The Hacker with Hardware Implants (interview)

Key Takeaways

well hey all right everybody thanks so much for tuning in I'm super excited I finally have a chance to chat with a good friend of mine uh Len and hey just for a little bit of background context we met some time ago at the bides in Cayman Islands which was phenomenal and fantastic but it sounds like Len you've been up to some sweet stuff kind of hey working in the background to put together a new book is that right that is correct would love to learn hey what your life has been like these couple weeks months I don't know a year really and then what the book is all about how you're feeling what's good bad and ugly in that whole process but I'll let you take it away if you can give some uh context and background let's get this party started awesome man first of all thank you very much for having me on yeah it it was great seeing you in the Cayman there's nothing like you know hanging out with good friends on the islands got some nice tropical drinks with some umbrellas in them but no man you know I've got the opportunity to produce my first book uh it's actually part autobiog graphical and it's part science fiction science fact what I did was I I believe you you've seen some of my my previous Works around biohacking and transhumanism well I took a lot of that Concepts that I did originally in terms of showing that there are augmented humans with technology in our bodies and rather than just doing it as a presentation I kind of took it and well I had to kind of tell a story with it because I mean I mean you John you're you're one of the more you know known cyber security figures on social media but you just don't really seem like the type of guy that would wake up tomorrow and just go you know what today seems like a good day to start shoving microchips in my hands you know you kind of got to build up to this it's a progression so it starts you know with my first hacks around Commodore 64s my first Network hacks on on you know isolated token ring Networks and what really kind of pushed me into a an early life of crime and cyber crime uh I spent most of my life in my early years doing we'll just call them black Hatty kind of you know things and it was honestly at one point I was a 1% Nomad for an well we'll just say kind of like a Sons of Anarchy kind of a group and I was actually a system architect for one of the largest payroll human resource companies in the world you know I I I never quite understood how I could ride my motorcycle to work hang my leathers with my my patches on it in my cubicle and Cub Bland and they never kind of really realized that I may have been a security threat well if I may cuz uh I know and I don't know if it's super duper clear for everyone that I don't know might might have just stumbled across the video but I think one of the coolest things about you Len is just exactly that you hey are working with uh some extra devices some extra Tech just living in your arm is that right both arms okay uh I am currently up to 10 microchip implants in my arms from my elbows to my fingertips I have the ability to directly interface to NFC RFID I have a biosensing magnet in my pinky which you know aside from giving me an additional sense it does make for some really cool bar trick um I at one point I actually had a credit card in the top of my hand and you know that's the big guy right there oh boy you know at one point I could literally just walk up and tap to pay with my hand but unfortunately the the credit card company that that was backing that has recently gone out of business so now just like any other you know walking talking computer biological thing I have new real estate in the top of my hand so I'm have that removed and a different one put in well I got to be honest I wonder and part of M always tend to think would you would you be willing to help sort of demystify that and destigmatize it because I I don't know if anyone's going to be saying like what the heck this guy's a cyborg this guy's a robot can you can you help I don't know level set here you know and that's a lot of what I've done in the book is you know the truth is anybody that's using technology to enhance the Human Condition would be considered a transhuman and the earliest recorded kind of instance of this would be the first time some prehistoric person used a a branch as a crutch you know anybody that's got a continuous glucose meter and dealing with diabetes stem Pain Management Systems these are all considered transhumanism the only difference is it didn't come with the Fanfare and the science fictiony kind of Borg look that we would expect you know based on you know science fiction you know the Star Wars Star Trek but I can literally directly interface to the technologies that are in our cell phones and one I have about two or three implants that are basically set for use against physical security wow I can directly interface to almost 350 types of protocols for physical access hid pyramid andala procs and one of the things that makes these types of devices even more dangerous from a security perspective is because they're inside of my body laws like in the US like Hippa and gdpr in Europe makes these medical at which point I'm have all of the laws for personal privacy around medical information that are actually protecting me as opposed to the organizations that are trying to demand the security I remember well we were at the bsides event in the Cayman Islands I think a question that was kind of raised in the back of the room was like Hey how do you how do you get through TSA what what does flying look like and I know I'm sure you get these all the time but uh I I hope that's all right for me to just kind of