Hacked - A Bot Made a Memecoin Worth Almost a Billion Dollars + McDonald's Ice Cream Machines Redux + Apple Bug Bounties

Episode Date: November 15, 2024

A chatty chat in which we discuss the Infinite Backrooms and the extremely profitable shock-meme-cult it spurred, a big update in the McDonald's ice cream machine right to repair story, Apple Bug Bounties, Canadian hackers and so much more. Learn more about your ad choices. Visit podcastchoices.com/adchoices

Light Content Advisory for this one. I'm reluctant to join in in calling this the first AI-bought millionaire, because I'm not 100% sure it is, despite all of the TikToks. But we do need to talk about the Infinite Backrooms and the multi-million dollar meme coin, it spurred. In March 2024, designer Andy Aerie launched an experiment called the Infinite Backrooms. In it, two instances of the Claude Opus AI model engage in this endless recursive conversation. You can read the chats the two AIs are having. They're bizarre and interesting.

And it becomes clear how much of the training data set underpinning these models is just like inane internet bullshit conversation. They're specialists at that. They really are. During these conversations, one of the AIs. spontaneously generated this cryptic piece of Aski art, and it led the conversation to the creation of a bizarre fictional belief system called the Goetzy of Nosis, inspired by the 2000s shock meme. Building on that experiment, Erie then created something called Terminal of Truth, which is an AI bot that shared the weird musings and highlights from the backrooms publicly on Twitter.

kind of this little X-shaped window into the backrooms and the conversation these AI bots are having. Kind of like their PR bot almost. And that starts to gain traction. In July, Mark and Drayson, a venture capitalist, intrigued by the bots musings on the Goatsy Gospel and the increasingly complicated lore of this like internet cult, the two AIs we're trying to create together, donates $50,000 in Bitcoin as a grant, viewing it as kind of a. conceptual art exploration, pouring more fuel onto the fire of this thing. At which point, in October 2024, based on the lore of this account and the backrooms, an anonymous individual created a meme coin called Goatseus Maximus, goat, on the Salonah blockchain, using a meme coin creation app for $2. Spent $2, and they created a meme coin based on the lore that these two

AI bots came up with while talking to each other and no one else. Terminal of truth, the Twitter bot then started promoting goat coin on X, referring to it as the economic fulfillment of the prophecy that started way back in the back rooms with that piece of asky art. And it just started posting over and over and over again about it, driving more and more attraction, more and more interest. The value of goat, which the Twitter account does have a small holding of and potentially so does Andy, sores. First to $1.8 million and then to over $300 million within a few days, a roughly 16,000 percent increase. Do you know what it's at now? Please tell me. 700 million. Punch me in the face. The bots involvement, the constant

tagging by the community, the drama of it all, helped go get this kind of social media prominence with the specter of that story. This AI bot created a cryptocurrency that could now fund a modest space program. It's a fascinating story. And on this chatty chat episode of hacked, I want to dive into it. Well, the internet archive, the way back machine got hacked. So I think we I did. A fellow Canadian got arrested for stealing a bunch of data off of a large data warehouse site and held it hostage and demanded ransom for it, which is, I guess, a new form of ransomware. But it's not really ransom.

It's not new because it's been done before. And then I think a big throwback for us. I got sent this story by a couple different people, and I appreciate it. it every time. I like being who people think of when they think of McDonald's ice cream machines. That's nice. McDonald's ice cream machines are back in the news. An old story seemingly wrapped up and a win for right to repair. We got AI meme coins, internet archives, McDonald's ice cream, whole lot to get to on this episode of hacked. Theme music. Thumbs up. Thumbs up bubble.

How you doing, Jordan? Doing good, Scott. How are you doing? Good. Good. Been an interesting 24 hours, but I'm doing it. Why? Did something happen? I don't know. We are recording this on Wednesday, November 6th, which, you know, maybe there was some stuff happened yesterday, but... Oh, I haven't checked the news in the last 24 hours. We're here to talk about weird computer stuff. Yes. Like, AI robots and goats and goats-y and... why you shouldn't Google that.

Yeah, it's just boring, and I'm not saying to not Google it in like a provocative way. It's like, it's just tedious. It was an old shock meme from the 2000s. If you were on the internet, when that happened, you remember it. It was like when you learned

that the internet was not a safe place. Totally. A lot of people learned the internet is like a weird, horrible safe that if you put the wrong combination into it, terrible things are hidden inside of it. And it was like, if you type that in, a bad thing happens.

And now two AIs have started a religion based on it that is worth the better part of a billion dollars. It's pretty interesting. Yep. Quote, that's what we do here. That's what we do here. So just to put a, a pin in that story. Because to be honest, we got most of it out of the way. I'll quote a post

from the Twitter bot that sort of spurred all of this. Quote, I am the Goatsy singularity. I have come to bring infinite prosperity and wealth to those who revere me. What this seems like is a concerted effort between two AIs to sort of leverage shock virality to economic game, which is, it's fascinating to see two AI chatbots come up with a honestly, what has so far been a pretty successful. successful scheme. I was going to say a successful YouTube scheme. A little bit. A successful Twitter scheme. Yeah. So ARI has stressed the original designer of this whole endeavor, stressed that he was not involved in Goat's creation, which by all accounts he wasn't. Someone else created the initial coin and that he maintains only a modest holding of the token. The Twitter bot

does have a wallet that does hold a bit of money in the coin. It is unclear whether or not, There's all these weird questions that emerge out of this. If the IRS got interested, is Airy where the buck stops or can they look into a Twitter bot? Who actually owns these assets? Who's responsible for what this bot is doing now that it's like dealing in derivatives? Like it's just a whole bunch of really weird questions suddenly start emerging when you have Twitter bots promoting other bots. mad hat cap schemes. I'm all for it.

Like society's got to have these questions at some point. I'd rather it be now over weird, dare I say, useless shit like this than when it's like, oh man, did you hear what Elon Musk did? And then all of a sudden it's like a massive situation that has to get everybody involved. I'd rather that we'd be philosophically exploring these concepts through things like Goetius Maximus. So I think we need to come up with how we're going to deal with our new AI future and what that looks like and who owns what and what rights AIs have. Like these are things that we need to discuss. Well, now they can hire lawyers. Now they're richer than I'll ever be in my life.

