Mackenzie Jackson: Hello, you're listening to the show where we bring you the latest and greatest in cybersecurity news, research, and leaders. My name is Mackenzie Jackson and this is The Secure Disclosure. We have a fantastic show lined up for you today. We're bringing on Nathaniel Jones, who's the VP of Threat Research and AI Strategy at Darktrace, and we're going to talk about some discoveries that they have made involving the SAP NetWeaver server and also a very nasty bit of malware called AutoColor. We're going to get into the latest drama that's happening with WinRAR and why you should absolutely, finally, definitely delete that from your computer. And we're finishing up by having a conversation with Len Noe, who is a legitimate cyborg hacker. I know how ridiculous that sounds, but he has multiple implants throughout his body to enhance his hacking ability. We're going to sit down, drink some sake, and discuss what life is like as a cyborg hacker. So stay tuned for that. All right, let's get into the first segment. Darktrace has been in the news recently thanks to them discovering some particularly nasty malware called AutoColor that is being installed on infrastructure via a vulnerability in the SAP NetWeaver server. To discuss this further, we're bringing on to the show Nathaniel Jones, who's the VP of Threat Research and AI Strategy at Darktrace. He's also a Field CISO there. Nathaniel, thanks so much for coming on to the show. We really appreciate you coming and spending the time with us.
Nathaniel Jones: Thanks very much, Mackenzie. Nice to join. Appreciate the opportunity.
Mackenzie Jackson: So, I'm going to kind of dive straight into it. The reason why I was so excited to bring you on to the show is that you're obviously working for Darktrace, and Darktrace has been in the news a little bit about some of the discoveries that they found, some particularly nasty malware being rolled out via some vulnerabilities. So, maybe we just start with a little bit of context. What actually happened? What did you guys discover out there being exploited in the wild?
Nathaniel Jones: Yeah, sure, sounds good. We're here to talk about AutoColor in terms of the malware and the sophistication, but also how it exploited SAP NetWeaver, that vulnerability that hit maybe late April, early May-ish. And so, yeah, from our perspective, it was really interesting because we saw detections about a week before the vulnerability was disclosed, but also the exploitation of that vulnerability after as well, sort of a natural story. And then, yeah, just the way our detection worked as well.
Mackenzie Jackson: So, how did you guys first actually detect this? Because there's a lot happening out there in various different states. So, how did Darktrace actually understand that something was wrong with both SAP and also, we'll get into the malware itself a bit later on, but let's start with how you first discovered something was up.
Nathaniel Jones: Yeah, sure. So, the first few things were we had a couple of our models or detections go off due to an anomalous connection to an OSINT site, which is quite common. And then we had a couple alerts across our SOC and MDR that sort of came through, and our team started investigating from that. And then we saw an unusual ELF download from a rare IP. So, we saw a few different anomalous connections and then a file download, and then saw subsequent activity after that. Our team sort of extended the containment of those actions, and then we kind of investigated after we sort of stopped it in its place.
Mackenzie Jackson: I mean, it is very interesting. I think anyone that has worked in a SOC or been in a SOC, you get all of these alerts all the time from various different things. There's never, and I think people that probably haven't had this experience may not know, is that you don't get an alert to say there's a breach happening. There are all these little things that together paint a picture, but there's no point, there's no air of certainty in it. And I think that's what you're touching on there too, is there are lots of different things kind of coming together that pointed to the fact that, okay, something's not quite right here. Let's move on to the actual vulnerability. So, the malware that was used is called AutoColor, we'll get into that, but to be able to deliver this malware, which is particularly nasty, the attackers first need to get a foothold. So, there was a vulnerability in SAP NetWeaver. For any nerds out there, we're talking about CVE-2025-31324 if you want the CVE number. But let's have a, what is this vulnerability that's in SAP NetWeaver?
Nathaniel Jones: I love that you listed the CVE because I was going to do that for you if you weren't. Definitely nerding out, important to have that right because there's a few. Yeah, I mean, SAP NetWeaver has been, so SAP has been exploited before, it's in CISA KEV, we know it's a technology that people are interested in. In this case, NetWeaver is sort of internet-facing naturally, so that sort of brings attention for people to understand that technology. In this case, it was a remote code execution vulnerability and a CVSS score of 10. So essentially, you also had a problem with sort of authentication authorization, but without getting into too much detail, essentially you could just write a command remotely and get something, write a command and have it sort of process inject or sort of take over the machine from that.