keep questioning uh and then I'd love to learn yeah like okay what's the rest of the book like where you're discussing do you become a security vulnerability and are you hackable it's absolutely yeah in terms of of the airports that's one of the two in the back of the book I actually put my own FAQ which is really kind of funny you know the airport is honestly the the the number one frequently Asked question I get how do you get through airports and the simple answer is Left Foot Right Foot Left Foot Right Foot and I would just walk right through oh yeah you know those Lidos scanners that we see at all major airports those are not x-rays despite what everybody wants to believe those are considered body scanners so they're only looking between the skin and what's out side of it and between the skin and the clothing they're not looking inside and one of the things that I discovered recently through my own medical you know I I had to become even more transhuman robotically cyborg back in February where I actually had to have a full left knee replacement done oh wow and one of the things I learned after that procedure was I I'm sure you know somebody that's had some type of of medical implant you know a hip replacement shoulder replacement something of those Natures the medical card that the doctors give you for dealing with the airports and TSA is completely useless 100% useless the process that the you know TSA agents have to go through is exactly the same whether you have that card or not and that card can actually be downloaded from the tsa's website all it does is just give them a heads up that says hey there's going to be some type of metal in the body put them through the full body scanner you know don't go through the metal detector but I have flown two over 200,000 miles I have never been stopped once and back to my previous statement even if they stop me all I have to do is say it's medical and they're not allowed to go any deeper because then they would be prying into my medical history which is protected by law here here's something for you John have you ever heard of Technology sniffing dogs in any of your research no not for sniffing dogs technology there is a new kind of canine that has been added we actually have one of these canines here in Texas up in Dallas so most people are familiar with kadab dogs drug dogs explosive dogs but they've now got a new technology Snelling dog and it it doesn't work the exact same way but they've trained the dogs to hit on a specific chemical that's used during circuitry and hard drive creation called triphenyl phosphine oxide so these dogs are used in criminal cases around pedophilia human trafficking so this isn't would not the same thing like we would have at the airports where they're looking for drugs and they smell your suitcase and they sit and it's like oh John Hammond you have an iPhone you have technology you know this would be more like in the case where somebody is arrested and then after they've been arrested a search warrant for their property can be obtained and they'll use these an these canines to find USB thumb drives external hard drives that may contain icit files my question is and I've reached out to uh the local police department we're trying to actually set up an opportunity for me to come in and meet this particular can9 can they smell the technology through the skin because that would currently be about the only way that you could actually detect someone like me and I can't help but go back to the the original Terminator movies and everywhere the rebels were they had dogs because the dogs could smell the machines and I'm wondering if through the Advent of technology and consumer grade implants is this going to be a situation where life is ultimately going to imitate art that is quite a thought and you know maybe we'll get there but the the rest of the book kind of takes off and goes into demystifying you know anyone who what I would consider technologically augmented you know I spend a lot of time around the concepts of brain computer interface faces you know there's a lot of discussions about neuralink and even neurol Link's biggest competitor which most people have never heard of called synchron yeah I haven't heard of that one myself oh the in my opinion I love the fact that a lot of what Elon is bringing to the table with neurolink is the publicity it's the ability to get the information about brain computer interfaces out but you know when it comes to the actual implementation human trials they're actually behind the eightball uh there's an additional company called synchron based out of Melbourne Australia and neurolink is a lot like Black Rock Neuroscience brain gate and you know the the ability of putting you know devices in our brain has been around since the N the early 90s wow there's an amazing book called I cyborg by a Dr Kevin Warick out of Oxford University he was actually the first person to embed electrodes into his nervous system and was actually able to control a robotic hand in New York when he was sitting in his office in Cambridge yeah he also was the very first one and this is actually in my opinion one of the coolest in ideas that was ever done in terms of transhumanism he actually got his and and props to Dr Warwick because I offered to do the same thing with the same thing with my wife and she was just like there is no way but his wife actually had the same same uh electrodes put into her a nerve bundle in her hand and anytime Dr War would open his hand she would feel it and they were transmitting this stuff across the internet and whenever she would open her hand Dr War said he could feel a ping in his brain whoa so we are really moving beyond the Realms of what