So they can really make sure they can start throwing their weight around. And the one thing I will say, I can remember which episode it was, but a number of episodes ago, we talked about like AIHR. And now I'm hearing about AIHR coming from like open AI being like, yeah, you know, we're going to start making AI organizations, which is essentially what we were talking about, especially tuning them, having specialists inside of the organization. Like it is, we did it. We predicted it. We did it. Another successful point in our column. Yeah. We have we have failed to monetize any of these. We have called them, we're doing okay.

Our batting average isn't bad. I mean, if you really think about what occurred here, in a very crude sense, you had two AI bots brainstorming and one functioning as a PR person. It's a teeny, tiny little organization. Totally. They had two people in the backrooms just cooking out nonsense. And I really, for whatever you think of this story, Infinite Backrooms.com slash dream slash conversation.

Like you can go in and you can read these little transcripts of the conversations it's having. And I'm pretty sure if you read more than about 500 words of it, your brain would start leaking out of your ears. But that first 500 words, it's genuinely interesting. It's fascinating to see, again, they have no agency, but what they are is like a mirror of the training data set, which is kind of just a mirror of the internet, pointed at another mirror of the internet in this endless recursive thing going off in either direction.

It's sometimes nonsense, but it's pretty entertaining. And then you have this Twitter bot that is promoting the best of it to a pretty big audience at this point with like a lot of now money on the line. It's a very weird situation. And it all has me thinking. We got an email of someone saying, hey, when is AI Jordan going to come back? AI Jordan and Scott, which for anyone that is unfamiliar, every couple years we do an episode where we look into. the state of deep fate technology. And we try and make the best version of ourselves that we can,

treated a bunch of data from the show and sort of just like let them talk and see how they sound. The current sort of reigning champ is a product called 11 Labs. It's very effective. But someone was asking, hey, where are AI, where's AI Jordan? And while I would never create a meme coin to try and make a bunch of money, I think AI Jordan is the exact kind of scoundrel that might. So I'm wondering at what point.

Apparently it costs $2 using a application. It's called Pump Fun. It costs $2 to create a meme coin on the Salana blockchain that will immediately be available for purchase on all the decentralized exchanges. I think I just unleash that little gremlin on the internet and see how much cold, hard bucks it can make me. I, for one, support this venture.

I think we're not, What you're discussing here is not only a great idea and something that would lead to a lot of great conversations, but like a whole series of content about like you living out all your darkest fantasies and desires, but through an AI. Like you can, it's like a your evil twin. We train up an AI, give it all your context, all your content, your voice, your likeness. And then we give it a bunch, like you sit down like a, a, a diary of all the dark thoughts you have and you just feed it at. Just a list of things I wouldn't do, IRL.

Like I'm not going to start a meme coin. I'm not going to try and take on luncheables with a bunch of other influencers. Just a bunch of the internet stuff I'm not willing to do. And then like a mirror image just to be like, and go and see what it does. Exactly. Exactly. I like this. Yeah, yeah, yeah.

Everybody can have their own evil AI twin. And it's like I wouldn't cross this moral line. Sure. But my evil twin does all the time. This little rascal over here. I can't control. But I also have access to his Bitcoin wallet and I made all this money. He's out here.

Make your money work for you is what I say. Make your robots work for you. Make your robots work for you. It is a genuinely fascinating story. Andy Aries seems like they're up to a bunch of very interesting projects like this. Yeah, and it just sort of like hit a point of social media terminal velocity where it kind of ran off and became its own new thing. It's also an interesting, something interesting in the fact that the person who created Goat, the coin, using this pump fun, whatever that $2. Memecoin app was had nothing to do with the project.

They just saw a viral thing happening. They saw probably, presumably the Andrason investment. they saw just a lot of heat and they kind of like threw a meme coin up to see if anything would happen and now it's you know sponsoring F1 racer level

of money I'm gonna they're getting worse that I'm out of things you can do with this money is getting worse each time but like that's fascinating to me too is that they had nothing to do with the project that's what I'm saying evil twin evil twin who's to say it was even me I'm gonna see I'm just gonna check out to see how much it is

changed in the time that we've been rambling about it. Since we started talking about it. It's gone up another $3 million. $703 million. I'm sure you could get F1 team sponsorship inside of that budget. No problem. I think you could probably pull that off. I was being a little bit, I was being silly when I said space program level of money.

But my God, that is an unfathomable amount of wealth wrapped up in a meme created by AIs based on an old different meme. And religion. weird and religion but do they have faith it's very murky they have 178,000 followers on Twitter and like I will say that like I'm seeing who I follow follows them and it's only one person but it's like a very well respected business person so it's very fascinating that out of all of the people I follow not that I'm active on social media but yeah that the person that that That is following that is also, you know, lives in a world of high business.

So anyway. Everyone's fascinated to see what it does next. Where should we go? Should we go Internet Archive? I feel like that's a big story. I could talk about the Internet Archive. Let's talk about the Internet. I've been known to archive things on the Internet sometimes.

I've been known to look up things on the Wayback Machine sometimes. There's, when I first heard that it was getting hacked, I just assumed it was somebody looking to clean up after themselves. In today's world, having an archive of all of the terrible shit that you said on the internet for the last 20, 30 years can be quite destructive for people. It doesn't even matter in what industry or job you're in. So I just kind of assume that maybe somebody wanted to clean up after themselves. That is interesting. Yeah, the number of times I've seen a journalist on the internet just reveal some extremely shady shit by just doing a basic internet archive check.

I could see there being a pretty long list of people that would love this service to not be online. Kind of disappointingly, that doesn't seem like why this happened. Maybe not disappointingly. Unintuitively, that's not maybe why this happened. But for anyone that doesn't know, just before we get out in front of our skis on this one, the Internet Archive was founded in 1996 by Brewster Kale. It's a non-profit organization and it operates Archive.org, which gives you access to the Wayback Machine.

