Hacked - Crypto Mines in Crawl Spaces + Youtube as Infinite Storage +Voice Biometrics Aren't Doing So Hot Right Now.

Episode Date: March 16, 2023

A chat episode about the a teacher who allegedly built a crypto mine in a school crawl space, researchers using Stable Diffusion to read MRIs, the state of voice biometrics, a credential stuffing attack at Chick-Fil-A and whether their sauce is gross or just gross looking. Learn more about your ad choices. Visit podcastchoices.com/adchoices

Give this a listen. Do I listen to this thing? Yeah, give it a listen. The quick brown fox jumps over the lazy dog. The quick brown fox jumps over the lazy dog. What do you think that is? You want, it's definitely generated. Okay.

Listening to it over and over. Give me one sec. The quick brown fox jumps over the lazy dog. The quick brown fox jumps over the lazy dog. It's kind of interesting. The quick brown fox jumps over the lady dog. It sounds like a shitty microphone, which is interesting because I'm assuming it's generated because of the artifacting in the ends of the words.

Okay. I'll listen to it again one sec. Give it more and more pass. The quick brown fox jumps over the lazy dog. Okay. What's the question? Hit me. So I wanted to check in on this state of voice biometrics and see how they're doing.

In light of all the big leaps, AI has taken over the last little bit. Okay. And I wanted to try out some of the tools that have shown up in the last, say, six months to a year. Last time we did a deep fake voice episode was almost two years ago. What's changed, right? Yeah. And in the process of doing that, I ended up asking a very, I think, unsettling question, which is what happens when you start to lie to these systems?

Specifically, telling it that you're training it on one voice when you're actually training it on two. I was going to say, it sounds like layered voices. That was actually going to be the next thing I was going to say. So what if instead of giving it, say, five minutes of me talking, I unmuted your track. Gave it five minutes of us? And gave it five minutes of hacked podcast talking. So wait, this is a hybrid of us? This is a robot that thinks it was listening to one person but was actually listening to us talk and it produced this voice out of that.

Give me one second. I got to listen to it again. The quick brown fox jumps over the lazy dog. You know what the weird thing is, though? It's like I can hear bits of my own voice in it, which is why I was like to tweak, but it doesn't really sound like you. You know who it actually sounds like is Moe from our office. Interesting.

If you listen to it, like maybe it's just me. You hear a little bit. Yeah, it does sound like someone I've heard before. I think I must have like listened to a podcast that sounded like this. I almost called him this guy. It's not a real person. It's made up. I don't know what it is.

It's an AI creation based on us. It's based on us. It's based on us. So if we were to have a voice child, your silky, beautiful voice and my terrible nasal voice becomes this voice. It is the son of hacked. The son of hacked. The son of hacked.

Wow. Can we just feed it a script and have it recorded entire episode? On a long enough timeline, I think, it could take over for us. Yeah, I think so. Let's go. Let's go. So I think we talk about that, the state of voice biometrics. I think we talk about a Massachusetts teacher that is facing charges for allegedly building an elaborate cryptocurrency mining operation in the school where he worked. Allegedly. Allegedly. And a new game that I'm calling, where would you hide a clandestine crypto mining operation given your circumstances.

It's like a new road trip game. No, it's going to be like the geo-explorer. Like it shows you an office building and you have to like, jump to somewhere where you would hide a crypto op. Yeah, totally. Pretty good game. Well, because we're going to talk about teachers, I figured we'd talk about some ransomware stuff in schools,

you know, some real depraved stuff where like, you know, you're holding records on at-risk children for a rampant. some. So I'm going to take the less fun version of the teacher stealing electricity to make free crypto and go and go dark. School crimes of varying degrees of fun. And then I want to talk about people, so people have taken stable diffusion and MRIs and slammed them together. And it is pretty remarkable. So let's talk about all of that here on this chatty episode of Hack. Yeah, how are you healing up?

How are you feeling? I feel back to one hundred. No, I'm like a hard 68. Specific. I'm at the point, yeah. Like, I'm not quite 70, but I'm not far from it. Like, I can get up and go do things again. Like, I'm resuscitated to the point of functioning.

I'm just not functioning at the point of exceptional, you know? Maybe by next episode. So I think I'm in that. We're going to get to watch you here. heel essentially. Slowly but surely, slowly, slowly, but surely. So where do you want to start? I kind of want to start with the YouTube hack.

I mean, I kind of want to start by thinking just the best dang Patreon on the internet. You know what I mean? Oh. Oh. I think that's where I personally want to start. You're the real. You're the real. You're good at this.

Like, do you want to thank Devin and Will and Ben? You know I want to thank Devin and Will and Ben. Reed and Jill. But don't forget about Namclaw. Davey, Brian. You're going to forget about Namclaw? That would be like forgetting about Gordon and Sulus. I would never forget about Namclaw.

Which is almost as bad as forgetting about Robcast Bobberton, whose name I had never said out loud until this moment. Robcast. And have a lot of appreciation for her. You mean Rob, Robberton cast? Robcast Bobberton. And Kelly Fitzgerald, Matt. The one and only.

John, we've had a bunch of people kind of flood into the Patreon and into the Discord. And you've got to say, you know, we love you all as much as we love the rest of our patrons and other people we hang out with. I promise I will post a photo of my computer setup at home to go with the rest of other people's computer setups. Get your rig in there. Let's just say that there's a little bit of chaos on my desk right now that I have to deal with. So mostly cabling chaos. I'm more ashamed. I have, because I have two computers on my desk.

One's a Mac and one's a PC. And I have them audio bridge and I have them like a bunch of stuff. So I have spit-if cables running between them. And like I just have so much cabling that I'm ashamed to post a photo because I will be judged severely for how much cable disaster my desk is. My desktop tends to look, I'm quite proud of it. I think I've laid it out quite nicely. I think it's a good looking desk.

And I was kind of like fawning over it a little bit the other day. And then my, my partner just like dunked on me. She's like, yeah, it looks really, really good. What about under there? I was like, oh, that's just the bottom of the desk. It doesn't matter. She's, no, how's it going on right under that way? And it's just cable hell.