people can normally considered human activity and to answer your other question that you had originally asked am I ha hackable oh heck yeah you know tell me about that like how does that work you got to think about it you remember the the old days and and I hope you do but rewritable CD ROMs oh yep I I got that one at least that that's in the catalog but you remember how you could rewrite them as many times as you want but you could also close them so all of my implants currently which are all consumer grade bought right off of a website it's called Danger things.com they're based out of Seattle Washington uh in Europe there is a second distributor called KC based out of the UK so these are off-the-shelf devices that are normally used for legitimate use cases but as you've seen in and as I've seen you demonstrate in numerous of your videos the most amazing audit tools or legitimate tools become some of the greatest offensive tools when repurposed true enough you know most of the usual use cases for these types of implants would be replacing your your badge to get into a shared garage maybe you go to a gym and they give you a little RFID key card to get in you can put it on there there's even one select group of implants called the vioc key and this is actually a way to actually enhance my security online it's actually listed as what is called a crypt bionic chip and it actually has AES encryption on it so I can actually use this implant as part of an authentication routine they recently released a new version It's called the vioc key Apex and this actually allows me to do all of my otps through an implant so rather than just using say authenticator you know and you just oh I got a thumb print and there's your OTP code I have to scan the implant just to get into access the OTP and then as soon as that first 60c code runs down I actually have to scan the implant again to get a different one so in my opinion this is more like true multiactor yeah integrated cyborg style you know MFA it also has my my my crypto wallet authentication in there and if you drive a Tesla you can actually put your Tesla valet key on an implant just get in your car and drive that's wild I guess you don't have to worry about you know yeah those identity attacks or the the three layers of authentication the pedestals of uh something you something you know something you have and something that you are well look you uh you've got that all contained you don't need the duo or the authenticator you're right that's that's very neat so I mean when I first started going down the road of transhumanism it was all about you know how can I use these off-the-shelf products to essentially find a new attack Vector that people weren't looking for and in over the course of my journey I I basically discovered that not only can I cause Havoc with these types of devices they can actually enhance my own personal security you know and the way I see it especially when we're dealing with things like deep fake you know we're we're in a point in in the world right now where we're sitting here on Riverside but you don't know that this is actually me you mean there's no real way to prove this is me you know and if we take a look at what happened in Asia a couple of months ago with that Financial uh worker who wound up in that V video chat with a CEO and a CFO that were both being faked and wound up transfering $25 million goodness so we're we can no longer believe what we see or hear is you know and I'll take it even one step farther how do you get a unique identifier to a human being anymore that can't be counterfeited spoofed or bypassed yeah you know I I don't know I try to think of the all cheesy passport cards passport birth certificate but you know that's just something you can print on a piece of paper so y That's a thought goodness you know and I've even had people come to me and go well what about DNA well we have crisper technology right now you may not live long afterwards but we can literally cut and paste DNA sequencing every time we get a virus our DNA changes to some extent you know we passed bio facial Biometrics with deep fake voice patterns are gone you know everybody's talking about behavioral authentication as the next potential solution to Identity but there is no way to identify a unique human being and one of the questions that I've stated is could the idea of implantation and transhumanism become some type of a source of Truth to an individual I would think that it might be right because look that again much like the Identity or the author provider or like a duo or like you are the only uh proof that you are what you say you are who you are and who you have been throughout every many years um that's crazy I'm sorry I know this is I I'm sure you get this reaction a lot but I think this is just a fascinating thing and especially throughout the book um as you're telling I know you said a little bit of the autobiography for your career and if you'd like to if we can chime in a little bit more on I guess your background and how that inspired bringing this to life and even uh the science fiction is it so much a story or a narrative or is it still that speculation on you know what maybe our future is going to have more and more of this in a part of it I don't mean to keep rambling sorry I think it's more of a road map because I mean we're seeing a lot of changes in terms of my history I I I was born on the west side of Detroit you know very awkward kid very shy and and I basically just discovered that it was easier to be a jerk and and bad attention is better than no attention at all and growing up in as a Gen X kid my my I basically had absentee parents I I raised myself running the streets of Detroit