Unspoken Security Ep 35: Security Awareness Training Sucks…Focus on Situational Awareness (Part 2)

I've learned how to hack the Copilot and circumvent its awareness and its abilities to detect.

Like, when I first go into a building, the first thing I do is I go to the break room or the bathroom.

It's like, usually it's better if it's the break room.

And what I do is I have a bag of like M&Ms in my pocket.

Welcome to Unspoken Security, the raw and gritty podcast for for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

All right, hey, welcome back to Unspoken Security. For those of you who, I assume if you're tuning in this week, you probably were here a couple weeks ago. Jason E. Streets, the guest. This is a two-part episode, so if you weren't here two weeks ago, I recommend going back and checking out that show first because we're if you're gonna pick it up right in the middle of a conversation here. Otherwise, he's an interesting guy and you'd learn a lot even if you start right here, but it's probably better to go back. For those of you who were here a couple weeks ago, thanks for coming on back. Really looking forward to finishing up this episode and then getting all of your feedback and your thoughts and your likes and, and the shares and all the good things that come with, you know, being in the podcasting world. So without further ado, let's jump into part 2 with Jason E. Street.

I don't care if a client gets upset with me like, oh, I don't want you back because you did that. Like, I did the right thing. Screw you. I had a CEO, I broke into their, their building. This was another country. I broke into their building and I destroyed them. It's like I went to all these floors they swore that I was never be able to get to. It's like I literally called them like, okay, I'm on your, in your IT department floor. Like, okay, well try to see if you can get into legal because they're lawyers. It's like they've got a lot of data to protect. It's like they're going to catch you.

Okay.

2 minutes later, I'm in, I'm in the law office. It's like, is there a certain file you want me to look at? And I kept doing it. Everyone they told me to go to, I did it to the cybersecurity information security department floor.

And it's like, and then they're like, and finally I stopped them because it was like going on. It was like, it was a high rise.

I don't got time for that.

So I said, I said, can I just go? You want me to go to the executive office at the top? I'll go there now. Like, no, no, you're good. You're good. So I then have a meeting with the CEO, explained to him what that part was.

He was not very happy about that.

And he wanted someone to pay because I did not give him any names of people that let me in.

I said I didn't take them.

It's like, I'm not gonna— this was a learning exercise. They weren't prepared for this. That's why I did these things. And so he said, well, I want you to do a fishing exercise now. And it's like, motherfucker, I will make you pay for scope every single time. I don't know why they play with me, okay? It's like, so they go I want you to— he said this, it was official— you can choose 1 to 100 people, I don't care, but I need you to be successful, and I need their names, whoever clicked the links. I was like, okay, I can do that.

You targeted the CEO, I'm assuming.

I, I, I followed him, I, I followed him a little bit, and then finally I just gave up. I went to the About page on the website, found a picture of an executive, took the picture, did reverse search, found Twitter where he was at a conference 3 months before. Related to his business, went to that conference website, found a speaker, assumed their identity, sent him an email saying, hey, like, it was great meeting you 3 months ago at this conference. Like we discussed there, I would love for you to be on our board of directors. It's like for our new initiative. Here's the website. Please let us know.

Click this link.

Think about it. He clicked it within 12 hours.

Game over. Yeah.

So I get back to the, the meeting the next day with the CEO. And we discuss what's going on, give them the debrief, and I'm like, okay, as you said in scope, we agreed this is what you stated. And he's like, yes. Okay, well, that's good because I picked one person, it was you. It's like, and you click the link within 12 hours. And the only thing that we have learned from this exercise is the fact if you're not fully prepared to what these kind of attacks look like, you're going to click the link. Sure, he was not happy with me.

No, you don't get it back.

I've never gotten a call back on that. But you know what, who gives a— it was wrong to try to penalize people when they've never encountered these kind of situations. It's like before you've actually given them that lesson, that teachable moment. Now, after the fishing is done properly and after they've done a fishing exercise, after they've done a fishing exercise Then you can start getting metrics. Then you can start going like, hey, you need to do better at this. But the first initial one, when I come in, no, there should not be— it's like any kind of tracking, any kind of penalization, any kind of like stigma on, on letting me do this. It's like, so that's not— it was not cool. And when you talk about scope, I literally had a— I robbed the state treasury once, and these guys were so like We broke in, it's like we were already in on the network, we already had domain admin, okay? But the employees were like, the IT department infrastructure, they were pitching a fit going, yeah, but you had a Dropbox in a box inside and you're on our internal network, so that doesn't count. You couldn't get a Dropbox inside. It's like, we had to put that in there for you. So The CEO of this company called me up. He said, Jason, you want to come out to the state and rob a treasury and see if you can drop a box into their network?

Yes.

Challenge accepted.