I have a big desk. I have a lot of cable. All right, Scott. And the underside of my desk is amazing. Like I have coiled up double-sided taped. So like there's switches and power bars mounted to the bottom of my desk. Like every, like I spent a day setting on my desk when I first got it. And then I added some more stuff to my desk.

And then you had a little bit more. Interlink my computers for audio connections. And I wanted to do like a few things. And then all of a sudden there's just a pile of cables that aren't dealt with under the desk. and then you have to rip everything apart and redo it all. And I just don't know if I'm there yet. Like I've got too much to do. And I'm not bored enough that I want to spend seven hours recabling my desk.

So maybe what I'll do is I'll take all of the cables off of my desk. Like I'll unplug everything, take a photo, and then digitally put on backgrounds on the monitors and stuff. So people can see it and I'll post that and be like, look at how beautiful this is. My shit's impeccable. Exactly. If you want to join all that fun, support us over at hackpodcast.com, which redirects to our Patreon. And for context, we are recording this pretty early, recording this on March 6th. So if you have been kind enough to support us after that point, but before this episode goes up, that is why you're not included in this list. It's a really well-organized, legible list. But we'll get you in the next one. True, true, true. Okay. Can we talk about YouTube now? Heck yes, we can talk about YouTube. I'll talk about YouTube all day. What do you want to talk about?

I just, this, this story of the people using YouTube as a storage facility, I love it. Like, it's just, it makes, like, when you're encoding binary data into video frames and then just, like, dumping them onto a free video platform. Granted, you're like, just, like, I guess you could encrypt the data, but, like, it's kind of brilliant. It's incredibly, it's super fun. So the story here is a username Dvorak Dwarf, which is a really, really good. That's a fantastic username. And for everyone that knows about Dvorak, I know a guy who uses Dvorak. I had to Google Dvorak to remember what Dvorak was.

But in any case, Dvorak Dwarf posted this like proof of concept essentially of how to encode binary files into video on YouTube. Interestingly, it does make the file size bigger. I think it makes it four times larger than the original file. but it does allow you to post data for free on YouTube. You just have a monstrous, like instead of paying a Google time subscription, you just need a piece of software that can retrieve, because you're getting, I don't know,

it's like a, it's like a fun hack. It's a super fun hack. No, it's not. I mean, I just want to remember, Devorik is the weird keyboard layout, right? Devorak is the weird keyboard layout. A good mutual friend of ours uses it or used it for years. And every time I would try and,

Let's give him a shout out. Logan uses it, our friend Logan uses it. Our friend Logan uses it. And every time he would, any of us would go to type on his computer, type anything. Be chaos. It's just madness. Like the button has a letter written on it. And when you hit the button, not that letter. I feel like, I feel like, I feel like Logan's at the point now, though, that with Tivorak, I imagine most Tivorak users are probably also mechanical keyboard nerds. And they probably reconfigure their keys. Like I would. Sure. reconfigure it to Dvorak. So like at least you know when you hit you hit the A button, you're getting an A button. Yeah, exactly. Yeah, that's pretty good. Yeah, that's a really good call. I wonder, I wonder if you can get Dvorak key caps.

He must be able to. I mean, it's the same key set. It's just have they shuffled it around for you. Well, but, but the keys have different, the keys have different slopes, right? Like, that's the big thing with key caps. If you're a mechanical keyboard nerd, which I, which I'm, which I'm, that's true. Your J needs that little bump. The F needs that little bump.

But it's not just that. It's actually, if you. take all the keys off and lay them, there's a profile to your keyboard for how the keys function with the layout of the keyboard for reaching and sloping and angles and stuff. Like if you're a keyboard nerd, which I've now exposed myself as being. Yeah, gotcha. You'll know this. So there must be devoura key caps. And if Logan doesn't have a devouraic keyboard, I know what I'm getting for a wedding friend. So in order for Dvorak Dwarf's hack to work,

and I was curious about this when I read the headline, is that I know that YouTube's compression is not only pretty severe, but kind of constantly changing. So this is a really interesting question of how do you do this in a way that YouTube's compression isn't going to just result in a bunch of data loss.

The quick sort of early solution at this point was just make sure that you're not using any RGB. This has to be entirely black and white pixels. The blocks have to be of a certain amount, like certain kind of size. It's not totally clear at this point if this method is going to violate YouTube's terms of service. So there could be a situation where if this reached like became a thing people were actually doing where YouTube could basically just apply stronger compression to corrupt the data stored inside of these staticy data storage videos. It's really, really cool and interesting. Well, the way that they've done it is, I would say, is very, what's the best way to describe this?

It's very low efficiency. Yeah. Like the size of the blocks and stuff, like to ensure that it doesn't get corrupted away. Like you could do this so much better with actually just saving the data. But that's missing the point entirely. Exactly. Exactly. is that it is. It's just like black and white squares that represent binary things, like

laid into frames per second, laid into a video. And you can probably build in some form of parody check in it and things like that to rebuild corrupted data if it were possible. Like, almost use like a like a raid algorithm across different YouTube videos. But anyway, it doesn't matter. It's still a cool thing. Like a happy hack, something neat and fun that people do. And I, you know, I think it's a good story to kick us off before we get into. holding at-risk child information hostage? Hackaday when they posted it, they brought up an episode of a podcast they did

where they experimented with baking information into the audio file, which sent me down a reading rabbit hole of the technique that they used there, which is something I had never heard about, which is called the Kansas City Standard or the Byte Standard. I'd never heard about this.

It goes back to 1975 and is like the foundation of storing data on tape. Incredibly interesting. There's, like, what we're talking about weird hacks,

there's actually like a for-profit hack that's like this. Hmm. Like, you're an audio guy. Have you ever heard the term MQA? MQ.

Does this ring a bell? No, it's not. Master's Quality Audio. Okay. Anyway, so, so like,

titles, high-fi subscription and stuff like this, like, you know, there's like different file types and bit rates and all the rest of this stuff.

MQA, what they did is they took the inaudible space inside of, like, the way that, like, there's all this frequency that humans can't hear, right? So our audio file still encode it. So there's, like, most people can't hear above 17,000 kilohertz. Like, dogs can and, like, bats can. Yeah, sure. But most humans, like, over, over. Over 20K is like you'd have to have super ears to hear it.

