Darknet Diaries - 90: Jenny

Episode Date: April 13, 2021

Meet Jenny Radcliffe, the People Hacker. She’s a social engineer and physical penetration tester. Which means she gets paid to break into buildings and test their security. In this episode she tells us a few stories of some penetration testing jobs she’s done.SponsorsSupport for this show comes from Blinkist. They offer thousands of condensed non-fiction books, so you can get through books in about 15 minutes. Check out Blinkist.com/DARKNET to start your 7 day free trial and get 25% off when you sign up.This podcast is sponsored by Navisite. Accelerate IT transformation to respond to new demands, lower costs and prepare for whatever comes next. Visit Navisite.com/go.View all active sponsors.Sourceshumanfactorsecurity.co.uk

I don't know why, but I'm always amazed by a well-executed scam. There's something especially elegant about the ones that are as simple as they are effective. Have you heard about the watermelon drop scam? Okay, so for a while in Japan, the prices of watermelons were really high. And so what con artists did is they got a hold of some bad watermelons, ones that were worthless. And they would carry it through a part of town where tourists visit. And they'd intentionally bump into a tourist and drop the watermelon at the same time, which would burst open on the ground and make quite a mess. The con artist would then yell and scream at the tourist saying, don't you know how much these are worth? And I can't believe you

broke it. And the tourist would feel bad and then pay for the broken watermelon. This con has been adapted. Sometimes you'll see a con artist take a cheap vase and smash it up and put it into a box or a paper bag and then intentionally but accidentally bump into someone and drop the box, and when they open it, the vase is all in pieces. The con artist shouts and gripes about this expensive vase of theirs and that this person just broke it and needs to pay the money. And it's common for con artists to collect as much as $100 for these broken vases. In this episode, we hear stories from a woman who breaks into places and

steals for a living. But she's no con artist. She's a social engineer. These are true stories from the dark side of the internet. I'm Jack Recider. This is Dark by Delete Me. I know a bit too much about how scam callers work. They'll use anything they can find about you online to try to get at your money. And our personal information is all over the place online. Phone numbers, addresses, family members, where you work, what kind of car you drive. It's endless and it's not a fair fight. But I realize I don't need to be fighting this alone anymore. Now I use the help of Delete.me. Delete.me is a subscription service that finds and removes personal information from hundreds of data brokers' websites

and continuously works to keep it off. Data brokers hate them because Delete.me makes sure your personal profile is no longer theirs to sell. I tried it and they immediately got busy scouring the internet for my name and gave me reports on what they found. And then they got busy deleting things. It was great to have someone on my team when it comes to my privacy. Take control of your data and keep your private life private by signing up for Delete Me. Now at a special discount for Darknet Diaries listeners. Today, get 20% off your Delete Me plan when you go to joindeleteme.com slash darknetdiaries and use

promo code darknet at checkout. The only way to get 20% off is to go to joindeleteme.com slash darknetdiaries and enter code darknet at checkout. That's joindeleteme.com slash Darknet Diaries and enter code Darknet at checkout. That's join delete me dot com slash Darknet Diaries. Use code Darknet. Support for this show comes from Black Hills Information Security. This is a company that does penetration testing, incident response, and active monitoring to help keep businesses secure. I know a few people who work over there, and I can vouch they do very good work. If you want to improve the security of your organization, give them a call.

I'm sure they can help. But the founder of the company, John Strand, is a teacher. And he's made it a mission to make Black Hills Information Security world-class in security training. You can learn things like penetration testing, securing the cloud, breaching the cloud, digital forensics, and so much more. But get this, the whole thing is pay what you can. Black Hills believes that great intro security classes

do not need to be expensive, and they are trying to break down barriers to get more people into the security field. And if you decide to pay over $195, you get six months access to the MetaCTF cyber range, which is great for practicing your skills and showing them off to potential employers. Head on over to BlackHillsInfosec.com to learn more about what services they offer and find links to their webcasts to get some world-class training. That's BlackHillsInfosec.com. BlackHillsInfosec.com.

BlackHillsInfosec.com. For this episode, we hear from a social engineer and physical penetration tester. My name is Jenny Radcliffe. I'm known online as the People Hacker, and I'm a social engineer and specialist in the psychology of security. Jenny's from Liverpool in the UK and she spent a lifetime learning social engineering skills and how to break into buildings, but she's not much for computer hacking. So I only deal with the humans. I'm hopeless technically. Jenny's good at tricking people into doing what she needs. But she's no criminal.

She's a professional who legitimized her skills for a number of jobs. She's worked as a negotiator, working out business deals across the globe. And she's done social engineering and physical infiltration, pen testing. She's been at it for 30 years now. But when she got started, no one used a term like social engineer. No one used that term. I didn't know that term. Yeah, they used the term con artist at the time. Yeah, or burglar, you know, and I at no point thought it was going to ever be something that

was respectable or something that I could ever talk about. I couldn't have told my family because they'd worried, my parents and everything would have worried. And I couldn't have told my family because they'd be worried. My parents and everything would be worried. And I couldn't have told my friends, really, because a lot of people I knew kind of had an idea about it. So I never really talked about it very much to anyone. Jenny's career as a social engineer and pen tester goes all the way back to her childhood. It all started when her neighbor kidnapped her. Jenny wasn't even 10 years old at the time.

She wandered into the neighbor's house, but they just kind of closed the door and wouldn't let her leave. Her parents couldn't find her and began a frantic search. This was a very scary situation for her, which kind of shaped who she would become. I mean, I'd made my mind up when I was being held captive that I would never be helpless

again. I thought if I get out of this, I'm going to be some kind of superhero. She was eventually found by her parents, safe and sound. But being kidnapped gave her a whole different view on life. And yeah, she wanted to do something special after that. Something like what a superhero would do. But she wanted to do something special after that. Something like what a superhero would do. But she wanted to use brains over brawn. Coincidentally, her superhero training would start soon after, when her parents set her up with her older cousins.

I think my folks decided that I needed to be more streetwise. And so they let me hang out with the older boys, as opposed to just sort of play in the street. Her parents figured out the cousins could watch over her, show her how to protect herself and stay safe. But what they didn't know is that the boys had a mischievous streak and they spent their nights breaking into abandoned buildings around the neighborhood. And now young Jenny would be tagging along, picking up her superhero tradecraft along the way. And as far as my parents were concerned, I was, you know, tucked up in bed with a story and a teddy bear, you know, eight o'clock at night. And really, I was out with the cousins, helping them get into all these buildings. And it was great fun. And

it starts off, you get into the empty house in the neighborhood and then you go into the empty house at night and then you start to pick targets, you know, like, do you think we could get into that place? And before I knew it, the places we were getting into weren't empty anymore. The cousins taught Jenny how to get past locks and alarms, things that could be crucial to her career later on as an adult. The cousins taught Jenny how to get past locks and alarms, things that could be crucial to her career later on as an adult.

But in her youth, her greatest strength was her small size. This made her the ultimate physical penetration tester. They used to throw me over fences and things and get me to kind of open gates or, you know, run around and check things out. After she'd been with the cousins for a while, they let her pick the next target. I asked if he could go to a local zoo and see if he could get into that at night. Jenny had been to this zoo before and she always wondered something. I wanted to see if the lion got locked away. Yeah, what do the animals do at night?

