank\">Puzzled Pint<\/a>! I&#8217;m also looking for Hunt for Justice teammates lol.<\/p>\n<p><b> Matt:<\/b> I recommend for anyone getting into this stuff the capture the flag at picoCTF built for high school students. I have some CTF links for readers:<\/p>\n<div data-iframely-id=\"D5CfcdK\" class=\"article__embed article__embed--iframely\">\n<div style=\"left: 0; width: 100%; height: 0; position: relative; padding-bottom: 56.2493%;\" data-iframely-smart-iframe=\"true\"><iframe  src= width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <\/div>\n<\/div>\n<div data-iframely-id=\"0vsgqo1\" class=\"article__embed article__embed--iframely\">\n<div style=\"left: 0; width: 100%; height: 0; position: relative; padding-bottom: 56.2493%;\" data-iframely-smart-iframe=\"true\"><iframe  src= width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <\/div>\n<\/div>\n<div data-iframely-id=\"y7X0WDH\" class=\"article__embed article__embed--iframely\">\n<div style=\"left: 0; width: 100%; height: 0; position: relative; padding-bottom: 56.2493%;\" data-iframely-smart-iframe=\"true\"><iframe  src= width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <\/div>\n<\/div>\n<p><b> Micah<\/b>: So Elliot being super-fast-wizard at CTF&#8230;wasn&#8217;t so real. The challenge they talked about sounded legit, but there&#8217;s no way Elliot would know what the challenge was or where the vulns were without spending at least like three minutes looking at the problem.<\/p>\n<p><b> Jason:<\/b> Yeah, I had no idea what Elliot was actually explaining to that guy with the over-indented Python code.<\/p>\n<p><b> Yael:<\/b> I think Elliot went there to try to&#8230; find a random computer? To try to close a backdoor which would end phase 2 how exactly?<\/p>\n<p><b> Micah:<\/b> Oh yeah, I don&#8217;t understand why Elliot doesn&#8217;t just carry a laptop. He just walked up to someone on the CTF team and they&#8217;re like, &#8220;You&#8217;re good, join our team. Here, take my computer. It&#8217;s running Kali and logged in as root, but I don&#8217;t mind, sit at my keyboard.&#8221;<\/p>\n<p><b> Harlo:<\/b> Yeah, I felt that Elliott&#8217;s success at the CTF was a bit of &#8220;ex machina.&#8221;<\/p>\n<p><b> Jen:<\/b> I think the idea was to prevent remote access to the UPSes.<\/p>\n<p><b> Harlo:<\/b> He did NOT succeed!<\/p>\n<p><b> Yael: <\/b>Yeah because the power got cut out? Or did they just not get to that point?<\/p>\n<p><b> Harlo: <\/b>It&#8217;s still on the server. He tried to shred it but the reverse shell failed.<\/p>\n<p><b> Jason:<\/b> I thought the connection dropped because the reverse shell was deleted by the shred command.<\/p>\n<p><b> Harlo: <\/b>Okay, let&#8217;s dissect this. It appears that he ran &#8216;<a href=\"https:\/\/en.wikipedia.org\/wiki\/Ls\" target=\"_blank\">ls<\/a>&#8216; and that showed the bin file that contained the backdoor, and then he tried to shred it, and that command failed because connection timeout. But I cannot be sure! Let&#8217;s get eyes on this!<\/p>\n<p><b> Jason:<\/b> Or at least the confirmation message from the reverse shell failed to arrive<\/p>\n<p><b> Harlo:<\/b> Right\u2014that&#8217;s what I thought. But you make a good point. IIRC he deleted everything including the reverse shell.<\/p>\n<p><b> Jason:<\/b> So that would explain the timeout on the command. Experiment needed to confirm \ud83d\ude42<\/p>\n<p><b> Harlo<\/b>: Is this a race condition thing?<\/p>\n<p><b> Yael: <\/b>I couldn&#8217;t tell whether he was doing CTF or closing the backdoor. Was he supposed to solve CTF real quick and then close the backdoor?<\/p>\n<p><b> Jason:<\/b> I think he was just closing his backdoor.<\/p>\n<p><b> Harlo: <\/b>He was supposed to solve the CTF for a team by faking their score? And then get them to move on so he could use their computer?