166: Maxie

Episode Summary

Executive Summary: This episode of Darknet Diaries features Maxie Reynolds, a former underwater ROV pilot turned cybersecurity professional, who shares her journey into physical penetration testing. She recounts several high-stakes engagements, including a failed attempt to pose as a Swedish ambassador, an accidental shutdown of a city's water supply, and a successful infiltration of a secure logistics facility where she stole multiple trucks. The episode culminates in her innovative idea for underwater data centers, which she co-founded to enhance physical security.

Main Topics: The Cardiff Giant Hoax (Priority: 2/5): The episode opens with the story of George Hull, who faked a petrified giant in 1869 to prove the Bible's mention of giants, leading to a profitable hoax that attracted P.T. Barnum. Maxie Reynolds' Career Journey (Priority: 4/5): Maxie describes her transition from underwater robotics to stunt work and finally to cybersecurity, highlighting her persistence in overcoming gender-based barriers. Physical Penetration Testing Techniques (Priority: 5/5): Maxie details specific methods used in pen tests, including social engineering (posing as a Swedish ambassador), OSINT, and physical infiltration via unlocked windows and sewer tunnels. High-Stakes Pen Test Failures and Lessons (Priority: 5/5): She recounts two major mistakes: accidentally shutting off a city's water supply and being detained as a suspected Russian spy, emphasizing the power and responsibility of pen testers. Underwater Data Centers (Priority: 4/5): Maxie explains her concept of subsea data centers, which offer enhanced physical security and energy efficiency by leveraging ocean cooling and reducing maintenance needs. Attacker Mindset and Security Philosophy (Priority: 3/5): Maxie discusses the importance of adopting an attacker mindset for effective defense, as outlined in her book 'The Art of Attack', and the cognitive skills involved.

Key Arguments: Physical security is often overlooked; companies focus on digital defenses but leave physical access points vulnerable (e.g., unlocked windows, keys left in trucks). Adopting an attacker mindset is essential for designing robust security systems; understanding how attackers think, strategize, and persist is fundamental. Underwater data centers provide superior physical security against unauthorized access, as they require specialized equipment (submarines, ROVs) and self-destruct if tampered with. Penetration testers must handle findings with sensitivity, presenting them as opportunities for improvement rather than blame. The ocean's high specific heat capacity makes underwater data centers environmentally friendly, with negligible temperature increase near the units.

Data Points: Height of fake giant: 10 feet 4 inches - The Cardiff Giant statue was 10 feet 4 inches tall. Daily visitors to the giant: 500 people per day - At the peak of the hoax, 500 people paid 50 cents each to see the giant. Barnum's offer for the giant: $50,000 - P.T. Barnum offered $50,000 for the Cardiff Giant, but the farmer refused. Power capacity of underwater data center unit: 3 megawatts - Each underwater data center unit can handle about 3 megawatts of compute. Cost savings of underwater data centers: 80% less expensive - Underwater data centers are about 80% less expensive in terms of capital expenditure. Temperature increase near underwater unit: 0.001 degree Celsius - The water temperature increases by about a thousandth of a degree within a meter of the unit. Percentage of power used for air conditioning in traditional data centers: 40-50% - Traditional data centers use 40-50% of their power for air conditioning. Number of interesting things Maxie expects to do in life: 140 - Maxie estimates she will do about 140 interesting things in her lifetime.

Pivotal Quotes: "I was thinking, okay, this is a good job. This is the kind of job that I would like to do." — Maxie Reynolds: After witnessing a physical pen test via live camera, Maxie realized she wanted to become a penetration tester. "I hit the kill switch on a city's water supply." — Maxie Reynolds: During a pen test, Maxie accidentally shut off the water to an entire city, leading to police involvement. "We got into your data center through a manhole for a sewer line." — Maxie Reynolds: Maxie and her team infiltrated a highly secure data center by crawling through a sewer tunnel.

Implications: This episode underscores the critical need for comprehensive physical security in addition to digital defenses. It highlights the value of red teaming and the attacker mindset in identifying vulnerabilities. The concept of underwater data centers presents a novel solution for ultra-secure computing, with potential implications for data sovereignty and environmental sustainability.