But the file is still encode to like 48,000K. There's empty room and moving back. Yeah. Huh. Exactly. So what MQA did is said, you know what? Let's just, and I'm by no means an expert in this, but this is the way that I understand it. So if I'm incorrect here, please rib me on Twitter.

And I will apologize. But they've taken inaudible space and they've used it to essentially boost. boost up the resolution of the audible space without changing the file size. And that's like the big. So when we're talking about like compression types and using things kind of in a non-traditional way, that's that's kind of what this dynamic is. There's a big argument about whether it actually increases the quality or decreases the quality. And there's a bunch of people that hate it because it's created by a company and they charge licensing fees.

Right. There's a whole political aspect around it that I don't want to get into and don't rib me on Twitter about. But anyway, just an interesting way to look at a problem and solve a problem by just looking at outcomes rather than the input. Is it better or worse than the 300 bits per second I can store on tape using the Kansas City standard? Because I'm a traditionalist. I like that old school Kansas City standard sound, you know? So can it beat that? I feel like the Kansas City sounds is more of like the DSD.

in audio, direct stream digital. I don't know if you know what it is, but it's essentially a format used to preserve and encode like audio files. And DSD files are monstrous. Granted, they're essentially bit perfect or they're supposed to be like pretty close to it, I think. But they're, they're massive.

Like you're talking about like, I think I've got a DSD album and it is multiple gigs for like one album. Interesting. Well, find this episode of Hacked stored as thousands of static frames on YouTube. There was a comment that I really liked where someone said, like, this looks so much, they were talking about the data that had been encoded using the system on YouTube. And they said, this looks so much like TV static.

It makes me wonder, what if there are clandestine analog TV stations broadcasting, quote, static that's actually data? And I love that as like a spooky sci-fi concept that all the static just that you can pick up on a TV is actually some data being broadcast from somewhere. I'm like that's some some quality, spooky past or whatever those are called. R-slash-no-sleep stuff. I'm here for it. I was going to say that's like an R-slash writing prompts. Totally.

That's what it feels like to me. Yeah, it's great. And you finally crack how it's been, how it's been encrypted. And it says some stuff. So where do we go from here? We could talk about chick-fil-A. You know, we had a long, lengthy conversation of a chick-fil-A before we pressed record.

I tried it at Christmas because we're Canadian. We don't have it, but I tried it at Christmas. And the obsession with the chick-fil-a sauce. Well, you said you love it. I'm going to mix it. I'm going to mix it at any reason. I say this, but it disgusted me. You're not here for it?

The chick-fil-a sauce. It just looks so unhealthy. Like it just the the glimmer to it and the shine and the like just the way it moves. The way it moves like natural sauce. Yeah, literally, literally. It's just of its own accord. I just, I'm not there for it. I'm sorry.

I'm going to get roasted because I know Chick-fil-A is like a loved institution of the States. But I Google image this sauce because we talked about it for for a minute before we started recording. It's a shade of yellow. I wouldn't say it's a shade of yellow. You see often in nature or food, but it's certainly a shade of yellow. Yeah, the soybean oil base really gives it a texture and a dynamic that feels unnatural to me, which therefore makes me not want to eat it. I will say this, when you do put it in your mouth, it does taste good.

I mean, you buried that leaves that it's actually delicious. This is all aesthetic complaints. You don't like the way it catches the light. But in terms of putting it on a chicken sandwich, you're like, I'm here for it. Yeah, yeah, yeah, yeah, yeah. Well, like, but like I'm a, like, who doesn't love a good honey mustard?

Sure, sure. Like, I even make my own honey mustard with just honey and mustard, and it's delicious. The Chick-fil-A sauce is like essentially a kind of a honey mustard. And it is, it does have its own sweet, salty, insane taste. but I just aesthetically, I'm a texture guy and I just can't do it, you know, like textural foods. Like if it's, I can't eat oatmeal. Like I'm telling you guys all something about myself right now, I cannot eat oatmeal.

The texture of it's just too slop, too slop-like to me. I can't do it. I rock with some oatmeal. Yeah, I really rock with oatmeal. So presumably now your information regarding this, this sauce order was part of the compromise that occurred on December 2020. Yeah, yeah, yeah. In which Chick-fil-A users' accounts were stolen in a credential stuffing attack.

I had to kind of reacquaint myself with this. Credential stuffing, Blooping Computer reported on this. It's essentially just we're going to go find a bunch of credentials in some other data league, something entirely unrelated to Chick-fil-A. We're going to buy a bunch of credentials, emails and passwords, and then we're going to automate a system over here. Exactly. And we're just going to, maybe you use the same email and password combo on Chick-fil-A's user profile, whatever it's called.

I don't know what their point system is named. Maybe you use that same combination there that you used over on this site over here that was compromised in a breach. Which is maybe the single largest reason to have a password manager. You know, let's leave last pass out of it. I know we talked about talking about it more because it seems like it's just a never-ending story. but but like that's the I would say it's one of the largest reasons to have a password manager like in the problems with password episode that we did like five years ago that's like the big thing that's changed now is like people are hacking your like I got a notification from like do you remember

Evernote do you remember that service oh yeah yeah I do I used to use Evernote a ton in like 2010 and I got an I got an email the other day being like hey your password request is in and I was like, excuse me? Like, I don't think I've logged into my Evernote account in 10 years. Huh. And so I logged in, changed my password, set a two-factory authentication, and just moved on with my life. But somebody clearly credentialed stuff me probably off of some hack to some old system,

and I had to use the same password. And anyway, so it's just, it's, yeah. Can you imagine what would have happened if you'd use those same credentials for your Chick-fil-A account? Oh my God. I will say, let's just talk about Chick-fil-A here again, is, so the lineup was ridiculous. Not about the hack, just about the shopping experience at Chick-fil-A. I, I, we got to talk about this.

This is, there was like four lanes of drive-s. Oh, wow. They have like an Uber Eats and like, skip the dishes, kind of like, flying out the door. They have their own lane in the drive-thru just to pick up takeout orders for delivery. Anyway, it was like, I wish I owned Chick-fil-A after seeing the operation and like the school buses of like sports teams showing up and like waiting in line for food. Huh. Well, they're moving units of sauce too and it's clearly just soybean oil. I mean, profit margins must be high.