Mackenzie Jackson: It's not often you see a 10. Often you see like a 9.8 or something, but a 10 is basically worst-case scenario. Why was this one considered so dangerous in terms of this vulnerability? What attributes kind of gave it that 10? Is it just that it's remote code execution? Is it that it was kind of unauthenticated? What gives it that perfect score, if you could call it that?
Nathaniel Jones: Yeah, true. I think from the fact that it's interfacing is a challenge. The fact that you have remote code execution, so you could do it from anywhere, is a challenge. I think being able to do full system compromise that quickly, you had exploitation before the vulnerability was actually listed and then put out into disclosure and then into CISA KEV. And the fact that you had exploitation after that, the PoC, I think the proof of concept code, I think was a day, maybe two, before it actually got out there. So, you had quite a few natural interest parties and then it just sort of exploded from there.
Mackenzie Jackson: Yeah, because I mean once you have that proof of concept on GitHub or wherever it is, then it's just a field day. One of the interesting things is when these vulnerabilities are actually exploited in the wild, there's a lot of very severe vulnerabilities out there that never get exploited in the wild because the exploit chain is very long or whatever it may be. In your opinion, do you think the attackers were targeting specific companies looking for vulnerabilities or were they doing wide-scale scanning to try and find this version of SAP NetWeaver? Was it targeting the version of NetWeaver that was vulnerable or do you think it was targeting specific companies?
Nathaniel Jones: Yeah, I think both. So, first, we did see probably scanning widely because they're looking for that specific type of server. I think that happened probably after the CVE, at least from our telemetry, after the CVE was announced and then disclosed and the PoC became available. Before that, we saw activity that I thought would match with specific targeting. Any APT worth its salt that is going to be using that for operations, they're going to get into the targets for either espionage or industrial property theft or whatever their national security goals are. So, both.
Mackenzie Jackson: So, you mentioned their APT. I was going to ask this question later on, but as you've mentioned it, I'm going to throw it in there now. So, Advanced Persistent Threat, kind of state-sponsored actors, this is who you believe is behind this type of attack. This isn't like opportunistic script kiddies, you believe that this is coming from like a larger scale, more sophistication?
Nathaniel Jones: It seems to point that way. I mean, I'm not, we're not the only ones that thought that maybe some of the pre-disclosure activity was nation-state related. It matched with I think Palo Alto and a couple others, maybe ReliaQuest rather. So I think the combination of the targeting, who the victims were, the fact that they're using a zero-day plus the AutoColor backdoor, the nature of it points to some sort of well-resourced adversary.
Mackenzie Jackson: You've mentioned AutoColor. We've danced around it a lot. So, let's dive into the juicy part. So, AutoColor, it's a specific malware. So, what is this? What makes it so kind of dangerous?
Nathaniel Jones: I think there are a few things, so I'll have to rattle maybe five of them. But for background, I think it came out late 2024. It's Linux malware, which is not that common comparatively speaking, particularly if you think about like Android. But when executed, it checks if it has root privileges first. And then if it has root, then it proceeds to install sort of a malicious object and modifies a Linux file that essentially allows you to sort of force it into separate libraries, which just expands into every process. I think those few things plus the malware hidden in a directory that sort of mimics logs, which is also interesting. I think the fourth thing would be that it uses encrypted strings and dynamic API resolution to avoid static detection, which also points to the challenge of having signature-based detection. But then also, it uses a custom encryption algorithm for outbound communication. So, those are five things that I rattled off that might be a little too intense for the crowd, but those are five things that you're like, "Wow, nice."
Mackenzie Jackson: Yeah, yeah. I know, like you touched on a really good point there of like signature-based detection, is that how we detect most of these things is basically by identifying a hash or something of what we know is malicious software. We're in this new era where polymorphic malware is a term that kind of gets thrown around, but it's basically like signature-based malware is becoming more and more obsolete. So, it's getting harder and harder to detect. So, how can't it? It's 2025. We can't talk about, we can't mention the podcast without talking about AI. So, let's dive into this. I know that Darktrace is kind of on the frontiers with kind of using AI to help detect this. We talked a little bit at the start about how you detect it, but what specifically kind of role did AI play in helping uncover this and how's that going to help us in the future?
