>> Today's episode is brought to you by Squarespace.
>> Head on over to squarespace.com/rogue,
sign up for a free trial.
When you do sign up for the service,
use promo code "rogue" at checkout.
Get 10% off your first order.
[static buzzing]
All right we're back again with Red Team Alliance.
We've got Babak, we've got Deviant.
We've already explored magnetic stripes,
we've learned how RFID works
and how people can hack it.
What do you got for us now?
>> We've got an electronic lock for you here.
We've been doing various electronic access control things.
This is kind of new and fresh.
This is "I know a guy."
It's not available in the U.S. right now,
but this product is from Korea
and it operates with RFID.
Right, it operates with a lot of technologies,
but RFID is popular of course.
>> It occurs to me right now
some people might think this is an ad.
This ain't an ad.
Whoever this company is I don't even know them.
Go ahead. >> Exactly.
So if you have a card, sure enough you can get in,
not fumble around with your keys,
but if a nefarious person steals your card
and it's like, "Oh my god, my card is gone
"and my house is locked.
"How can I get in?"
>> JASON: You smash a window.
>> Well-- >> Chimney.
>> Oh, in the chimney?
You could do the Santa Claus attack.
[laughing] >> Santa Claus attack.
He's the ultimate penetration tester, Santa Claus.
>> Well what I might just do is say,
"Well even without my card on me,
"I can just kind of try that."
>> No, thumb technology. >> It's in your ring.
>> I heard about this. >> It's magic in your ring.
See look, I know how magic works.
>> You just got to.
You give it a little, that's not working.
>> The ring, which is tungsten, baby.
No circuitry at all whatsoever.
There is nothing in my ring,
there is there nothing up my sleeve.
>> You're definitely doing wizard moves.
>> DEVIANT: No, you just got to give the lock a high five.
It likes me.
>> All right, spill the beans.
I'm too excited about this.
>> It is ESP! [Brian laughs]
>> So if you rub your hand across my fingers right here.
>> Oh!
Yeah, no you have a thing in your body.
In between the first and second metacarpal of each my hands
subdermally implanted--
>> This guy with his multi-syllable words.
>> Yeah. >> Ah, oh it's so weird.
>> JASON: That sound you're making is so weird.
>> I'm used to people making sounds like that around me.
That is just a smaller version of this.
>> You're a cyborg!
>> Basically, yes.
>> He's more man than machine by a lot,
but eventually will be more machine than man.
>> Yeah, we call it biohacking
or a grinder lifestyle or you name it, but--
>> Sorry? >> We call it biohacking.
>> Yeah, we're good with biohack.
>> I assumed that per what we learned before
there's a microchip in there,
there's some kind of coil that--
>> You actually just take some scissors
and you cut one of those apart and you jam it in there.
>> If I did kind of cut this up and swallow it,
would it work from inside your belly?
>> Yes, someone did that with their transit card
in, what was it Australia?
It was a transit technology that was not miniaturized yet
and they really wanted an implantable,
so they made their own under skin.
Well that's fun.
You walk up to a card reader or lock, it's--
>> Bah! >> "Let me in."
>> Much like we showed you earlier,
credentials that are re-programmable, that's what this is.
I can make this a number of things.
The guy in Australia couldn't
and the municipality got upset and killed his credential.
>> Oh no!
>> It's kind of wasted effort.
>> So it is important that it be re-programmable
because otherwise you just have a number on there, right?
And you don't want just a piece of paper,
you want something that you can constantly be updating.
>> DEVIANT: Yeah.
>> Can I assume you update it using the same gizmo
that you would use to update one of these.
>> You can. >> You do.
>> And does it hurt?
I don't get hurt by most things
that people kind of scratch their head at when I try it,
so it didn't hurt me, but I mean, your mileage may vary.
>> That's a yes.
>> Are you worried about that becoming out of date
like a lot of technology?
And then how bad is it to remove it?
>> You can remove it.
I mean, what goes in you can come out of you.
Just with blades and effort.
>> I just realized I didn't see any scars.
Let me see it again.
>> DEVIANT: Yeah, so that heals up pretty good.
It's pretty invisible and this one--
>> BRIAN: You have two?
>> DEVIANT: Yes, I have one in this hand.