You know, I'm going to make an economic argument for why you should have a Chick-fil-A account even after the hack because the lineup was massive. But then I was noticing that people would like walk in, walk up to a little desk and grab their bag and leave. And if you ordered from the app, you could skip the line entirely. So there were people that were in line with me who were downloading the app would buy and pick up their food before we'd move like two people. And I was like, this is why you have a Chick-fil-A account, even if it gets hacked. There's the value right there. Well, that about covers this, this hack of this account and why this account rules. That about covers it for this month.

Take care of that. Catch you on the next one. It is a pretty quick turnaround on, so Christmas 2020, bleeping computers email, bleeping computer emails chick flay about reports of an account breach January 2023. They say, we're looking into it. Meanwhile, there are telegram channels showing people, purchasing these accounts and sharing their purchases made through these purchased,

these stolen Chick-fil-A accounts. And then in February 12th, 2023, Chick-Fleigh confirms there was a credential stuffing attack that happened over the holidays. 71,473 Chick-Flea accounts hacked. Personal information, including name, email address, your Chick-fil-A-1 membership, which apparently is the name of this program, your mobile pay number, your QR code, a masked version of your credit card and the amount of Chick-fil-A credit on your account, if anything, may have been accessed by these actors.

So in the screenshots they provide, you can see the different accounts. And it's like, by this account, it has a $2,000 balance on it, pay $200 for it. In Chick-fil-A points, essentially. It's 10 cents on the dollar. But like, could you imagine, I don't know if it's, well, let's a whole different conversation about if you had $2,000 with a chick-fil-A points. But like, let's not get into that. But a $2,000 balance inside your,

they must have, like, charged the visa to add gift certificates, I would assume, or something. And then before the visa got canceled and the account got canceled or something, but, you know. Right. I thought you were saying that there were $2,000 worth of whatever their points were, which would then evoke the chilling math

of how much money do you have to spend at Chick-fil-A to get $2,000. thousand dollars. No, no, no, no, uh,

and I was going to crunch that math. But yeah, okay, I hear what you're saying. We're intentionally, we're intentionally avoiding that. Let's not, we're not having that conversation.

We don't need to know that number. We already heard what happens when an AI slams our voices together. Enough love crafty and horror for one episode. Thank you very much. Oh, man. Could you do, I don't know,

whatever. I assume it's got to be one percent. So that means you're like one or 10 percent. Let's hope 10 percent. So to get $2,000 in points, that means you've spent $20,000. At 1%. At 1% it would be $200,000. And if you've spent $200,000 at Chick-fil-A, wow.

Wow. You really do love that yellow, yellow sauce. Chick-fil-A forced a password reset. They froze all the funds. Did what you'd expect. But it is a good reminder from that problem with passwords episode. Hey, even in like seemingly very, I would say low concern. accounts, not to editorialize the value of a Chick-Fleigh account, but even in those, do not reuse

your passwords, try and have something unique for each individual one, because that eliminates the concern of credential stuffing, which is still a very viable tactic that people are using. Oh, a million. Like that, yeah, a million percent. Let's stay on the light side. Let's stay on the light side of life here. I was creeping on crebs the other day, just to give them another shout out, Krebs on security. And apparently, Hulu has commissioned and is soon to releasing

a documentary series about the Ashley Madison hack. We'll watch. Which they've called the Ashley Madison Affair, which I think is an appropriate name, given the fact that, hey, oh, Ashley Madison was there to have affairs. But yeah. So I think that's just like an interesting pop culture rip on,

I feel like that could be a hacked production. Like hacked makes a, like we make documentaries. I don't know if people know that, but Jordan and I've made some videos together with some friends of ours and colleagues. I feel like that's something that we could have done very well. Maybe we should, maybe we should have done a doubt. When we're not making video games, our video game podcast, talking about hacked and working

our day-to-day jobs, we should be making Hulu series for the Ashley Madison affair. Apparently, yeah, I feel like there's a lot of hunger for hacky, scammie, grifty content right now. It's kind of in the air. A bunch of the stories we've talked about over the last six months are in some stage of active development. There's a real hunger for it. And I'm just really happy to see Brian Krebs in everything. I put him in all of your movies about cybercrime. He's great.

That, yes. Absolutely. Yeah, you love to see it. Yeah, absolutely. Razzal Khan and Dutch episode we did. They're making that into like five different shows. Beautiful. Beautiful.

Do you know what I've seen in, remember the episode we did about the crypto queen? Yes. Wait, the one coin episode. or the Rouselcon and Dutch episode. Yeah, yeah, yeah. No, the one coin episode. I... Are they making that one into something?

I have a memory that I read an article, like a month ago, that they are making that into something. Oh, no, they are making into something. I think we talked about that in that episode, actually, but it was early. Oh, did we? I think we might have. Hmm.

Mm-hmm. Mm-hmm. I feel like it was a dramatization, though. Like, it wasn't actually a... Oh, a docu-s series. It's not a docu-series. I feel like I've read that it was actually being made into a real show. I mean, it makes a lot of sense.

They're interesting stories. Like, oh, yeah, the double whammy. We can leave it there. I'm not sure if I'm making that up or if I read that late at night, one night laying in bed trying to fall asleep. Why don't we kick it over to the old commercial break? And when we come back, we'll talk about crypto minds in crawl spaces right after this. Think about the last time you heard a breach story on this show.

It always starts the same way. Someone, somewhere, saw something too late, an alert buried, a signal missed, an SOC that just couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already using AI. They created the Aurora Super Intelligence Platform, a fully agenetic system powered by the swarm of experts. Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy. And all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than 9 trillion telemetry events every week and over a decade of real-world incident response.

The system reasons on real signals and real context not synthetic training data. And the result is the new Aurora Agent SOC. It's the first SOC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts. Arctic Wolf didn't try and bolt AI onto an old model. They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience.

