Hacked - From Street to State

Episode Date: August 16, 2025

We discuss the rise of China’s early patriotic hacking scene, and a new report that unravels how some of its most skilled members eventually found their way into more formal, state-aligned cyber operations. This episode is brought to you by Push Security. Check them out at Pushsecurity.com Learn more about your ad choices. Visit podcastchoices.com/adchoices

The story of Tandai Lin starts in China in the early 2000s. The internet was still new and confined to university campuses. But as is the case pretty much everywhere around the world where the internet was starting to take hold, that little bit of access was enough to spawn a whole generation of young self-taught hackers. But hacker wasn't the word. The etymology of this like Mandarin English loan hybrid word is a little bit above my head. But I think the basic idea is that if you take a version of the Mandarin word for red, which is Hong, and combine it with the Western word hacker, Hong, plus hacker, gets you hunker.

The story of Tan is the story of something called the Honker Union. The Great Firewall, which is China's like big sprawling system of kind of internet control, is already taking shape at that time. Foreign news sites, forums, Western tech platforms, they're increasingly kind of blocked. That's still true today. And loopholes existed then as well. Honkers would use proxy tools to access foreign servers, dig around for vulnerabilities, and importantly, watch how global hackers operate. It became a big part of how they learned.

And pretty quickly, a culture that's kind of unique in the hacking ecosystem starts to emerge. A hacking culture that's really centered around this very patriotic hacktivism. Someone does something to China on the world stage, and the honkers are there. They're immediately into the work of representing, not like a specific, individual handle or a hacking crew, but their nation in this newly emerging cyberspace. Inside the country, and this is obviously based on secondhand account, they're quite quickly seen by many as like patriotic heroes as opposed to like internet near-do-wells. Government officers are publicly praising their zeal and for years they operate in this kind of legal

gray zone. Not exactly sanctioned, but not exactly outlawed. But around 2005 something shifts. and the government shifts their policy towards the honkers union. If uncontrolled vigilante hackers were to continue operating unregulated, basically, they could and were becoming a liability. So instead of chasing them down, the state starts to recruit. Which is where we meet our main subject, a guy named Tandai Lin. He's 20 years old at the time, a grad student at Sichuan University, on the forums he goes by Wicked Rose.

And his footprint is really familiar. He's writing code. He's breaking about. hacks, he's digging around, he's learning, and importantly, he's blogging about all of it, very openly, about infiltrating like foreign Japanese systems. And that blog post gets noticed. Rather than getting in trouble, Tan gets invited to a People Liberation Army sponsored hacking contest, and he wins the whole thing. And in that moment, Tan is one of the first people to set off down this path that a lot of people around the world have since embarked down. He's sent to this

months-long, like, military cyber boot camp and goes on this road from becoming a university-aged hacker to a state operative. We're talking about this because of a new defense report out of Switzerland that traces the history of the honkers, these patriotic teens in 20-somethings in the late 1990s and early 2000s who started out as like independent hacktivists and who over the last couple decades have morphed into like the key architects of China's cyber espionage apparatus. Let's start there with the history of how the Honker movement morphed into one of the most powerful cyber espionage forces in the world here on Hacked. Do do, do, do, do, do, do, do, do, do. How are you?

I'm good, buddy. How are you? I'm doing good. I'm keeping busy. It's warm in this apartment. My cat is yelling. How are you doing? It is not warm in my house.

I have the air conditioning jacked. But it's actually raining today. So it's very wet outside. which is sad for the sportsman inside of me. He wants to go outside and do things after work today, but we'll see. You like to hit the links. You like to hit the links. That's what they call them, right?

I've, like listeners to the show will know that I'm a disproportionately large tennis fan. And just this year I've started playing tennis. And I've gotten my wife into it, which is the biggest shock because she typically does not like tennis. But has given my tennis fanship. She has kind of like been exposed to it and has started watching tennis and like now knows a lot of the WTA like the women's tennis professionals. And she like gets engaged in the matches and then now she's playing it with me, which is awesome. That's fun. I couldn't be happier about it.

Yeah. I love that. My partner who is the jock in our relationship has not gotten me successfully. Hiking, I guess with the exception of hiking, which is barely a sport. But you're not out on the pickleball courts. I'm not on the pickleball courts. I'm not on the softball courts. softball pitch.

I'm not softballing. Diamond. Diamond. I should know. I haven't yet, but the time is near. There it is. It's waiting for me. Welcome back to another episode of Hacks.