It's a good enough question that the cousins were on board. They all grabbed their flashlights or torches, as they say in Liverpool, and headed to the zoo. I had a little torch, a little Sesame Street torch. This zoo had recently been shut down because of animal abuse issues. So it was even more mysterious to Jenny and her cousins to explore an abandoned zoo at night. They wanted to find out if the animals were still there. So they head down there and they come to a fence which surrounded the zoo. The cousins boosted Jenny over the fence and then climbed over after her.

Once inside, the boys just ran off for some reason, leaving Jenny all alone with her little yellow Sesame Street flashlight. And it was like there was no alarms. There was no security guards. There was nothing. The Sesame Street flashlights are horribly dim. And this was a very dark night. So she didn't see which way the cousins ran off. But she did know which way the lion exhibit was.

So she made her way over to that. But she could barely see. So she used her hands to sort of reach out in the dark to try to identify the exhibits by touch. And I kind of padded over to where I thought the lion's cage was and I shined this really dim torch into the cage of this lion and I couldn't see it. It wasn't there. She turns away to listen for her cousins who were laughing somewhere off in the distance. And then I turned round and I could smell like a chicken soup breath, and it was right in front of me.

All that separated her from the lion was a fence that suddenly seemed very flimsy. And it just went crazy and threw itself at the fence and growled and it stalked me. I screamed, dropped the torch, started to run. And the cousins ran after me and they were laughing. They scooped her up and retreated back over the zoo's fence. They got out of there safely, but that Sesame Street flashlight didn't make it out. And that was my first ever kind of, that I really remember clearly that was the first real unauthorized access that I ever really picked and kind of did and really remembered. Gosh, that could have left nightmares on you for life of falling asleep

and having lions chasing you in your dreams. So it did, and I still do dream that all the time. And really seriously, I do. If I'm stressed at all, I'll dream about lions. But it didn't put me off breaking into buildings, though. Jenny was really starting to enjoy breaking into places. As the cousins grew up, they moved on from break-ins to working security at local bars. Jenny tagged along with us, too, running deliveries between pubs.

She also ran little side schemes, like ripping off vending machines for change by entering a secret code. So I always had change, pockets full of money and things. All very, all terrible. And I've made amends since. Apologies to, you know, Coke and Pepsi. As Jenny went into her late teens, she went to college. The cousins figured out a way to turn their street skills into legitimate work. They started doing security audits for high net worth individuals like professional

soccer players. And it was like, you know, we used to break into houses. Do you want us to check out where you live and tell you how we get in? It was the same thing they did as kids, but now they were getting paid for it. But Jenny was grown up and was too big to just be thrown over a fence. So no more flying over walls. She adapted by using her people skills to get the cousins inside. Often the easiest way of getting in wasn't to bust an alarm or get on the roof or anything

dramatic. It was just to have me knock and say can I come in I want to talk to you about your curtains or you know something like that. Once she was inside Jenny would just figure out a way to leave a door open or unlock a window so the cousins could just break in later. Some professional soccer players hired them to audit their businesses, too. This weird side business of theirs was actually getting some real work to do. But then something changed. The cousins started meddling in heavier crime, stuff Jenny didn't want to get involved in. And that's about the time when she got offered her first solo gig as a professional security auditor.

Still at this time, social engineer and physical pen tester just weren't terms yet. And she was still going to college when she got this job. I got a phone call from this guy and he called the house. I was still living with my parents and he called the house. Mum answered and said, there's a guy on the phone talking to you, wants to talk to you about a job. And I answered the phone

and it was this guy and he said, you know, I've got, I want you to get into this office in Liverpool and I want you to steal an address book. It's a security audit. And I didn't ask any questions except, oh, well, you know, I need to ask the cousins. And he said to me, why do you need the boys?

That's when it dawned on her that she didn't. She liked the idea of trying to break in without the cousins' help this time. She knew all the tricks at this point. It would be less people involved, less work. So, yeah, a solo mission. Let's try it. But she did call her cousins to let them know that she was going to be going in on this job alone. All right. Step one. So, reconnaissance stage.

The target was a politician in the British Labour Party. Jenny's mission was to break into his office and steal his address book. His office was in a waterfront building in Liverpool. Jenny went over there one day to check this place out, to look for obstacles or weaknesses in the building. On the ground floor around the entrance, there weren't any barriers, no turnstiles that required her to badge through or anything like that. She looks at a directory on the wall and sees the office that she needs to go to is on the eighth floor.

So she hops on the elevator. What she's looking for is a POE, a point of entry. This is a public building. Anyone can jump in the elevator and take it up to the eighth floor and then just look around the lobby. You can't really get caught in this stage. But doing this can really be helpful for when you want to come back later and actually break in. So this is like completely not how I would do it now. I guess I just thought I'm not doing anything at this point. I'm just looking around. So I'm not actually doing anything wrong. So there's no problem. Jenny steps off the elevator and sees some double doors with a big open floor plan office on the

other side. It's bustling with workers. Jenny looks to the far end and sees the politician sitting at his desk. And I'm kind of thinking, OK, so that's where I need to go and then and then one of the office workers comes out and just says oh hi you know what do you need do you need to go in and I said no no no I don't need to go in actually I'm looking for Mr whatever and I said is that him in there and he said yes and I said oh I need to speak to him but I'll leave it he looks busy and he said yeah well he won't be there tomorrow. He's at the conference. I said, oh, oh, right. I said the conference. And he said, yeah, it's the Labour Party conference. Well, that accidentally worked really well. Jenny now knows that nobody's going to be in the office tomorrow. Again, her mission is to lift an address book off the guy's

desk. Jenny left the building and stopped at a cafe for a coffee. As she sipped her drink, it struck her how laid back security was at this office building. And I thought, right, I'm just going to go back. This is going to be not as difficult. I'm going to wait for the guy to go out of his office. I'm going to go and get it. She went back into the building, headed up to the eighth floor, looked through the office window. That politician, her target was still at his desk desk where she presumed the address book was too. So she left. I kind of, I guess I lost my nerve.

Came out and went, right, I'm definitely waiting for the next day now. And she does. She goes home, sleeps that night and comes back the next day. But not straight away. She waits until 5 p.m. to go back. There was no one around. There was not even security at the front desk, but not straight away. She waits until 5pm to go back. There was no one around. There was not even security at the front desk. It was wide open.

I went up the stairs and I walked into this office. It wasn't locked. Went into the guy's office. It wasn't locked. And his address book was just in the drawer on his desk. Jenny grabbed it, stashed it in her bag and was feeling good. The job was going well. I kind of thought, yes, this is great. You know, wait till I tell my cousins and I've done this one on my own

and I deserve my fee. And as I said, I saw the doors open at the other side of the office and it was security. Just panicked and I just ran out the office. Jenny dashed out of the office and ran to a stairwell. And I ran up to the roof, so went up the stairs rather than down the stairs. Something that I've always done. It's a signature move now, I guess. It's a little psychological trick that Jenny does sometimes. Her theory is that the security would see her go into the stairwell and assume she was going down to get out of the building. And so they'd go down to look for her.

But instead, she went up. Jenny ran up the stairs and got to the top of the building and she came to a fire door, which led to the roof. She could hear the security guards on the stairs somewhere below and didn't want to get caught with the book. I just opened the door to the roof, threw the book onto the roof, let the door slam, ran down again and just ran into them on the stairs. She was caught, but she didn't have the book on her or any evidence on her. So her plan was to somehow talk her way out of the situation. They were like really nice, actually.

