HandsOnKB

1×09: eps1.8_m1rr0r1ng.qt

Episode Description: “<mr.rob0t> evil corp hack is threatened when a mystery man from elliots past arrives. wtf.”

No hacks actually happen in this episode, but I will talk about the QuickTime file format (.qt). Just hearing that name is such a blast from the past. QuickTime was a very popular media player back in the early 2000s that died off sometime in the mid 2010s. The QuickTime media player was created by Apple but available on Windows for a long time, which explains its prominence.

1×10: eps1.9_zer0-daY.avi

Episode Description: “<mr.rob0t> a brave new world. but where are mr. robot and tyrell? & 1 of elliots past hacks comes back to haunt him. TEOTWAWKI?”

The .avi (Audio Video Interleave) file extension is another media container filetype holding both audio and video data that Microsoft created back in 1992. It’s able to work with a number of different codecs with DivX or Xvid usually used for encoding. It’s also the National Archives and Records Administration’s official wrapper for preserving digital video.

Mention of the Ashley Madison Data Breach/Dumps

Krista’s old boyfriend Michael (real name Lenny) mentions that Elliot hacking him and revealing his infidelity didn’t end up mattering much because he got caught up in the “Ashley Madison dump.”

Ashley Madison was a dating site that many people went on for extramarital affairs. Huntress has a great breakdown of the breach, and there’s even a Netflix documentary that covers the fallout of the whole thing. Up to 32 million users had their data exposed and it led to several divorces and even a few suicides allegedly.

Elliot Using “Proxies” in Estonia

While talking to Krista at the French restaurant, Lenny mentions that the local police department’s cybercrime unit is having a hard time tracking Elliot’s activity because he was using “something called ‘proxies’ in Estonia.”

This is what people did before graduating to Virtual Private Servers (VPS) from places like Digital Ocean, Linode, and some less reputable Bullet-Proof Hosting Providers (BPH). A lot of millenials have fond memories of using online proxy services to bypass school content restrictions when at their school’s computer lab.

HDShredder 4 (Enterprise Edition) Hard Drive Wiper

When Angela arrives at her new job at EvilCorp you can see people using this application to wipe drives. This is an older version of Miray Software’s hard drive wiping application which works “at the physical level.” They’re now on HDShredder 8, which really makes you feel the passage of time since this show came out.

Conversely, when we cut to FSociety one of the characters is using a power drill to damage an HDD by drilling through the platters. That’s the simplest physical way to destroy the ability to read data from them.

FSociety & The Dark Army Encrypt All Financial Data with AES-256

Elliot mentions while walking through the now chaotic offices of Evil Corp that Darlene’s malware that took her “two hours to code” encrypted all their data in 256-bit AES which would take an incomprehensible amount of time to crack. How true is that in 2026? Still the case, surprisingly.

AES is a very strong encryption algorithm, with any attacks only working due to weak implementation, side-channel attacks, and even being able to guess the original plaintext that was encrypted (like passwords). It’s even considered to be resistant to quantum computers.

Mr.Robot’s Calvin Klein USB Sunglasses

When searching through Tyrell Wellick’s Cadillac Escalade for any clues about the hack Tyrell and Mr.Robot did while Elliot was blacked out, Elliot opens the sunroof of the car and a pair of sunglasses fall out that have a USB drive in one of the arms. Calvin Klein released a pair of sunglasses with a 4GB USB drive in 2009, and if I’m not mistaken it looks like that’s what they used for the show.

2×1: eps2.0_unm4sk-pt1.tc

Episode Description: “one month later and omfg, five/nine changed the world. elliot in seclusion. darlene takes the lead. fsociety delivers malicious payload. TANGO DOWN? tbc.”

TrueCrypt (.tc) Disk Volume Files

The .tc file extension referenced in the episode title is the filetype for storage disk volumes encrypted by the application TrueCrypt. It was an open-source application for data encryption. I’d heard of it before, but apparently it’s been deprecated for years and replaced by a fork of the original project named VeraCrypt that, based on the Top-Level Domain (TLD) of the site seems to be a Japanese project.

Elliot’s/Mr.Robot’s Data Encryption Operation Begins

On a terminal screen in the fsociety hideout Elliot has remotely logged into the CS30 server in the Evil Corp server farm that they maintained access to after episode 1 and he runs a file named “fuxsocy.py.” This is the malware that Darlene wrote that encrypts all data on a drive in AES-256.