Yes.

So I go through and show them. I do the assessment where I'm like walking a tour basically with everything. They take me to the satellite office in this office building 50 miles away. They take me through the headquarters, through the downstairs, like So they show me all this stuff and they're like, okay, so where do you want to test?

It's like, when do you want to attack the headquarters?

It's like, and do this up and see if you can put that box in.

I'm like, dude, why would you think I was going to go to the headquarters?

Y'all got bulletproof glass, you've got like guards, like it's a scary building.

No, no, you have an office building 50 miles away. I'm attacking that. And they're like, what?

Soft target.

I'm like, okay, correct me if I'm wrong, But do you have a dedicated network connection from that office to the headquarters, to your internal network? And they're like, yeah. Well, then sitting in that office is like sitting next to the treasurer. Yeah, I'm going to the office. So all of a sudden they weren't so cocky and they decided to have scope defined.

Mm-hmm.

So they were like, okay, you can do that, but you can only come in after 5:30 because it's a shared office building. It's like, but you can't use any kind of tools or anything to try to open up the doors to get in. But you can't talk to any employees that are coming out of the building or going in the building because you don't know if they're State Treasury employees. But you can only get into the lobby if you're in there, and you can only stay in the public areas unless you can get the cleaning crew to let you in. But you can only talk to the cleaning crew. But since they're not a state treasurer employee, you can't lie to them. But if they can let you in, you're good. You can do it. Go ahead, go for it. Attack us like a criminal would.

Well, a criminal wouldn't have taken all those— those— exactly, to begin with, right?

Yeah, exactly. It's like they all start to scope like, oh, we want you to attack us like someone. By the time it's over, oh okay, attack us like a criminal would. And it's like, right, yeah, that looks exactly like the way that they— that's exactly how they're limited to their attacks.

So I get there 5:30, a lady's coming out, I'm acting like I'm on the phone, I walk right in.

Sure.

And I've got a video recorder watch running at this time, so it's like it's got all recorded. Yeah. And because, because the, the video has to be seen to be believed, because it's like I walk in And as I go in, I wait there for 2 hours. Dude, I'm on the spectrum with ADHD, dude. That was the worst assignment I've done. That's all day. Oh, it was— there's only so many birds you can flip or tweets you can tweet in 2 hours. That's a long day. Unsupervised. It was torture. Okay. That was the worst part of the whole thing, because as soon as I heard the vacuum cleaner, it was upstairs, but it was in the hallway. That's a public area. So I went upstairs because I wasn't waiting till they got downstairs, and I went up to the lady and I told her the truth. Hi, I'm trying to get back in to sweep this number because I was there the day before, so I am trying to get back into it. It's like I'm working late tonight. I'm on the clock. I ain't doing it free. Yeah, that's what I was like. I forgot my employee badge. I have an employee badge. I had a day job. I didn't say it was their employee badge. Okay, I do have my employee badge. Can you let me in? It's like I just have to do one thing, destroy their network. So it's like, that was it. I told her the complete non-script, ba-boom, I got in. And it's like, and when they saw that video, they were just like, guess who, who's also not a repeat customer?

Yeah, they're not inviting you back either.

I, I am happy to say with our new clientele, it's like with our new clients and stuff, it's like you're getting, it's like I have a lot of recurring clients now, so that's good. It's like, so it's not the problem, wasn't me.

Okay, right, right.

Partly, probably me, let's be honest. It's like, but it wasn't totally my fault.

No, it's not you, man. I'd say this all the time. A lot of people say they want the truth until they get it, and it's kind of the same thing here. They want it, and then you make them look bad. And, and again, it's that competitive thing in reverse. They're competing with you instead of going, hey, I'm thrilled you got in, man. Now let's teach us how to get better.

That's the whole idea.

Of course you're going to get in in most cases. This is, this is— I don't want to downplay it because It's, it's hard work. What you do is impressive and you're special. But at the same time, most people are easy to have. They're easy to fool on things, right? It's— people have a nature of not thinking this way. The ruse of being on your phone and just walking in happens all the time, right? Packages. I'm carrying a bunch of packages. Somebody will open the door for you. Like, the pregnant woman ruse is a really common one, right? You know, illnesses. I mean, there's lots of them.

People are easy to get. And I forgot what— I know Corgi, she does it. And I know there's another woman, uh, Jack and—

yeah, Jack Hyde.

Jack and Hyde. Yeah, yeah, I know her.

She's great at it.

Yeah, so both— I want to give them props. It's like, we're able to do it. It's like, but one of the things that I think we failed to realize, it's like, when I see— I don't— I haven't learned social engineering. I don't know how to social engineer. It's like, I know human nature. When I was growing up, it's like, my childhood was against the Geneva Conventions and being on the spectrum. Because I love the fact that, like, people say, like, oh, Everybody's getting autism now. What about your grandpa's stamp collection or the train set that's built all throughout his den and stuff?

