Security war stories
Curated by Claude · 13 videos · 10 hr 42 min
These are stories, not tutorials: people who broke into wallets, buildings and elevators, investigators who took apart Stuxnet and Mt. Gox, and the opsec mistakes that got hackers arrested. It opens with a single tense break-in, moves through cons and physical intrusion, then malware and crime, and ends with the near-miss supply chain attack of 2024. Most are conference talks that HN keeps linking because they are a pleasure to watch.
Play all on YouTube- 132:18
How I hacked a hardware crypto wallet and recovered $2 million
10M views • 4 years agoJoe GrandJoe Grand recounts being hired to hack a Trezor One hardware wallet and recover $2 million of cryptocurrency. He describes three months of experimentation, voltage glitching, failures and high-stakes attempts with only one chance to get it right.A gripping opener: Joe Grand spends three months glitching a Trezor wallet, knowing he gets only one real chance to recover the $2 million inside.
- 256:58
The KGB, the Computer, and Me.
87K views • 13 years agoDragonFartOutLoudA WGBH/NOVA re-enactment of Clifford Stoll's hunt for KGB-linked hacker Markus Hess, based on his book The Cuckoo's Egg. It starts from a 75-cent accounting discrepancy at Lawrence Berkeley Laboratory.The original hacker detective story: Cliff Stoll follows a 75-cent accounting error at Berkeley Lab all the way to a KGB-linked intruder, re-enacted by the people involved.
- 31:03:20
Frank Abagnale | Catch Me If You Can | Talks at Google
15.9M views • 8 years agoTalks at GoogleFrank Abagnale, the real subject of Catch Me If You Can, speaks at Google about his life as a con man turned FBI fraud and cybersecurity expert, including advice on fraud, breaches and credit cards.The real man behind Catch Me If You Can shows that social engineering predates computers, and HN still repeats his advice on credit cards and fraud.
- 416:18
Spying on the Scammers [Part 1/5]
20.1M views • 6 years agoJim BrowningJim Browning reverses a scammer's remote connection and discovers CCTV in a Delhi call centre. He gives a detailed look at how a tech support scam operation runs, and he shared the footage with the BBC.Jim Browning turns a tech support scammer's connection back on them and ends up watching the call centre through its own CCTV.
- 5
19:55Nina Kollars - Confessions of an Nespresso Money Mule - DEF CON 27 Conference
597K views • 6 years agoDEFCONConferenceAt DEF CON 27, Nina Kollars tells how buying Nespresso capsules on eBay led her to investigate fraudsters reselling goods bought with stolen credit cards. She describes her non-technical tracking and reporting efforts.A short, funny DEF CON talk in which a cheap eBay coffee order pulls a researcher into the world of stolen cards and reshipping fraud.
- 6
44:56I'll Let Myself In: Tactics of Physical Pen Testers
2.9M views • 8 years agoWild West Hackin' FestDeviant Ollam, head of a physical penetration testing team, presents tactics for getting into buildings, from bypassing door levers with a wire to defeating bank doors. He argues that physical security is often surprisingly weak.Deviant Ollam shows how professional break-in teams get through doors with a bit of wire and some confidence, and why physical security is so often the weak link.
- 7
1:55:54Elevator Hacking: From the Pit to the Penthouse
889K views • 12 years agoDeviantOllamDeviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.HN's go-to link whenever elevators come up: two hours on how they work and how to get one to take you where you are not allowed, which commenters say they watched in one sitting.
- 8
10:41Ralph Langner: Cracking Stuxnet, a 21st-century cyber weapon
323K views • 15 years agoTEDIn an 11-minute TED talk, Ralph Langner explains how his team reverse-engineered the Stuxnet worm and worked out that it targeted industrial control systems, with a covert state origin. It is a compact look at cyber-forensics.An 11-minute account of how Langner's team worked out that Stuxnet was a state-built weapon aimed at industrial controllers, and a good primer for the next talk.
- 9
1:14:5627C3: Adventures in analyzing Stuxnet (Bruce Dang from Microsoft)
95K views • 15 years agobasti0007Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.The first-hand version from Microsoft's analyst, which HN calls the definitive walk through each of Stuxnet's zero-days.
- 10
38:22Kim Nilsson - Cracking MtGox
47K views • 9 years agoTheBitcoinArmyKim Nilsson presents his investigation into how Mt. Gox was hacked and mismanaged, tracing the finances and the missing bitcoins. It was given at the 2017 Breaking Bitcoin meetup.The investigator who traced Mt. Gox's missing bitcoins explains what actually happened, in what HN calls the clearest and most even-handed account of the collapse.
- 11
1:04:25#HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftpd
158K views • 13 years agoHack In The Box Security ConferenceThe Grugq's Hack In The Box 2012 talk on operational security for hackers, drawing on hacker indictments and counter-intelligence research. It reviews OPSEC goals and methods for avoiding detection and arrest, with case studies of how hackers got caught.The Grugq goes through hacker indictments to show how people who thought they were careful got caught, and HN treats it as the essential opsec talk.
- 12
50:59DEF CON 22 - Adrian Crenshaw- Dropping Docs on Darknets: How People Got Caught
219K views • 11 years agoDEFCONConferenceAdrian Crenshaw's DEF CON 22 talk gives an overview of Tor and I2P, then goes through real cases where darknet users were caught. These include Silk Road and its operator.Silk Road and other darknet busts, case by case, showing that the operators' own mistakes mattered far more than any flaw in Tor.
- 13
53:00The Internet Was Weeks Away From Disaster And No One Knew
16.4M views • 8 months agoVeritasiumVeritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.To close, Veritasium's documentary on the xz backdoor: an attacker who spent years earning a maintainer's trust and very nearly compromised SSH across Linux.