Console output and progress bars are shown for two sequential actions: “Loading Source of Entropy” and “Generating Keys.” Afterwards the malware starts its encryption of the entire Linux filesystem on the server and presumably spreads to datacenters across the globe.

Smart House Hack (TV, Thermostat, Speakers, Water Heater, Alarm System)

A woman who we later find out is Evil Corp’s general counsel has her smart home hacked in order to stress/scare her into leaving so Darlene can make it her new base of operations for fsociety (or what’s left of it).

Darlene Using the Social Engineering Toolkit (SET) Remote Administration Tool Tommy Edition (RATTE)

After stealing the woman’s smart home, Darlene gives a bullshit speech to her new fsociety acolytes before using the SET to generate a RATTE payload (from a third-party SET module) for a “cryptowall recursive attack” from the SET module “WebAttack.” She then uses umount to unmount the flash drive she was working out of from her root filesystem.

Darlene’s “cryptowall recursive attack” is just a typical ransomware filesystem encryption that runs recursively throughout the entire directory structure, complete with countdown timer and ransom note. We see this in the next scene when it cuts to a consumer bank branch and the teller’s workstation shows the results of the attack.

2×3: eps2.1_k3rnel-pan1c.ksd

Episode Description: “elliot vows to beat mr. robot but it aint easy, smh. angela sees behind the scenes at evil corp. sh*t hits fan with fsociety.”

KeepSafe Encrypted Media Files (.ksd)

The episode’s title makes reference to .ksd files, which are encrypted photo or video files stored within the personal vaults of the KeepSafe app. It’s still around today, and still popular, which must mean they’re doing something right.

Elliot Compares His Internal Turmoil Over Mr.Robot Resurfacing and Gideon’s Murder to a “Kernel Panic”

The stress Elliot feels over realizing that his Mr.Robot persona has been operating while he sleeps, and that his former boss Gideon Goddard was murdered in a bar by a mentally ill man who believed he was a “crisis actor,” leads to an internal crisis he compares to a kernel panic. This is when the core of an OS has such a critical error that it triggers an emergency stop, a sort of failsafe to immediately stop operations and minimize damage.

It’s similar to the Windows “Blue Screen of Death (BSOD)” where a serious system error causes the entire OS to halt and display an error message that requires immediate action. Elliot’s immediate action to deal with the issue of his body being hijacked by Mr.Robot while he sleeps is to take an absurd amount of adderall to stay awake. A terrible idea, but he’s desperate and grieving so I get how we got here.

Romero Modified His Desktop Computer Ports to Burn the Motherboard If Accessed Without Permission

The FBI agent we’ve been following for the past two episodes visits the scene of the crime of Romero’s murder. While talking with the another agent she sees the digital forensics specialists accessing Romero’s desktop to gather information because it was still unlocked.

She asks if they checked whether the ports were modified before doing that, and seconds later we see sparks and a fire start inside the hardware case that presumably burns up all the internal components.

From doing a little research on this it is possible by messing with the pins of a USB port to create a short so that when the metal shielding of a USB is plugged in it completes the circuit and triggers whatever incendiary payload is inside the chassis. Apparently the technical consultants for the show intended it to be a thermite payload, which would definitely burn hot enough to melt the internal components.

Elliot’s Kernel Panic Error Screen

After reaching his fifth day of abusing adderall Elliot’s mind starts to deteriorate and we see a Linux error screen full of references to QEMU, the RealTek RTL-8029 network interface card/driver, memory addresses, Linux kernel routines, drive errors, and an actual kernel panic when trying to mount the root filesystem.

I looked through the error messages hoping to find references to RAID arrays (of which Elliot’s mind has none) or drive partitions to symbolize Elliot’s multiple personality disorder (because that would be hilarious). Funny enough, it looks like Elliot’s mind runs on some version of Fedora or Red Hat based on the reference of Red Hat nash in the error messages.

Final Thoughts

Overall I really liked this batch of episodes. I’m glad to see the show still including a healthy amount of hacking and IT material instead of getting too wound up in the character drama. I’ll miss Romero as my second favorite member of fsociety, but I felt like the way he went out without the FBI being able to comb through his desktop computer was a great send off.