>> Why two, what's the, oh you program,
they're different keys.
You program one for work and one--
>> Yes, and one is is low frequency, one is high frequency.
>> What is the difference between
low frequency and high frequency?
>> They're different credential technologies.
Low frequency is much older,
like your 125 kiloHertz kind of a low frequency card.
The high frequency card
is what all modern systems are using.
If you have NFC on your phone or if you have tap to pay,
that's all modern 1356 MegaHertZ.
>> What are you using the old one for nowadays?
>> Most of the time I use it on penetration jobs.
When we go up to a building,
there are readers that can do both technologies.
They're called migration readers,
or multi-technology readers.
And we say, "Oh, I don't know.
"Multi-class, I wonder if they're using
"new technology on this site for their credentials."
Beep, nope still using Prox, awesome.
>> Oh, so you get to sort of do the equivalent
of testing the locks without looking like
you're pulling out a badge and doing anything.
>> Absolutely. >> That's ingenious.
>> You told me a story about getting into a server room--
>> Yes. >> With a guest badge.
>> Can you recount that for us?
>> Yes, we were on a job where we had stolen some credentials
using technologies we had shown you before,
sniffing and cloning, and we all rewrote badges.
So we were around the building
and everyone had a badge they could present
and get into doors.
We stole a guard badge,
but of course if you get stopped and challenged
and someone says, "Hey, what are you doing in here?
"I don't recognize you."
Sometimes, a very proactive guard might say,
"Let me see your badge."
And they present it to a reader.
And if that doesn't match up with who you are,
you got a bad day.
Well what I did, because I'm the only team member
presently that has a subdermal,
I wrote the guard badge to this hand.
>> That's brilliant.
>> I kept my guest badge on my hip,
so I walked into any building I wanted to,
any door I wanted to
and I did get caught in a sensitive area.
And an employee said, "Hey, wait a minute,
"that's a red badge.
"You're a guest, why are you in here un-escorted?"
They called a guard over.
The guard said, "Hey, wait a minute,
"you don't belong in here.
"Who let you in?"
And I said, "No, look I just badged into this room.
"This isn't the coffee room?"
And they said, "No look, you seem like a nice guy,
"but you're trying to cover for somebody
and we need to know who let you in."
And I kept pushing back and finally the guard just says,
"Yeah, yeah Sock?
"This is mobile one,
"I'm here with a guy with a beard
"and we're in server room 6,
"yeah can you just roll that footage back?
"We got to know how this guy got in the room."
[Brian gasps]
And they rolled footage back
and they saw me walk up to the door,
extend this, kind of just smack like this,
and the door goes green and they're like,
the sock, we're squawking,
and they're like, "Dude we're watching it,
"we're watching a red badge open the door.
"We don't know what's up."
>> Oh, that's fantastic.
That is amazing.
Meanwhile, I assume that there's a practicality benefit
if you have the kind of job
where you don't want to have to worry
about keeping your badge on you.
You just do the thing once and you can always get in.
>> My wife did that.
It really freaked out the head of security
where she used to work.
>> Well what does it look like?
>> Well, it looks like a small version of this.
>> BRIAN: Oh there we go, the dramatic reveal.
[gasping]
It's so tiny.
>> Can I put it up my nose "Total Recall" style?
>> Yes!
>> If we were to make a list of things that you could do--
>>> DEV & BABAK: That would be on the list.
>> I don't know if I would recommend it.
>> Is it okay for me to open-- >> Absolutely.
>> BABAK: Yeah, yeah.
>> DEVIANT: So that particular chip inside there
is a Mifare style chip.
>> BRIAN: What does that mean?
>> Technically it's not even a real Mifare chip,
it's a clone, which allows you to manipulate
some of the data on there,
so you can clone hotel key cards.
But basically if you inject that into your hand,
then at most hotel properties,
we would be able to clone your room key to your hand.
So then even after you have
a really long and involved evening
and you lose your credential,
you can still come back to your room,
kind of slap your hand against the door and have it open.
>> Could you theoretically program it
using the hotel's equipment?
Like when they program the key,
you could just put your hand--
>> You could, that might look weird
reaching over the counter
and just kind of being like, "Hey man, don't--"
>> Mind me. >> Could you get a pen
or something? >> You click enter.