The team brings customer-specific context directly into the platform so every AI driven decision reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy, production-ready AI and security operations actually looks like, go to arcticwolf.com slash hacked. Never feel like cyber threats are evolving faster than anyone can keep up? Last year, 2025 was nothing short of a record-breaking year for major breaches, from sophisticated ransomware operators to AI-enabled attacks that turn defenses on their head. Organizations around the world saw headlines they never expected and cybersecurity teams

were tested like never before. But here's the thing. These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th diving to the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded. And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights into how threat actors are evolving, how defenders are responding,

and what strategies can help you stay ahead of the next big breach. It's not fear-mongering. It's practical, actionable, intelligence from experts in the trenches. Register now at arcticwolf.com slash hacked. So I don't think you understand the gold that you just outrode us on there. Crypto mines and crawl spaces. a new docu series by Hacked Podcasts.

Oh, pretty good. Coming to Netflix this fall. Oh, pretty. I'm, uh, where do I sign? Where do I, this, this shark is interested in investing.

Yes, I'm here for it. Um, I feel like that's, let's in Netflix. Yeah. We'll take the meeting if you ask, but,

you know, only if you ask. We're not going to come. We're not going to, we're not going to come for you. Uh, mm-hmm. Uh, mm,

disagreed. I just, I just, just, just, joking. Please let us in. I'll camp in front of your building.

Let us inside. Please. We'll buy you lovely dinners. All of the Chick-fil-A sauce that your heart desires, we will show up with it in a big pillowcase. Yeah, Cryptomines and Crawl Spaces. I feel like that's probably at this point. A pretty, like, thriving genre of story.

And there was a very interesting one that kind of sort of came to a little bit of a head this months, Massachusetts authorities first discovered a very unusual electrical something going on, somewhere in the Cohasset High School. And it was announced this month that Nadim Nahas, a 39-year-old teacher, has been arrested in relation to it. It was a very weird one. You'd read about this before the arrest and the announcement of who had kind of been charged with this when it was just a school found some computers that were being used to mine

cryptocurrency. Yeah. You learned about this before we knew kind of. to worry this was all gone. Yeah, the first time I saw this story kind of flowed through my timeline, it was like, they'd found this. Like they'd, somebody had gone into a thing, saw something, the IT person was like, oh shit, I know what this is. They brought in external investigators, but I don't think they had figured out who it was. So it's interesting that it turns out to be a teacher. I just assumed it would have been like one of the IT staff or something, but,

but essentially, somebody had figured out how to leverage, public power and turn that into money or I guess into crypto which you know arguably can be turned into money so it can be turned into money depending on what day of the week it is yeah yeah so the town's IT director calls the cops saying there's a weird computer rig doing something or other in the school they contact the U.S. Coast Guard investigative service and the Department of Homeland and security, which is quite the escalation, but they swoop in and they figure out what allegedly this teacher kind of was doing. And this really just comes down to, so the coverage of this spoke with a guy, a crypto expert, who said that the reason something like this

might happen is because the cost of electricity in New England is prohibitively high. And so this can't be done efficiently at home, which is a wild way to understand what occurred here. It did lead me to go down the rabbit hole of researching whether or not Massachusetts does have expensive power and whether it would be a good place for crypto mining and crawl spaces. And the power there is very, very expensive. Yeah, fifth from the top. It's sandwiched between Connecticut and Oklahoma, a very expensive place to try and mine cryptocurrency, not a good place to do it if there's a good place to do it at all. A little bit of petty electricity thievery. And next thing, you know, you've got a semi-profitable business off the cost of the public tax dollar.

Completely. I always find this style of, like, crime, interesting and fraud, because it's like... Sure. Like, physical access to anything is insecurity, you know? Like, the... Like, this person just has access to the school. Easy way to get caught. Exactly.

They just have to run extension cords into essentially a completely vacant space that no one really probably like who knows how long it had been there. Totally. Like you probably started with one or two rigs. And then I think in the photo you can see that there's like 10, 12, 15 rigs. Yeah. But it's like. You're talking about cable rats nests earlier and it's really, it's quite the operation

he built out in there. Yeah. But it's like, I remember when I was younger, like before Wi-Fi security got really high and stuff, like you can build a like a wireless packet sniffing device and just like, walk into a public place and like plug it in and most people won't know what it is and it'll stay there forever like you can like places where the public has access to building things that look nondescripting can be like just set aside like these things look at crypto mining rigs but like you can imagine like if you go to build a small enough it looks like a land party in a crawl space

it's not inconspicuous but like you can imagine if you made these things look more like equipment and you just threw one. Sure, sure. If you just plug them in around, like most people would walk by them a thousand times and not even look at them twice. And it's like there's such an interesting, it's not social engineering, but it's like social norm engineering where it's like, you know, I expect, I expect to see office equipment when I'm in an office. So when I see office equipment in an office, it doesn't trigger my senses. Yeah, sure. So it's like if he, if they didn't put these,

or allegedly, if they didn't put these allegedly in the, in the crawl space and if they were made to look more realistic, it probably could have hit them in plain sight. Well, it raises an interesting question of how that IT person caught him because it could have to do with power demand. It could also have to do with whether or not he accessed the network infrastructure of the schools. Like was this thing lighting any?

thing up on the network side saying like, hey, there's a crypto, crypto mine in a crawl space. It's called crypto mine one, two, three, four, five. But then on this on the social side, like hiding it in plain sight, you wouldn't have what must have occurred here, which is this IT director at some point peeked his head into a hole in the floor and was greeted by a bunch of computers. Totally. Like that very weird, weird moment where he's like, I think I need to call the Coast Guard, apparently. I'm in the crawl space on my, like, I'm on land. I'm in a school.

I'm in a crawl space. I need the Coast Guard. It's very strange. I don't understand American legal system. I mean either, apparently. The Coast Guard is your first call there. I wonder if at the Coast Guard, they got that call and they're like, I know we're the Coast Guard, but we did just get a call about an illicit crypto mine in a school somewhere.

But the guy sounds nervous, so maybe we should. Check it out. Yeah. This teacher who was allegedly responsible resigned from their position at the school in early 22. A criminal complaint was issued against him for fraudulent use of electricity and for school vandalization. The vandalization charge is very interesting. He was scheduled to appear in Quincy District Court for his arraignment this past month.