<\/p>\n<p><b> Micah: <\/b>If you freeze the frame where they&#8217;re talking about the C2 listener, he&#8217;s running a program called rwwwshell-2.0.pl. I looked it up, it&#8217;s basically an old-school reverse shell running on port 80, disguised as a website to get through firewalls. <a href=\"http:\/\/www.gray-world.net\/papers\/rwwwshell.txt\" target=\"_blank\">Here is a paper about it<\/a>. Also, there&#8217;s no way he&#8217;d actually be using that tool. It&#8217;s from 2002.<\/p>\n<p><b> Jason:<\/b> Also, one would have to imagine that old a reverse shell tool would be caught even by E-Corp.<\/p>\n<p><b> Freddy:<\/b> Well, Equifax didn&#8217;t notice 30 shells on their production servers, so&#8230;<\/p>\n<p><b> Jason: <\/b>Yeah, but nobody would use that old Perl code, at least something a little more modern looking.<\/p>\n<p><b> Micah:<\/b> But also in that frame, did anyone spot the Easter egg? He was taking over the command and control server by hacking a domain name registrar to update the nameservers<\/p>\n<p><b> Jason: <\/b>Yes, Micah. Hacking a domain registrar seems non-trivial.<\/p>\n<p><b> Micah: <\/b>The CTF scene ended with browser windows with <a href=\"https:\/\/www.maindomain.co\/domain\/enterprise\/\" target=\"_blank\">https:\/\/www.maindomain.co\/doma&#8230;<\/a> open on his screen.<\/p>\n<p> I think that may be a CTF Easter egg challenge. I tried solving it some last night, discovered some things but didn&#8217;t get it. The maindomain.co site lists the domain name ruxmsu9u.net.<br \/> $ host ruxmsu9u.net<br \/> ruxmsu9u.net has address 216.178.100.20<br \/> ruxmsu9u.net mail is handled by 10 inbound-smtp.us-east-1.amazonaws.com.<\/p>\n<p>If you load <a href=\"http:\/\/ruxmsu9u.net\" target=\"_blank\">http:\/\/ruxmsu9u.net<\/a> it redirects to <a href=\"https:\/\/www.ruxmsu9u.net\" target=\"_blank\">https:\/\/www.ruxmsu9u.net<\/a> which is actually a different server, but if you load <a href=\"http:\/\/216.178.100.20\/\" target=\"_blank\">http:\/\/216.178.100.20\/<\/a> without sending the &#8220;Host: ruxmsu9u.net&#8221; header, you get a different vhost. I poked around more, found some interesting stuff, especially if I manually change my host header<\/p>\n<p><b> Yael:<\/b> So if we move on to the chase scene\u2014how do you plug in a license plate number and then get a <a href=\"http:\/\/www.autocheck.com\/vehiclehistory\/autocheck\/en\/vinbasics\" target=\"_blank\">VIN number<\/a> and shut down a car, do you have to be a cop? Or a pretend cop?<\/p>\n<p><b> Harlo: <\/b><a href=\"https:\/\/en.wikipedia.org\/wiki\/OnStar\" target=\"_blank\">OnSTAR<\/a>!<\/p>\n<p><b> Micah:<\/b> He was pretending to be a cop.<\/p>\n<p><b> Harlo: <\/b>Ex-cop. He is probably an ex-fed, who still has access, like a lot of private investigators.<\/p>\n<p><b> Jason: <\/b>Or even not ex.<\/p>\n<p><b> Freddy: <\/b>Chase scene was the worst. Totally unrealistic. FBI does not follow with one car!<\/p>\n<p><b> Matt: <\/b>You call OnSTAR, report it stolen, &#8220;prove&#8221; it&#8217;s you and you pay for OnSTAR security. Then boom cops get tip off and car is slowed. Subscription pays for itself. They can also lock the engine block.<\/p>\n<p><b> Yael:<\/b> Maybe FBI would follow with one car if it was just low-level surveillance? Though seems like Elliot is past that point.<\/p>\n<p><b> Matt:<\/b> If it was one field agent, it would be one car.<\/p>\n<p><b> Jason:<\/b> They would call in backup if that happened.<\/p>\n<p><b> Freddy:<\/b> Surveillance teams usually work in pairs, at least 4 but often as high as 8. One person falls back, the next team picks up a block over.<\/p>\n<p><b> Yael: <\/b>If he&#8217;s current FBI, why would he have to warn\/rescue Elliot and Darlene from FBI? Couldn&#8217;t he just say, &#8220;I got this&#8221;?