And they said, what's going on? And I just said, oh, I don't want to say. And I was really panicking. I was really young, really panicking. And I thought, I don't know what to say. She just kept saying she was supposed to be there. But Jenny didn't have a letter from her client. No get out of jail free card, as they say,

which explains that this is all a security audit and it's on the level. She was unable to talk her way out of this. So the security guards escorted her to their office and sat her down and started questioning her. They sat me in the security room. They were looking at me and they left me there. There's only one door. They stood outside the door and I could hear them talking and they came back and they said you know

did you take anything and I said no. Ginny could only think to tell the guards that she was just looking around. And that was the best I could come up with and and I just felt like if I just kind of just just said oh I was looking for a politician just was a bit dizzy that they they probably wouldn't do anything. I don't know what they thought. And I don't really remember exactly what I was thinking, but I don't remember being particularly concerned. I just thought they'll let me get when they did.

And just sort of said, you know, don't do that. Don't get into trouble. Jenny says her innocent demeanor helped her escape. It was very strange at the time for a woman to do any of this. And you just, I got away with so much and there was so little scrutiny in my early years that it wasn't even a legitimate thing. It just, I mean, I still do get away with things just because I'm, not just because I'm female, but more because I just look so innocent.

It just doesn't resonate with people that I'm a threat at all. Never did. She caught a bus home, but she knew the job was only half finished. She still needed to go back onto the roof and get that address book. This would be an embarrassment if I didn't get the book. All I need to do now is get back up to the roof. I'm thinking about now grab the book and it'll be fine. So she headed back that night because there was a sense of urgency to get the book before someone else found it.

Even though she's shown her face at this building three times now and has been caught once, she decided to go for it anyway. And she tried to justify why it was safe to go back. They didn't, like, call the police or do anything the first time, so they probably wouldn't do it the second time. It's just the most stupid reasoning. She stood out in front of the building for a while, watching the front doors from a distance.

It was late in the year, a couple of weeks before Christmas. It was cold out and it was getting late, like it was after midnight now. Waited and waited and it was completely quiet and it started to rain and it started to really rain. I just thought, I've got to move now, I've got to go and get it or I'm going to get wet, as if that's the main thing to worry about. She didn't see any movement in the building for a while. So she went in and then quickly ducked into one of the stairwells and made her way up the stairs to the roof. And as I got to the roof, the thunder and the lightning was just

really loud. And I just grabbed for this book and it was all soggy and wet. And I got the book and then ran out, didn't get stopped, didn't get any, there was nobody there. She successfully left the building with the address book in hand and made it to safety. She did it. She turned the address book over to her client and got paid. But the thing is, that first one always reminds me now that I was completely incompetent that first job. In the past, she'd had her cousins to lean on. They had experiences to share. They worked as a team.

And although she made some mistakes, the end result was that she did it all by herself. And it's one of the reasons I kind of stayed in security because it was so easy. You know, I look back on that now and think, that was ridiculous. There was no protocols. There was nothing keeping it safe. And that was a politician. God knows what was in that book.

Security on that building improved a lot after this audit. The office was locked at night after that. And the politician's office door was locked at night too. You can't always rely on security guards catching everything. You have to make deterrence for thieves. After that, Jenny started to pick up more work. And every job she did, she learned better techniques for breaking into buildings and manipulating people. Looking back at what she did, she sees how far she's come.

I over-prepare now. And I mean, I have plan A, B, C. I have teams. We cover every eventuality. I have props, everything. As she grew her business over the years, the jobs got more complex and she started needing extra people to help her on certain jobs and props. Like this one time, she had a job to con a business tycoon. And for this story, we'll just call him Mr. Big. The job started when Mr. Big's security team reached out to Jenny. Mr. Big thought his security was flawless, but his security team thought otherwise.

So they reached out to Jenny to see if she could expose some security holes that would prove that Mr. Big would need to up the security budget. They knew of me and they asked him if he would allow them to hire a social engineer to get to him. And he told them to knock themselves out. So they came to me and said, you can do whatever you like because he doesn't believe that this is a thing. Mr Big didn't think anyone could gain access to his confidential data or con him. He thought he was too clever to be tricked by any social engineer.

And he especially wouldn't believe that some little woman from Liverpool confidential data or con him. He thought he was too clever to be tricked by any social engineer. And he especially wouldn't believe that some little woman from Liverpool would get past him. Challenge accepted. And they said, do what you like, but, you know, he'll be good about it in the end. And I didn't care if he was good about it in the end. I just thought, silly sod, like, you know, you're going to get hacked for real. So here's the job. Mr. Big's security team wanted to see if Jenny could get into his office and get access to his email. If somebody could get into his email, then they'd have access to future deals that are in the works, sensitive information about the business or other private information

like his whereabouts. And with that, they could track him, plot against him and maybe figure out a way to con him out of a bunch of money. When starting the job, or any social engineering job, her first step is always to do OSINT, Open Source Intelligence Gathering. So Jenny starts looking on the internet to see what she can find about Mr. Big. By this point, places like Facebook and Twitter were pretty popular, which became an important part of information gathering on people. I used to have to do proper surveillance. I used to have to sit outside offices and Facebook and Twitter were pretty popular, which became an important part of information gathering on people. I used to have to do proper surveillance.

I used to have to sit outside offices and theatres and things and watch people, you know, to see who they socialised with and everything. But when social media came in, I just couldn't believe how easy they made my life. You can find out a lot about a person on social media because people post all kinds of private information there. Name, location, job, high school, hobbies, friends, sexual orientation, trips. People post it all. Like, there's no reason to hack into someone's phone to see their private photos when they're posting these photos for anyone to see. For Jenny, social media was a game changer for this type of work. It was like someone being fed to the lions, you know. It was like, oh, this is going to be so easy to get hold of this person.

She has a specific goal in mind when she does OSINT. Something, she says, sets her apart from some of her other colleagues. What I'm normally looking for is different, I think. I think when I speak to other people who do the job, you know, they can collect the ostent, but the data's nothing without the story. And I'm looking for what's underneath it. I'm looking for the things that people fear

or the things that people, you know, the last things someone would give up. You know, what is it that really pushes this person's buttons and how can I use that in an ethical way to simulate this attack? You know, and obviously I'd stop very short of anything criminal or anything very harmful. But, you know, we look at the art of the possible. So she fires up a computer and starts searching for dirt on Mr. Big online. Normally it's so easy.

Normally you go to, you do some OSINT, right? So I go over to the internet and I look at Facebook and he's not on Facebook. He wasn't active on Instagram or Twitter either. Huh. Odd, but okay. Some people are just like that. She starts looking for the guy's wife, but Jenny can't find her either. All this is becoming tricky. She might have to look him up in other databases or dig through public interviews with him or something but as she looked more she just wasn't finding much on this guy. He was somehow staying off the internet pretty well. And in the end in desperation you know just as sweet we found his secretary on Pinterest.

Jenny took a hard look through Mr Big's's secretary's posts, but didn't find much. She was in this extreme knitting group. She used to knit little cupcakes out of wool. And that was all I had. And it's terrible. It's not enough. Jenny kept pivoting her searches. LinkedIn, Reddit, nothing. Come on, this guy's got to be somewhere. So she just starts reading public articles about him and his company.