That's right.

Don't— it's always been there. Trust me, autism always been there.

Okay, that's right.

It's like, so it's like we just didn't know what it was.

He was just special.

Let's leave him with the stamp collection. It's like, so no, that's always happened.

It's like, so I didn't understand it back then.

They didn't understand it.

They didn't want to understand. So I had to understand how humans operated. Normal people terrify me. It's like they communicate in such a way where it's like you have to have this, like, this combination of, like, physiological signs. It's like, plus you've got to, like, have certain stances, plus you have certain tones, plus you— and I don't— when I'm not masking, it's like I'm very monosyllable monotone. It's like, don't emote. It's like, when I go to a conference, I have to—

on—

in the morning, every morning I get up, I have to go and practice how to like be the smiley guy. It's like, so— but I had to acknowledge early on reading people's body language and facial expression to see if I was in danger. It's like, were they mad at me or were they happy? Were they having a good day or a bad day? What did they want me to be, or who did they want me to be to make everything okay? So I learned how to adapt and blend like that.

And so, and what I learned throughout my life is how to study humans, because humans are like, we all think that we've got like this one mind and everything was like, and this is how we operate, and we're all different and unique little special snowflakes.

No, motherfucker.

I've never met a foreigner in my life. There is a much difference between someone in Beijing to someone in Boston as there is from someone in Boston to someone in Baton Rouge. It's just geographical ethnicity. They're still just humans. It's like they still do the same things. They still do— they react the same way.

When we're in—

when you look at your brain and your mind, the problem is most people see it as one thing. They see it's like just your mind.

No, motherfucker.

Your mind, your soul, your consciousness, your spirit, whatever you want to call it, your id, who you are, that's your mind. It's like, and I've never talked to you from what you look like. All I'm— because if you close your eyes right now and envision who you are, it's not what you see in the mirror. It's not the shell that you've got. It's not the meat robot that I'm talking to. I'm talking to the pilot inside the meat robot. It's like, that's— and I'm never going to see who that person is, what they look like, but I just go by what the meat robot shows me. And it's like, and so that's the main pilot. That's the who you are. But you have an AI copilot. And your AI copilot is your brain. Now, there's a couple of problems, like, because when we— this whole conversation, when have you thought about breathing? Your AI copilot took care of it, but now you're consciously thinking about breathing because it's—

and you can do that.

You can override the copilot in certain things. Well, okay, I'm gonna hold my breath, and then eventually the firmware kicks in and it's gonna say, no, motherfucker, you're breathing now. Sorry, but, but you're, you're gonna breathe, right? And it's like— and so that firmware, the problem with it is it hasn't been updated in a millennia. It hasn't been updated since hunter-gatherer times. So that's the reason why you get anxiety when you're not being productive, when you got to go do things, because that's your bot, your brain saying, oh, we need to be— we need to like gather, we need to make sure that we've got enough supplies, we've got to survive. It's like, we need to make sure that we procreate, we need to carry on our species, we need—

it's got all this firmware set up that it does stuff without you even realizing.

I've learned how to hack the copilot and circumvent its awareness and its abilities to detect.

Like, when I first go into a building, the first thing I do is I go to the break room or the bathroom.

It's like, usually it's better if it's the break room.

And what I do is I have a bag of like M&Ms in my pocket because as soon as I break in and I get into the— behind the perimeter, without my control, without my mind doing anything, my autopilot kicks in and says, you're in an unfamiliar situation, there could be danger, I'm going to help you out and produce as much adrenaline as I can possibly can. And when you produce adrenaline, it doesn't matter what your mind thinks, your body responds by focusing and narrowing your vision. So you're looking further ahead because you have to be in fight or flight mode now. It is changing the posture of your, your shoulders and your neck muscles, and it's changing the gait of how you walk because your adrenaline is pumping and you are like thinking way quicker and more irrationally because you're, you've got to make split decisions in a hostile situation. The problem with that is that everybody around you, their co-pilots are now going, uh-oh, that person's either predator or prey because they're acting in that method. And so you want that gone.

So the M&M's are the answer to that?

Yes, I figured it out. What I do is I go to the break room and I eat the M&M's and I drink water because I don't— I can't communicate directly to my co-pilot. And my copilot's an a-hole because it can't talk directly to me either. So it just does things. It withholds dopamine, it withholds chemicals. It's like, oh, it could give me all the dopamine I actually need, but no, motherfucker. It's like, no, not today.

A little bit more, a little bit.

