HandsOnKB

S1x3: eps1.2_d3bug.mkv

Episode Description: “<mr.rob0t> elliot tries to lead normal life – but pulled back into fsociety. gideon gets suspicious. tyrell plays dirty @ evil corp. I did it 4 the lulz.”

This episode title is a reference to the Matroška Video (MKV) open-source video file format that was the first creation of the Matroška project (pronounced “Ma-Trosh-Ka), which aimed to “create a container format that can hold an unlimited number of video, audio, picture, or subtitle tracks in one file.”

It also references “debugging” which is the process of looking for “bugs” or vulnerabilities in the source code of anything that runs via any kind of programming language.

“[H]ospitals are easy to hack.”

Boy are they. Elliot goes on a monologue about how underfunded and outdated his local hospital’s IT department is. This is painfully accurate to real life because hospitals have more important, and expensive, medical equipment to spend their budget on. Things like MRI machines can cost upwards of a million dollars, and the more everyday equipment isn’t much cheaper, usually in the six figure range.

As Elliot gives his condescending monologue on how much better he is than this poor shlub, we get to see the hospital’s ancient antivirus scanner at work. The first virus shown uses the well established Computer AntiVirus Researcher’s Organization (CARO) malware naming scheme. It goes as follows:

CARO Naming: [Type].[Platform].[Family_Name].[Variant]
Virus Name: DoS.Win32.DieWar
Type: Denial of Service (DoS)
Platform: Win32 (32-bit Windows like Windows 95)
Family_Name: DieWar

DieWar is a VERY old denial-of-service program that targeted FTP servers, specifically WarFTPD v1.7 according to this Kaspersky threat report on it.

The other two seem to be misspellings of real Windows malware. Sality (here spelled “salty”) is an old Windows virus/worm first identified in 2003 that still has updated variants floating around online and. It was summarized pretty well in this Huntress post.

The seedadubtor.B file seems to be a mash up of seeder programs used for Peer-to-Peer (P2P) network connections (and as payload droppers) with abductor which might have to do with a Trojan exfiltrating files. I’m not sure.

Regarding the hospital’s infosec shortcomings, oftentimes hospitals don’t want downtime for their networks or need to make them work with legacy equipment that can be in service for 10-20 years.

Many of these machines are built to run on older operating systems and don’t have a practical way to patch or update the underlying OS. Regardless, the hospital’s higher-ups should be giving the head of IT a larger team and WAY more than $7,000 a year.

Cyber Extortion Continues for Ollie & Angela

The idiot Ollie continues to get played by “The Dark Army” and is almost convinced to load that same fake rap album CD-ROM with malware on it into an AllSafe workstation. Removable media is a great transport medium for malware. Ollie later comes clean with Angela about the hack, and how he’s been flirting with other women online and receiving pics.

It turns out that the hacker extorting Ollie has access to Angela’s bank account information, credit card info, and social security number because she used Ollie’s laptop to access her student loan account.

AllSafe Tracking Social Media, IRC, and PasteBin for fSociety Drops

PasteBin might be a bit of a blast from the past, but this is more true today than ever. With ransomware gangs and other cyber criminal groups (“hacktivists” as they call them) public image building and showboating is a regular thing in 2026. The one thing this show might not have been able to predict is just how corporate and organized the biggest ransomware groups got.

Gideon Reviews CS30 Server Logs for the fsociety.dat File

Gideon sits in his office reviewing the incident report Elliot submitted for the server incident from episode 1. It includes the MD5 hash for the fsociety00.dat file and web server logs of the fsociety bots’ HTTP requests hitting their server.

S1x4: eps1.3_da3m0ns.mp4

Episode Description: “<mr.rob0t> fsociety hits the road to initiate world-changing hack. elliots inner demons threaten to derail operation. LIRL.”

The episode’s title refers to “daemons,” background processes that run on Linux/Unix systems on their own after being started. Some well known Linux/Unix daemons are systemd, sshd, auditd, crond, httpd, etc.

Elliot compares the daemons’ actions (monitoring, logging, notifications, etc.) with subconscious human influences (primal urges, repressed memories, unconscious habits, etc.).

Elliot’s Plan to Destroy Tape Drives at Steel Mountain

Linear-Tape Open (LTO) is a set of very high capacity magnetic storage tapes used for backups. Elliot states that Steel Mountain uses “linear-tape open standard 9 (LTO-9)” but that didn’t exist until 2021. I’m not sure if the show was trying to jump ahead to the next generation, but it’s a weird detail. Elliot states that the tape has an operating temperature range of 61 to 95 degrees fahrenheit. Anything higher than that causes the polyurethane binding to mollify and make the data unreadable.

This is pretty valid. Data centers are very strictly climate controlled for not just temperature, but also humidity to make sure there’s no corrosion of server racks and other components as well as no build up of static electricity.

The plan, as Elliot states it, is to install a Raspberry Pi into the thermostat in the storage facility and use an “asymmetric backdoor” on it to build a VPN into Steel Mountain’s intranet. “Asymmetric backdoor” is a really fancy way to say “We’ll have SSH private keys so that only we can log into the backdoor” but it sounds cooler for film/TV so it’s fine.

Romero and Mobley Hack A Woman’s Minivan

Using a 315MHz radio-wave analyzer Romero is able to capture the signal from a woman locking her minivan using her remote key fob. I don’t know if this is an actual existing device Romero’s holding, but it seems to feature dedicated Lock, Unlock, Mute, and Memory (M) buttons with an LCD character display to store, index, and re-transmit captured RF payloads.

They then are able to replay that signal to get in and steal it. Since this was probably before rolling codes were used by car manufacturers, this would mean the same signal was used by the fob for both locking and unlocking. You can read more about that kind of attack here.

After getting inside Mobley then interacts with the van’s CAN bus port to get it to start. This hack was one of the four explained by the show’s technical lead Kor Adana in Rolling Stone.

Mobley uses cansniffer from the can-utils suite of Linux tools to view the packets being sent across the wire, determine which ones control starting the car’s engine by using candump in conjunction with cansniffer to review the hexadecimal values being sent, and injecting those ignition starting values he identifies to start the car.

Mobley Hacks a Hotel Room Lock Using A Dry-Erase Marker?

In that same Rolling Stone article Kor Adana explains how, at the time of the season’s writing, certain brands of hotel room door locks could be hacked open by using an Arduino controller held near the lock and triggering its unlock signal. Mobley keeps the Arduino in an emptied out dry-erase marker to be inconspicuous.

Trenton Staging Malware Compressed in TAR Files On An FTP Server

Muslim female hacker Trenton is seen finishing up the uploading of the malware the crew plan to use in the Raspberry Pi to an FTP server using FileZilla. The PHP file might be a webshell to provide easier access to Steel Mountain’s network after the initial compromise.

I can’t tell what exact IDE she’s using but Gemini claims it’s JetBrains PyCharm so I’ll go with that. She also has some Python written in the other background window.

Overall, these episodes included less overt discussion of cybersecurity and IT concepts and instead chose to show them in quick shots or in the background of scenes. Hopefully future episodes will put more focus on the details of the hacking.