He and his wife are both in charge of a charity that was connected with an illness that had been in their family. Huh. Jenny is an ethical hacker. But would she use a charity to exploit someone? That might not seem like an ethical approach. But then she thought, you know what? The bad guys would do low blows if they had an opportunity. So Jenny decided, yeah, let's get to him through his charity. And even though this is an ethical gray area,

Jenny doesn't lose any sleep over something like that. I sleep like a baby because I am showing you what the bad guys could do. I am not a bad person, but I do know how criminals think. So a charity or anything else really is fair game for her. And the charity thing was a great lead. I couldn't get to him through his business dealings because he just wasn't public about it and he's very guarded. But when it came to the charity and his wife, there's your soft spot, there's your chink in the armour, you see. And I figured that the way to get to him was to get to his wife. Mr Big's name was on the charity, but it was really his wife's passion project.

She was the way in. So Jenny hatched a plan. She bought two tickets to one of the charity's dinners in London. She'd go, posing as a journalist who was writing an article about Mr. and Mrs. Big and their charity. And this time, Jenny brought a partner along, a confederate, as she says, or an accomplice, to help her. Their goal at this dinner was to somehow get the pin from Mr. Big. She thought that would be a good first step in proving that Mr. Big's security could use some work. And yeah, if someone told me I wasn't very secure and I told them, oh yeah, prove it, and they said, well, this is the pin to unlock your phone, I'd be rightfully embarrassed.

Jenny's plan was to chat up Mr. Big at the dinner and somehow get him to take his phone out of his pocket and unlock it. And she was thinking up ways she might be able to get him to do that. Maybe ask him to look something up on a website, or maybe they'd trade emails and check his inbox while they were talking. And if he did take his phone out while they were chatting and unlocked it, Jenny's partner, who would be hovering right nearby, would look over his shoulder to see what pin was entered when he unlocked the phone. On the night of the dinner, Jenny and her partner arrived. She saw Mr. and Mrs. Big and approached them. I went up to them and I said, look, I'm sorry, but I'm a journalist. And I wanted just a few words for our online publication about the event. But she wasn't just talking to both of them.

She was really talking to the wife, Mrs. Big. And I went to her and said it. And she was like, oh, absolutely. And she made him talk to me. Which was all part of the plan to get Mr. Big through his wife. She turned on her charm to build rapport. I kind of assumed and surmised that people never told him no and I was very cheeky with him so I said well you know I wanted to interview you but my glasses dry I think you can afford a drink and and you know and he was like right and he got me a drink. Jenny sunk her hook deeper she recorded a short interview with him about this charity told him that it's going to go into a magazine that she worked for she said she'd send him a link to it. And she kept chatting him up, trying to get him to pull out his phone.

I made sure that I spoke to him enough so that my confederate was watching him open his phone and putting his passcode. Her accomplice had a phone too and pulled it out and recorded Mr. Big entering in his passcode. This way they could play it back later in slow motion to see what his pin was. It worked. The confederate gave the signal that they got it and walked off. And that was her cue to wind down the conversation and leave. They'd start phase two the next day. I called the next day and I called the secretary and I said it was great but unfortunately the recording just didn't work. And now I've interviewed them, I really want a bigger piece. I want them to be on the cover, we want to take a few photographs. But the problem is I'm on

a horrible deadline. Like this needs to be in by Friday. This sense of urgency was important to Jenny's plan. It was a tactic she used regularly. Because you never give a mark time to think. Got to rush people into doing something. We're going to flatter them. We're going to get the wife on board. They've got to sell it to me. And now the Biggs were selling the interview to Jenny,

building rapport with Mrs. Bigg at the dinner paid off. She called Jenny back within a half an hour to let them know the interview was a go. Jenny worked out a plan to meet with Mr. Big in his corporate office so they could take some photos of him. But their real goal was to somehow gain access to sensitive information in the office, a computer, phone, anything that might lead to accessing his email. On the day of the interview, Jenny and her partner showed up, still posing as journalists. We set up the camera and a little microphone. We took a few photographs

and we asked a few questions. And then he said, oh, I'm sorry, I didn't offer you a coffee. Now, the thing that makes a good social engineer is someone who can think on their feet. And I said, oh, I'd love a coffee. I said, but I'm a pain. I like decaf.

If you've got a decaf? And he said, I'll go and find out. See, the thing is, Jenny hates decaf. Death before decaf. What it was is I wanted him to have to go and really look for it. And I thought maybe that was a better option. And he left us on our own in the office. Bingo, alone in his office as he hunts for decaf somewhere in the office and he left his mobile phone on his desk. They weren't really sure when this opportunity would present itself but when it does Jenny says you have to be ready. We weren't banking on that happening. We were looking we had other things that we had in mind to get him out of there. Phone calls planned and all sorts of things but at the end of the day the opportunity presents. You need to know everything about the target so that you can tactically adapt if the opportunity arises that takes enough bandwidth

to have to adapt to a situation that you don't need to be thinking of anything else so I need to know everything about the secretary the building who is in charge officially but who do people rally to who do people like who really holds do people like? Who really holds the power? And there's different types of power. Where do they celebrate? I always say a building's like a person and it's what's the rhythm of the building? How does it breathe? You know, when's it alive? When does it sleep? And the reason is, is that once you have all those things in place, then when something like the guy just pops out to get us a cup of coffee happens, we're quick enough to act very quickly in the moment and leave.

In this case, knowing that decaf coffee might be hard to find, that was the key to their success. With Mr. Big gone, Jenny quickly grabbed his phone, punched in the pin that she had gotten the night before and sent a text to the security team. Then she ran around his desk, sat in his chair and sent an email to the security team. This proved that she had gotten in

and got access to his emails and phone. And once she finished, Mr. Big still wasn't back. So Jenny and her partner vanished. Yep, gone. She says there's no need to hang around after a successful con. There's no point in exposing yourself to getting detained. The best move is just to get out. Once Jenny sent the code word to Mr. Big's security, they quickly swooped in and debriefed Mr. Big. After the job, Mr. Big reached out to Jenny. He was really good-natured about it. And what he said to me was, he said,

I want to take you for dinner. And I want you to tell me exactly how you caught me out. In the end, Mr. Big carved out more budget for his security team. For Jenny, the Mr. Big carved out more budget for his security team. For Jenny, the Mr. Big job was important because it showed that even if you're not on social media, someone can still get to you. A lot of the jobs we have, I can find out everything from social media.

I don't even have to go. We can just fish people or whatever and I'll do a lot of my work over the phone. But everyone's networked and someone in that network will be able to give you enough to just work out where the chinks are in the armour, where the psychology leads you.

And with him, it was always going to be flattery. We always had to work with ego. But to get to his ego, we had to find out what they cared about. Speaking of preying on ego, the next story from Jenny is about a time when a handsome sum of money helped lure her into a job. Stay with us. This episode is sponsored by SpyCloud. With major breaches and cyber attacks making the news daily, taking action on your company's exposure is more important than ever. I recently visited

spycloud.com to check my darknet exposure and was surprised by just how much stolen identity data criminals have at their disposal, from credentials to cookies to PII. Knowing what's putting you and your organization at risk and what to remediate is critical for protecting you and your users from account takeover, session hijacking, and ransomware. SpyCloud exists to disrupt cybercrime with a mission to end criminals' ability

to profit from stolen data. With SpyCloud, a leader in identity threat protection, you're never in the dark about your company's exposure from third-party breaches, successful phishes, or info-stealer infections. Get your free Darknet Exposure Report at spycloud.com slash darknetdiaries. The website is spycloud.com slash darknetdiaries.