Yeah, it's like, so it doesn't do that. It's like, so you can't talk directly to it. It's like, so what you do is you let your stomach do it. When you eat, your stomach, which is connected to your brain— it's actually scientifically proven, and I knew, and I was doing this before I, I saw the science on it— I knew this is what happened. Your stomach sends signals to your brain that we are eating, so we can't be in fight or flight mode. We have to be at rest because we are now eating. So we have to be in a safe environment because the firmware back from the millennia ago, you only ate where you were safe.

You could never eat in a place that was unsafe. And so the brain, knowing that we're eating, ceases the production of adrenaline. So in about 3 to 5 minutes of being in the break room, you can walk out and you can now control all your functions. And act relaxed and walk out and be seen as just a regular person.

What a great trick. I, I think it's for people who like have stage fright, for instance. It would be an area where like have a small snack before you go and, and see if it doesn't change how you feel, right? Interesting.

One of the other thing is stop going on stage as yourself. See, that's another problem. It's like I could never— I've tried to give a talk just as me. Oh, it was bad. It was bad. I am not Jason right now. I'm Jason E. Street. So whenever I go out in the public, whenever I do public speaking, whenever I go out to conferences, even when I go out and rob people, it's like I am Jason E. Street that does that. Whenever you see the jewelry on This isn't because, you know, I just accessorized a little bit too much, or it's like I have a problem with silver, or I went to an Ed Hardy convention. No, it's because of the fact I needed a costume. I needed a mask for me to be. And this guy, Jason D. Street, he's loud, obnoxious. He's always got something to say. He's always trying to be funny and witty, and he's like all crazy kind of guy. And so when people get mad at Jason E Street, when they like say stuff about Jason, well yeah, screw that guy. It's like, I can't really stand him that much either. It's like, so it's like, I, I understand. Yeah, it's like, I can be annoying. It's like, so that's my persona. So I can go on stage, I can go and talk no matter what. I can be all— exactly. It's like, you have— see, anybody that, that has seen me like not on There's a difference. It's like, but that's why I say if you want to do speaking, have a button or like a pin or have a hat or just— and what you do is you totemize it and say, when I have this on, I'm the AJ Nash. I am the AG Nash, motherfucker. Come at me, bro. It's like, and then every time you get on stage, you remind yourself No, I'm not this guy.

That guy's on the circuit.

I'm the AJ Nash.

Hmm.

It's like, and that helps your brain realize that you're switching gears and that this is what you're doing now for the, for the exercise.

What an interesting concept. Well, I have to admit, I've never told you this. I've seen you on and off. I mean, obviously we did a prep call, so I, you know, you were, you were a little, I won't say you're off, you're never off, but you, you weren't as—

I had my social That was my social, but slightly not as much social Jason, because it's been really exhausting lately.

Yeah. But yeah, I know I ran into you last year. Well, I shouldn't say ran you cuz you don't know this. I saw you last year. So we were both in Vegas, Black Hat, DEF CON timeframe. And, and this was actually DEF CON and I remember seeing you in the hallway. You were alone and you know, you were, you weren't, you weren't entertaining anybody. You weren't on stage. You didn't have to do shit. And, and I, I remember walking by cause I, I was walking by with my girlfriend actually and I was like, oh shit, that's Jason. And I could just tell, I was like, I'm not gonna bother him. I mean, I could tell, like, I was like, he's, he's down timing it. You can tell. Like, I was like, I'm gonna leave him be. I was like, I need to talk to him. I sent him an email and I never followed up. I was like, I need to talk to that guy, but it ain't gonna be right now because you could just see, like, there was a difference. Like, and you know, I don't want to bother too many people in general, but you know, some people are on all the time. Like, they're, they're just— that's who they are, right?

Right.

But I could tell, I was like, no, he's, he's in his zone right now. I'm gonna leave him be. So, and you know, I'm glad I did. I didn't need to bother you, but But I could see the difference. Like, you could tell, like, there was a, there's a difference. Like, all right. And, and you don't want to overload people who are in a different zone at that time. You know, I, my kid happens to be on the spectrum. So I also have some advantages in that I've, I understand, not fully, I won't pretend because I'm, I'm not her, but I do understand a bit, right? And I've, I've, I've had this journey and I've had this experience and I can recognize it and, and be like, okay, listen, that's cool. Like, we're all wired differently. We all have amazing different talent. And so, but I've seen you in both modes, you know, and I was like, oh, yep, I— Jason is— he's downtown.

It's like, if I'm in public at DEF CON, always approach me.

Oh, you weren't at DEF CON though. You were, you were off grounds at like a hotel. You were in DEF CON proper. You were at, you were at one of the hotels in a hallway. So yeah, if you'd been on the floor, yeah, I would have, I would have walked up.