<\/p>\n<p><b> Jason: <\/b>Were the followers FBI or Dark Army? Was that really clear?<\/p>\n<p><b> Micah:<\/b> I think both.<\/p>\n<p><b> Yael:<\/b> Irving said it was FBI.<\/p>\n<p><b> Harlo:<\/b> I have to appreciate the car chase escalating in intensity as the guy reads out fucking VIN numbers.<\/p>\n<p><b> Matt: <\/b>I think it could buy you time to slip away from one agent, but if you are the subject of an investigation and it&#8217;s this big, because they are following Darlene after questioning, it could be one person doing follow up tag. But I don&#8217;t think it would warrant more than one person to follow or door knock a person of interest.<\/p>\n<p><b> Jason:<\/b> Or was that SUV even set up by the &#8220;fixer&#8221; guy? Get a buddy to rent a Suburban, follow you around, have them call his cell phone and act like on-star, then hit the brakes<\/p>\n<p><b> Matt:<\/b> I like the way you think. TRUST NOTHING, it is Mr. robot after all. It&#8217;s masterful directing to make VIN numbers feel that REAL.<\/p>\n<p><b> Yael:<\/b> After that scene was the revolutionary one where Elliot got us riled up about the evils of capitalism but was also upset that he contributed to four people&#8217;s deaths. They turn our dissent into intellectual property y&#8217;all.<\/p>\n<p><b> Matt: <\/b>WORST SCENE EVER. *Vomit.* My love of Elliot is lost!<\/p>\n<p><b> Harlo:<\/b> It&#8217;s totally like Eminem rapping.<\/p>\n<p><b> Yael: <\/b>Why?<\/p>\n<p><b> Matt: <\/b>Because Elliot was an anarchist superhero. We CAN blame capitalism. We can blame governments. It&#8217;s like a revolutionary being like, &#8220;you know, we should just try to vote our way to a better America.&#8221;<\/p>\n<p><b> Jen: <\/b>There was fsociety merchandise in the storefronts during the &#8220;fuck capitalism&#8221; part of this segment \ud83d\ude09<\/p>\n<p><b> Yael: <\/b>Oh, and there&#8217;s a Trump cameo.<\/p>\n<p><b> Freddy<\/b>: The show producers tried to make it somehow relevant to the political turmoil in our current times but also link it to previous season 2 and connect the two (the political times and S3E1).<\/p>\n<p><b> Matt: <\/b>Agree. Don&#8217;t put Charlottesville footage in there.<\/p>\n<p><b> Micah: <\/b>Did you notice the timing of the shots with the dialogue? Elliot says, &#8220;What if instead of fighting back we cave. Give away our privacy for security,&#8221; and it shows Trump, and Theresa May. &#8220;What if we choose weakness over strength?&#8221; Trump&#8217;s inauguration. &#8220;Blame all the world&#8217;s leaders for aiding and abetting them.&#8221; Shows Putin on video screens.<\/p>\n<p><b> Jason: <\/b>The problem with any show that gets too tied in to &#8220;real time&#8221; is that reality changes and it&#8217;s sometimes hard to keep your plot in sync.<\/p>\n<p><b> Yael: <\/b>Okay, so let&#8217;s talk about the Tyrell scene with Shodan.io. One of our future chat members said that looking for <a href=\"https:\/\/en.wikipedia.org\/wiki\/Apache_Tomcat\" target=\"_blank\">Tomcat<\/a> on Shodan is usually a good place to start during recon.<\/p>\n<p><b> Matt:<\/b> Shodan, <a href=\"https:\/\/motherboard.vice.com\/en_us\/article\/vv7ybx\/inventor-of-the-internets-most-terrifying-search-engine-shows-us-how-to-use-it\">the search engine of things<\/a>, made more powerful in the age of Alexa &#038; Google Home. I pay for 100 queries a month that I never use.<\/p>\n<p><b> Yael:<\/b> Here&#8217;s a fun DEF CON talk:<\/p>\n<div data-iframely-id=\"7X96pX2\" class=\"article__embed article__embed--iframely\">\n<div style=\"left: 0; width: 100%; height: 0; position: relative; padding-bottom: 56.2493%;\" data-iframely-smart-iframe=\"true\"><iframe  src= width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <\/div>\n<\/div>\n<p><b> Jason:<\/b> Tomcat is very common for running enterprise software. He searched for Alfresco which is an enterprise content management system<\/p>\n<p><b> Freddy: <\/b>Shodan is good, but most enterprise don&#8217;t publish the software they use, it&#8217;s usually behind load balancers.