95: Jon & Brian's Big Adventure

Episode Summary

Executive Summary: Jack introduces a Darknet Diaries story about a physical-red-team engagement by Brian Halbach and Jonathan Studebaker. Their covert recon was exposed by vigilant security, then the pair pivoted through multiple nights of fence-climbing, lock bypasses, badge attempts, and improvised social engineering. They succeeded at some sites, failed at others, and learned that tight security, community awareness, and fast adaptation matter as much as tools.

Main Topics: Jack’s night photography anecdote and mistaken suspicion: Jack recounts photographing abandoned buildings at night near an industrial area, where slow driving near a fortified food-processing plant led police to detain him as a suspected threat. Physical red-team engagement overview: Brian and Jonathan describe their job as attackers hired to test physical and network security across multiple sites, using covert entry, social engineering, and evidence collection. Reconnaissance and being identified: They mapped sites with OSINT and drove by at night, but security spotted their rental car circling repeatedly and photographed them, forcing a change in cover and strategy. Tools, tactics, and bypass methods: The episode details their loadout: RFID cloners, routers, radios, night-vision goggles, ladders, lockpicks, shim tools, magnets, USB drops, and other entry tools used to exploit doors, gates, and networks. Field execution across multiple locations: They test several buildings: successfully entering some sheds and offices, failing others, and discovering hidden vulnerabilities such as unmonitored panels, loose gates, and default gate keys. Injury, police response, and lessons learned: Brian fractures both heels after jumping from a shed, later requiring an ER visit; police were notified, handled the incident professionally, and the team debriefed lessons about detection, adaptability, and physical toll.

Key Arguments: Vigilant security teams and local observers can detect suspicious behavior even before a physical breach occurs. OSINT is powerful, but public information must be interpreted carefully; assumptions about camera coverage, staffing, and access can be wrong. Physical penetration testing requires extensive preparation, specialized tools, and constant improvisation when conditions change. Simple defensive measures such as proper door installation, active camera coverage, badge discipline, and secure gate keying can defeat common attack paths. Real-world red teaming is physically and emotionally demanding, not just technically challenging.

Data Points: Number of target locations: 5 - The company hired them to test one headquarters and four additional sites. Police cars responding to Jack: 2 initially, then 3 total - Two police cars first swarmed Jack; a third was called in during questioning. Fence height: 20 feet - Jack describes the fortified food-processing plant as having 20-foot fences with barbed wire. Cooldown period before execution: A few weeks - They waited before returning so the security team would cool down and not be on high alert. Approximate distance needed for RFID reads: About 2 feet - Their long-range reader still required close proximity to badges during the pandemic. Number of locations in one night: 5 - They planned to hit all five sites in the same night, starting with the most likely successes. Heights mentioned for climbing tools: 10 feet - The periscoping ladder could expand to about 10 feet to get over fences. Brian’s injury recovery: 6 weeks - An MRI later showed both heels were fractured, requiring six weeks out. Sleep after the operation: 3 hours - They returned to the hotel around 8 a.m. and woke up at 11 a.m. to work again. Police response time warning: 30 seconds - At one point John was told police were about 30 seconds away after an alarm was triggered.

Pivotal Quotes: "sometimes you have to be careful about looking suspicious near certain businesses or neighborhoods late at night." — Jack: Jack sums up the lesson from being detained near the industrial area. "we drove by in the same rental car three times" — Brian / Jonathan: Security noticed their repeated passes during recon and identified them as suspicious. "No amount of planning that you do is ever really going to be sufficient." — Jonathan Studebaker: He reflects on how red-team work constantly changes and requires improvisation.

Implications: The episode shows how effective physical security depends on vigilance, layered defenses, and human awareness—not just cameras and locks. It also highlights how red-teaming can reveal real weaknesses while imposing significant physical risk on testers.