Jenny has another job. She's also a professional negotiator. She's really good at getting people to agree on certain things. I was working for these big companies, big corporates, and they were sending me on negotiation trips and supplier assessments all over the world. Some big companies need someone like Jenny to be on the ground negotiating contracts. And I was good with people, right? So I could negotiate well. Jenny realized over the years that yet another way she could legitimize her skills would be to teach others how to do this. So she developed a negotiation course, but with her own little manipulation slant. Here's how it goes.

I will talk to them about, you know, all the usual things you'd learn in a negotiation training. Know your best alternative to a negotiator's outcome. You know, weigh up your objectives, know what you're willing to lose, all the stuff that you get in any other course. But then at like half past three on day two, I'd say, okay, now this is how you make someone do what you want them to do. So you can manipulate someone to do anything you want. Ginny came up with 19 identifiers that people could use for negotiating. It's like a recipe for getting people to agree with you. Normal, regular business people who are very legitimate and do very respectable jobs absolutely love the idea of being able to kind of input a formula and get that person to sort of bend to your will.

She says her philosophy for all these negotiations and manipulations can feel a bit dark. To change those people's minds, I have to tune in to the thing that they really fear like the last thing they give up under interrogation the thing that wakes them up in the cold dark night I need to know what that is and I also need to know what they really care about like not not the first thing they tell you not the second thing but the why underneath all these things and it's like a push and a pull, you know, what do they push towards? What do they sort of run away from that pulls them back? And once we can sort of get inside that and know exactly where your heart beats,

then you can persuade anyone of anything because you tune them in to that. What I say to them on the negotiation training is, it's not football, right? It's chess. And you've got to think way, way ahead. And what you've also got to do is understand the way people really are. It's never just about money. So in the corporate negotiations, they always never just about the money it's always about power or revenge or sometimes it's about sex but mostly it's power and revenge in business and if it's a power play where are they pulling their source of power from like what is it that they'd hate the most to lose and and and that's what we threaten and then back it up with a really easy decision. And that sounds very dark, but I've seen far darker. I still teach collaboration and I still teach actually being clever as opposed to threatening anyone is the best way to do the best negotiation. Like apply your mind and get everybody what they want so nobody loses. But the principles involved in really reading and understand people's psychology,

particularly the darker side of that, is what everybody always wants to know. And if you're up against people who mean other people real harm, it's very helpful to be able to tune into that and understand how that works. So yeah, Jenny goes all over the world helping companies negotiate contracts, but also teaching people how to do it too. At one time, she was in Hamburg, Germany, teaching the art of negotiating and persuasion techniques. After she finished up her talk one night, she headed back to her hotel, but someone approached her outside. And I'm stood outside and I hear this, Jenny, Jenny Radcliffe, right? So I'm like, shit.

So I look around and there's this guy just like sort of hiding in the shadows outside the hotel. And he says, we need your help. This is strange, but not completely unusual for Jenny. I get jobs in lots of different ways and always did. The guy had a big ask. He told Jenny he needed her help breaking into a bank in two days. So I said, yeah, right, no, you know, no. I said no because I didn't know who it was.

It could have been a real criminal, you know, and I didn't speak German and this could be very dangerous. So I said no and he said, no, no, no, it's all legit. We just need a social engineer. We need a woman in particular to get us past the security at this bank. The guy said he was with a security firm that was auditing this bank and they already did all the recon. But they needed Jenny's help getting a USB thumb drive in the door past security and to be plugged into a computer somewhere. They didn't think they could do this themselves. They all were huge, like great big special forces types

with baldy heads and muscles and tattoos. And they just would stand out a mile. I said, look, I don't know who you are and everything. And I don't know if I can do it. And he said, well, we'll pay you. And then he named this figure. And it was more money than I've ever been paid at that point than I'd ever been paid in my life for like a day's work.

Like thousands. Everyone's got a price. And this was Jenny's price. So she thought it over and said. But where'd you want me? She agreed. But she wanted to confirm all this was legit. Jenny got this mystery guy's business card and went up to her hotel room and started researching this company that he worked for.

And yeah, it seemed legit. It was an above board company doing actual security audits for big businesses. And the security team of the bank was aware of this assessment. So the job was this. They were going to give Jenny a USB thumb drive. She was to take it past lobby security and then go into a hallway where there were some offices. And then she'd go into a specific office and plug the thumb drive into a computer, just plug it in for like a minute or so, and then take it out and get out. Jenny didn't ask what was on the thumb drive. She's just not that interested in the tech side. But I can guess that it was probably some kind of rubber ducky or something like that, which is a device that acts like a keyboard when you plug it in. It just automatically starts

typing commands, and the computer then starts doing things like it could create a reverse connection to a computer out in the world somewhere. And now someone from the outside can access that computer that she plugged it into. So she started thinking about a plan, her disguise, her backstory. My pretext was I was going in to do some training on the inside of the bank. I was sort of in-house trainer. And that's why I was there. Because she was training, she had some props with her that fit with this disguise. First was her handbag, which she packed with minimal infiltration kit. She had a can of compressed air, like the kind you'd use to spray the dust off your computer. Because it turns out you can use these to open certain kinds of doors. So you've got magnetic locks on fire doors that sense smoke.

And if you just get some, sometimes it even wears a deodorant, but if you just get that condensed oxygen can and spray it through the little crack, it very often opens the door. She also packed one of her all-time favorite items to bring. I always have smoke bombs with me to create my diversions. Why do you like smoke bombs so much? This is a new one. I haven't heard people use this. You know, it starts a diversion. It starts an evacuation. I was in a TV building once, TV studio, and there was this huge evacuation. Not me that caused it, but there was someone

had set fire to toast or something in the kitchen. But, you know, the alarms go off, the whole building evacuates. But it's when you go back in that you can go, you can tailgate effectively, you can get in quicker. So snow bombs, it's so helpful. You can draw people to an area, you can get a building to evacuate. The ones I use are like yellow wax. And they really do draw a crowd. If you put, if you light one, there's a tremendous amount of smoke that gives off. But briefly and safely, it's just a really good diversion. Jenny packs some more stuff for this job, too. A couple different IDs, a lighter. She likes taking little mints along with her because she can use them as like chalk markings on things.

A small hammer to smash locks with if she needs to and something to lever a door with. These are things that are all helpful. But Jenny would always rather talk someone into opening a door than forcing it open herself. She likes to keep her kit minimal and to keep things hidden like if she needs a knife or a blade hide it in something like a tampon and she says people rarely if ever search tampons and finally she packed the USB thumb drive with the security firm's payload on it and she chose a thumb drive in the shape of a flip-flop because, well, it looks silly and it doesn't look like a malicious USB drive. Jenny finished up her disguise with two other important props.