<\/p>\n<p><b> Jason<\/b>: People mess up and put enterprise apps on the internet all the time.<\/p>\n<p><b> Matt:<\/b> Also on AWS leave things open and online.<\/p>\n<p><b> Freddy<\/b>: Shodan is okay, Fierce is another good one for mapping infrastructure. Web apps are usually not going to get you in.<\/p>\n<p><b> Matt: <\/b>Nah, won&#8217;t get you in at all, but if you wanna do a <a href=\"https:\/\/motherboard.vice.com\/en_us\/article\/vbgbpj\/hacking-is-the-least-ridiculous-part-of-house-of-cards-somehow\"><i>House of Cards<\/i><\/a> style traffic cam hack, it&#8217;s a start. Pray for default passwords. admin:admin.<\/p>\n<p><b> Jason:<\/b> The top result on the search was an Apache Tomcat server supporting tls 1.0-1.2, using Apache Coyote 1.1. I&#8217;m not familiar with Coyote but when I searched that version, Google auto-suggested &#8220;vulnerabilities&#8221; and there&#8217;s a Metasploit module from what I saw. The fact that it isn&#8217;t only accepting TLS 1.2 only also seems like a bit of a flag that it isn&#8217;t being updated or aggressively secured.<\/p>\n<p><b> Matt<\/b>:Ha! Yeah, Google &#038; <a href=\"https:\/\/www.exploit-db.com\" target=\"_blank\">https:\/\/www.exploit-db.com<\/a> your way to pseudo hacking the thing. Shodan and some time&#8230;.<\/p>\n<p><b> Yael:<\/b> Anyone have any predictions for next episode or anything to add?<\/p>\n<p><b> Jason: <\/b>Why doesn&#8217;t fsociety just blow up the building with a botnet of hoverboards?<\/p>\n<p><b> Yael: <\/b>Can they get the people out first?<\/p>\n<p><b> Freddy<\/b>: Next episode, we need more haxx.<\/p>\n<p><b> Matt: <\/b>Yeah, I wanna see more scenes like the CTF. I was SO HAPPY to see that in there.<\/p>\n<p><b> Micah: <\/b> For most good CTF challenges you have to sit down and develop an exploit, which takes a bit of time, a lot of testing, and often like working in a debugger.<\/p>\n<p><b> Freddy:<\/b> Yeah, the CTF is good but could be more realistic, basically 10 people sitting in quiet \ud83d\ude42<\/p>\n<p><b> Yael<\/b>: With pained expressions.<\/p>\n<p><b> <i> Get six of our favorite Motherboard stories every day<\/i><\/b><b> <i><a href=\"http:\/\/motherboard.club\/\" target=\"_blank\">by signing up for our newsletter.<\/a><\/i><\/b><\/p>\n<p><a href=\"https:\/\/motherboard.vice.com\/en_us\/article\/bjv9va\/mr-robot-season-three-episode-one-recap-power-saver-mode-hackers-roundtable-second-screen\" target=\"bwo\" >https:\/\/motherboard.vice.com\/en_us\/rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/video-images.vice.com\/articles\/59e12e485a093d517b9acf62\/lede\/1507929765179-2_mrrobot_s3_e1_tyrell_irving_elliot_01_1920x1080.jpeg\"\/><\/p>\n<p><strong>Credit to Author: Yael Grauer| Date: Mon, 16 Oct 2017 13:33:12 +0000<\/strong><\/p>\n<p>Technologists, hackers, and journalists recap episode 1: &#8220;Power Saver Mode&#8221;<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,13328,10378],"tags":[4500,15785,3919,15653,1706,15784],"class_list":["post-9896","post","type-post","status-publish","format-standard","hentry","category-independent","category-motherboard","category-security","tag-cybersecurity","tag-fsociety","tag-hacking","tag-mr-robot","tag-tv","tag-tv-show"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/9896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=9896"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/9896\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=9896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=9896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=9896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}