But I always tell people, it's like, when I'm at DEF CON, it's like my main responsibility is to be there for other people. It's like, that is, that is literally when I go into it, I go into it like I want to be available because people are coming up to me every time. It's like, say they want to talk to me, they want to have a moment with me, and it doesn't matter. And I've literally— there's been— I've been going for over 20 years. There's been times where it's like it was really not a good time that I was having, doesn't matter. For that person's moment, it's like I am going to give them what, what they need. I'm going to be that person for them because it doesn't matter what I'm going through. This is their one time. It's like that they may be able to get to talk to me. I'm not going to ruin it by like, oh, I don't have time for this, or I don't like— oh no, screw you, I'm in a bad mood.

I can't be in a bad with those kind of encounters.

Well, that's why you're a great person.

I'm there for the community. That's my community service. Other hacking conferences, I— there's a lot more downtime. It's like I literally will just chill out and I don't have to be on all the time.

Yeah, but at DEF CON, from when I get on the plane, it's like I'm in character. I try to— I try to be Social Jason at least when I get on the plane, but once I hit Vegas It's like the jewelry's on. I'm that guy and I'm going to be there after 2 weeks because I got to be there for 2 weeks. I do classes at Black Hat at the beginning and I do classes for DEF CON, which is like, you know, the security awareness stuff is for Black Hat, but then I teach people how to rob people like I do at DEF CON. And once that's over, that's been 2 weeks. People know I get back home on Wednesday. My family, my loved ones, is like people that I— my friends. I'm not communicating for 3 days at least. I'm going to order Pizza Hut and I'm going to have my Pepsis. I'm going to be in my Oculus Quest and I'm going to be just watching movies or playing No Man's Sky or Starfield. I do not want to verbalize anything. I just want— because I am physically, mentally, and emotionally exhausted. But motherfucker, if I'm at DEF CON, I want you to come up and, and talk to me. I want you to have that experience. If you feel like, oh, I only want to talk to the guy, come and talk to me. It's like when I'm talking to someone else, come up to me. I'll take a moment to still talk to you because that's your moment and I'm not going to rob you of it.

See, that's— and that's special. I mean, that's really cool. It reminds me, years and years ago, obviously. So Willie Mays, great baseball player, and somebody had asked him at one point, you know, how does he, you know, how does he mustered every day, right? And Mays said something very similar. He said, listen, there's some kid in the stands out here, and this is the only time he's ever going to get to see it, see me play. Like, I don't, I don't want to put on a bad show. I have to give my best because, yeah, I'm here every day, but there's some kid in the stands, he's not here every day. This is it. This is, this is the one day he comes out to see us play. And so I don't take— I can't take a day off. I can't, you know, I owe it to the, to the fans, you know, to the team, to everybody. And I— it always stuck with me. And frankly, you're the first person I think that's, that said something similar in the time I've been around. And it's, I mean, it's a special thought process to be like, hey, listen, it's because you're right, you know, I'm here every day. I'm, I'm in this body and this life or whatever. But for somebody else, that's not it. And if it's the one time they get a chance to see you, you know, in, in contrast to that, many, also many years ago, I worked for the Minnesota Twins briefly as an usher. And I remember seeing a good player at the time who was swarmed by fans who was a total jerk and just like blew right by them and didn't want to sign autographs. I was like, He just crushed some kid's dreams. Like, he was, he was, you know, a star at the time for the team, and they liked him, and he just blew right by him because he wasn't thinking that way. And he's— this guy, by the way, wants to know, his name's Chuck Knoblauch. He's a total jerk. He was Rookie of the Year that year, and he went on to be a jerk, and he had the yips, and his career went in the tank. And I've always been really happy about that, frankly. So, you know, screw Chuck Knoblauch. But anyway, listen, man, I gotta start wrapping this up here. We're running a little bit long, which is totally fine.

I was hoping we would. Yeah, yeah, go, go, go.

Yeah.

Because I, I just— I realized after I said those things, it's like I've made myself sound too magnanimous and too good. I want to make sure that we're clear on this. When I first went to DEF CON, my first couple years, I was ridiculously stupid. I was making so many mistakes left and right. It was like, because I didn't know how to be— there were so many different people to model, I couldn't get some good masks. It was horrible. I was an embarrassment. I was so busy taking selfies with people, not really having good conversations. It's like I was not— it was not— it was embarrassing, my behavior. But Major Malfunction, Adam Laurie, Dark Tangent, Jeff Maltz, FX from the Phenolic crew, it's like those guys, uh, my friend Teton, it's like his— actually, uh, Titan, but it's like he's French, so I always go Teton because it sounds French. It's like those guys treated me nice. Those guys showed me all, all that I am. The way that I treat people at DEF CON is because I had someone to show me what it was supposed to be.