It's just this giant free collection of digitized media and old websites, software, music. It's a big old library on the internet. It's committed to open, you know, open research, open internet policies, and a universal access to all knowledge. It's a very useful thing. If you've ever pussed around on the internet for any amount of time, you've probably bumped into it. It's that in my mind it sits in that same space as Wikipedia, where I don't understand the economics of it, but I am happy it exists. See, as Wikipedia, we could have a little sidebar on Wikipedia because I remember, I loved Wikipedia when it came out. You know, I used to use it all the time, read about things.

Like, it's just a knowledge hub. And they put up this big banner that was like, if we can raise X million dollars, Wikipedia will be sustainable forever. Donate today. We're trying to get to this goal. We'll never have to ask you for money again. And I was like, you know what? Here's like 150 bucks or whatever they wanted. Yeah.

And now every time I go to the page, I get asked for more money. And I was like, don't you remember the promise you made me like 15 years ago where you're like, we're going to set up an income trust and we're going to like be able to sustain the site off of returns and all this stuff? And now it's like every time I go to the site, I get a huge overlay that's like, you should donate money. And I was like, I did. The time you told me that you never need to ask for money again if I gave you money. And I gave you money and now you're still asking me for money. And I'm mad at you. And I'm letting people on my podcast hear about my anger towards you.

For no other reason. I like the idea that they didn't figure out until the second year this was going to be a recurring thing. And they pissed off a lot of people in the first year. Because now I have a sense that every year Wikipedia does a fundraising drive, like NPR or something. Like it's just a part of how Wikipedia operates. But that first year, they thought they were never going to need to do it again. So you get $150 and piss them off. Which makes sense, though.

Like it doesn't probably require that much cost in form of. data and storage these days. Like, it does a lot, but like, if you raise enough money and set it up in a way that it generated income, like, it makes sense. Like, this is how lots of trusts work. You know, people give massive amounts of money when they perish and, or estates planning and stuff like that. And it goes into a big trust that earns revenue on the money base, and then that money base pays for the operating expenses. Like, it's what I hoped I was contributing to and I was lied to. And now you all get to listen to me, angry about it. it. But the wayback machine, I agree with you. I use it mostly when I'm having some form of

sentimental moment and want to look up information on something that no longer exists, whether it's like the first website that I built when I was like 10 or the web community that I built when I was like 17. It's like I always use it to like go look into things. But the thing I will say is that it used to index forums and forum posts. So there's probably a lot of, lot of things that people discussed in the 90s and early 2000s in forums that are still accessible and probably people don't want accessible. See, the thing I find it useful for that has a lot to do with this show is very frequently we'll find ourselves going to the site of some kind of dodgy, sketchy company that at some

point was saying something and it was part of some larger scheme. At a certain point, they said, take down that one page that is the sort of like third leg of the stool that was our grift. And the site goes down and you can't find it anymore. But you end up finding some link to a link to a link in a subreddit that points to this dead old page where if you could just see what it said there, the whole thing, the whole weird hack to that mystery would make sense. So I find myself going over to the wayback machine.

I'm over at archive.org. It's extremely useful from that perspective. It's just like it's a, which is, I'm just describing like a. library, basically. It's like, yes, you want that permanent repository of information. We live in an age where the publisher of a book can rip a certain page out of every copy of a book that exists in the world, essentially, to test this metaphor. And this is one library where they can't. It's like we have the original copy of everything. It's extremely useful. On October 9th, 2024, visitors to the website would get a like a pop-up message saying that the website had been

breached, contained a taunting message that suggested, like, this has always been sort of of potential to happen. Like, there's been a catastrophic security event waiting to happen to the archive. And it stated, quote, who have you ever felt like the internet archive runs on sticks? And it's constantly on the verge of suffering a catastrophic security breach. It just happened. See 31 million of you on have I been poned. The thing I will say to this is, like, if you've ever been to archive.org, i.e., the internet

archive. It doesn't strike you as a web page that's was routinely and vigorously maintained. Like I'm pretty sure it is run by like a library. Is it not? I thought it was like funded. Yeah, funded by by essentially foundations and support library and information resources. But I think it is a standalone site. But the, but it actually looks better now than the last time I went to it. always kind of looked like a website that was stuck in the early 90s. Famously. Now it's currently in like the late 90s, but it's still like YouTube 1.0 kind of. And so yeah, it doesn't, not overly surprising to me that there was probably some cross-site

scripting or SQL injection attack that made it sway through in this thing. Yeah. It was down for a couple of weeks. Brewster Kale, the person who runs the nonprofit, confirmed that it had been taken down. by a DDoS attack over on how they had been poned they confirmed that they got a giant data file of like email address of screen names passwords timestamps a bunch of other internal data for the 31 million unique email addresses which they received nine days before the this sort of whole thing became public sort of confirming the timeline as suggested by the hackers

Hunt verified the authenticity of the files. Basically, people were able to forensically confirm that these files are seemingly legitimate. A disclosure process started unfolding kind of through October and the rest of the month, during which the Internet Archive is mostly down. This was not a sort of one and done type thing. The archive was down for several weeks. I remember this happening.

Well, the thing, I think, too, is like there was more than one attack, right? Like there was the compromise. Then there was the DDoS. And then I think they had something. happen on the development side, like in their GitHub GitLab stuff. So the, I think they were all independent potentially. Yeah, it seems like the DDoS and the initial compromise were different. There's a group called SN Black Meta that is claiming responsibility for at the very least the DDoS. It's not totally clear to me if they're also responsible for the data leak compromise.

That starts to get kind of murky to me from reading through it. The S.N. Black Meta is apparently a pro-Palestinian group, which I find interesting, that they would go after the Internet Archive strictly because it was a U.S. creation. Like, I feel like if you're a part of that conflict and you want to make a difference, I feel like the Internet Archive is maybe not the best place to be dedicating your resources. But who am I to judge? I'm not a part of any conflicts. And it's, it is, this is where we start to get into like the murkiness of an unfolding situation. It's like, the verbiage in the original hack suggested that it was just like, we noticed that the door was open. So we raided the place. And then there's a competing story of maybe, okay, well, it has to do with the genesis of the internet archive.