As Jordan and I catch up. Yes. Happy to have y'all here. Brought to you, as always, by push security. We got a couple different stories we want to talk about. I want to talk about this Honkers Union report that came out. because I think it's fascinating and I just spent a lot of time reading about it

and I want to share it. I've got some interesting kind of AI chat GPT news after the break. Classic. Classic. I think that's pretty much it. Ready to dive in. Next week's, next episode is going to be a kind of a different one,

a little chill one. I'm going to be traveling for the next two weeks. You'll hear about where in the next episode. This is a total aside, but I just found out that there's a new alien television show that I am now downloading for my flight this week. I'm very excited. Are you an alien fan, Scott?

Uh, no. No, you're not. No, I, I have seen them, but I'm not like somebody who's not. You don't know the lore. You, you saying that there's a new alien TV show, did nothing to my, like, my blood pressure. We had a very different internal experience about that because I'm pretty pumped. So I'm not, like, I think, I think Alien versus Predator to me was like the peak. Oh, yeah, very different relationship to the franchise.

I love that. Um, very fun. It's going back that way. Anyway, I bring it up here so that if anyone here is also excited about alien Earth, comment, which babble with me about it. I want to talk about it. But for now, hard, hard pivot. Hard pivot to honkers.

To hunkers. Let's talk about the journey from patriotic hackers to state cyber spies on the rise of the Honker Union. Let's do it. Let's get into it. So yeah, we're talking about this because of a new cyber defense report out of Switzerland that sort of trace the evolution of this group and one of its key architects, this Guy Tandai Lin.

It was a report published by a researcher named Eugenio Benin Kasa of E.T.H Zurich that digs into this the term has a couple different translations, but red hackers basically laid the groundwork for China's modern cyber capabilities before eventually just getting absorbed by the state.

Have you ever heard about this general story, Scott? I haven't followed the Chinese hacker scene, honker scene. I don't know any specifics of it, but the story is as old as time. There's many a sci-fi TV shows and state-run cybersecurity programs that are full of people like this.

Yeah. There's shades of like American stories we've told on this show. There's shades of Russian stories we've told on this show. This practice of identifying talent coming up organically from like a young hacker community and fostering it and bring it into the government in different all sorts of different ways with different outcomes is like, like you said, a very old story. I think if you're a nation state that's not doing this, you're just, you know, cutting your Achilles tendon for like black better.

And it, you can see this starting back in the 1990s. Like they got on it early and it has yielded results, let's say. So let's go back to the 90s. China first connects the global internet in 1994. It's largely limited to like universities and research. research centers, which means that students are getting online before the rest of the country. Again, a very familiar story. You got a lot of like self-taught enthusiasts hanging out and like dial up Bolton boards,

swap and know-how. They're like forming little crews. They're doing what young people, young tinkers and hackers on the internet do. They start the Honker Union of China. They start a few more. There's the China Equal Union. We'll talk about the Green Army, X-Focus. But that name Honker, I want to dig into this because I took a bunch of

etymology classes in university, and this one was like a fun little, a fun little return to that. Yeah. So I struggle with the exact etymology of this. I've seen different readings on it. As a non-mandarin speaker, it's like both a hybrid word and alone. It's complicated. There's two different ways I've seen it broken down. One is what I said, which is Hong, which refers to red and then hacker.

So you get red hacker, Hong, hacker, honker. There's another one that is that it's a contraction of Hong and the word key, K, K, K, which kind of refers to like guest, maybe intruder. I think it has multiple meanings. So it's like uninvited guests. Exactly. So it's like it's like a double meaning hybrid loan word. If anyone long shot is in an etymology class in university right now, like here's your paper.

This is a really interesting word. Or if there's any listeners that are actually in the honkers union, please, you know, hit us up. Drop us email and let us know what the full background is. Yeah, we're fascinated by the history and like just want to understand. In the early days, the Honker group were like, it was self-governing. It's very loose. It's like an underground hacking community. Ironically, a very influential Taiwanese hacker known as Lin-Gen Long,

otherwise known as Coolfire in that time, kind of like shaped to the ethos of the whole thing. His argument was like, these are really remarkable skills they should be used to strengthen cyber defense of the. nation, like go out, learn all the tricks that people around the world are doing, bring them back to make our stuff a lot stronger. He wrote this like really widely read hacking manual kind of like espousing this philosophy. At the time, formal cybersecurity training in China was basically non-existent. There weren't like capture the flag events.

All of those state sponsored like competitions were years down the road. So people are just online learning by doing. Importantly for the ability of all of this to grow. row, hacking wasn't explicitly illegal in China back then, except for like internal specific sectors like government, military, scientific research systems. And Lynn's guidelines basically said, like, honkers, steer clear of government or defense targets. Don't permanently break anything, fix anything that you do break.