Nathaniel Jones: Sure. I guess just for AutoColor's particular stealth and how we were able to sort of capture it. One, the hardcoded IP means that the hash is different for each file, so making that signature sort of much harder to use if you're trying to get a rollup of those different games of compromise. So I think that on top of the Linux malware, on top of the anomalous sort of connections outbound, we thought that was interesting. From an AI perspective, it's from us, we sort of apply AI to the business data and we sort of avoid any sort of threat actor-centric behavior. We try to learn that and use it to sort of bubble up different anomalies. So if you think, Mackenzie, okay, we understand his data and on top of that we apply a series of machine algorithms or sort of unsupervised machine learning, machine learning from a control supervised perspective, but also we employ math like Bayesian math, so different types I think provide that sort of anomaly score and then that'll sort of raise up into different categories for you and then we use our AI analyst which we've trained on our SOC to sort of help piece together different bits of those anomalies and then that helps provide sort of the SOC human, in this case our analyst, to see it. So, in this case, cyber analyst pulled two or three different sort of incidents around what was happening across that environment and then we saw it from that perspective. What's interesting around the AutoColor backdoor, we talked about it in terms of stealth and sort of the cool things. What also is cool is if it doesn't get that immediate C2 connection and it tries to sort of perform the kill chain, then it'll just go benign and it looks very benign and it sits within logs. So just the functionality of it I think was interesting and the use of AI to detect that was pretty cool.
Mackenzie Jackson: Have you guys kind of seen this malware in other areas? So, right now we're talking about kind of the chain of going through the SAP vulnerability and installing it there. Have you kind of seen it in other areas as well? Is this being used more and more by kind of threat actors, APTs?
Nathaniel Jones: I have not seen it that much, to be honest. I know it came out late 2024, so about a year ago, but it was mainly targeting sort of governments, a little education institutions across particularly Asia, Southeast Asia and the US. For us, I think ours was around a US chemical plant. So, that was interesting from our perspective. Does that fall in line with targeting critical infrastructure? Yes, by maybe an East Asian APT. Yes. But broader than that, I can't really comment in terms of attribution because we don't have enough telemetry and we're pretty threat agnostic, the whole anomaly-based detection thing. So, yeah.
Mackenzie Jackson: You've mentioned they're the kind of the victim in this. It's with a US chemical company. Classic target for an APT, this type of organization. This may be getting into a little bit of speculation, so perhaps maybe we can't go down this path, but what do you think the threat actors were trying to achieve in all of this? Was it disruption, stealing of information, moving laterally? What is it? Do you notice anything? I mean, you stopped it pretty quickly, but did you notice anything there or have any ideas about what was trying to be done here?
Nathaniel Jones: Without speculating too much, we do know APTs sort of go for twofold: industrial espionage but also just espionage and some of the targets that we saw in or that were observed in East Asia and the US. From our perspective, at least from the chemical factory, you would probably assume that they're looking for either two things. One, they're using as a proxy to sort of obfuscate other attacks or two, that they want to hold that organization or entity at systemic risk and sort of change the calculus of the US and also just sort of maintain that that is a threat to critical infrastructure.
Mackenzie Jackson: Yeah, definitely. I don't want to take up too much of your time, but there is probably something that a lot of people listening want to know. And I guess there's kind of two parts to this. One, if you're running SAP NetWeaver as a server, what should you do? What can you do to kind of help prevent that? And I guess kind of the other part is kind of what can we do to prevent this kind of new era of malware? But let's start with SAP NetWeaver. What if you're running this service, what should you do? Is it fundamentally unsafe? Is it safe to use? What would you suggest?
Nathaniel Jones: Yeah, I mean, I think it's fundamentally safe to use. I think vulnerabilities happen. So you just need to think about, okay, if you're not going to use something that bypasses signature detection, what else can you use within your stack to sort of provide that security posture? From SAP NetWeaver specifically, I would go straight to SAP's website. Make sure you actually patch the servers. And then so, you know, patch management is easy on a vendor, harder on an operator because of downtime, right? So just the natural thing. The other thing would be, you know, segmentation of vulnerable systems, sort of the internet-facing, for and by design they're internet-facing. Then you want to have a little bit more control and segmentation, micro-segmentation is important there.
Mackenzie Jackson: And what about from like the AutoColor perspective and these new threats of malware? If someone's out there, I mean, as you said, vulnerabilities happen. They're always going to happen. It's not a sign of poor software. It's just a sign of popular software basically that you have these vulnerabilities. But so you can't deny, you can't completely prevent the fact that perhaps someone can get a foothold in. What can you do about preventing these kind of new era, let's call it, of malware, of things like AutoColor and whatever is going to come after AutoColor?