The reason we're hearing about it now is that he never showed up forcing the court judge to issue a warrant for his arrest. And that's kind of where the story is up until this point. Interesting. I wonder if he went full crypto con and he's like disappeared into the places with non-extradition treaties. Well, the one data point we are missing here right now is how much of it he mined. So maybe he had the funds to do that. Maybe he's a quiet billionaire. And Netflix, if you want someone to make a talk about it, just getting to touch.

Let's just talk about how they probably found it, aside from looking at the hole. Like, I assume power metering at the level that you know what's using it, especially in an infrastructure and at the scale of a school would be very, very complicated. Yeah, that tracks. Network access, I can definitely see. Like, because you would see those nodes on the network and you would see their network names and their Mac addresses. And you would wonder what they were. That would also, in an infrastructure the size of a. school with Chromebooks and iot devices like out to ying yang like you can only imagine the level of

detail that it would take to be unless they were named something like crypto mine one crypto mine two nahas's retirement crypto plan one yeah sure sure but it would be it would be it'd be it'd be tough i assume truthfully i assume it's just i shoved my head in a hole and i saw a bunch of computers whirring away and was like those aren't supposed to be here and called the police. It honestly could have been that that he just found computers. It could be that it wasn't even the IT director. Someone finds computers in a crawl space. The person they're probably going to go to is either the principal or the IT director

or one leads to the other. And suddenly you're trying to figure out what these computers are doing. This is an aside. For years, I lived in an apartment building. You know the apartment that I was living in. I do. After years of living there, I was, when we were moving out, I had a conversation with, like, the building manager.

We were talking about just the building and the experience of having lived there and the rent. And we started talking about how, I brought up how power was not included in my bill. It was factored into my rent. And he said, oh, that's not the landlord's choice. We can't tell. There's no individual power meters. on any of these units. We don't know how much any one unit is actually drawing.

The building's average is amortized out and it is charged as part of the condo fees. And I had this like brief moment where I was like, so you're telling me. I could have been mining crypto. I could have been running a crypto mine in the crawl space of this building this entire time. I was livid.

Not even in the crawl space. I rent apartments in that building. Just in my house. And they're just not even. Nobody lives in them. They're just. rooms full of crypto mines. Yep.

Because you had a lot of windows too, so you could just easily create like an air, like put some, intake fans on some and exhausts on the other. The thermals would have been incredible. Especially in Canadian winters. You could have just. Yep. Just hummed power into money.

Would it could have shoulda, man. What it could have shoulda. Missed opportunities. Yeah. And I can almost guarantee, too, that your lease agreement didn't stipulate that you weren't allowed to put a server reform and crypto mine in there. Yeah, I don't think, I imagine we're going to start seeing that in residential and commercial

rent agreement soon, especially ones that include power. Well, that was such an interesting story. Like, the province that we're both from has relatively affordable, in the context of North America, relatively affordable energy. Yeah. And that was why about four years ago, roughly speaking, there was a huge influx of entrepreneurs from all over the world. And their whole thing was we're going to identify jurisdictions with relatively

affordable power. And we're going to like air drop in shipping containers full of servers, basically. And we're going to boot up these little businesses. And you ended up with this very strange recurring story of very rural communities in northern Canada who suddenly there was like a weird worrying off in the distance. And it was that a giant server farm had just been like plopped into some farmland somewhere. and was mining cryptocurrency. And the second, you know, that math changed,

they would vanish and they would go off somewhere else. But for a while, that hit where we were from, like reasonably hard. Well, the funny enough, like south of us, medicine hat, because they have their medicine hats like a unique little town. They have their own like electrical utility. They got hit with that. And as well, the marijuana industry saw that as an opportunity, cheap cheap utilities.

So it's like crypto and and grove farms. We're like, yeah, cheap, cheap power. Like we're in. Cheap water and power? There's a fun parallel there in that the exact same story of a teacher was running an illicit operation in the crawl space of a school. I feel like in 1975, that would have been a little grow-op.

They would have found some little fun way to grow weed in some far off corner of the school and no one had to know. Exactly. Maybe a crawl space wouldn't work. because plants, but it feels like it's got the same spirit about it. You know, I remember when I was like really young, I remember hearing about grow ops being busted and the way that they caught them was power usage. Power usage, yeah.

So I wonder if like, I guess weed's legal in Canada now, but like I wonder if that really, like, when crypto farms were getting big, but weed wasn't legal, I wonder if there was a crosshold where they're like, hey guys, we got another growop popping up and then they go raid it and it just turns out it's like some crypto farm and they're like, oh, okay, never mind. And then they like the next one. It's like, okay, we got another girl up and they go raid it.

And it's like, oh, it's another one of those crypto things. Just like consuming so much power. Just swat teams walking out of buildings with their heads. Like, between like heads down all four lore and like just a bunch of dorks again. Making that. A weed in there. Bad stuff. Teaching bad stuff, school stuff.

Bad stuff. Yeah. So in the UK. That stuff in schools. Yeah. Classic ransomware, the Vice Society Ransomware group. You go to British school, and they were trying to demand a ransom. And in doing so, they started posting files about children on the internet as, like, a proof that they had it, saying, you know, pay our bills.

So not a positive story, but still in the education space. Not that having an illegal crypto farm is a positive story, but way, way less chill than having a legal crypto farm to like, you know, outing kids. Yeah, it's like the collision of two things that we've talked about before, which is the weird part of a lot of ransomware operations where they have to kind of, I think we've likened it to the part of a traditional kidnapping where they mail someone a finger type thing. Exactly. It's the part of the whole process where they have to show, here's what we could do.

a lot of the time it's not quite as sinister as the information that you were storing on minors. But it then raises another question we talk about a lot, which is like, be really, really thoughtful about the amount of information you just maintain ever. When you're that level of an institution, it's like how much info on kids do you really need to be keeping? I think it was from a panel of 14 schools. Highly confidential is what they're saying. So I assume it's, I assume it's childhood behavioral information. And the news reports and stuff clearly stipulate that it was about at-risk children.