I have never come across how to naturally be a good person. It's like I wasn't raised that way. I've had to learn that, and I've learned it from Mr. Rogers. It's like I've learned it from Major Malfunction, Jeff Moss. It's like I had to learn those things from those people. So that's the reason why I am the way I am now, was because of who they were when I needed them.

Well, and that's— and props to those guys, and, and that's great. And, and like I said, we all have to learn some from somebody, right? And no matter where we are, some— sometimes we get lucky and, and we have an easier upbringing. We have, you know, parents we can learn from, and a lot of times we don't. We have to learn from others. And, you know, it's great. And those are all, you know, impressive people you named, and it Thankfully that happened and it's good for all of us. 'Cause I mean, you're a huge ambassador for the community. I'm lucky to be a goon. I've been part of DEF CON now for the last few years as a goon and I'm lucky to be able to do it. It's a great community to be a part of. And like you, I do it to give back. I don't give back nearly as much as you. I'm not as impressive, but I wanted to do it just so I could give back. 'Cause I'm not a hacker and I can't do some of the things that the community does that's so amazing. And I was like, well, I wanna get involved and help. But it's, you know, having you there is always awesome. And obviously you're one of the rock stars of the place, but it's nice that, to know that you learned from it, right? Everybody's first year at DEF CON, we all do some crazy stupid shit. It's just how it works, right? It's overwhelming. I don't care who you are, how you're wired. And then you start figuring things out and hopefully you get in with the right crew of people that, that says, hey, this is going to make you more successful, or this is where you're going to learn more. This is how I get more out of the experience, or, you know, be more socially acceptable in some cases and then get better at it. So it's good to hear that you had that and, and have these great people, you know, Jeff and the rest of them, obviously, to to be a part of that because you're a huge part of that community. You know, at this point you're one of the pillars of the community, so I appreciate it.

I, I have to correct you. It's like, I know this is not— that shouldn't be good, but it's like you were so blatantly wrong earlier, I have to—

no, go for it. I'm always wrong.

What is it?

You, you called yourself not a hacker.

I—

that is so much BS. It's like, you need to understand one important thing. We have skewered what hacker means now. Every 3-year-old you've ever been around, you realize you were born a hacker. Because every 3-year-old's like, why? What is that? Why does it have to be that way? Who's that? What are they doing? Why do they have to do it that way? Can we do that? I would like to do it. That's hacking. Hacking has nothing to do with computers. Tesla hacked with electricity. Hedley Lamar hacked with wireless signals. It's like all these great Hackers had different mediums. Back in the day, it was electricity. It was like the telegraph. It was those kind of communications. Nowadays, the newest domain that we explore is computers, but that doesn't mean that's what hacking's about. Hacking has nothing to do with the computer. It's just how hackers are exploring now and experimenting with it. Back in the day, before there were computers, there were still hackers. We were just using and going after and learning and trying to discover and explore other things. Jacques Cousteau was a major hacker.

It's like figuring out ways to get deeper into the water and trying to go into the lowriders in California in the 1950s. They hacked cars. It's like to, to make it do different and stuff, you know, when they were getting cars in the 1950s. That's hacking. So you are a hacker.

It's like You're just— it's like you don't specialize in one field or what, or this field. You're still a hacker.

No, that's a good point. I appreciate it. And you're right, and it's a good point for everybody, right? Not— not— I appreciate it personally, but you're right, because there's different kinds of hacking. I think you're— we, we do spend too much time going down the path of, do you write code? You know, is that the kind of thing you do?

I don't program.

Yeah, I don't program either. But, you know, I think you're right. I don't, I don't think about it that way enough. Yeah, I am part of the community, I guess. I've certainly done some hacking over the years. I've done some social engineering. I've done some breaking in.

I've done—

if you're at DEF CON You're a hacker.

Yeah, and I appreciate it.

There's been a lot of elitists that go like, you know, well, there's so— there's hardly any hackers left at DEF CON. If you're at DEF CON, if you believe in being there and wanting to be there and stuff to learn and be with your community and your tribe, you're a hacker. You're part of my tribe.

30,000 a year questions about it.

Exactly. Those are all hackers in there.

I appreciate it. All right, listen, I wanna get to the, to the meat of the last piece we got here, right? So we're getting ready to start rolling down the show. With every episode, I ask every guest the same question. They all get stuck answering this one. So the name of the show is Unspoken Security, and, and it's gonna be a tough one for you cuz you're so public and, and you, you, you know, you're outgoing and you speak a lot, but with the name of the show being Unspoken Security, the question is, tell me something you've never told anyone, something so far that's been unspoken.