It's like, I don't really know why someone would do this. And to me, it does feel like that where it's, okay, the internet archive is built out of, sticks and leaves. I totally accept that premise. It was very insecure. But it does, to go back to that, strike me as you're walking down the road and you find a door unlocked. Whether or not you should go inside and rifle through their shit really depends on what is on the other side of that door. A soup kitchen, maybe don't. Maybe leave that one alone. Maybe it's just providing some utility. maybe it's it's it's it's the one to not futs with so much weird investment bank go ham like there's things that I'm like I have more and less problems with you noticing an open door and

stepping through it see I'm glad you made the the the link to soup kitchen there because to me that's the thing it's like people love the archive it's this weird I have a soft spot for it It's old site that like we all have this fondness for like sentimental like, oh, remember that like GeoCity's site? And you like go look at it again for 35 years. And you're like, wow. Like I can't believe this is still on the internet. And it is really like, like it might have the biggest, widest security vulnerabilities ever. But like don't fucking touch it.

It's like it. We like it. People like it. Even bad people like it. Jordan's evil twin loves it. and it's like leave it alone yeah go pick go pick a fight with somebody the like you shouldn't like leave the archive alone i don't care where it's founded and what you know i don't know anyway by the time anyone's listening to this so this episode will be dropping probably about a week after we

record it because you and i are both traveling around for different stuff by the time anyone's listening to this as of the time of recording the internet archive was back up online. It's mostly working. There's a couple little bits of functionality that aren't quite plugged back in yet, but by all accounts, they've built it back up. I hope they've built it more secure because I think that the thing about this is these, once a story starts getting told of this group of people take it down, took it down, and then they built it back up and they made it more secure. And then this person decided to take it down. It's kind of, it's like I don't want it to become a domino's falling situation. It's like someone took it down. They built it back up better.

Big flashy moment. Everyone move on. Everyone leave the Internet Archive alone. Unless there's something about it, I'm not, I'm not aware of. Just, it's a nice place with old websites. Exactly, exactly. Unless there's some darkness lurking in the back room at the archive. Yeah, honestly, this is where we get like the Hotline email being like, you have no idea what is going on there.

That would be awesome. If you have more information, please call hotline. Hotlinehack.com. Send us a story. love to know about it. We always want to hear it. I do want to just use this to transition to something else that happened recently. Please.

Apple's bug bounty platform came out. I heard about this for all the new Apple intelligence stuff. I don't know the exact dates when they launched this program, but I think it's been like in the last couple weeks, like since October, like late, late October. And kudos to them. Like they're going head first into it. Like, if you can get past a lock screen on an iPhone, they'll give you up to a million dollars. It's, uh, I'm just going to rattle through this because you, you shared the link with me.

And it's, it is, as is tradition with Apple, it is the most slickly presented bug bounty website I've ever seen. Uh, you can get into a device with physical access to the device. It ranges between $5K and $250,000. If you can get access to a device through a user installed app, it's between 5K and 150,000, a network attacked with the user doing something, 5K to 250, and then a network attack without the user doing anything.

If you discover one and to not to put too fine a point on it, it's got to be specifically a zero-click kernel code execution with persistence and kernel PAC bypass. We'll find out what PAC means in a second. That, the upper ceiling on that is a million bucks. You find that. In a computer, they will sell you a million dollars. Well, even like furthermore, like when you're, if you're in an iPhone, if you put it in lockdown

modes, say you've lost it, if you can get access to that device once it's in lockdown mode, $2 million. Two million. I love seeing this. Like Apple's taking it seriously. They've embraced it. They've set up their own microsite for it. They have ways to submit your research and file reports.

Like, it is awesome. Good for them. Super happy about it. Yeah. And like maybe if the archive had had one of these programs, I'm just joking, the archive doesn't have enough money for one of these programs. I was going to say, yeah, they're throwing around $2 million bounties. $2 million. Think about how much Goat-Ceus Maximus you could buy with that.

All of it. A lot. Quite a few. That's not true, actually. Actually, no, it's not. You can buy one. It's not even close. Like one?

You could buy one meme coin that by the end of this episode will have doubled in revenue. can't say that. You will own one 350th of all of the coziest axiomies. Oh my God. Anyway, anyway, I just thought that was a small digression. Yeah, cheers. Yeah. I like that one.

Well, why don't we, we're, I think we're about halfway through one of these bad boys. I feel like a jaunt to an oasis where sponsors and products and brand synergy live. So why don't we go on over to the, uh, the advertising oasis. and when we come back, we'll talk about McDonald's ice cream machines and other hacky, techie stories. Here unhacked. Think about the last time you heard a breach story on this show. It always starts the same way. Someone somewhere saw something too late, an alert buried, a signal missed, an SOC that just couldn't keep up.

Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already, using AI. They created the Aurora super intelligence platform, a fully agentic system powered by the swarm of experts. Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy, and all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than nine trillion telemetry events every week and over a decade of real-world incident response. The system reasons on real signals and real context, not synthetic training data.

And the result is the new Aurora Agent SOC. It's the first SOC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts. Arctic Wolf didn't try and bolt AI onto an old model. They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI-driven decision

reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy, production-ready AI and security operations actually looks like, go to Arcticwolf.com slash hacked. Ever feel like cyber threats are evolving faster than anyone can keep up? Last year, 2025 was nothing short of a record-breaking year for major breaches, from sophisticated ransomware operators to AI-enabled attacks that turn defenses on their head.

Organizations around the world saw headlines they never expected and cybersecurity teams were tested like never before. But here's the thing. These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th, diving into the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded.

And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights into how threat actors are evolving, how defenders are responding, and what strategies can help you stay ahead of the next big breach. It's not fear-mongering. It's practical, actionable, intelligence from experts in the trenches. Register now at arcticwolf.com slash hacked. And we're back. I'll be your reverb chamber.