So it's probably kids. Woof. Yeah, exactly. Kids experiencing issues. So it's definitely not good. Highly sensitive, highly confidential information about at-risk youth. So not, not chill. Not Jill and good.

Vice Society has carved out a little bit of a reputation in this space, apparently, largely going after health care and educational organizations. Agnostic to kind of where they've done it in Europe. They've done it in North America. As targets go, again, we've talked about this before. It's like I get why folks would go after health care. It's very high stakes. There's a huge incentive for people to pay. there's relatively, relatively large coffers.

But it contains such an obvious ethical dimension that it's pretty, pretty not cool. When you've drifted over into educational organizations, you've kind of, I've lost the threat on what it is you're looking for here because that's not, you're not flushed with cash. There isn't that urgency. It just seems like you're kind of really picking the worst things to go after at that point, be like hospitals and schools. It's like, wow, okay. So ransomware. dot live a site that tracks ransomware attacks

has vice society is the number one education attacker in the field so they were like and by like a 5x multiple so they're like one of the biggest ones so the uh I'm also seeing I wonder if this is still up but they

they have a website apparently and it is based off of the grand theft auto vice city design Oh my god, is that the name? Vice Society? Vice Society. So it's a, I don't know. They are what they are.

Okay, well, let's balance out, one or two more things we could chat about here. Let's balance out some of those bad vibes from that Vice Society story. With the story that actually came out of our Discord user Bite Mantis, who I think also gave us the YouTube encryption story, shared some stuff about trace labs. In a previous episode, Scott, we talked about, I can't remember what the name of the group was, but they essentially functioned as like a hackers without borders type thing. Well, that's funny enough. That's what their name is.

Hackers without borders. Literally hackers. I wonder why that was in my brain for some reason. You nailed the memory recall there. You just didn't trust yourself. Wouldn't be the first time. So Trace Labs is this like donor funded nonprofit. They do open source intelligence.

but their whole kind of purpose for existing is to help find missing people. I've never seen anything quite like this. It's super interesting. And it's basically if you are interested in open source intelligence and you're interested in participating in some kind of big decentralized project on the internet to help do a little bit of good, it seems like a very, very interesting initiative. I just wanted to kind of put it out to people. We don't know a ton about it, but it seems pretty cool.

They're not going after bad guys. they're not doing that like no we're going to find them and take them down they're just trying to find people that are missing and then they report it on to the police and then they move on to the next one. You love to see it. It does. It does.

I think it's just going to be something we see more and more now that I think government, well like we talked about this in the Christmas chatty chat but like governments governments need to accept that cybersecurity is a thing and it's here and it's not going anywhere and some of the most harmful

thing, some of the most harmful behavior and policy that we're going to create is stuff that limits knowledge development in it because it's kind of like a, yeah, I don't know. But I say that, I was about to make a paradigm to gun control there, and I don't know if I want to go there. Because it's like, it's like, is the best way to fight guns with more guns. Maybe I've just caught myself in a moral quandary that I'm not okay with. No, no, Scott, an hour and one minutes into this podcast, I say take on gun control. It's like, yeah, yeah, yeah, yeah.

We're going to have cybercrime, so we need to develop better cybercriminals to fight the cyber criminals. Whoops. The only way to stop a bad guy with a computer is a good guy with a computer. Oh, no. Oh, no. Anyway, quick shift. Quick shift, pivot, pivot, let's go over here. The last thing I wanted to talk about,

there's not really even a big story here. It's a little outside of scope, but it was wild. I think it's incredibly interesting. Researchers at the Graduate School of Frontier Biosciences at Osaka University published a paper called Stable Diffusion to Read FMRI. What they've essentially figured out how to do, for anyone that doesn't know stable diffusion is like Mid Journey or Dali, a commonly used practice for AI image synthesis.

It is one of the more kind of open-sourcy ones. There's an official version of it with some controls built into it, but it is open-source. So there's people creating new versions and forks of stable diffusion all of the time. It's becoming kind of the workhorse of the AI image synthesis world. Very interesting stuff. These researchers went full mad science and figured out how to wire in images produced by an fMRI, so like essentially a brain scan, and they piped it into the

stable diffusion process to the point where they were able to show an image to a person who is inside of an MRI, scan that person's brain, take that brain scan, a 2D image that was produced, wire it back through a stable diffusion based process, and output an image. That image that outputted looked a great deal like the image the human user was shown. So what they essentially managed to do was reverse engineer what that person was seeing without seeing what they were seeing. Not to be kind of hyperbolic about it, but they kind of read the person's mind in a weird way if you think about it like that.

This is very dystopian sci-fi. I feel like we're knocking on that door. It's very sci-fi. This one felt weird to me. Like, I think in Prometheus, the Ridley Scott Alien prequel, there's a big plot point that involves a technology that is used to scan and essentially be able to view people's dreams. Oh, this is. And this feels kind of like that. Where it's like, oh, you're, you're seeing what I'm seeing without seeing it just looking at my brain.

Maybe. It's very interesting tech. Maybe you, maybe our age difference is showing here, but this is minority report. Like nailed. Yeah. Like, Yeah. Like,

Oh yeah, Minority Report's a good parallel too. Yeah, but it's like, like Minority Report was based on a story out of like 1950s. Like this is like some, some real true sci-fall,

like total recall. Like the, I could, I don't know. That's, that's crazy. Like imagine, imagine a world where,

like, and this is just me synthesizing this into like, weird talking. points and potential dystopian futures that we can turn into future Netflix series. Hit us up. Like imagine a world where like, you know, we all wear these biomechanic computers now, Apple watches, whoops, garments, you know, you name it. We have things on us all the time measuring our heart rates and our breathing and respiratory conditions and you name it. Imagine one that was literally

constantly monitoring our, what we were seeing, recording and monitoring what we're perceiving. Like how far away are we from that dystopian future? Where it's like when you do something or see something, bang, it shows up in the, uh, uh, like it shows up in a, a global database and is auto analyzed by a computer to be like, oh, this person just committed a crime. There was, um, there was a black mirror episode. It's pretty hacky to, to, to bring a black mirror in the concept of a dystopian sci-fi premise. But here we are. There was a Black Mirror episode where the sort of core mechanic of it was that they had the ability to plug a person into a thing that could visualize what they were remembering. The story was following a person essentially trying to solve a crime.