At the time, in that world, a pretty, like, thoughtful, idealistic code, I would say. I feel like that code was the same in North America and Europe, too. back in the day when hacking kind of came about. It was a lot about exploration and, you know, puzzle solving, things like that. And it had very little to do with destruction. I think that like wave of like, you know, early 2000s, 2010s, when you've got like Indonesian hacking groups, just like mass blanketing WordPress sites with, you know, hack, call it hacktivism, but it's not really. It's more just like, I don't know, mischief, online mischief.

It's funny you paint that timeline because some like real world stuff's coming down the pipeline that's going to test that restraint and shift the vibe pretty considerably. Late 90s, early 2000s, there was a series of like non-cyber real world international incidents that stirred a very intense reaction inside of China and the honkers were there responding online. This became known and this was a discrete term used in the report. It's the beginning of what is known as the patriotic hacker wars. And it, quite the term. And it forged like a new identity for this community. I alluded to these in the intro, but there was incidents. So the honkers at one point launched like a coordinated attack on Japanese government

and corporate websites defacing pages and going after servers after in 2000, a group of Japanese soldiers publicly questioned the scale of the Nanjing massacre, which was a World War II, a war. where hundreds of thousands of Chinese civilians were killed. Something happens. They respond. In 1999, Taiwan's then president described Taiwan and China as two states. Honkers retaliated with one China defacements on their policies on their websites.

In 2001, a U.S. surveillance plane collided with a Chinese fighter midair. We're going to talk about that one later because it was a really big one in this whole story. These were the patriotic cyber wars, these waves of hacking events that these real world incidents spurred. So it was a form of hacktivism. Yeah. Okay. Yeah.

Yeah. It was politically moated hacktivism in response to real world events. Yeah. Nationalistic. Exactly. Yeah. Okay. Yeah.

Interesting. It gave them like a unifying cause beyond like curiosity and mischief. It kept them kind of focused on that purpose. It was a manifest. There was a manifesto from one of the Honker groups. It was the China Eagle Union that it was this vast. that they all made to, quote, put the interests of the Chinese nation above everything else. The publicity about their response, like this was an underground, this was reported on in China,

and it caused the like kind of unofficial number of members to swell like a crate, it became a bit of a pop culture thing. Hawking Union of China reported the group to like 80,000 people at one point at its like height. And there was other groups with thousands of members. Most of these are like casual enthusiasts who sort of like align with it, like young people just learning to tinker. But within that huge pool of the Honkers Union, there was this core circle of like really highly skilled leaders. Ben and Cass's research identifies about 40 influential red hackers, he dubbed them the Red 40, who were like the really talented ones, the leaders of the group. They would go on to become really important figures at like big cybersecurity companies in China, leading state sponsored hacking teams. It's important to note, and this is flagged multiple times in the report, up until this point,

point, there's no hard evidence of Beijing directly orchestrating any of this stuff. Sure. It's all underground. It just happens to align with Chinese state interests. And like, officials are paying attention at this point. One survey found that 84% of Chinese internet users supported the honkers actions during that patriotic cyber war period of time. There were like a, there were a big popular cultural moment. Yeah, it's interesting.

In political sense, 84% is like ruling party. Yeah, exactly. dominant public perception. No leadership candidate in any like, you know, national election has got that kind of favorability ratings. It's also nice, like if you're the government, that there's this like independent group of highly skilled people like out doing things on your behalf that you're kind of totally chill with. Yes.

You keep setting these up beautifully. Thank you. You do. Because the next turn is that snake kind of eating its own tail a little bit. and that unofficial tolerance not lasting that much longer. The end of this period of time, April 2001, there was this major geopolitical flare-up that altered the government's attitude towards the honkers. I alluded to this earlier.

April 1, 2001, a Chinese fighter jet collided mid-air with a U.S. Navy surveillance plane near Hainan Island, China. Chinese pilot is killed. The damaged U.S. EP3 plane made an emergency landing on the island, where the crew is detained by Chinese authorities. This international incident inflamed nationalist sentiment on both sides of the issue. Outraged American hackers were attacking like Chinese sites. The Chinese honkers retaliating against like U.S. targets. It's like tit for tat cyber skirmishes happening.

Again, outside the purview of the government. So Beijing's leadership gets really alarmed by this. And they go, okay. So it seems like we have hundreds if not thousands of uncontrolled. hackers effectively waging a private cyber war. A digital militia. That is threatening very delicate U.S. China diplomatic relations that are happening in the real government.

Hard vibe shift. The People's Daily, that's like the official newspaper, ran commentary likening the attacks to web terrorism, like hard pivot in how we're thinking about all this. Head of the Internet Society of China issued statements condemning the attacks. That PLA admirable who'd been saying, like, I love their Patriots. zeal is now saying this could jeopardize international diplomacy. The mood is different. And the message is really unmistakable.

