SCENARIO 003: Part II - The Exorcism 🧵
We tried to delete the user. The user came back. We wiped the logs. The logs rewrote themselves. The "Delete" command was just a suggestion that Arthur Pendelton’s ghost refused to take.
Software had failed us. The terminal was lying. So I stopped looking at the code... and started looking at the air. 👇
We tried to delete the user. The user came back. We wiped the logs. The logs rewrote themselves. The "Delete" command was just a suggestion that Arthur Pendelton’s ghost refused to take.
Software had failed us. The terminal was lying. So I stopped looking at the code... and started looking at the air. 👇
https://x.com/zoecyber001/status/1998037853083930778
The SOC at 03:00 AM is a strange place. The air conditioning hums like a dying engine. The blue status LEDs blink in the dark. And on the main monitor, the "Active User" count ticked up by one.
Arthur was back. The team was panicking, typing furiously, looking for a backdoor script or a hidden cron job. I told them to stop typing. "You can't fight a ghost with a keyboard," I said.
Arthur was back. The team was panicking, typing furiously, looking for a backdoor script or a hidden cron job. I told them to stop typing. "You can't fight a ghost with a keyboard," I said.
I pulled "The Auditor" out of my bag. This isn't a laptop. It’s a custom-built signal intelligence tool I designed for exactly this kind of nightmare. Powered by an ESP32 and a copper coil antenna tuned for Sub-GHz frequencies.
Most hackers look for logic bombs. I was looking for a heartbeat. I set the device to RX Mode and tuned it to 433.92 MHz.
Most hackers look for logic bombs. I was looking for a heartbeat. I set the device to RX Mode and tuned it to 433.92 MHz.
Why 433MHz? It’s the frequency of the "dumb" world. Garage door openers, cheap weather stations... and long-range remote switches. If Arthur wanted to hide a trigger that Wi-Fi sniffers couldn't see, this is where he would put it.
I started walking the server rows. Rack 1: Silence. Rack 2: Just background static. Rack 3...
I started walking the server rows. Rack 1: Silence. Rack 2: Just background static. Rack 3...
The OLED screen on The Auditor lit up (as seen in the first pic). A sharp, jagged waveform cut across the display. Signal Strength: -38dBm (Very loud. Very close).
It wasn't random noise. It was rhythmic. Every 30 seconds, a burst of hex code was blasted into the room. It was a "Keep-Alive" signal. A heartbeat from the grave.
It wasn't random noise. It was rhythmic. Every 30 seconds, a burst of hex code was blasted into the room. It was a "Keep-Alive" signal. A heartbeat from the grave.
I followed the signal strength like a game of "Hot or Cold." The waveform grew taller as I approached Rack 4. I knelt down by the bottom shelf. It looked empty. Just a blank metal faceplate screwed into the chassis.
But The Auditor was screaming now. The source was millimeters away. I unscrewed the faceplate and shone my light inside.
This is what I found. 👇
But The Auditor was screaming now. The source was millimeters away. I unscrewed the faceplate and shone my light inside.
This is what I found. 👇
There was no ghost. There was only a Raspberry Pi Zero, wrapped in dust and neglect.
It was wired directly into the switch's console port via GPIO pins. Arthur’s "Dead Man’s Switch." A physical script that checked for his account. If the account was gone, the hardware injected the commands to recreate it.
It was wired directly into the switch's console port via GPIO pins. Arthur’s "Dead Man’s Switch." A physical script that checked for his account. If the account was gone, the hardware injected the commands to recreate it.
This is the danger of the "Smart" world. We spend millions on firewalls and EDR. But we forget Layer 1: The Physical Layer.
Arthur didn't hack the software. He hacked the building.
(Reminds me of an estate I visited today. The entire community Wi-Fi server rack was sitting exposed in the gateman's office).
Software security couldn't see the device because it wasn't on the network. It was controlling the network from the outside.
Arthur didn't hack the software. He hacked the building.
(Reminds me of an estate I visited today. The entire community Wi-Fi server rack was sitting exposed in the gateman's office).
Software security couldn't see the device because it wasn't on the network. It was controlling the network from the outside.
I didn't run a line of code to stop him. I just pulled the jumper wires.
On The Auditor’s screen, the waveform went flat. On the main monitor, the "Active User" count dropped to zero. The exorcism was complete. Hardware beats software. Every time.
On The Auditor’s screen, the waveform went flat. On the main monitor, the "Active User" count dropped to zero. The exorcism was complete. Hardware beats software. Every time.
I am building "The Auditor" to visualize the invisible signals that control our cities.
This is the prototype I am preparing for an Event. The goal is to open source the schematics and code so you can build one too.
If you want to survive the next scenario, you need to understand hardware.
#ZoeCyber #EthicalHacking #DeepTech #Lagos #CyberSecurity #hardware
This is the prototype I am preparing for an Event. The goal is to open source the schematics and code so you can build one too.
If you want to survive the next scenario, you need to understand hardware.
#ZoeCyber #EthicalHacking #DeepTech #Lagos #CyberSecurity #hardware
⚠️ Field Note: This thread is a fictional Scenario designed to demonstrate physical layer vulnerabilities.
While the story is a simulation, the tools (The Auditor) and the risks (Physical Access) are 100% real.
Images generated with AI.
Stay secure.
While the story is a simulation, the tools (The Auditor) and the risks (Physical Access) are 100% real.
Images generated with AI.
Stay secure.
@threadreaderapp unroll
• • •
Missing some Tweet in this thread? You can try to
force a refresh