and I eventually just looking to find some companionship and friends I you know I wound up in the motorcycle clubs yeah and I will freely say it is not like it is on Sons of Anarchy you know we you never go out and beat up people people wearing your club stuff I mean there there's an amazing thing that most people don't realize in the United States is there's a law called Rico which is essentially the guilt by association law it was originally put out to go after mobsters and things like that but if you're a known member of an illegal organization you could be in another city another state heck you could be in another country and they do something heinous the minute you get back you're arrested because it's guilt by association so so yeah there's a little fun fact real bikers do not do that but I spent about 15 years of my life in those types of organizations and that's where I I like to say I got most of my skills through practical application gotcha you know it's a friendly way of saying I did a lot of things that I really probably shouldn't have but well I'm sure there are stories there here there oh none that I'll tell until statute to limitations are up fair enough but it all changed when I when I started having grandkids yeah you know and I'm showing my age here but no I I I was fine with with screwing my own kids up and looking back on my life I wasn't a very good example to anybody you know but when I saw they handed me my first grandchild I was like I can't do this anymore MH and I made a promise that you know my grandkids would never meet me behind bars and they I needed to become something that they would never be afraid of or ashamed of and in doing so I I quit not only doing you know illegal activities but I I I quit the clubs I changed my life I moved to a different state you know and I I left in good standings which means I have no issues with any of the organizations I was members of and I started using a lot of what I was doing out at on the streets but I started looking at them from the opposite perspective I mean you know it as well as I do one of the the biggest catchphrases in cyber security is you know we have to think like the attacker we need to learn how to think like the bad guy I don't need to learn to think like the bad guy I just need to think you know I the minute I walk into a room where are the security cameras where are the exits you know and I think it's just conditioned me to the point where I can look and I can see things from the same perspective of an adversary and I find that that gives me a really unique perspective on this the security landscape as well as what we're going to be moving into well I know the title here I'm looking at it and I'm very very grateful you had sent kind of hey a little Advanced copy uh someone for me to peruse so the title of your book is human hacked and subtitle my life in lessons as the world's first augmented ethical hacker uh so I know all of that bundled up and wrapped in it uh what was a little bit more of either that process uh good bad and ugly as you were going through it and then if I may what's sort of the mission what's sort of your goal uh is this a call to action like hey should we have more transhuman folks a lot of those I don't want to say cyborg because I'm I don't know if that's a good bad or ugly again connotation but or is it just like hey let's have a little bit more understanding let's have a little bit more of a perspective on how that's a potential part of our reality I think my goal for the the book most of all was basically to just get people to realize that there are attacks out there that you may not even be aware exist yeah conce like have the conception that's why exactly you know and the pro when it comes down to it a lot of the attacks that I can do with the current consumer grade Hardware that I can buy are all attacks that as professionals we've kind of you know just overlooked these and considered them to be a non-issue anymore I mean one of the the simplest ways to prevent these attacks especially the attacks I have against mobile devices you know and I before I go into that I I actually explain about five different attacks that I can do all instantiated from microchip implants I can download Trojans to Android devices both Android and iPhones can be redirected to and I know you're a little bit younger than me I'm an old school guy I think one of my favorite tools to this day is still beef because people don't look for it anymore yeah you know and for any of the listeners that the the browser extension exploit framework this is that urban legend that you know the minute you go to the bad guys web page they're in your system it uses Java hooks you know and people don't think anymore that this is an actual real thing they just think it's an urban legend so I can redirect iPhones and Androids and be in your device before I even hand your device back to you and I just came up with a couple of new attacks which I've added for this book which I think are some of the nastiest ones that I've come up with so far so hypothetically John who who's your favorite you know hacker out there and I don't you know I use that term very lovingly because at the end of the day I don't think there's anything wrong with hacking yeah oh goodness I have no clue when I put you people on the spotlight yeah uh you know what I don't we'll we'll give a big shout out to uh Dave Kennedy I think he's always doing cool stuff yeah sweet guy Dave Kennedy so I'm assuming you know Dave probably he gives me a big bear hug when we see him at conferences and I get like crushed so let's say Dave is actually my target if I I found that some of the newer uh NFC tag capabilities are for a predetermined