And that community starts to like really lower their profile and kind of starting to stand down a little bit. With that core motivation and the sort of sense of safety removed, the group fragments. There's like conflicts about what to do next. What do we go pro and do legitimate work? Do we go sell malware and exploits for profit on? The black market. Do we move to Russia?

Like, what do we do, gang? And the honkers in that red 40 in particular splinter off. You get cybersecurity professionals that go get scooped up by like. Yeah, I do. Alibaba. Yeah, yeah. Yeah. Yeah.

Yeah. Like there's that route. There's the go do crimes route. Or just develop malware, steal stuff. And then there's the covert state hacker route, which is really the focus of Ben and Castle's report. which is a bunch of them go off and end up working for, you know, the espionage apparatus there. Sure.

They stop being independent. They get absorbed into the state. It's like the, what's the dark night thing? It's like, you die a hero or you live long enough to become the villain? Yes. Yes. It's like, we love what you guys are up to and we were really happy about it. But now, you know, you're becoming a diplomatic headache.

So we need you guys to roll into this so we can tell you when you're, are allowed to do this mischief. Exactly. We need a little bit more control. We're going to Harvey Dent this situation. Exactly. Struggling to remember who said that. Which kind of brings us to Tandai Lin.

This guy, Wicked Rose. Wicked Rose, Wither Rose. I saw both transactions. Summer 2005, Tan, who came up in that scene as like a young teenager, basically. He's like 20 years old. He'd come up during that patriotic cyberwar. period of time. He's pursuing a graduate degree in Setschuan, University of Science and Engineering.

He'd been, like, active in Hawker forums. He'd been blogging about the things he'd done in the past, Japanese breaches and stuff. PLA see those posts and invite him and some friends to come to this military-run hacking contest. Tan shows up, crushes it. Comes in first place, wins the whole thing. He's like 20 years old. So him and a few of his peers get just like scooped up and brought into this like months-long training camp run by the PLA. They go through several weeks. They go through the cyber boot camp. They're like practicing simulated cyber attacks under like military and like heavy duty.

Building custom tools for what they're trying to do. Tan gets out of this training and he's like even more formidable. And he forms his he forms a new hacking group called NCPH, the network crack program hacker to go do more of these contests in these competitions. So like not going off doing the things that was getting people mad at them, but really trying to just thrive and win inside of this growing military ecosystem. Was this a business or was it like just a group? I can't really tell.

I think that it was a business. They started developing like they developed something called the Jinwi root kit, which was like the first locally made in China remote access Trojan. And they start stockpiling like zero day exploits. I don't know if they were monetizing it yet. At a later point in the story, there's documents of them getting paid. I think by the, I can't remember if it's the PLA or the MSS. So they were charging someone in the military for something they were doing at some point.

Sure. Yeah. Well in advance of just getting fully absorbed. A little, a little arms length. A lot arms length. Yeah. And this is why the United States trade policy is so worried about Chinese made electronics. It's right here, the story. Over the spring and summer of 2006, NCPAH, this group,

is part of like a bunch of attacks against U.S. targets. They're going after like companies, government agencies, U.S. and around the world. In this report, you have like a bunch of quotes from cybersecurity experts talking about like really the kind of remarkable scale for 2006 of this kind of international hacking that's going on. There'd always been stuff, but it was still very,

it was that early 2000s. It was underground. This was seemingly very well funded and very like large scale. Tan and his crew were we would discover later actively working on behalf of the PLA during that 2006 spree. Shocker.

Shocker. Shocker. There's some stuff that happens between then and now. Tandai Lin, the timeline is murky here, but it's looking at some point while working for the PLA, Tandai Lin starts facing a seven and a half year cybercrime sentence from the Ministry of State Security.

A different group is getting mad at him and he actually makes the jump. He jumps from working for the PLA to the MSS, which is where he goes on to, like he becomes a contract hacker for them and eventually becomes part of APT 41, which is a group we've talked about on this show, several times advanced persistent threat 41,

also known as Wicked Panda, which is this Chinese hacking squad that works for the government and is blamed for like financially motivated global hacks, state espionage. All sorts of interesting stuff. I love how he's facing a seven-year charge. So he just goes to work for them.

Like he's just chasing the same dragon. Just like, oh, I'm in trouble. Yeah, I'll come work for you. I'm in trouble. I'll come work for you. Yeah, how do I make this go away? It's like I do exactly what you're trying to make go away. Come do that over here.

We don't like your current bosses. You need new bosses. It's like could you just do a transfer? I feel like you're both the government. Can you just requisition me? Do you have to charge me with a crime? Your union benefits still apply. Totally. Like just changed my job title.