>> But we actually use the Proxmark,
the same tool we used last episode
to clone hotel keys onto those.
>> So what do you say when people are worried
about this thing tracking you?
>> Oh my god, so many comments about this.
No concerns whatsoever.
First of all, as we've seen with with most RFID,
the range is super tiny.
There was a James Bond film where something that size
was in his arm and they were tracking him from space.
That's not real.
You have to be really close.
And also it's not, as you point out,
like a fixed serial number.
I control what's written on my tax.
I can blank them, I can write any data I want.
>> Plus also, if you wanted to track someone,
you got a little thing called their face and freaking,
yeah and of course, we're carrying tracking devices.
>> And the things that they put in my teeth
when I was sleeping.
>> Yeah, those are way more efficient
in a longer range. >> The tooth trackers.
>> Okay, I do have a concern though
because it looks like this is made of glass?
What happens if it shatters?
>> It's a special glass.
It's hardened in a way
that makes it very resistant to cracking
and impact damage.
So, while it is still technically glass
and if with enough force, yes you can crush it,
the reality is that once it's installed properly,
it's actually very resilient and very, very safe
unless you hit your hand with a hammer.
>> We know people who are mixed martial artists
that have them.
I mean, I, as anyone knows me,
I do a lot of lead acceleration, so my hands are subject
to tons of recoil impulse all the time.
>> Took me a second to figure out what lead acceleration was.
>> For what it's worth, within the community,
we've been using these for a few years now,
about three to four years,
and to date I have not heard of an instance
where someone had one of these implants
crack inside their body.
Now again, anything is possible,
but I just want to highlight
that it's, in my opinion, fairly unlikely.
>> You mentioned a community.
How many people that we know of have these implanted?
>> Well in excess of 10 people.
>> Hundreds. >> Hundreds, yeah.
>> Every DEFCON there's usually a free table
where people can come up and they'll buy the chip,
but the service of implant is donation based, if anything.
And hundreds every-- >> Many hundreds.
>> Many hundreds. >> If not well into
over a thousand by know I would imagine.
>> All willingly? >> Yeah.
>> Right. >> As far as I know.
>> Most of them are willing.
>> Enthusiastic consent. >> Yeah.
>> I assume this is close to,
for aesthetic purposes people get subdermal implants
to put bumps on their head or whatever,
I assume it's just sort of injects
what between the dermis and epidermis?
>> That's correct. >> Exactly, yeah.
>> How often is infection a problem?
>> If the person who's doing it
knows what the hell they're doing
and they understand the basics
of germ theory and disinfectant, not a problem.
Again, at DEFCON hundreds of people,
I'm not aware of anyone showing photos
on Instagram of their big swollen green hand
after DEFCON happens.
>> Right, so I guess don't go to your local jewelry shop
and just say, "Hey, I bought this online,
"will you should shove it into my body?
>> That is an option for people
who don't have the ability to come
to a hacker conference or a Grinder conference.
If you have a a tattoo parlor or a body modification shop,
those are the kind of places
that will at least have the sanitary set up
to maybe be able to do it to you if you order it online.
>> Dude, that is awesome.
>> It is, but you know what's even more awesome?
>> I'll do it. >> Yeah, he knows what's next.
>> I'll do it, I want to be a cyborg.
>> He knows what's next.
>> I want to be a cyborg.
>> What are you going to use this for?
>> Okay, I want to walk up whenever I meet someone,
I want their phone to start playing Mambo Number 5.
>> Wait can you do that?
>> No, no, no, when I walk into a room,
everybody's phone starts playing Thunderstruck by AC/DC.
Whole room, nah, nah, nah, nah.
>> Can that work?
>> I don't think we can do that.
>> Can you program in a webpage?
So that somebody can use their NFC reader?
>> Yes, yes.
>> [gasps] You can do that.
You're like, "Hey I got something for ya."
And then they do it and Rick Astley starts playing.
>> And it's a Rick roll.
[laughing]
[dark intense music]
>> BRIAN: All right Murphy, tell me where your head's at.
>> I'm in a warehouse on the edge of town
and a guy's going to inject a chip into my hand
and my parole officer totally called it.