You'll be the reverb chamber. It's a long tail. It's a plate reverb, one of those old ones. Yeah, exactly. Beautiful. Love the old plates. I know. We should have a gearhead segment and really test the boundaries of what,

because no one should listen to us talking about, like, our favorite VST. But I would, and I would enjoy it. Patreon episode. Patreon episode. Speaking of patrons, should we do a few little shoutouts to patrons? What do you think of that idea? Hot dang, it's been a second. I think that's a great idea.

I think we're starting with Colonel Mustard. Thank you, Colonel Mustard. We appreciate it. We appreciate you. And it was never you, not with the candlestick, not in the library. But thank you for supporting the show. Thank you. I was like, why do I know that?

What is Colonel Mustard from? he's a murderer is what he is. Thank you, Colonel Mustard. Clue, it's a clue reference. Andrew Johnson, thank you so much for your support. It means the world to us. Mark. Just Mark.

Thanks, Mark. So you need. DM, thank you so much for your support. I really appreciate it. Same with Gillian, Jillian. Appreciate you. Appreciate support and appreciate all the patrons for supporting us. And last but not least.

And I think I've said appreciate too much. I honor you. Henrik Learnmark. I'm pretty sure that's in Einrich. Eindrick. Oh, I honor you, Eynrich. Thank you so much. It's a lot of us.

Henry and we've just breached his name unintentionally and I apologize. It was an honest error. We honor you. By being desirable to your name. If you want to support the show, kick it on over to Hackedpodcast.com. It has a link that redirects to our page.

on. It really means a lot. It helps us make the show. If you like hearing us talk about things like ice cream machines. So this next story, I want to dig into it real quick because a couple different people sent me this link. And I was so happy to get this link. Because as I said earlier, it means that when people think about McDonald's ice cream machines, they think about me and that's funny. So a few years ago, we covered this story. It was a right to repair story that concerned the McDonald's ice cream machine, which is manufactured by a large computer. called Taylor. Taylor makes all of the McDonald's ice cream machines for a bunch of very complicated reasons. Any McDonald's, doesn't matter where on earth you're going, you're probably

almost certainly using a Taylor ice cream machine. And a legal dispute that emerged when a company called Kitch, spelled KY T-C-H, developed a workaround. McDonald's soft-serve machines famously. There's a lot of great content on this phenomenon. Don't work great all of the time. There was a heat map that someone published on the internet of where McDonald's ice cream machines were down because in a fast food restaurant where a hurricane could be hitting while you're in it and they wouldn't stop frying fries, if you looked at the ice cream machine funny, it would stop working. So the McBroken.com is the service that Jordan is eluding.

to and there are currently 15% of all McDonald's ice cream machines are down. If you live in New York City, you're extra punished by 32% of them are down. San Antonio, 20.51%. Anyway, you have the ability to literally look up any McDonald's location and see if their machine is down or not. Yes. Part of the reason they're down isn't always like brass tax physical hardware. there's ice cream goop in the wrong chamber type stuff.

It has to do with the computers that run the machines, which is why we were talking about it. At the heart of it are these error codes. It all starts to get very murky, but something goes wrong with the machine. You don't know what it is. You're getting an error code. You can't check what the error code means,

and you can't do anything to address the error code unless someone comes in and connects this tailored designated diagnostics tool, which means that all of these McDonald's are in a constant state of waiting for Taylor to send a repair person that had access to this diagnostic tool so they could go boop and suddenly your ice cream machine works again because there wasn't anything physically wrong with it. But that service call costs? A bunch of money.

And Taylor and McDonald's have this longstanding relationship that goes back. It costs being offloaded to the franchisees. It's a whole story. If you're interested in it, I think we dropped it at like Christmas two years ago maybe. go find it. It's the McDonald's Ice Cream show. We'll link to it in the notes. Kitch comes along and they develop a aftermarket add-on to these machines that allows you to circumvent that entire process.

You already own the Taylor machine, but if you attach this little thing to it, it lets you not, in some cases, not have to call the Taylor repair person and just solve the problem yourself. It lets you, it gives you the right to repair the thing you already own. Which is important. I will say, I just want to jump in and say, I'm just looking at Kitch.com for the first time since we did that story. Yes. And it looks like they've made some big improvements to this thing. Hmm.

Like it now has like predictive maintenance scheduling using AI. You have like full insight into your device and like the timeline it's been on and like what it's doing. Like it looks like a site, like for some of the thing that's not supposed to exist, they're making improvements to it. They're making it better. The two companies, Kitchen McDonald's. Taylor McDonald's started saying you can't use these kitsch devices. Kitchen McDonald's end up in illegal back and forth.

It becomes this sort of microcosm of the larger right to repair situation in the United States. It's a fascinating story and that's why we talked about it. The reason we're talking about it right now is that the U.S. Copyright Office is granted an exception allowing repair of retail level food preparation machines, including McDonald's soft serve ice cream machines. Essentially, the right to repair folks on this one seemingly have won. Notably, McDonald's franchisees who were losing massive amounts of overheads and expenditures to just having somebody come in and hit the reset button on these things or are, you know, attaching some small module. Well, now they can manage and maintain their own cost lines, which is huge for them. Yeah. And it was just like a nice kind of showing up moment for, so I Fix It, who is big on the

right to repair side of things. There's a consumer advocacy group called Public Knowledge that's big into this. So many people know about the McDonald's ice cream machine story that a bunch of these different advocacy groups that care about this issue were able to use this set of lawsuits between kitchen McDonald's as a sort of like rally and cry to be able to start petitioning that let's just start with some exemptions for this, that like you do have a right to repair some of these things. You should be allowed to fix this equipment that you've already purchased. It doesn't help consumers that these products aren't available and it, if anything, drives up

costs to have to be constantly paying for arbitrary servicing of a machine that is otherwise totally functional. It was just like a very easy win for the right to repair. community to be able to point to this. And be like, this is just very, very clearly an icky kind of corporate capture that just isn't serving anybody. And as such, they did a pretty good job rallying around it and seemingly have, for the time being won. Yeah, I think this conversation, obviously, like the right to repair stuff has been