There was like this big shit. I found this interesting. The 2008 Beijing Games also apparently represented like a pretty big. There was a big push to get more of the former honkers into the state run organizations because it was like, okay, we have a bunch of stuff we want to look at. We have a bunch of stuff we don't want to go wrong during this. The world's going to be looking at us. Let's just a rug. Let's do some sweeping. 2009, criminal law amendment seven outlawed all unauthorized. hacking and band hacking tool creation. Basically saying if you were going to do any of this stuff, it's either a crime or you come work for us.

Yeah. You get that. You get the 2009 switch to the MSS and then the slow development of APT-41. I would imagine that has sort of been, you know, the last 15 years of his life is kind of being the grandfather and one of the grandfathers and architects of that group, which brings us to now. 20 years after it started as like a patriotic hacker, Tandilin is no longer an undergraduate.

ground in the shadows kind of figure. In 2020, the U.S. Department of Justice charged him in the APT-41 crew with more than 100 different cyber attacks around the world. Hospitals, telecom giants, U.S. government networks. His story, and the reason I think this report, which is quite good, it's worth a read, focuses on him, is that it really mirrors so many of those people

during that Honker era. Starts out as a teen vigilante in the 90s, gets recruited or kind of pushed into China's cyber forces. Some were joining the PLA, other working for the Ministry of State Security. Some are hiding inside of private security firms. Subcontractors. Subcontractors.

But it's a model that's still working there today, which is this blend of like ex-hackers, contractors, uniformed officers, all funneling and delivering talent, providing a little bit of liability and keeping that original honker legacy alive. There's still that DNA there, the tools, the tactics, and those personal relationships. I feel like the parallels. Yeah, I feel like the parallels here to, like when you say PLA and MSS, all I'm thinking about is like CIA and NSA.

Totally. The American parallels are deep. Yeah. It's like they're, I feel like most developed first world like nations or like fully developed, you know, actors on the military and diplomatic stages have these structures. And I feel like they're all recruiting out of the same pool of like tech savvy youth who are showing strong, technical. competency in these in these areas so yeah it feels like there's this fork thing where it's either you you do something big enough to get everyone's attention and either you have a example made out of you or you have a job offered to you totally those are kind of the two things that happen if you

cause a big enough of a ruckus we've i feel like that a lot of shows where it's the former this one's the latter i feel like this happens probably a lot in like police stations or like boardrooms inside of like sure it's like hey you're going to going to go to jail for like 45 years or accept this offer and come like be a spy. Yeah, totally. And if you're in North Korea, it's like come be like a crypto malware guy and like come make us money. You're now part of the Department of Revenue.

Yeah, sure. I wonder that one's so interesting because I'm like, I wonder if you even have to show an aptitude or an interest or they're like, you do crypto scams now. Like I'm a baker. They're like, no, you do crypto scams now. When you mentioned the Beijing Olympics, it just made me think that like there really isn't. So like the e-sports World Cup is on like gaming. And it's actually insane.

Like I've never really followed that much like hyper competitive stuff. But this year it's like really nuts. Okay. In what way? Like it's scale. Oh, scale. Like they had an opening ceremony that had like post-Malone saying. And like, they paid a bunch of artists to make custom music.

And there was, like, choreography, dancers and, like, big sets. Anyway, just, it's becoming, like, a real event. Hmm. Like, it's kind of like the global Olympic games of, like, e-sports. And, like, they spent so much money. The trophies are so insane. Everything about it is, like, the scale that they're doing it at is, like, crazy. So the thing for me is, like, when you said Beijing Olympics, I was like, man, imagine

there was a global hacking Olympics, like, every year or two, like a Euro Cup or a World Cup of hacking. Like just the best capture the flag person. It's like not regionally, globally. Like you send your best. Yeah, yeah. Like everybody sets, submits a team and there's like, you know, all the different types and facets

of it. It's not just capture the flags, but there's like various other things. And then just like everybody wins medals. And then at the end of the thing, you see that like China got 12 golds and two silver. And it just, I think it would be fascinating. You know, talking about TV show. ideas to roll back to Yeah, sure.

We really just want to make a game show. This is, I'm, it seems, like, just sensing, I'm sensing everything becomes a game show. Everything is, yeah, everything, all pass lead to game show. 2025 E-sports World Cup. This is pretty wild, seeming rad, Saudi Arabia. It's not. I think the only game here, the opening ceremony. I'm curious to watch it now.