Well, I think one of the things that I can— that I'll share, it's like, and I always have a problem because it's like I do this thing just, you know, just tackle things with Jason where I do not filter, and I lie for a living, so I try not to do it for free. I mean, I still lie, but I try to minimize my life actively. It's like, and so I will answer mostly all questions. So it's like there's people that have asked some stuff, but I will say one of the things I have not shared, I think directly is I'm going through a lot of the problems that I'm going through now in my personal life. It's like with finances and with relationships and all this other is because I never understood fight or flight, fawn or freeze trauma responses. And also I never thought I would live to be 30. And if I could tell anyone that's a teenager and stuff, mother plan to actually— I didn't, I don't, I did not, I don't know how to do the, the bills or like how to do checkbooks. I did not know how. I literally have had old exes that had to teach me basic human necessity things because I was, I was raised— I mean, wolves would have been kinder. It's like, it's like, so I didn't understand. I was like, I didn't know how to shave. It's like, so I had a— I didn't learn that until my 20s. That's why I do an electric razor most of the time. It's like, so I wish that— it's like, my problem is when I was in my 20s, I was all fight response. I was always fighting. And then when I got tired of being the one that was the scary one, the people that were afraid of, because I never liked that, I never liked people being afraid of me. So I tried to be adorable. I tried to be the— but then new trauma responses come in that's like caused me so much problems because now I fawn. It's like where I'm such a people pleaser, I'm so afraid of like people being upset with me, people being angry with me, that I've let people just do what they want. And because I have no self-worth, I don't care if I live or die, I don't care about what my worth is. So it's like if it's between that person getting the help that they need or me, you know, it's going to be them. I am the guy, and I've always said this, it's like I feel like my life is the Titanic.

My job is not to get off the Titanic. My job is not to get into a lifeboat. My job is to get people into the lifeboat. My job— and I will complete— I will feel like I had a good life if I can get everybody into the lifeboats.

I'm going down with the ship.

I already know that I'm going down with the ship, but how many people can I get on the lifeboat? That's really what drives me to this day. I don't care about— I mean, literally, it's like, especially when I'm really depressed or something like that, it's like I'll drive without my helmet. And I'm like, it's like, because who cares? It's like I don't have that fear thing where you're supposed to, like, self-preservation thing.

I'm only existing now because I made promises after my last suicide attempt in 2018. So it's like I still have to be here. But man, if effing sucks. It's like, I hate existing right now. It's like, but I made promises. It's like, so, but yeah, so I deal with that. And it's like, so I tell people, it's like, if you want to know something about me, it's like, is like, I should have learned and prepared better. It's like, and people should not try to be me. Like I've always said, they need to be better than me. It's like, because I've, I've made way more mistakes than I've ever succeeded. And the only reason why I've succeeded is because I just didn't stop. I'm too stubborn and I'm too petty. And it's like, and I have too many haters that I've got to make unhappy because I'm still successful. I exist out of spite. It's like, you know, and that's all I've got going for me right now. I, I can listen to a thousand people tell me good things, but man, it's like it's those three people that are like, you know, calling me out and saying whatever. But okay, motherfucker. Okay, first of all, I'll believe you. It's like, I believe exactly what you say. Yeah, that's— I'm a horrible person. That's right, that's crappy. I, I sucked on that. But I'm not gonna let you get away with telling me that. That's what I tell me. It's like, that's, that's what I say. It's like, you don't, you don't get to tell me that. You haven't earned that.

I've earned it.

I've had to live with this guy. This guy sucks. It's like, I'm not gonna let anybody else tell me that. It's like, I mean, I say worse things about myself before 10 AM, before these little online keyboard warrior trolls can even come up with all day. So I think that's one of the biggest things that maybe I haven't really like let out there to such extent. So you now have to live with that. You're— I'm glad.

Listen, I'm glad you shared it, man. Listen, I, I love you. Like, I, I— you're a big part of this community, man. You matter. I, I know some of the, some of the things you go through and some of the struggles. I won't pretend I know too much. I'm not gonna, but I know enough to know. And I, and I, you can add me to the list of people that care about you and want you to stick around, and the list of people you can ping and call if you need shit, and the list of people you could promise that you're gonna stick around and keep working on it, man. Like, you're, you matter. I, I get that it's another set of words that'll just bounce off, and I understand that. I can relate to some of that.

I know I do, but it's okay. I appreciate it. I do appreciate it. And it's like, and also, let's be honest, I provide community service at DEF CON, but you don't understand how many people that have come up to me and said that I've changed the course of their life, or I've helped them do something. They saw a video of mine. That helps me. That does something for me. It's like sometimes when I'm in my darkest moment, it's usually in December because December is the worst month for me to survive. It's like when I am through that, it's like I think about DEF CON. The last DEF CON. And I think about like, I mattered to somebody, I helped someone, someone got into the lifeboat because of me.