They could interview people, but they could put this little thing on their head and then watch on a little screen what they were remembering in real time. That feels very, very analogous to this because it's not just about seeing what you're actually perceiving. It's about seeing what you're imagining in your. head as a rendered 2D image. For now, it's a single 2D frame, but the speed at which we went from, okay, stable diffusion in mid-jurney can generate one static frame. Now they can generate 24 static frames in a sequence and you have animation. This is, you're starting to get a bit of a pipeline for being able to just sort of see what a person is imagining in their head. And the massive implications of that are certainly not unpacking this paper, but are really interesting

to think about. If they're releasing this paper and talking about this research, that means that it was done probably long enough ago that they are probably actively working on pulling memories out as animated sequences. Like, you've got to imagine it's the same parts of the brain that are creating, like if I'm looking at an image, it's, oh, maybe it's not. Maybe memory. Maybe memory. Memory Center is different. It'd be very interesting, but you've got to imagine that that's something that they're working on. Like if they have the ability to pull information out of your brain and turn it into a generated image. I think the, okay, so Lord knows I don't know anything about this. But I think the bottleneck would be the speed at which you could capture these FMRI images of the brain. Because that's the input that you're using to get the final image. So unless you could capture those. images at an animatable frame rate, like unless you could capture 12 of those bad boys a second, you're going to hit a bit of a bottleneck using this technique to be able to create like a stream

of video of what a person is picturing. Okay, well, I've got, I've got news for you. FMRIs run at a frequency of. Yeah, what's your frame right there? Oh my God, I'm finding conflicting data. So I shouldn't say anything. One says 100 hertz, which is like 100 frames. a second. Whoa. So, but the other one says 0.01 to 0.25 hertz. So I'm not sure which one is right, but 100 hertz is definitely enough to pull video out of. Hmm.

Wild stuff. Anyway, we, that's a, what a time to be alive. What a time to be alive. So lessons learned from this episode, find free public power set up crypto farms. Your voice is no longer a part of you. It's now property of the internet, especially when you put it on the internet like we do. We never actually talked about the voice story.

I only introduced you to Son of Hacked and never where that came from. Let's wrap up there. So Joseph Coxover at Motherboard Post this really cool story and video about him using some of the newer voice, free speech synthesis programs that are out there to circumvent Lloyd Banks' voice ID biometric service. So basically, he used this service to hack into his own bank account. Great, great story, great video. Ever should go check it out.

Lloyd's Bank's voice biometric security thing uses all of the standard language that a lot of these do. It talks about how your voice is like your fingerprint. We use all these unique characteristics and it can even recognize when you have a cold or a sore throat. Or apparently we have learned if you use a deep fake version of yourself. So what Joseph Cox did was he recorded a five-minute sample. of himself uploaded it to a product made by a company called 11 Labs and it generated this synthetic version of his own voice. Eleven Labs has been implicated in a couple of like kind of not great things that have happened online. Nothing that they did but people on 4chan using it

to create videos of celebrities saying all kinds of messed up stuff. Really the classics. Importantly, at the time that motherboard, all the classics. You've seen them on Twitter. You know which ones are talking about. Yeah. Completely. I think part of the reason this product was at the time really popular for those things. And this was still true when motherboard published it, though not when I went to use it,

was that for a long time, the entry-level version this was free. So basically with a burner email, you could do voice synthesis. And again, importantly, it only requires five minutes of speech for this to work. when we did our deep fake episode like a year and a half, two years ago, in order to get that fake voice, I had to upload 40 minutes of audio of myself talking. It took, I think, close to an hour for it to, like just to synthesize and process it into a usable voice. And then the amount of time it took between me typing, hitting enter, and it producing an audio file was on the scale of minutes. I wanted to try Eleven Labs product out to see how you could use it for something like this.

And it now requires five minutes. It was able to generate the voice within less than a minute, almost instantaneously. And then between typing and hitting enter, it's not quite real time, but a delay of less than five seconds. That's crazy. Which is how Motherboard was able to basically hold a real-time conversation with this voice authentication service and break into this bank account. You would need the, uh, the victim's birth date, but with the amount of breaches where that information's gotten out, uh, for a lot of people, that's pretty, uh, it's a pretty low barrier. Lloyd's Bank is not the only place that uses something like this. TD Bank up here in Canada,

uses voice print, use that same language. Your voice print like your fingerprint is unique to you. Chase Bank has voice ID. Wells Fargo has voice verification. Um, I think maybe for a little bit, maybe we put a pause on these. Maybe until we, we, we figure out this speech synthesis thing, maybe we don't consider voice biometrics as secure for a little bit.

Let's just, let's just pause that as a way of locking down an account. I'm tossing that out into the world. Especially for people like you and I, Jordan, who have hours and hours and hours of our voices on the internet. Mm-hmm. Maybe,

maybe I am not a TD account. Holder, so let's be thankful for that because I'm sure it wouldn't take much to generate my voice. No, I did it by accident. Like, it wasn't your voice. It was a weird. But you could have made my voice. Of both of our voices. But like I could have.

I actually, I thought that. I was like, no, it feels like if we're going to start developing cultural rules and mores around this, don't deep fake someone without their consent probably seems like the very first one. So don't accidentally do that for your podcast. podcast, Jordan, I thought to myself. As I created my new 2023 morality. Kind of like trying to write some rules at a dead sprint here. But I did feel like I could cross the line of, you know, playing around with the both

voices version. Yeah, that was weird. A child of us. It's cute. A child voice. Son of fact. Yeah. No.

It's good fun. It'll inherit this show from us at some point. The future will. have chat GPT write it will have son of hacked say it out loud we'll get music i'm scoring it with all the music we've already written for the show um this thing will just be on rails baby let's go let's go okay i think that's it youtube is infinite storage uh crawl space crypto mines robots can read your brain this crypto mines on netflix 2024 get at us chick flay sauce Thank you for listening.

We appreciate your time. We hope this wasn't too chaotic, and we look forward to seeing you in the next episode. Catch you in the next one. Ciao.