I don't play Valerant or Crossfire. I played a little call of duty. EA sports football club 2025, which we have a which we know. Jordan and I have a Guinness World record raising money for a hospital by playing this game for way too long. Yeah, they're like over a decade ago now. We spent 48 hours sitting inside of them all playing a soccer video game and that's all I'll say about that. Could you imagine a hackers world cup? Do you imagine how cool that would be? I'd watch. Oh, do you? So it would be, because what's the, what's the, the setup at the esports? We're transitioning into chatty chat now. Just to heads up to everyone,

just so no one's worried, like, I'm waiting for the end, be like the end was about four minutes ago. Uh, esports World Cup. Like, what's the setup? It's, uh, in Riyadh, Riyadh. Yeah, it's in Saudi Arabia. Saudi Arabia. I think I say Riyadh. They have a massive complex. Oh my God. This looks like the hunger games. This is insane looking. And it's based on teams. So the teams, a crew medals in different games and different like and the teams every every game has a prize pool and like there's substantial prize pools like a million plus i think anyway and they go and for like two or three weeks there's always a game tournament going on and then the winner of that tournament wins the trophy so if you're a member of some of these bigger teams like i think the

i think last year was won by a team called the falcons and i think they're out of saudi arabia if i'm I'm not mistaken, but they only like contract the best players of all the games in the world because their intention is to win this tournament every year. I'm curious what the prizes are. I'm just looking at the week-by-week breakdown and it's pretty funny because it's this big grid and it has the logos of all the different games. It's like apex legends, very graphic design. Call of Duty, Blackop Six.

Call of Duty Warzone and then just in like Helvetica, chess. Yeah, yeah, yeah, yeah. And you're like, oh, that one's different. The Magnus Carlson, like the chess guy, he was in the opening ceremony. Oh. But it's becoming, anyway. Of course. Chess is a huge sport now, which is a strange thing to say.

Yeah. Chess.com is like one of the biggest gaming platforms in the world. It is amazing. Huh. It's definitely, like I would love to see that structure applied to so many other things. Like, and hacking would be one of those. Yeah, you can imagine. there must be, I'm curious what the like current,

because that's a big community of people that take part in those competitions has been for as we've seen 25 years. And it's like there must be an apex of that. There must be the top of the pyramid. Totally. And I'm curious what it is. Even if you've had,

and how well filmed it is. So many of the organizations that play in this space, you know, red teams, blue teams. Yeah. The CTA people, the teams like at DefCon last year, there was like a big CTA competition. They were all in teams. It would be fascinating to see that all put together into one contest and then executed at a global scale.

Yeah, the thing that I loved about DefCon was the fact that you would find very formal competitions. And then you would find like weird kind of almost improvised competitions. It would be like there's just a car here and hack into it. Oh, that's different. You could imagine all the different types of contest and structure you could cook up for something like that. Totally. So if you're interested, call us, as we seem to really want to make a game show. Yeah, it looks from Googling the biggest hacking contest in the world.

The thing that keeps coming up a lot is the capture the flag at DefCon, which is really interesting. Yeah. But you would like a more televiseable version, and again, are in the business of funding our hairbrainski. We got to go to ads. You should get at us. Get at us. In the meantime, do you want to just take a really fast rip down the ad waterfall? And then we can just chat about some stories, do a little chatty chat.

Let's do it. Let's get after it. Identity attacks, fishing, credential stuffing, session hijacking account takeover. These are the number one causes of breaches right now. But most security tools still focus on endpoints and networks and infrastructure. And meanwhile, the browser, the place where all that stuff is really happening, where people actually work, that's been mostly ignored. Push changes that.

They do. They've built a lightweight browser extension that observes identity activity in real time. It gives you visibility into how identities are being used across your organization, like when log-ins get multi-factor, when passwords get reused, or when someone unknowingly enters credentials into a spoofed login page. Then, when something risky is detected, push enforces protections. right there in the browser, no waiting, no tickets, no compromise. It's visibility and control directly at the identity layer.

And it's not just about prevention. They monitor for real-time threats like adversary in the middle attack, stolen session tokens, and even newer techniques like cross-IDP impersonation, where the attacker bypasses SSO and MFA and registers their own identity provider. Think about it all taken together. It's sort of like endpoint detection response, but for the browser. Yeah. people behind it, amazing. All offensive security pros, published tons of research, came on

our pod, talked about their software, their backgrounds, their everything. They break down exactly how these things work. And yeah, they are great. So definitely check it out. Identity is the new endpoint and push the streeting it that way. Check them out. Pushsecurity.com. That's pushsecurity.com. Think about the last time you heard a breach story on this show. It always starts the same way. Someone, somewhere, saw something too late. An alert buried, a signal missed, an SOC that just couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already using AI. They created the Aurora superintelligence platform, a fully agenic system powered by the swarm of experts. Instead of single-purpose

bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy. And all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than 9 trillion telemetry events every week and over a decade of real world incident response. The system reasons on real signals and real context not synthetic training data. And the result is the new Aurora agent SOC. It's the first SCC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive

work that normally buries human analysts. Arctic Wolf didn't try and bolt AI onto an old model. They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI-driven decision reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy production-ready AI and security operations actually looks like, go to arcticwolf.com slash hacked. Ever feel like cyber threats are evolving faster than anyone can keep up? Last year, 2025 was

nothing short of a record-breaking year for major breaches, from sophisticated ransomware operators to AI-enabled attacks to turn defenses on their head. organizations around the world saw headlines they never expected and cybersecurity teams were tested like never before. But here's the thing. These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th, diving the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded.