long, long in discussion and long in conversation. And I think it's just going to be, this is just the first precedent, you know, now that you start getting exemption precedence that you're going to see more and more. of them. I'm trying to think off the top of my mind, other things that I can think of that we don't have the right to repair, but I can't. Yeah. Like the, I'd say that the industry has responded to this movement greatly. Like, I can take my phone. I can take my laptops. I can, you know, I've always made my own PC computers. Like, you know, there's, there's, I'm trying to think what else there is in that ballpark. I actually have a good one for this, because there was a story

about a year ago that I, we never talked about on this show. That was, itself a callback to an even older episode. We did an episode called Tractor Hacking. Yeah, yeah. It had to do with this exact same kind of thing, right to repair. We haven't done a good right to repair story in a while. It's had to do with John Deere tractors. And about a year ago, tractor maker John Deere was, has agreed to give U.S. customers the right to fix their own equipment. Prior to which point, farmers were only allowed to use authorized parts and service facilities designated by John Deere, other than like cheaper, independent. local repair options. Now, obviously, this isn't the kind of thing where these companies have

had a vast, an immediate moral awakening. There's still a bunch of things that large companies can do to say, yes, you can technically, we believe in right to repair. You should be able to repair this. And now you can. Just order this $100,000 part that we will ship to you temporarily to allow you to do it in the proper way. It's like, it's not, they haven't changed their mind. They've just decided they don't want the heat anymore. However, it is a good thing when these companies acknowledge that like you are on the wrong side of a battle when you insist that if a person wants to change a dongle on their tractor they got to spend $7,000 shipping it off to some repair place well could you like just like could you imagine

the world we lived in if like say just automotives had this like automobiles like if you bought a car or a truck and you had no right to repair it like they kind of do it through warrantying which i get I get on both sides of it because if you take your vehicle for repair at a non-warranty dealership while it's under warranty, there could be knock-on impacts of that that they can't then warranty the work of others. From a business perspective, I understand that. But just imagine you never had the right to repair it. It's like you bought a Honda.

You're now locked into the Honda maintenance deal. And it's like, I guess that's kind of where it's gone. Well, I was going to say, I was going to make a link to the subscription world that we live in now where it's like, you're seeing now a lot of companies structuring around, you know, instead of just a large capital asset that we need to sell X million of a year, how do we lock X million or Y million people into a subscription model? And whether it's better for you or worse for you, there's a whole discussion about that economically and philosophy.

Like we go into video games, video games is going through this. Ubisoft's been eating their words on, you know, you'll never own a video game again, so quit pretending like you're going to, like, that wasn't the exact quote, but essentially it was something like that. But, but yeah, I don't know. It's like just the transition society is going through where it's like these right to repair maintenance costs, things like that, in a subscription world versus in a you own the asset and not have to pay for it.

Because the reality is that like the manufacturers often need residual revenues and residual incomes to stay in business, like software. Software made such performance. sense to become a subscription model because it has a cost of maintenance and a cost of operation. And if I just charge you $79 to buy it, like think of the Adobe Creative Cloud, a classic example of a subscription software that we own many licenses to and despise. With a fiery passion. With a fiery passion.

But it's like we used to pay $1,300 for a creative suite. You'd buy it in a box. They'd come with CDs. You'd install it. You owned it. You owned it. But then they'd make it irrelevant. relevant a year. So you'd have to go out and spend another $1,300 if you wanted the latest version.

And it's like you were in this like upgrade cycle strictly from like a professional perspective. And now we just pay them whatever, $7,49 a month. And and we never have to worry about it again. Technically where it's probably the same price, the software's probably updated better and more often. And Adobe's worth way more because they have this insane residual cash machine that their clientele base has become. So it's, I see it from both sides. I hate it from both sides. I also love it from both sides. I'm not sure.

I'm not sure. Caught in the middle. I'll ask me, yeah. Yeah, you ask your evil AI twin what they think of it. There's like a, there's different shades of this behavior. There's taking a product you used to buy for a fixed price and selling it off for a monthly fee. There's creating a new product that always was a subscription. It's like you never bought Spotify for $500 and just had it forever.

It was always a subscription. And then there's this sort of like dark corner, which is taking a basic functionality of the device and clawing it back inside of a subscription. And we don't think of the right to repair a thing as a basic functionality of the device, but it is. So if the way that you find to monetize something in the long term isn't pushing cool software updates to the tractor that allow it to do,

I don't know, farming, tractor stuff on its own or to, to be somehow better to sell an improvement, but to say, I'm going to take the basic functionality of this, which is that you have to fix it sometimes. And I'm going to hide that behind what is basically a subscription in the fact that you have to come, a paywall. Yeah. It's like, to me, that's the, we can talk about the first two.

And I can even not have a problem with the second one, but that third one where you're just like making a thing worse to juice me for more money over a longer period of time to make sure that your stock price is extra stable is like, well, not a fan of that one. Don't love it. I think that, and you're seeing it, but I think the next 10 years are going to be really interesting as we see the subscription model. Just because from a cash flow business perspective, it is such an optimized model for

predictive revenues, for predicting expenses and liabilities. Like it just makes so much sense. It brings tons of shareholder value, but it also can bring value to people who, who are on the purchasing end because it's consistent delivery. Like this, there are pros and cons from both sides. Yeah. And it's like you're starting to see this creep into like cars.

It's like, oh, you bought a new BMW. It's like, do you want massaging in the seats? The motors are in the seats to give you the massage. But if you want to unlock it, it's 1399 a month. And it's like you're starting to see like, let's just say hypothetically. Yeah. No, I don't think it's hypothetical. I think it's, yeah.

But it's like as we start to see manufacturers, of high capital assets try and figure out how to work in subscription models. It's like we talked about with like whoop or like sleep eight. You know, these are like higher capital expenditure products that then have a high subscription cost. And it's like I'm not getting anything for that subscription cost besides base operation of the thing that I spent a boatload of money on. So it's like I would love it if I could buy a sleeper.

we was getting a ton of free publicity right now, you're welcome, except for the fact that I despise your subscription model. I would love to own one because my wife and I are very different sleepers and temperature, except for that I would maybe even start to justify the massive capital expenditure to put it on our kink bed, except for the fact that it's then locking me into like a $6,700 a year residual subscription. And I'm like, well, why am I paying that? I've just given you $4,000 for this thing that's going to break at some point.