I bandaged up my arm so it looked like I had a broken wrist and then I put a load of box files under my left arm and I'd lost a loose leaf paper in so that like if I dropped the file, the paper would sort of spill out like in a cascade. She had it in her mind that she could use a fake bandage to maybe get people to hold doors open for her or something. You never know what you might use these sort of things to do, but she'd be ready if there was an opportunity that presented itself. When the day came, Jenny headed down to the bank and walked up to the front door. And there's a security guard that opens them, but he's just like the bellboy kind of thing, right? So he's got the big, the uniform and the hat and everything. And

it's very sophisticated. He opens the doors. She walked in and scoped out the lobby. It was a very expensive sort of financial institution with, you know, leather sofas and huge wooden doors. The firm that hired Jenny had coached her up on where she needed to go. She saw the door to the staff offices over on the left side of the lobby. And the door wasn't like a door. So what it was like was, if you can imagine, the walls are just these huge oak panels, sort of, you know,

well, how high? 12, 15-foot high panels up to the ceiling. And this staff door, the only thing that gives away that it's a door is that there's this biotech pad on it. It's a fingerprint scanner. Only people with valid fingerprints would be able to open the door. Jenny's fingerprint obviously won't open this door, but hey, let's try it anyway. I didn't make eye contact or do anything, just walk straight over.

My arm's bandaged up and I'm carrying all this stuff, my handbag's over my shoulder, and I put my thumb on the bio lock. It just beeps. It didn't work. She expected it wasn't going to work, but part of her job is to kind of test if things do work or don't work. So when that didn't work, now what? I mean, a security guard probably heard the beep and is starting to look her way now. And so what I did was I swore really, really loudly. So I'm trying to draw attention because I know I can't get in without some help. Jenny calculated the situation and thought that she can either try to defeat this fingerprint lock or the security guard. And she decided to square off with a person and not the lock. What I say is you don't have to work on the lock.

Work on the person behind the security. It doesn't matter what they put in place. If someone's got access, then I can access them. And then we're down to me versus the person. Right on cue. A well-dressed security guard comes over. The top security guard in the lobby. He's got all the sort of earpiece and the radio and beautiful immaculate suit and he says

madam and she says this isn't working today and it wasn't working yesterday which is a lie of course jenny wasn't there yesterday so he said she'll try again she does begrudgingly because remember she has her hand all bandaged up with a big box of papers under her arm and her purse on the other. So I made a huge job of it. And it beeps again. And I said, OK. And he said to me, I think it's because you're not pushing your thumb down hard enough. He grabs her bandaged hand.

And he got hold of my hand and pushed the thumb. And I went, ah, fuck, God, ah. And he went, right. And I just looked at him like this, like fury. And he said, try the other hand. I think at this point the guard was stalling. Yeah, maybe she scanned the wrong finger, but I bet he was just trying to get a better read on her,

watch her closely and see what she does. She tells him they didn't scan the other finger, just this one, but she tries that other hand anyway. And as I did it, I made sure I dropped all the files. So now there's files and paper everywhere and I'm swearing away. And I just started to pick them up, but like really, really loudly. And there's people starting to look over me. And he just said, for God's sake, go in and just beat me in.

And I went like, thank you. Danka Jean. Jenny was confident this plan would work. go in and just beat me in. And I went like, thank you, danke schon. Jenny was confident this plan would work. She says making a scene like this in Germany embarrasses people into action. But a similar tactic like that maybe wouldn't work in like a Mediterranean country where people are more

laid back. You really have to know the territory to be most effective. I just thought, the last thing they're going to want is to be massively embarrassed in the middle of the working day. So he's either going to ring someone and I'm going to have to kind of BS them or I think he's going to let me in. He did let me in. Jenny stepped through the door and into a hallway where there's offices. It was also high end, just like the lobby, and there were wooden doors with frosted windows. The computer that Jenny was after was at an office at the end of the hall.

I just walked down the corridor and it was so quiet and so it smelled like wood polish and money. She wasn't alone. There were people working in this office. A few people sort of looked up but didn't do anything. So just looked up at me and then looked back down. I was just really quiet and respectful, didn't make eye contact, didn't smile. Along the way, she discarded her file box and bandages. They served their purpose.

She doesn't need them anymore. And the box fit well enough to just leave it on a bookshelf somewhere. Got to the end of this office and walked past it once just to check no one was in there. It was empty. And just walked in the office and put this flip-flop USB into the guy's desktop, huge, big, clunky desktop thing. It was all switched on and wide open. And I put it in and I didn't, you know, it whirred away and everything, but I wasn't looking at that.

I had to trust that that will do what they tell me it's going to do. Meanwhile, I'm kind of just keeping an eye. But all I can hear in the background is just the sort of quiet, polite calls in German. I couldn't, nobody walking up and down or anything. She waits a minute or two with the USB drive in the computer and then pulls it out. And I just saw this like line go across the screen kind of like a lightning thing across the screen just once and that was it. Instead of going out the way she came in Jenny walked to the end of the corridor through a door and then out to the parking garage.

She turned the thumb drive over to her contact and the security firm and the job was over. And that was it. And that was the most money I'd ever made ever. All legitimate. Everything was fine. Nobody was being robbed. I was being hired legitimately. But I had no idea that people could make that much money just doing something as simple. See, the thing is, this job was really easy. She did it all in two days while on a trip already, without the need to do any write-up or do any reports or debriefs or anything like that.

So while she didn't say what amount she got, you can still imagine that even if the job paid her just a few thousand pounds, making that kind of money in just two days is really nice. And while breaking into a bank might sound hard, to Jenny, this is what she trained for. The Hamburg job was about jumping at certain opportunities. And she said business really started to pick up after that. Okay, so we have one more pen test story from Jenny.

And this one is a doozy because this one went really bad. All right, so to start, Jenny went to Asia to negotiate a contract for a large company. And one of her old clients heard that she was in Asia and called her up. Guy basically said, are you traveling home for business class? And I said, no, they're sending me back a coach. And he said, do you want to travel back business class and have some spending money? And I said, yes. And he says, OK, I need you to travel back business class and have some spending money? And I said, yes. And he says, OK, I need you to do a little job for me.

She had done work for this guy before, so why not take an extra job while abroad? She cancelled her flight home and booked a new flight to this other country in Asia. This job was to see if she could get into someone's house and find an address book in the office, then look through the address book looking for a particular name. And if she finds that name, then she's supposed to leave a post-it note on the desk with a secret message. And if she doesn't find the name, then she just leaves. Jenny accepted the gig and the client gave her half of the target's address over the phone and the other half would come when she checked into a hotel in this other city, which all sounds a bit cloak and dagger. And didn't really question it although it was naive not to question it she's done some pretty interesting jobs before and it comes with

the territory i guess but she wasn't robbing anyone she's just planting a note and it didn't seem that bad and she has done work for this guy before, and she trusts him. Jenny checked into her hotel room in this new city. She got the other half of the Target address and moved forward with step one, recon. She caught a taxi over to the neighborhood where the house was and got dropped off a little bit down the road and started walking the street to where the Target house was. This neighborhood that I got out in was so rich and completely deserted. There wasn't a sound of a dog barking.

There were hardly any cars on this huge road. I could hear the water of this sort of lake that ran beside the road, but I could hear virtually nothing. And it just did seem to be abandoned. Jenny looked for the house that she needed to gain access to. She didn't have a smartphone at the time, just a map with the address written on it. And she strolled around the neighborhood searching. But then I saw it and it was the biggest house on this street

and it was sort of set back a bit more from the road than the others. It was a big colonial style mansion with walls around the property and gardens and fountains and a fabulous driveway that looped around to the front door and back to the street. She saw the house number and confirmed it was the right one. And then she noticed the gate wasn't locked. It had the feeling that it was used as sort of like a base camp, but not really lived in. So it was kept nicely and everything, but I didn't feel So it was kept nicely and everything, but I didn't feel like it was a home.