And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights and how threat. factors are evolving, how defenders are responding, and what strategies can help you stay ahead of the next big breach. It's not fearmongering. It's practical, actionable, intelligence from experts in the trenches. Register now at arcticwolf.com slash hacked. And we're back. We are still here. We're still here. We're just still here. We're never left. My cat's still yelling. My air conditioner is still turned off. I'm locked in. The perspiration is starting to perspire. It's happening.

I got big news, Jordan. Oh, tell me. I think we were reaching peak euphoria as I have invested in a cryptocurrency company. I'm just throwing stuff. That's the appropriate response. I'm throwing pens. What? That is.

I don't even know what it. I cannot say more. Oh, I'm so glad you saved this for on mic. Yeah. I had to. I had to. And the listeners needed to hear it too. Okay, let's try, let's tread carefully and not getting into like, and that's why you should have, it's like,

no, no, keep it cryptic here. Let's keep it a little vague, but give me the broad strokes. Broad strokes of the hardest about turn of all time. Broadstrokes. A friend of mine was like, hey, I'm going to buy into this Ethereum business. It's traded on like the NASDAQ. Like, it's like a real thing. And anyway, they're the single largest holder of Ethereum now. and he's like, I'm doing it as like a short-term play should be like good. He's like, I've put a bunch of money and he's like, you should come play. And I was like, I'm quite well documented as thinking this sucks. So strictly as a speculative play, I did buy, I didn't buy any equity.

I just bought options so that I could limit my downside losses knowing how wild crypto swings are. but it literally eight hours later I was up 100%. God damn it. God damn it. Crypto, crypto speculations. I'm so bad right now. You should be. I'm still holding my options.

They've come down a bit more, but it's funny. Like I messaged him right after the initial big bump. And I was like so like if I remember correctly, the crypto recipe is like when you see green sell and when you see red buy like buy on the decline sell on an up trend yeah i'm like should i be doing that here and he was like you could do whatever you want he's like i'm gonna hold for a bit i was like i don't know so i've been holding it i don't know a lot of it it's just so funny that it's but it's swings like it was up to the casino this wasn't yeah yeah yeah yeah yeah i've had an epiphany about the value i just i just wanted to clarify i'm just straight up speculity gambling no hey you know what uh

you had a good night at the casino man I'm not upset about the, I'm not upset about any of it. He shouted. I just, it's, I wanted to clarify, is it, is it an about face or is it like I'm putting it all on this one? No, no, no, no, no. I'm putting some on the ponies kind of thing. This is just me straight up gambling.

Yeah, yeah. I don't even, if you ask. Well, then I'm happy for you. The name of this company, I would not even be able to tell you. I've done no research into it. I put a marginal amount of money as a bet down in call options. Okay. And it went up 30% the first day.

It went down 10%. Like it was started today. The market opened. It was up 12.5%. Now it's down 2%. Like it's just 15% swings in like a NASDAQ traded stock within a like an eight hour trading window is nuts. It's it is all of the insanity of crypto come to the real stock market.

Oh my God. It's not even on the NASDAQ. It's on the NYSC. That's even crazier. I will talk about this offline. I quite enjoy this. I quite enjoy this. I can't ask any follow-up questions because I don't want.

I don't want to get into specific stuff. We must be at peak euphoria. If I've been baited into investing in something that I'm so cynical about. Yes. We've got to be close to a top. I don't trust that horse at all, but I think it'll win the race. It's a little bit of that. It's like, that's a sketchy horse.

I'm not even sure it's a horse. I think it's five guys in a horse. outfit, but they're really amped up on something and they seem to be moving quickly. So I think they're going to win. I'm by no means an evangelist. I have no belief that like crypto is what the world needs for freedom and all the rest of the jazz. And like we're helping impoverished countries through income inequality.

Like I have none of those beliefs. This is just like me walking into a casino and putting money on like black on the roulette table. Sure. You don't have to have a face that it's going to come up red. you just got to be willing to willing to give it a spin. That's really, really funny.

I don't know how to get to a different story from that. I had to tell you. It's really good. And I have to tell the listeners because I get so much chastising about being so cynical to crypto. Well, now that's ammunition. Oh, totally.