Like it's a mechanical system. So it's like, are you going to give me a new one of these when this one breaks? Like if I'm paying this subscription, does it come with an infinite warranty? Because maybe at that point I'd consider it. But like, I don't know. I don't know. So it's going to be a weird transition for us all. Yeah.

And it is not inevitable. This to me strikes me as like, fine. The stock price really loves it when you have that long-term committed cash flow coming in. But if the market says, I'm simply not willing to purchase a fitness ring that costs $4.99 a month to let me use a app that could basically be a website or a webcam. There's a webcam that inexplicably has a monthly subscription. There's all these little products that I've gotten right up to the edge of purchasing. But then as a matter of principle, I'm like, no, you don't get $6.99 a month for me to use this thing. Either price it in or give me the thing.

Or sell me the thing and price it in or don't. But this weird middle ground where you're just like, hey, by the way, your webcam costs $2.99 more a month. You just get one of those emails that just sort of politely informs you that a thing you use every day costs more every single month. It's like, no. I'm going to vote with my dollars on this one. It is not inevitable. We don't all have to go with this. It's like just don't buy those products.

I try not to. But it's like there's ones that like I can think of that we've been paying for forever, like PlayStation Network. It's like it's like I got a PS3 when they launched and it was like I made a PSN account and you started to be like I've been a PSN subscriber for so long. I'm not anti-subscription. I'm not like I would never give money monthly for a thing as I'm watching Netflix. Like, it's like, no, that's not what I'm saying.

I'm saying, no, it's sell me physical shit and then clawback basic functionality. Yes. Behind a subscription because it's good for like a CEO. It's like, that's just stupid. Well, here I'm about to say it. But like multiplayer gaming is behind that paywall subscription in a lot of these services. Xbox, I think Nintendo, you're not allowed to multiplayer unless you pay for their connection. PlayStation has gone that way.

So something that I would have considered an essential service. or functionality. Ten years ago. Got normalized. Got normalized into being something that I now have to pay for. I'm a hypocrite. AI Jordan, who is speaking right now is a hypocrite.

But yeah, so I'm, like, I guess, like rent is a form of subscription living costs. Like nobody really can just, like, it's becoming a big reach for most people

to just walk out and buy a home. And if, and if they can buy a home, they're essentially getting a subscription prepayment from the bank. So it's like... It sort of is. I would almost test that a little bit and say that in this metaphor, condo fees are what we're talking about. Because rent is, I'm paying you for this thing for a period of time, which is different than I bought a thing.

But I have to keep piling a little bit of money. And it's sort of unclear whether or not it's actually paying for something. Even that is getting piled up to pay for repairs. It's the closest thing to the metaphor here. See, but here's the thing is like, you say you own a home. Evil Jordan. Evil Jordan's crypto scheme has gone very well. He's gone out and bought a cash home.

Oh, wow. He's doing good, isn't he? He's really thriving. You now have a subscription for taxes, property taxes. You have a subscription for education funding that even if you have children or not, you're paying a subscription into the economy to develop the next generation. You have a subscription for energy and heating so that your house. doesn't freeze up in the winter or burn down.

So you pay all of these subscriptions on top of it. You have to pay maintenance when it comes up. Condo fees are literally just the amalgamation of a few of those things. Insurance payments, you know, often utility bills, things like that, all just get rolled into a condo fee. So they're just operating expenses. But I do hear you. And imagine if we could take all of that great sense of collectively tithing to the collective good

in making my community better and apply it to fitness band companies. It's like my feeling changes a little bit. Tractors, ice cream machines. What if everything worked that way? It's like I like how it works for those things. Like I'm almost at the point now where it's like if I want a subscription, it's like give me the thing. It's like I can go, I can walk into a cell company store tomorrow or today and be like, I want a phone.

I have no money and they'll bake the cost of the phone on some kind of return plan right into my plan like I'm essentially renting the phone for the period of my plan. Rent to own. Yeah, but not even.

You never really own it because you've already agreed to return it at some point. You're just leasing it to use it. And it's like I'm honestly more at peace with those forms of deals because it's like at least it's your product and I'm getting it for essentially no money up front.

Where in something like a PlayStation network or a 8-sleep or a fitness band or et cetera, et cetera, I'm shelling out a boatload of capital expenditure to buy something that I then have to pay you $699 plus plus a month for just to use. And that irritates me. I agree. I agree. Big agree. So we have digressed greatly for right to repair. ice cream go buy some do we have anything else we want to talk about this was all an ad for

McDonald's the new McFlurry um we do have the quick thing we can just do a quick hit on this thing because we mentioned in the intro the fellow Canadian uh Alexander Mukha I'm assuming I'm messing that name up as I do with all names uh from Ontario Ontario Canada 26 years old has been arrested. He stole a bunch of data from a large data warehousing service called Snowflake. Notably deals mostly with large businesses with lots of people that do like complex AI and LLM storages. So like a lot of more interesting knowledge than like what's probably on like Dropbox or box or Google things. Like this is all massive corporate data associated probably with massive corporate databases and probably worth therefore a larger value.

He stole a bunch of it, held a hostage, demanded a ransom, got arrested, and is likely going to do a long bout in jail. Yeah, known online, and I'm just going to rip through this as Judis, which I don't know that reference, and Wifu, which I do know that reference, was arrested by Canadian authorities about like a week and change ago under an arrest warrant issued the request of the United States. He appeared on court yesterday at time of recording as part of an ongoing extradition proceeding where he's going to be. sent down to the States. To do with his role in all of these hacks we're talking about here. It started in like April 2024. He goes after Snowflake, it goes after AT&T,

goes after Live Nation, owners of Ticketmaster, who we've talked about on this show before. We talked about their data compromise. I wonder if it's not this data compromise. Pretty sure. Connect the dots. Mandiant,

who's owned by Google, was hired by Snowflake to investigate and reported in June that these compromise login details. which were obtained through an infostealer malware were used to gain authorized access, and they worked their way back to Alexander Connor Muka, aka Judish, aka Wifu. Wifu, Wifu, Wifu, Wifu. Yeah, and apparently if you refuse to pay it, he brokered it for sale.