Nathaniel Jones: You're making me think about the, I can't, I think it's called LameHug, the malware that came out from CERT-Ukraine around Russia, sort of a newer sort of malware, and then it called out to a Chinese-based LLM. And sort of incorporating AI into malware tech is definitely a scary thought, right? Typically you're thinking, yeah, GenAI or sort of phishing, and we're seeing a lot of that in terms of phishing. And yeah, it's just been, it's been interesting to sort of watch it happen. It's also been really cool from a defensive perspective to apply AI in this new era around, cool, like that was a very sophisticated malware, but we picked it up. And we not only picked it up through the different algorithms and cyber analyst, but the analyst was able to sort of get that feed from all that different AI and make a good defensive decision. So for me, that's cool.
Mackenzie Jackson: Definitely. And I think that's great to kind of see. It gives me hope that you guys are out there. And it's even great to kind of see it in action because Black Hat has just finished. I don't know if you were there and if you walked around the vendor hall, but everyone is making wildly bold claims, but it's great to see it in action actually stopping something in the wild, being used in that, not just theoretical, right?
Nathaniel Jones: No, exactly. You're seeing it in practice. We do it every day. It's really fun.
Mackenzie Jackson: Well, Nathaniel, thanks so much for your time. I won't take you for too much longer, but it's been fascinating. Thanks for sharing your findings too. There are links to the blog post that Darktrace did, as well as some news articles in the links of this. So, if you want to find out more, you can click down that. But, Nathaniel, thanks so much for coming on the show and hope to have you back sometime.
Nathaniel Jones: Awesome. Thanks so much, Becky.
Mackenzie Jackson: And that segment gave me a good segue to talk about the sponsor of the show, Aikido Security. Aikido Security is your complete code security platform. Aikido brings together multiple different tools like static code analysis, dependency scanning, but also it could check things like your API endpoints and your cloud infrastructure for vulnerabilities. But Aikido have just launched a very cool open-source tool called SafeChain. SafeChain wraps around package managers like NPM and blocks installations if the package contains malware inside it. This is especially important with all of the attacks going on. You never know if a package has been compromised or not, but with Aikido SafeChain, you do have added protection. You can try Aikido for free today at Aikido.dev. Now, into our next segment. If you're from any generation other than maybe Gen Z, you're probably pretty familiar with WinRAR, possibly from when you were trying to torrent some software and it came in this wacky RAR format and you needed a tool, a utility to export it. Well, WinRAR has been around for a very long time and it is still very widely used today despite being maintained only by one guy. WinRAR was first created by Eugene Roshal, and it was actually his brother Alexander Roshal that took over the development of this and maintains it to this day. It's quite rare we get a WinRAR patcher update. However, they have had to release one recently due to a very nasty zero-day that is being actively exploited in the wild by a Russian APT group called RomCom. The vulnerability, CVE-2025-8088, is a path traversal vulnerability. The exploit works like this: an attacker can embed a malicious payload leveraging something called ADS, Alternate Data Streams. This payload then gets put into the RAR folder. In this case, it's a malicious DLL file that gets extracted at the time and usually embedded into the boot systems of a Windows machine so that it can run on the next reboot. This is actively being exploited by RomCom who is going after your usual suspects that an APT would, being government organizations or critical infrastructure. The targets that RomCom go after are of no surprise to anyone. They're targeting your financial institutions, defense sectors, government sectors, anything that you expect an Advanced Persistent Threat from Russia would be going after. RomCom are conducting spear-phishing campaigns to get people to run this malicious software. The RAR file will be hidden in something like a CV or a document that gets emailed or sent to someone. The malicious payload is executed and is installed on the background. So, nothing appears to be wrong. Now, this is obviously working because it's being actively exploited. But if you're like me, you've probably got a couple of questions. One, why are people opening RAR files? And two, who is using WinRAR today? Well, apparently still a lot of people are. There is a patch available for this. And if you absolutely must use WinRAR, then you can install that patch. However, my advice would be to uninstall WinRAR and to throw the computer that has it installed out the window. Of course, I'm joking a little bit. The RAR format was actually pretty great when it came out, but there's lots of different compression software that we can use that have replaced it. There's also other better maintained software that can extract RAR files. For example, 7-Zip, PeaZip, or Unarchiver. I do want to give a bit of a shout-out to the Roshal brothers. They did create this technology and they have maintained it for 30 years, but it is time now to move on from WinRAR. Well, that was our final news segment, and I'll be honest, it was a little bit of a cathartic rant from me, but we're going to move on into a very exciting segment. A couple of weeks ago at Black Hat, I got to sit down with Len Noe. Now, Len Noe is a legitimate hacker cyborg. I know how ridiculous that sounds. Another name for it could be transhuman, but it's essentially someone that has made modifications to their body in the case of Len by implanting himself with different microchips to be able to conduct advanced hacking techniques. Now, I could talk about Len for a while. He is definitely my most freaky friend, but I enjoy my conversations every time I sit down with him. So, without ado, let's go into the temporary Black Hat Cyber Sake Bar and have a conversation with Len Noe.