She scoped the place out a bit more and noticed there were some exterior stairs that led up to some French doors on the second level. She figured out that might be a good way to break in. And that was it for Recon. She thinks this place isn't lived in, the street gate is unlocked, and the exterior stairs go up to the second story. With a house this big, there's bound to be a door or window

unlocked somewhere. The plan was to come back the following night for the job. So, she headed back to a hotel. Her contact calls her, and she tells him, recon went well, I'm going to go back tomorrow and finish up the job. Get back to my hotel room, kind of, I was going to run a bath,

get a drink, get some dinner, have an early night. And I actually got undressed and put my robe on, ran the bath, and then just thought, screw it, I'm going to go back and do it now. Jenny's recon had her convinced that this job would be easy. So why wait? Let's get it over with now. The place looked deserted anyway. I remember thinking that bath water will probably still be warm by the time I get back. Jenny got dressed in all black. She wasn't prepared for this job. After all, she traveled to Asia to do a negotiation, not some security assessment. So she has none of her equipment or props with her. She ties her hair back in a ponytail and looks around the room for anything

useful to bring. She grabbed the post-it note that she was going to plant on the desk. She ties her hair back in a ponytail and looks around the room for anything useful to bring. She grabbed the post-it note that she was going to plant on the desk. She stuffed some cash in her bra and went down to the hotel gift shop to look for any useful tools there. She buys a small flashlight and a bottle opener from the gift shop, which both have the hotel logo on them. She got a cab and went back to the neighborhood. The reason this story is so significant, one of the reasons is that I broke my own rules. Because by the time we get to this job in Asia, I've been doing this for a long, long time, 18 years maybe. And I was, first of all, very superstitious about things. I have lots of little rituals and all sorts of bits and bobs that I kind of do before I go out and do a job. But there was also just sensible things like someone always knows when you're on a job.

You always, you know, I've checked with the client that, you know, right before you go, we are, you know, it's still green to go, you know, we're going to abort, all that. But in this job, she didn't do that. She didn't tell her client that she changed her mind and was going back that night. She didn't tell any family or friends that she even took another job while in Asia. Right now, only her client knew where she was. And moreover, he thinks that I'm tucked up in my hotel, good to go tomorrow. And I'm not. I'm a day early.

She didn't have a get out of-of-jail-free card on this job either. No little note to hand to some homeowner or the police saying that this is actually a security audit and call this number if you want to confirm everything is fine. And with this particular client, she didn't actually have his number. He always called her. These broke a few of her own rules, but Jenny thought this job was so easy, it wouldn't matter. Jenny got out of the taxi a few doors down from the. But Jenny thought this job was so easy, it wouldn't matter. Jenny got out of the taxi a few doors down from the house.

It's nighttime now. She made her way to the house and slipped through the unlocked gate. She headed for the exterior stairs to the French doors. Along the way, she realizes her little pen light is so ineffective that she just throws it on the ground

and kicks some dirt over it at the front of the stairs. The moon was up anyway, which was enough light to see without a flashlight. Climbed up the stairs and as I got to the double doors, I had a phone ring inside the house. So just flattened myself against the wall and listened and listened. And nobody answered this phone. This was good luck, actually. A ringing phone can tell you a lot.

How many rings until someone picks up? If someone answers, can you hear their voice? But the phone just kept ringing. Nobody picked up. Not even an answering machine. So she looked in through the windows of the French door. Nothing in the house seemed to be moving. And there's this bedroom and it's all sort of, there's like an unmade bed, but no personal,

no shoes on the floor or anything like that. Since no one answered the phone and the house seemed empty, Jenny got ready to force the French doors open with her bottle opener. And then I remembered something that I've been told all my life was security only works if someone

uses it. So she grabbed the security only works if someone uses it. So she grabbed the doorknob and twisted it. And it just swung open. They hadn't even locked the French doors. She leaves the bottle opener outside. She just doesn't need it anymore and didn't have a good way to carry it. Those little things can be pokey sometimes. So she just leaves it at the top of the stairs to get it on her way out.

The house was dark and quiet. She didn't want to turn any lights on to give away her presence. Just padded into the bedroom, no one there listening all the time, no lights, no alarms, nothing. And I remember thinking, what kind of person doesn't even lock the windows? I mean, why would you not have alarms? You know, what kind of person would do that? And the answer is someone who's not frightened to being broken into is the answer jenny this could mean a lot of things like are the people who live here dangerous are they looking for a fight are they some kind of criminal overlord

was she walking into a trap at this point though she was in the house and felt invested in seeing the job through. So she pushed deeper and headed downstairs to where the office was supposed to be. Luckily, it was the first door she tried. She went inside the office and saw the desk with an aquarium. She'd been super quiet up to this point, but once she found this desk, she started to relax a little. You know, I kind of had a look around, sat in the chair, great big chair that you sort of swivel in, swiveled down the chair a bit, looking at the fish and smiling at the fish and stuff. Looking for the address book, she tried to open the desk drawer, but it was locked.

She looked around for the key. It was in a bowl on the desk. She grabbed the key and unlocked the drawer. In the drawer was the address book she was looking for. She opened it and looked inside. Found the name almost immediately because there weren't many names in English. Put it back and put the post-it on the desk. Jenny can't tell us what the message was

that was on the post-it. It was some kind of code word anyway, just to let them know that somebody was here. Now that the post-it is on the desk, her job is done. That's all she had to do. So now, it's time to go back home. I saw two car headlights of two massive cars pull up outside the front door. Oh no, two cars are whizzing up the driveway.

Time to run. I just padded all the way up the stairs, ran up the stairs, ran across the hall into the bedroom and out through the windows, which was still open. She was up on the balcony and she looked toward the driveway and saw two big guys looking around the place. They seemed like they could be security guards for the house. They had radios, but they hadn't seen her and started to move into the house. It didn't look like they had any guns drawn, but they were probably carrying them. And just the type of people who would have no sense of humor at all

and were definitely looking for me. And I knew in that minute that this was not a legit job and that I was completely on my own. And I knew that if they caught me, I was dead. Jenny was spooked. She'd broken too many of her own rules on this job now and the situation just got very intense. She was here a day early.

The client didn't know she was even there. She hadn't told any family or friends what she was doing. If security caught her, she would just look like a common burglar. Even worse, she was starting to doubt her client. Had they hired her to break into the house of some enemy? Was she some kind of pawn in a game? In moments like this, you start realizing your mistakes. And she started regretting taking this job.

Every fiber of my being knew that they'd asked me to break into some massive criminal's house. And it made so much sense that they'd asked me to do it because if anything happened to me, it was just, I'd gone missing in Asia, you know, businesswoman goes missing in Asia. It wouldn't have been, there'd be no link to anything. But what would be the point of this whole thing? What it is, is it's to show you that someone got in and didn't take anything.