email and an SMS so I've come up with an entirely new way to fish and smash people that is undetectable so it's not the same way we would normally do it where I would have kind of create some kind of a you know john. hammond. influencer protonmail you know whatever right right you know what I'd do is just hey John you know hey can I see your phone for a minute man let me show you this new video the minute that the NFC energizes it can either be a pre-formed email including links or an SMS and it's going to come from your phone directly to Dave so the idea of spoofing the originator is gone it's actually coming from your number and your email all done because you get to hold the phone and your you know implant will do what it needs to to oh man that's you're right that that would do it it just takes ask like hey man I want to show you a video wow and the other one that I came up with that and I think you're going to love this I I took a raspberry pi0 W2 stuck a battery pack on it loaded it up with auntu 244 which has the built-in ability to just spawn a Hotpot as part of the OS I don't know if you you've noticed that I think it's one of the coolest features of 24 o yeah you go up can do that easy now you go up under your wireless networks all networks and there's just an option that says create Hotspot so you can create a Wi-Fi hotspot with built-in controls to the OS then what I did was use the man in the middle proxy to throw a transparent proxy behind it I have 10 different implants in my hands so the first implant I can download the root level certificate to your device the second implant tag is connect to Wi-Fi network where I can connect you directly to the U the raspberry pi0 W2 sitting in my pocket logging all of the communications from your mobile device from the moment the root certificate is installed I'm I'm I'm still putting pieces together in my mind all of this means means and I'm sure that you have had to do this like that means you at some point SSH into yourself is that right is that fair to say well actually what I do is I use my phone to connect to the Raspberry Pi turn it on just stick it in my pocket or put it in my bag yeah hey John again got this great new video of me you know an interview I did let me see your phone for a second you know I hold it in this hand it prompts me to download the root level certif the root certificate to the proxy that I've got set up as a URL redirection oh man hang on I'm trying to remember the you know the address switch it to this hand which uses the NFC tag of connect to Wi-Fi hotspot which is already configured with the the password and everything the SSID and then from there the Raspberry Pi 02 is actually getting its actual connection through my cell phone through uh sharing on my my mobile wow so hand you back the device it's already connected to my proxy and you can watch my my interview but then anything you do from that point until you get out of range is coming across my transparent proxy and clear text man some people have to be like scared to hang out with you is that right most my know off around me I don't know why I keep telling them I need Rules of Engagement and my lawyers have to get involved I I I've spent some some time in those state funded vacations and I got to tell you dude the amenities suck the beds are terrible the food's not mediocre there's no swimming pool wow those are that's wild you are you are blowing my mind I will say and honestly it's not just digital one of I think one of the most influencing attacks that I've shown with these is actually against physical security you're B your badge to get into your office you know let's say your badge gets you into a data center if I can skim that badge and write it down to one of my implants I can bypass your physical security with zero ioc's and not only that if you catch me which I'm assuming you're going to catch me I'm I'm not exactly inconspicuous looking you know let you know if we walk through the what's going to happen operations will take me to their office they'll call the police all I have to do at that point is Place stupid why were you in there well the door was open I've seen those racks of computers on on you know commercials for services on TV I thought it was cool yeah so the police are going to come they're going to search me they're not going to find a clone card they're not going to find a prox Mark or any type of Replay tool they're going to have me they're going to have me empty my pockets I may not even have my cell phone on me yeah so at that point the worst that they can do is trespass me and but keep in mind if you're dealing with iot iot usually works over NFC or zigg or zwave I have the potential to directly interface with that inside your data center and you wouldn't even know wow you know and one of the things that you know has been asked quite a few times is is there any white papers or DFS that show this as a valid attack Vector because the truth is one of the questions I get asked all the time is how prevalent are attacks like these you know is it something that we need to worry about in the actual while and the the truth is we will never know I mean could the you can go check your logs you may find you know an NX NFC trigger but there's no way to tie that directly to an implanted device it could have been a wearable it could have been a cell phone it could have been another card so the idea that you can tie any type of attack that has either happened in the past or or currently happening directly to an a subdermal implant is impossible but I can tell you for a fact that I know of at least three to five red teamers that are using these types of of implants in active engagements so if we're seeing it