Mackenzie Jackson: Well, hello everyone and welcome back to another episode of Cyber and Sake. And I cannot tell you how thrilled I am to be here. I'm here with Len Noe. Now, Len, it's fantastic to have you here. We've got a little bit of a history because you were the very first guest on my very first podcast. And I got to tell you, your intro is one of my favorite interviews I have ever done in my career. Holy. So, I just found out that cyborgs are real and they can hack. This is probably the most terrifying revelation I've had. You're a pretty big name, so I'm assuming that probably a lot of people will know about you, but for those that don't, you're a legitimate cyborg hacker.
Len Noe: I am.
Mackenzie Jackson: It sounds ridiculous, but can you maybe just explain what that means to you?
Len Noe: So, I took basically an old dog and taught it some new tricks. I found that through the use of implantable technology that falls into the wireless spectrum, RFID, NFC, you can actually get sub-dermal implantable technology. And of course, it was never meant to be used as a cyber tool. It was meant to be, oh, I want to be able to get into my garage and, or, you know, get into my gym, and, you know, well, obviously, I lose everything. Where's my keys? Put it in your hand. You can't lose your hand unless, well, you can, but then I think you'd know about it.
Mackenzie Jackson: Yeah. Yeah. Yeah, for sure.
Len Noe: So, I currently, I actually have 11 different microchips. I can interface with RFID, NFC. I actually have some crypto bionic security chips that I've added to my arsenal now. So, I'm both offensive as well as defensive. And I think we're going to open your eyes to some really cool stuff today because I've done a lot since the last time we talked.
Mackenzie Jackson: All right, I'm excited. First things first, can cyborgs drink sake?
Len Noe: We can. We prefer bourbon, but sake, we make an exception. You know, always good to oil the machine.
Mackenzie Jackson: Oil the machine for sure. All right, so we have two today. We're going to start off with number one. This is Yuri Masamune, and it's from the Yuri region in Japan, famous for kind of soft water. It's a bit of a nutty. All right. Cheers.
Len Noe: Salut.
Mackenzie Jackson: Salut. Oh, that's good. That's really good. Yeah, yeah.
Len Noe: Yeah, you know, subtle little nuttiness in the aftertaste. Very good.
Mackenzie Jackson: But getting back onto security, what abilities do you have that a normal person doesn't have? Like what can you do with these implants?
Len Noe: So, that's a very broad question. For starters, I can interface to wireless technologies at a high level. What does that mean? Near-field communication, or NFC, has been built into every modern cell phone for the last couple of years. It's the backing technology behind Android Pay and Apple Pay. But that's just one function it can do. There are what are called NFC triggers. I can redirect you to a specific web URL with these types of technologies. I can connect you to a Wi-Fi network. I can set up a predefined SMS or email. This is basically all of the basic tools that I'm using for all of my current implant-based attacks. I love this. This is actually one of my favorite new attacks. I don't think I showed you this one yet, but it's an implant-based smishing or phishing. So, I can actually have an email that's already predefined with hyperlinks in it. And you know, when we're dealing with phishing, we've all been put through so many of these campaigns. Don't click on the link. Check the sender.
Mackenzie Jackson: Yeah. Yeah. Yeah.
Len Noe: Well, what do you do if it's from the actual sender?
Mackenzie Jackson: Yeah, for sure.
Len Noe: So, who is somebody else within the podcast organization that we're dealing with? I just need a name. We're going to give some credit to somebody behind the scenes.
Mackenzie Jackson: All right. Phipe. Philip's my producer and editor.
Len Noe: All right. So, all right, let's say I want to get to you because you're the talent. Nobody's going to get to you because they got to go through the producer first, right? So, if I can convince Phipe, "Hey man, let me show you this really cool new cat video." The minute that phone comes into my hand, I've got a predefined email already set up to go to you, assuming and looking like it's coming from him, right, with my malicious links in it. So,
Mackenzie Jackson: So, the moment you get that phone in your hand, your chip, your chips are working. He's not looking at it. You go, "Oh, sorry, it's not coming out."