>> So a normal Tuesday then?
>> Yeah, right?
You think it's going to hurt?
>> He's done thousands of these.
He's going to be fine. >> Yeah, he's going to be fine.
>> Yeah, he won't hurt him at all.
>> JASON: Oh, that's reassuring.
Okay, okay. >> Oh, you meant Jason?
>> BRIAN: Yeah, I did.
>> DEVIANT: He's probably fine too.
>> BRIAN: Probably.
>> Everybody he fist bumps
automatically goes to scamstuff.com.
[Brian laughs]
>> I wait until he's asleep, and I re-program the chip.
>> Okay.
I'm good.
Yep. [Brian laughs]
>> JASON: Ready to rock.
>> DEVIANT: Keep your hand relaxed.
Breathe in, breathe out.
>> JASON: Well that's an unusual sensation.
>> BRIAN: What does it feel like?
>> It doesn't hurt.
There was a little pop, it's a weird feeling, and it's over?
It's done! [Brian laughs]
It's done? >> That's it.
>> JASON: I'm a robot now.
>> Oh my god, the Modern Rogue is now officially part cyborg!
>> I'm a modern cyborg!
[Brian laughs]
Now, when there's the robot uprising, they'll spare me.
Your ass is grass, Brushwood.
>> You're like, "No, we're friends I swear, I swear!"
Oh my god.
Dude, that's awesome, Jason.
>> That was nicely done. >> You are a beast.
>> This guy was amazing.
>> Yeah, we should introduce C00p3r.
>> C00p3r! >> C00p3r.
>> Thank you so much for this.
This didn't hurt at all, you made it really simple,
it was weird and now I'm weird, which is awesome.
>> More weird. >> More weird, weirder.
>> You we're already weird, just--
>> Oh! >> Drink water.
>> Drink water. >> Yep, copy that.
>> BRIAN: Also enjoy sleeping on the couch.
Missus is not going to be happy.
>> Oh yeah, that's going to suck.
She loves robots. [Brian laughs]
She's super into robots,
so I could probably apply for The Avengers now.
>> DEVIANT: Clearly.
>> No?
West Coast Avengers?
Great Lakes Avengers?
Not even the Great Lakes Avengers.
Lower?
The Champions?
The Defenders?
Justice League?
>> Teen Titans?
>> Snyder Justice League?
>> I don't think you're dark enough for the DC Universe.
>> Have you seen themodernrogue.com?
>> I'm familiar with the site.
>> It looks amazing! >> Yes!
>> JASON: How did that happen?
>> I'm telling you man, that Squarespace
is award-winning, easy, intuitive, WYSIWYG design.
You don't have to understand HTML.
What you have to do is create amazing content
and then they make it look beautiful for you
and the best part is, after you've done it,
you can say backsies, do it all over again,
and it looks amazing.
>> And it's really just clicking and dragging.
If you're stupid and or impatient,
even you can build a website
that looks stylish and current and sleek.
It's so simple. >> The Modern Rogue,
home to the stupid and the impatience.
>> That's accurate.
>> Head on over to squarespace.com/rogue.
Sign up for a trial.
Once you try it, you're going to fall in love with it,
you're going to want to use it,
and then you're going to make sure
to use promo code "rogue" at checkout, that's R-O-G-U-E.
You'll get 10% off and you'll be supporting our little show.
This is a test.
If you don't spell it correctly, you don't get 10% off.
We've been trying to give this to you for so long.
It's yours, you can do this, I believe in you.
I'll bet there's a beauty channel
that their promo code is rouge
and they're getting all their money.
>> That's what's happening. [Brian laughs]
We're going to have to declare war on the beauty channels.
>> Yeah, or invite them.
Thank you, Squarespace.
>> JASON: Ah, this is too long already.
>> DEVIANT: This is getting uncomfortable.
>> It feels so weird.
Oh, wait, wait, there we go.
Relax, relax, relax.
>> Give them a moment, we need to give them some time.
>> Yeah, yeah! [laughs]
[Brian beatboxing]
>> DEVIANT: I'm uncomfortable.
>> Cameraman: I was just going to see
how long you were going to do it.
[laughing]
>> The answer, as you know, is a long time.