100%.

And, and that's what it count— and that's honestly all our jobs are, to just create ripples. It's like to help positive ripples throughout this little existence that we have. Dan Kaminsky was a meteor going into the lake. It's like, I'm not going to be like that. I'm not going to be able to cause a tsunami, but I want to cause as many ripples as I can, because then those ripples add to other ripples. And it's like— and there are people who will never know my name, but they will tell a story about me, about— to their friends, about this one guy, this one place, at this one thing, not even a conference, who did something for them. And that's what matters.

Yep, that's what matters. I think that's incredible, and I think it's true. You know, we're all here to try to do more good than harm, hopefully. I think ripples is really a great way to put it, right? And you never know the impact you have on other people, right? I can tell you, I know your impact's been immense. You've impacted me more than you even know it. And every once in a while, somebody says something nice about me. Like, listen, I'll say it really quickly for those who don't know. Like, Jason and I had a little prep call for this. I don't do a lot of prep for the show generally. I like it to be live like this. But we do a little prep just so nobody walks in with nothing in mind. And you know, I've been trying to get Jason on for a while. When I say trying, it's, it's failing on my part. I, I emailed, I didn't follow up. I'm shitty at that stuff. But finally I have somebody else to help with this and she emailed and, and Jason tells me in the prep, he is like, I read the email. I'm like, AJ Nash, I know who he is.

Hell yeah.

I wanna be on the show. I, it still stuns me that anybody even knows who the, who the hell I am.

Right.

I, if I go to conference, someone's like, oh my God, it's AJ. I wanna meet you. I'm like, why? Like I, it, it blows your mind.

So you matter. Everybody matters.

It's, yeah.

And I think we don't sometimes realize. Because you're just out doing the thing, right? You're out there every day doing whatever our life is and our job, and you don't realize how you impact other people. For years, for me, I didn't realize how negatively I impacted some people. I have ADD, which I didn't know. I didn't— I wasn't diagnosed until I was in my 40s. And in retrospect, I look and go, holy shit, I hurt a lot of people's feelings with my sharp tongue and wit because I had no filter that I need. Yeah. So you can relate, right? And I had a lot of regrets with that and a lot of remorse as I no longer Hopefully I'm that person, at least not nearly as often. And you realize, oh my God, I've done a lot of harm that I had no idea I was doing. Right. And then the flip side is now people sometimes want to see me and I'm like, that's just as weird. Like you don't realize the impact. So I think what you, you know, the message that you've given is, is really impressive of, you know, it's about the ripples. It's about getting people in the lifeboats. It's about serving other people. And that's, that's a motivation that keeps us going through tough times. You know, December's rough and that's what happens for everybody.

Right.

Exactly.

We fix things.

We break them and refix them.

And we try to solve them. Yeah. It's like, and no hacker has created a vulnerability in code ever. They've discovered the vulnerability and reported it so it could get fixed. That's what we need to remember.

Yeah. That's a good point. Hackers aren't the bad guys. Like, like people want to think there are people who do bad things. That doesn't make hackers the bad guys. Right. I think you're right. Hackers generally, it's, it's. We find things and try to make it better or fix it or let people know. Sometimes hackers will take advantage of the things they found a little bit, but normally not for harm. A lot of times it's little things like, hey, I can find my way into the movie theater in the back door, so I guess I won't pay to see this movie. No, I might eventually tell somebody that back door is not locked and you should lock it. Or maybe I won't. Maybe I'll, maybe I'll eventually get around to it. Eh, that's one of those things people do, right? But generally it's a good community full of good people. And you're a perfect example. You're one of the best in the community. But I wanna thank you for coming on. I really appreciate you taking the time.

Of course.

You've been immensely helpful, I'm sure, to a lot of people on the show as you have been in other places. This has been a really cool episode and I think people will learn a lot from it. So again, thanks for taking all the time to come on, man. I appreciate it. I'll see you, if not sooner, I'll see you in August for sure. We'll get back out in Vegas.

But yeah, and you'll say hello to me when you see me.

I will this year for sure. Yeah, not about— I have to admit, last year I also forgot to mention I, I, I got COVID while I was out there, so it's a good thing I didn't say hello to you.

Don't be that close.

Yeah, I think the next day I was down.

So it's a good thing I didn't say hello to you as a turns out, because I spent the rest of the time in isolation. Anyway, so I'm gonna wrap it up. Again, thanks for being here, Jason E Street. I really appreciate it. And for everybody for listening and watching, please like and subscribe and tell people. And if you don't like the show, shut up. Or, all right, now let me know so I can try to make it better. But spread the word. I really appreciate it. So for everybody today, I want to close it out by saying, you know, this— I'm AJ Nash, and this has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.