Len Noe: No, I told you it's going to take me a second. I got to find this cat video. You know, these cat videos are amazing. But it's going to ask me, "Do you want to send an SMS?" "Yeah, I do." "Do you want to use the default messaging program?" "Oh, yeah." And I'm just going to fire it off.
Mackenzie Jackson: Yeah. And if you guys are in constant communication, the idea of you getting a text or an email from your producer is not out of the question.
Len Noe: No, not at all. And the other part that too is there's no evidence. Like there's, you know, like you walk in somewhere, you can communicate with different things. You grab people's phones, you pull up a wireless network, people get suspicious, they stop you. And that's another thing, you know. I unfortunately, I am from the United States. I know you're European and you guys are so much more cultured than we are. And I know my Latin is terrible, but I believe it's pronounced mens rea, which is Latin for malicious intent. You can commit a crime and not be a criminal. Was it your intention to commit a crime or did you just make an accident? Right. So this is the difference between if, let's say, you and I are both going to go on the same red teaming physical access penetration test, if I can skim somebody's badge, write it down to one of my implants, and even if they catch me, there's not anything more. I love walking this through with people. Let's walk the scenario. You find me in your data center, in your server room. What are you going to do? "We're going to call operational security. We need to get somebody, this. We got somebody where they're not supposed to be." They're going to grab me. I know I'm going to get caught. I don't care. That's the difference. I don't care if you catch me because I know I'm going to walk.
Mackenzie Jackson: Yeah.
Len Noe: "We're going to take you into our operational security office. We're going to call the police." The police are going to come. They're going to be like, "All right, how did you get in there?" "Well, I didn't know I wasn't supposed to be. I've seen like the towers of all the servers, you know, on the Dell commercials at home. It was just really, really interesting, you know." "Well, how did you get into the door?" "Well, I just opened the door."
Mackenzie Jackson: Yeah.
Len Noe: "Well, you know, obviously, we're all security conscious here, so there's going to be some video closed-circuit TV footage out there." And what are they going to see? Nothing. They're going to see my hand come up. They're going to see the door open.
Mackenzie Jackson: Exactly. Yeah. Is there a line that's too far? Like, you know, you've got all this capability. Is there something that you look at that people in the transhuman and in this movement are doing, and you think, in my opinion, it's too far?
Len Noe: Yes, absolutely. Transhumanism is being thrown all around a lot in the news right now, and not in a good way. It's like always has something to do with some kind of rich person trying to find the fountain of youth through technology.
Mackenzie Jackson: Yeah.
Len Noe: It's I want to live forever. And we're not going to talk about the other things that seem to be associated with that. But I can tell you that most transhumans are like me. We're just normal people. And the one thing I would say is that that immortality thing. That is the bridge too far for me.
Mackenzie Jackson: Yeah. Yeah. No, I get, I can totally get that. And there is a category of billionaires right now that are very, as we speak, that are very invested in this kind of like, as we speak. I mean, I don't know about you, but the idea of, you know, a thousand years of Elon...
Len Noe: It would be, and I'm not saying pro or con, I'm just saying imagine the stuff we would get.
Mackenzie Jackson: We would get a lot of content.
Len Noe: We would have content. We would have content.
Mackenzie Jackson: Yeah. One of the things that I'm kind of always curious about is where are we heading in this space? So, last time we spoke, one of your primary objectives was the SBC and but and also just to kind of show people what's capable, you know.
Len Noe: I think when it comes to, you know, the exposure to the possibilities, I have been very, very fortunate. I've actually come up with some new stuff now, and I got some prototypes that I should be able to show here within the next quarter, couple of months. I've come up with a, and this is actually something anybody can do this. You do not have to be completely, you know, cyborg crazy like me to pull this one off. So, you remember, in my opinion, one of the great cyberpunk films of the early 90s by the name of Johnny Mnemonic?
Mackenzie Jackson: I have not seen Johnny.
Len Noe: It was basically a movie that had Keanu Reeves in it. And he had a hard drive in his brain. And obviously you're going to know this is old because he had to double stack the drive to get enough space. All the younger...
Mackenzie Jackson: Before SSDs.