That's what it is. It's to show you that you're not invulnerable. I see. Perhaps her client wanted to do a security audit for whoever owned that house, but whoever owned that house didn't think a security audit was valuable. And by having Jenny break in and leave a note would be the perfect sales pitch. Like, look, you obviously need better security and I can provide that for you. Or maybe this was just a bet between two friends. Or worse, a shot across the bow at some kind of

rival. Jenny's head was racing in many directions. It was like someone was proving a point that someone could get in and do that. I thought maybe it was more than that. Maybe it was a warning or something to them. I mean, I don't know. But all that didn't matter now. Jenny was trying to evade running into any of these security guards and she just didn't want to get caught. She needed to get out of there.

She tiptoed down the exterior stairs, down to the ground level, then snuck over a garden wall and laid down to hide. I'm pressing myself up against the garden wall. So I'm sort of partially hidden by bushes and everything. I'm wearing completely black anyway. And I just hid my face towards the wall because my face would have been the only white thing against the shadows, you see. The guards were inside the house,

turning on lights and looking through the whole place. So Jenny started crawling along the wall, aiming for the gate to get out of there. But unfortunately, she had to crawl past the guards' cars to get there. She was freaking out. I inched forward a little bit more and a little bit more, and I felt like I would either laugh, throw up or cough was how I felt.

Holding all that back, she kept crawling towards the gate. She wanted to stay low and out of sight, but their cars were making it hard to get there. So she was pretty close to the cars now, inching along on the ground next to them. She stopped and listened for activity. And I thought, if they stay in the house much longer, it might be that I make a move, which is a stupid thing to do. You just lie still and wait for it to go. You know, it's 50-50 now type of thing. As she turned her options over, she suddenly realized that she couldn't move her head.

Her ponytail was caught on something. She couldn't move her head. Her ponytail was caught on something. She couldn't see what it was hooked on. Maybe a bush, a wall, the car's tires. After all, she was right next to the tires. She couldn't move her head to look back at all. It was stuck. She tried to get her hair unstuck, but she was having problems reaching back behind her head while staying low and motionless. In that situation, every interviewer just wants to get up and leave and run. And I'm fighting that and I'm going to be sick and I'm going to laugh. I felt like I was going to laugh, just nervous laughter. And my mouth was so, so dry.

I would taste soil and I could smell things and I could see like bugs walking towards me on this wall. And it was just like sheer panic. And I just remember thinking, I'm going to die. I'm going to like, they're going to see me. I'm going to get shot. I don't know why I'm laughing now because it wasn't funny at all, but I kind of felt like I was going to laugh. It was the ridiculousness of the whole thing, just for the sake of a business class flight, you know, nobody knows where I am. And I just thought, that's it. My hair's caught and I can't move. She laid there for a while, trying to come up with a plan, any plan to get out of there. And then they came out and then suddenly they were both still talking

in this like rapid language down the walkie-talkies. It was a tense moment. She was in danger, close to the cars, hair stuck, unable to move, hoping they didn't see her. Then she heard them clear their guns and put them away. And then they climbed into their cars. Guy gets into the car, slams the door and then just raced off. Someone's left there, lying against this wall. And they'd just gone in, as quick as they'd gone in, they left.

For a minute, Jenny still couldn't move. And then I kind of got to my feet a bit wobbly and then just walked out. She caught a taxi back to the hotel and went straight to the bar. I said to the barman, make me something very alcoholic but that a kid could drink.

Jenny sat down with her sugary cocktail. It was early morning now. The sun was starting to come up, but she was a mess. And I looked and I could see in the mirror behind the bar and my face was like covered in mucking cuts and leaves in my hair and my clothes were ripped and my shoe was ripped. Jenny downed the cocktail and the bartender asked, Do you want a beer to chase that? And as soon as he said that, I remember I'd left the bottle opener on the stairs. And the flashlight too,

both of which had the hotel logo on them. But there was no going back to that place. Not now, not ever. But what if they found these items and came to her hotel looking for her? Questions like this kept her up that night, worrying about every little sound she heard all night long. But fortunately for her, nobody came to her room that night. And so the next day, she booked it out of there and got on her business class plane ride home. Later, she had a phone debrief with her client. So he said, but you said you were going in on the Saturday. And I said, I know, I changed my mind.

Don't give me a hard time about it. I know it made all kinds of stupid mistakes. And he's like, well, no harm done. You know, that's fine. And then I just said, just one thing I need to know. I said, and then I'll never want to talk about this one ever again. And I said, I was on my own, wasn't I? And he just said, of course you were.

If Jenny had been caught, it would have been really bad for her. They would have thought she was a burglar. They looked mean. Not a typical for hire security guard, but more like a security guard that an evil villain would hire. A villain that doesn't care much about the law. And to try to convince them that she was there on assignment probably would have made things worse.

It could have turned into a dire situation. And it left her shook. Honestly, after that, I thought I'm hanging up my guns and I didn't do another job then. That was it for Jenny. She was done. This was just way too dangerous. And still at that time, her profession was just very uncommon. So she just felt like she couldn't talk about it. Like who would believe you if you said you were a burglar for hire? And if so, wouldn't they immediately, like, clutch their belongings, thinking you might steal their stuff? So she just stopped answering the phone for calls to break into places and just stuck with the negotiation stuff.

But then, as time went on, there was a sea change. The security world started adopting this type of thing. It was becoming a normal part of a security audit. adopting this type of thing. It was becoming a normal part of a security audit. And this really surprised Jenny. There were people writing books called social engineering. There were people giving talks, you know, about physical infiltration. And it was legit. She realized she didn't have to hide this secret part of her life anymore. And it was now more acceptable. And there were all kinds of ways to do this safely and honestly. So she got back into the game and was able to call herself a physical penetration tester

and started doing jobs again. And that kind of reminds me of this line from the movie Sneakers. So people hire you to break into their places to make sure no one can break into their places? It's a living. Not a very good one. into their places to make sure no one can break into their places. It's a living. Not a very good one. Like, I couldn't believe that at that point I could start to talk about it. And I really had to look into it to work out that this was a thing and that I'd really, the job I'd done my whole life,

I could do legitimately, be paid for, speak about on stage. And it would be a legitimate business that everybody was interested in. And you could even go on certain courses and train in it, for goodness sake. Even though this work was becoming more common, it took Jenny a long time to get back into it because she just couldn't stop thinking about how terrified she was on her last job. I just thought that was ridiculous. Like what for really? Because those guys would have just thought I was a burglar and shot me and they would have probably been right. A big thank you to Jenny Radcliffe for sharing these stories with us.

You can look her up online. Her Twitter is at Jenny underscore Radcliffe. That's R-A-D-C-L-I-F-F-E. And she goes by the name People Hacker. Her company is called Human Factor Security, and their website is humanfactorsecurity.co.uk. And she has her own podcast called The Human Factor. So definitely check out her podcast so you can hear her interview other social engineers. As always, if you want to help support the show, please consider donating to it through Patreon. Rain or shine, I bring the show to you every two weeks, free of charge. You know

why? Because I don't want to leave you hanging. So don't leave me hanging, okay? Visit patreon.com slash darknetdiary. Thanks. The show is created by me, the Nightingale, Jack Recyder. This episode was produced by Battleborn, Charles Bolte. Sound design by Garrett Tiedemann Blackbriar. Editing and mixing this episode from the Snowshod Proximity Sound. And theme music is by the Shattershield Breakmaster Cylinder. And even though in the future everyone will have 15 minutes of privacy, this is Darknet Diaries.