in pen testing companies the idea that you know Bad actors are doing using the same type of tools Tech techniques and procedures is not unrealistic well goodness so I would think you've already been blowing my mind this whole time while we're chatting uh human hacked in your book is just this tenfold more ideas more stories more thing things to consider um can I ask how can folks maybe get a hold of it how can folks dig in what's next what are the next steps uh we are available for pre-order right now on Barnes & Noble Amazon and pretty much anywhere books are sold um one last thing that I kind of wanted to throw at absolutely more anything you know we talk about this utopian future and if you're not familiar with it there's a group out there called and I got to be careful because this is not project 2025 okay this is Project 2040 if you've never heard of this this is a group of individuals within the scientific community that have basically stated that by time we get to 2045 we will be able to download our Consciousness into some form of digital media that can live as an extension exclusive from the human body so if we just look at that timeline you know we're not that far off but one of the key points that I and I would love to get this out to your your subscribers is let's talk about this for just a quick second from a moral and ethical perspective so when we talk about brain computer interfaces and this utopian future where you know John Hammond can actually download you know his brain into a computer and be doing amazing podcast for the next 300 years in order to get there we have to move beyond the fact that right now now all of these types of devices are only meant for the most damaged among us as far as physical conditions neuralink synchron brain gate all of these even the smart Prosthetics that they're using in terms of I don't know if you saw but there was a really cool article that they're saying that wheelchairs may be a thing of the past by 2030 wow and being replaced by exoskeletons with implants into nerve bundles that will allow quadruple iics and paralyze people to actually walk and if you'd like I'll send you the article when when we're done here you know but when we look at it from the the actual medical laws and ethics the only people that would get these types of devices would be people that were quadriplegic Shu inss people with you know severe physical and neurological damage so in order for your Elon Musk and your Jeff Bezos and your Bill Gates to become the the Cyber Immortals we need to move past the idea that you know putting something in the brain is not considered cosmetic this is not plastic surgery these are surgeries that have the potential for severe complications yeah not every brain computer interface is universally accepted by the human body just like anything else that gets put in you know so we need to determine a is this something that we want to do moving forward for shut-ins and medical issues or is this something we want to do to try and enhance and expand the human existence beyond the physical plane goodness gracious I got to I I I do want to spend uh the time that I can to explore and peruse your book I think these are wild thoughts and uh good things to consider CU you're right it's not uh it's not too far off and I how many can I ask Do you have a good gaggle of friends that are in that hey transhuman uh implant World reality living it day in and day out absolutely and we actually do have some highlevel numbers there could be anywhere between 50 to 100,000 individuals globally walking around with implants in them and one last thing just is to set the stage for all of you know your your viewers and subscribers that were concerned back during Co that oh my goodness the government is putting a tracking chip in me I address that too there is no way that they could have been put a tracking ship in us without us knowing for just for quick you know reference the needles that they use to implant microchips are about as big as this pen I think if any one of the citizens anywhere in the world that went in to get that vaccine saw somebody walking in with a needle that big there would have been far few people getting the vaccine I think you might have had a picture in your book I was scrolling through it and I saw one I was like hm you're looking very Final Fantasy right now but oh yep there it is y and uh maybe uh maybe a little bit of a quick disclaimer heads up warning if we showcase that in the video but that would be very very fascinating yeah I I would anybody that that is is willing to spend some time and read my book I'll warn you chapter 7 is called my first installs it's a pretty graphic chapter because I actually go into how these things get installed some of them are a simple syringe some of them require scalpel and dermal elevators so some can be quick some are extremely intense and at the end of the day all of them were done without the use of any type of Novocaine or numbing agent because it's against the law well you know what this is crazy it's uh incredible incredible story kudos to you for you know being willing to do it being willing to hey be and Lead this life as an example and to help think on what's the future going to look like and thanks for sharing that all with us uh I really appreciate you having me on John it's been an absolute pleasure I and I just wanted to tell you I've been watching your channel for a very long time so longtime viewer First Time guest thank you so much for the opportunity to come on and have a conversation with you well it's mutual we're Fanboys to each other and uh we'll get a link in the description for folks wanting to check out human hacked thanks so much Len my pleasure