Len Noe: Yeah, before SSDs. This was when a gigabyte of storage would cost you about five grand. So this is a long time ago, but it doesn't play well as far as its tech, but the concept did. And in this movie, he was basically exfiltrating data and smuggling data with hard drives that was inside of his body. Well, this has fascinated me ever since I saw that. And we've even talked about the fact that all of my current implantable tech is passive. So, there's not much I can do in an active attack scenario without another device or something to give me the energy field that will energize these chips and then perform the data exchange. So, I came up with a dermal stud-back style piercing where the back of the stud is actually a one terabyte hard drive.
Mackenzie Jackson: Wow. Okay.
Len Noe: I got it wired up through the stem of the piercing, and it connects to what essentially is contact points that are mag-lock oriented. And I have a custom USB-C cable that has plunger pins. So, I can literally just snap a cable on my arm, plug into your computer, exfiltrate anything I want, pull it back off, and it just looks like I got this kind of cool body jewelry on my arm.
Mackenzie Jackson: That's crazy. Yeah. So, it's all, this is so much, and this goes right back to what we're talking about before of like, no evidence, you know.
Len Noe: No evidence. And you know, I know we talked about this the first time, but for anybody that missed that episode, one of the main reasons why I've done this is the legal protections that the current health and privacy laws give me both here in the United States as well as the European Union. HIPAA and GDPR, anything that goes inside your body is then considered medical data. So, the authorities are not even allowed to ask me about this. I'm the only hacker that has governmental legislation protecting my tools.
Mackenzie Jackson: That's amazing. Let's talk about kind of like developments in this space too. Is AI changing the game in this? I mean, AI is kind of changing everything.
Len Noe: AI is changing the game a lot and we're seeing it much more in the medical space, right? I mean, we could talk about the brain computer interfaces for just a minute. Elon and Patient One with Neuralink. Patient One had, I want to say it was 83, 82, 82%, 83% of the electrodes pull out of the gray matter, and Patient One went through a short period where the device was no longer functional. Then they not only came out with a software update, this is Def Con, this is security, we know we can take a really good guess at what was happening. They oversampled the usable data with either machine learning or AI to give it enough to where it would actually be able to read the signal and function again. But the one thing that I'd rather focus on and get your thoughts on is we're talking about the technology. We here in the United States just had something amazing happen here. And I think this is going to be the start of a global trend. We've had three states here over the course of the last month that have enacted neural data privacy laws. So, we are actually, in my opinion, way ahead of the curve for a change in terms of getting in front of security sovereignty and personal PII at a bio-feedback level.
Mackenzie Jackson: That's really interesting. Do you think that there's much that frameworks, that legal governance and stuff can do? Is it keeping up with it?
Len Noe: That's the point. This is the first time I've seen something that's, I can't really say that it's preemptive, because we have multiple people that have had computers put in their brains over time. And for anybody that's listening that thinks that Neuralink is the first time we've done this, we've been doing this stuff since the '80s. They used to be called BCMs. They were called brain computer machines. And you had brain gate. There, this is just the next step of evolution in technology that we're seeing right now. So this stuff, what we can actually get from this is insane. And normally we won't hear about legislation in terms of privacy until after there's some kind of a data breach.
Mackenzie Jackson: Yeah. Yeah. For sure. So, this to me is extremely unusual.
Len Noe: Right. And nobody's been breached yet. You know, we talk a lot in my circles, especially with the biohackers and the transhumans. Ransomware for us has a potentially completely different meaning.
Mackenzie Jackson: Yeah. I was, this is actually only popped into my head now during this conversation, but you're an offensive hacker, white hat and all that.
Len Noe: Taupe. I'm a taupe hat.
Mackenzie Jackson: Okay. But you're also a target, like, you know, you're also target and you're, I'm sure that it's secure on that, but you're, you kind of, you have endpoints in your body that I could potentially connect to.
Len Noe: Endpoints. And the thing is, I am, I broke the number one rule about security. Do you tell people what your securities are? Do you tell people what your stack is? No. I not only put it in a book, I gave you the links to where you can go get the white papers on these things. The only thing's missing is, you remember that old game Operation where, you know, the only thing that's missing is the layout of me with the arrows pointing where they are.
Mackenzie Jackson: Does this concern you? Like, is it something that you worry about?
Len Noe: Concern me at this stage? No. I mean, but you also have to understand, I look at the world through a completely different set of eyes.
Mackenzie Jackson: Yeah. The other part of all of this, I'm just thinking out loud here, is like, does this become a potential attack vector in the future? Are we...
