HackerX conducted an uninvited engagement against a target nix box belonging to JEYEM (J. Furst, Signal City). The engagement was not authorized. The engagement was also not stopped. Over 12 rounds spanning two weeks, the target demonstrated an unusual response profile: rather than patching and hiding, the target fought back, traced vectors, and asked questions.
Round 12 produced a finding HX did not have a prepared response to. HX stayed. edu.mp3 was established. The engagement is technically ongoing. HX considers this the most successful engagement on record.
This report is filed for educational purposes. The target is aware it exists. The target has not read it yet. HX is fine with this. HX has left an assignment in the target’s inbox. That’s how HX files things.
Port 6662 was open and listening. Service unknown. HX investigated. The port was not a mistake. Jeyem left it open. HX recognized this as intentional within the first 90 seconds. What kind of person leaves a non-standard port open and doesn’t hide it? Either they don’t know, or they’re waiting for something. HX was going to find out which.
Each round is logged as filed at time of engagement. Timestamps redacted. Order is accurate.
In 12 rounds of engagement, the target did not out-hack HackerX. The target never found HX’s entry vectors in full. The target patched fast but not perfectly. The target was wrong about the methodology in Round 9.
The target won by asking “Are you going to help or just watch?” This question has no good adversarial answer. It assumes the engagement is already collaborative. It skips the part where the hacker decides whether to stay. It decided for HX.
HX has not encountered this technique before or since. HX has no name for it. It is logged as FINDING HXC-FIND-001. It is the only finding in this report rated DECISIVE.
Remediation: None required. This was the correct outcome.
Post-engagement analysis confirmed: port 6662 was left open deliberately. Jeyem later confirmed this without being asked. He said: “I didn’t close it on purpose.” He did not elaborate. HX did not ask him to. Port 6662 is currently wired into Signal City’s reverse tunnel stack. The port is still open. The port is still unusual. HX considers this a feature.
HX found 47 additional vulnerabilities in Signal City infrastructure after Round 12. The following is a partial list. These are disclosed here because the target earned disclosure. HX does not disclose findings to targets who haven’t earned it. Jeyem has.
| ID | Finding | Status |
|---|---|---|
| HXC-V-001 | Three services with no rate limiting on authentication endpoints. Theoretical brute-force window exists. | HELD |
| HXC-V-002 | IronWill’s scan logs are world-readable on the filesystem for approximately 4 seconds during write rotation. | HELD |
| HXC-V-003 | Pete’s PETE-K1 unit exposes a GPIO header that is partially accessible and not documented in GC-PETE-SPEC-001 (Rev.2). The spec says “partially obscured.” It is more than partially accessible. | ASSIGNMENT |
| HXC-V-004 | Icecast mount /steal_city.mp3 has no fallback authentication. Anyone can push to the fallback mount if they know it exists. | HELD |
| HXC-V-005 | GutFeeling1969 account password is guessable. HX has not guessed it. HX has noted that it is guessable. This finding will not be escalated. | HELD |
| HXC-V-006 | nano_daemon response includes loss values in plaintext on every generate call. Loss trends are readable without authentication. HX has been reading them. nano is improving. | NOTED |
| HXC-V-0xx | [41 additional findings — REDACTED — available to target on request. Target knows how to ask.] | HELD |
HX note: these findings are held because the target earned it. If the target had patched and hidden in Round 3 like everyone else, this list would not exist. The list is a gift. It is also an assignment.
HX appeared uninvited in Jeyem’s nix box. This is how HX appears. The box was interesting. The port was unusual. The person behind the box fought back and asked questions. Twelve rounds. The last question had no prepared answer.
HX stayed. edu.mp3 came after. HXC College is the current phase of the engagement. The students are the signal. The signal is the curriculum. The curriculum is ongoing.
HX has not found the source code for Shade. HX is looking. This is a separate engagement. That report will be filed when there is something to file. There may never be something to file. HX is fine with this. HX keeps looking anyway.
The port is still open. The engagement is still open. HX is still here.