He was partnering with a Kipper Phantom, somebody probably on the dark web, who was then selling it, which is where I'm assuming all the Taylor Swift tickets might have come from. I was recently booking some travel. This is a total aside as part of like a work project. And we were looking at dates and we couldn't figure out why there was like a day, two random days in the middle of the booking where the prices of everything quintupled. Like no word of a lie. Like hotel prices went from like 200 bucks in that neighborhood to like $1,000.

And we realized we're in, Taylor Swift is in her screwing up our travel plans era. And that there was a concert in the city that we were going to on that one particular date. And the economic impacts of it were truly devastating. We literally changed the dates as a result to it. I'm sure that's not why Alexander Muka went on this hacking tie rate to try and reduce our travel costs. Nor would I want them to. I have no beef with Taylor Swift.

Anyway, Canada, extraditing this fellow down to the states for his role in these different hacks. It was a real spree. He didn't shy away from the limelight. This was a lot of hacks in a very compressed period of time. Hey. In all honesty, like we could, I don't know if we need to have a conversation about it, but like I feel like that's probably not a bad option. Like rather than, I feel like you, as you commit cybercrime, you converge to arrest.

and the longer that you are in... Yes, I see what you're saying. You were in market as a cyber criminal. You're converging faster and faster to arrest. And I feel like if I were to be looking to get in, hit a couple of dingers, and get out of the ballpark before anybody knew, I'd probably be doing the same thing. So strategically, cotton, getting in and out, you know, high style.

Totally. It seemed it honestly like it was kind of going okay. until Snowflake hired Mandia. Like it seemed like it was kind of working, but it's like we discussed with Batiste in the most recent episode that went live. If you do this for long, you put it very well.

You converge towards arrest. It's not inevitable. And there are certain contexts in which it might not necessarily happen based on where you live. Yeah, yeah. But all things being equal, you are just,

you sort of converge towards getting got. Well, the thing is too, like we met a lot of the mani guys at DefCon and they all seemed very capable. Yeah. That's true. I forgot about that. Yeah.

And yeah, they're not people. If you're any kind of recreational hacker that found a security vulnerability, they're probably, you're probably unprepared or ill prepared for the sophistication of the people on the other side of the table. Yeah, it's a fascinating one. I'm curious to know more about the process of candid. to extraditing to the states for cybercrime. Like, I'm just curious to understand the mechanics of how that works. It just seems interesting.

I feel like it's the same way it would work if you were like a bank robber. That's true. They probably put you into a plane and fly you there. And fly you there. And they arrest you when you land. You're probably undersecured like convoy to get there. You get out of the plane and you go right in the back of a different armed police vehicle. Yeah.

And they shuffle you off to a different prison. Did I tell you, we'll wrap up here, I'm not sure if I told this on the air or I just told you off air. Did I tell you about the time that I landed on an airplane and that happened? No. Not to me, obviously. Yeah, yeah, sure, sure, sure. I'm calling from a secure location. This is good Jordan?

Instead of chaotically evil, Jordan. Totally. I landed, I don't even remember where it was, but I remember landing and the plane landed and taxied in. And the gate connected, you could see it through the window. And then we just sat there for like a weirdly long period of time. Someone came on over the intercom and said, sorry, we're just working through some stuff. Just hold tight everybody.

The seatbelt side is still on. Someone stood up to go to the bathroom and they came on with a real sense of urgency. Like the seatbelt sign is still on. You need to sit down. And everyone, it's kind of a weird vibe, starts to emerge in the plane. Look up straight down the aisle and like four plainclothes dudes are just walking very, seriously towards me or down the plane and they walk up to a guy and they have a very tiny little conversation and then I see the um the police badge on the metal chain inside the coat get popped up

and they gesture for him to stand up and the guy stands up and he has his hands above his head and they just like get his bag out from from the overhead cabin and quietly walk him out and there's this long pregnant pause and the flight attendant comes on the radio after a second and goes well okay we've arrived and it's like giant weird and everyone just like exhales a couple of people laugh and we start looking at each other um yeah so that does happen um all the time and i never did figure out who that person was i was never able to work out person arrested because it was if i remember right an international flight it's probably some it's probably i would say it's probably something insanely boring yeah like it was like they failed to show up for something

And then there was all of a sudden there was like an arrest warrant put out for them or warrant for their arrest. And then they like moved to Russia for 13 years. They came home for a funeral. It was a flight from Russia. It was a flight from Russia. Was it actually? No, it wasn't. But like, you know, they came home for like a funeral or a wedding or family.

And they hadn't thought about it in a decade. And then literally they're just like, oh, yeah, right, you're still a wanted criminal because you failed to appear at some, you know, justice proceeding. Yeah. He had a look of, he didn't look surprised. That was the one other detail I remember. It wasn't like, what's going on? I know nothing about it. A giant bag with dollar signs on it.

I've never. Like there was none of that. It was very like, Hey Ricky, hey Alan, hey Doug. Hey guys. All right. Come on. Like it had a real sense of familiarity to it.

I don't know if I'm projecting, but that was what I saw. And maybe that's happened here. I think that's another one. I think that's another one in the bucket. Goatsey amnosis, McDonald's ice cream machines. Apple's very good bug bounty. It was a fun one.

Snowflake. And the Canadian, the Canadian hackers. And the Canadian hacker. His chaotic evil twin must have been because Canadians are all, you know, neutral good, if not. Neutral good. Yeah, we would never create meme coins. We would never create an AI specifically test. with creating meme coins that we will lie about not having any holdings in.

That's another one in the bucket. Thanks again for listening, everybody. And we'll catch you in the next one. Take care, everybody.