Len Noe: Absolutely. It's an attack vector now. But the difference is now it's after medical devices. It's, you know, people look at me and go, "Oh, he's different." I'm not. I'm doing the exact same thing that anybody who has a stim pain management system has. If you are using an internalized continuous glucose meter, if you're using one of the new implants for sleep apnea, there's no difference between that and what I'm doing outside of the medical. And we can even question the term necessity. So, two of the things that I just mentioned, continuous glucose meters and the implant for sleep apnea, what makes those people that go for those choices, and I'm not begrudging them for doing it. You can prick your finger and get your glucose score. They have CPAP machines that have been around forever. Why are they accepted? "That was his choice. You don't need those implants. It enhanced your life." Made your life easier. But because I did something that is outside of the realms of medicine. There's no difference between us, and the only thing that makes it different is the perception of society.
Mackenzie Jackson: That's very, I think that's a very good point. Well, then let's talk about perception then. Are we going to, is perception going to change, do you think?
Len Noe: I think it already is. Yeah, I really do. And I can, we're Gen X, right?
Mackenzie Jackson: Mhm.
Len Noe: Okay. When we were younger, did you ever walk into a business and see, and don't get me wrong, I don't judge. I'm the biggest freak in the room. So, I ain't throwing shade on nobody. But that being said, when I was younger, and we were younger, you never walked into a bank and saw somebody with an unnatural colored hair.
Mackenzie Jackson: Yeah. Yeah.
Len Noe: You never saw a business professional with tattoos.
Mackenzie Jackson: No.
Len Noe: Body piercings. We have been continuously moving the needle of what is considered socially acceptable. And I think it will continue. I really, really thought that the wallet, more that credit card chip that I got would be that breakthrough that, "Oh, well, I want to do that."
Mackenzie Jackson: Yeah. Yeah.
Len Noe: But you know, honestly, nowadays, I really, really think it's going to be the sleep apnea or or the glucose stuff. It's going to be the stuff that people are going to go, "You know what? I don't need this, but I want it." You know, in the trailer for my documentary that's coming out tonight, "The body I was born in was not enough for me." Adapt or die. Maybe I'm just here to open everybody's eyes. Maybe that's my whole purpose.
Mackenzie Jackson: Yeah, I like that. And I actually just, that's a great segue because I wanted to, before we ran out of time, I did want to mention the documentary that you're going out, because I was curious, like, why, what, what's the motivation behind this? Because I know, you know, I think it's, I'm sure it's interesting, but I'm just curious, what's the motivation behind this?
Len Noe: The motivation that it's always been. I honestly want people to understand that this is real. You know, most people don't think that, you know, cyborgs or even this type of implantable technology, that's science fiction. It's science fact. And I have the opportunity and have been given so many amazing opportunities to speak and present this material at different conferences all over the world, 73 countries and counting. But the problem with that is this is a very small group of numbers and I can, I can basically wake people up and you know, shake these guys up. "All right, you guys get it. Now go forth." But what are you going to do? I can watch a presentation, but let's be honest, if you're not a cybersecurity person, sitting down and watching a Def Con talk.
Mackenzie Jackson: Yeah.
Len Noe: Most of us, you know, I like to think that I'm entertaining, but they're dry. Most people are intimidated by by cybersecurity and offensive sec type videos. This was done in such a way that this is the human story. You know, we really don't even show a single attack, but what I do show is, you know, an actual installation of a microchip. And there's a lot of discussions with my father, people around me, people in the industry. What does it mean to be human in 2025? And if you really want to get into my story, this is definitely more around the tech side of things. It's written from a human perspective, but there is much more around the attack side, if you want it along with the human, go ahead and check out my book, Human Hacked: My Life and Lessons as the World's First Augmented Ethical Hacker. And as a special for your listeners, we were going to keep this off to the side, but if you go to my website, i-am-machine.com, we actually have my book on sale right now if you buy direct from me, and you will also get an autograph. So, you'll get an autographed copy of the book and you'll get it for $10 off list price.
Mackenzie Jackson: Well, that sounds like there'll be a link to that website in the description, and I can highly recommend that book to everyone. It's very fascinating. Really appreciate it. Yeah. Well, Len, it's been awesome to have you. Thanks so much for coming on. I hope to have you on again. You're always entertaining, you're always insightful, and you're always freaking terrifying. So,
Len Noe: Well, in that case, as I tell everybody, stay safe, stay secure, stay sovereign, and stay dangerous, man.
Mackenzie Jackson: Oh, awesome. Thanks so much.