Anytime we should talk it, it's just like, what about how's it doing? I know my vices. I know that I like gambling. And I got baited into the gambling part of it, not the cultural part of it. Sure. Sure. I think this valueless thing is going to go to the moon. Oh, I love it. Yeah. Fantastic stuff. There you go. I have a little, hopefully brighten somebody's day. I have nothing that interesting to talk. I have some stories, but I don't have like a personal one.

We could talk about as a clean pivot from this. What Trump just did to AMD and Nvidia. I'm unfamiliar. Enlightenment. So, Nvidia being an American corporation, I'm air-quoting to Jordan because largely it's Taiwanese-based, but does operate out of America trades on the America stock market. Trump was slapping all kinds of restrictions about what Nvidia could sell to China because they don't want China to win the AI arms race. Yeah, the graphics cards and stuff.

Correct. GPU units. The GPUs, yeah. So it seems like I understand tariffs and that's essentially a government shakedown where you've got to like pay the government. But he actually signed a revenue share agreement. So Nvidia and AMD are now allowed to sell their premium products into the Chinese market. But 15% of gross revenue needs to be remitted to the American government,

which to me is just like a shakedown. Like I was so shocked to see it. Like, they could have done it through reverse tariffs and other economic, you know, nation-state level things. Yeah, sure. This is just like a toll. Yeah, this is literally just like a we are, you want access to a market that we don't want to let you go into. Pay for it. Huh. He said he would allow Nvidia to sell its H-20 chips, I'm reading from Bloomberg right now,

sell its H-20 chips to China in exchange for the U.S. government receiving a 15% cut for the company's sales, some advanced chips in that country. He made a similar deal with Nvidia's small arrival AMD. interesting. Yeah, this is the first time in my life that I can recall a deal like this being cut where the government has essentially taken a licensing royalty. Yeah, it's very pay for play. Like, it's kind of like, you'd give us money, you can do that. And it's like, but wasn't it prevented because it represented some sort of a national security risk?

It's like, that's worth less than that money you'll give us. Like, it's just, that's interesting. I'm assuming that they couldn't have done it through tariffs because the chips are probably manufactured in Taiwan. So maybe there was no export of a real good coming from America so they couldn't do it through reverse tariffs. So they had to figure out a different way to do it. It's going to be very fascinating to watch what happens from this because essentially he just put a social tax on a private corporation in America. Like I assume that's going to go into general revenues for the tax base and help pay for Medicare and all the rest of the stuff.

Yeah. But it's like I've never heard of it's not I'll say this. It's not typically something that I would associate with capitalism, but he just did. Yeah, it's like the question of how much a company needs to spend to receive an export license is like that's a weird different question. Like that's not normally how that works at all. You either like the thing is regulated whether you can export or import it. Not are you willing to pay us? It's like that's just, is that legal?

I don't know. That's just really different. I think in Vidia, like I read some articles about it and they were like, they understand how large the revenue pool and selling to China is. They were willing to be like, yeah, $3 billion is worth it for us. Wow. So like we so we will pay to play. Yeah.

Huh. A remittance model for exports. That would be, I'm curious if that will get extended to other technology. I appreciate that GPUs that have application and AI development are a uniquely sensitive type of product. That's true for a lot of silicon, but like they have sensitive applications in addition to consumer applications. I get treating them differently. I'm curious if this is the beginning of like a door being opened on if you can designate something that it becomes essentially like, well, pay to play to play. It's pay us money.

We'll let you sell it to those people. It makes it harder to stay out of the other side of your mouth. that there's these grave security concerns about selling these products. It's like, well, they can't be that grave if a 15% tithe gets you passed. Appropriate, appropriate term. Yeah, a little bit. Good find. I can't help.

I can't help but feel that they knew that the product would end up there anyway. That feels like it is. So it has that kind of like, do we legalize? Do we not legalize? You know, people are still going to get access to it. people are still going to be able to buy the drugs. Like, should we at least tax the drugs? What a metaphor.

I love that. I'm not sure I love the situation, but I like that comparison. That's an interesting one. Yeah. Okay. Well, good time to buy some. That's a good pivot. Let me do another one.

Keep going. Let's keep going. There's an interesting thing about 100,000 shared chat GPT conversations appearing in Google search. So chat, GPD has like a share link. button that lets you make like a public URL to share a conversation with people. And for a while they had this toggle that they have, I think since had an epiphany isn't a great idea, which is just you can just leave it on, which is make this chat discoverable. And allowed those shared like the shared version of the page to be indexed by search engines.

You know, your chat chbbyte conversation of that box is checked can appear in Google results. OpenAI has now removed that functionality because of the high potential for accidentally leaving it clicked and exposing what is supposed to be a private conversation and has been working on the process of trying to de-index any of the conversations that were originally indexed. A security researcher was able to collect over 100,000 shared conversations that were appearing inside of Google Searches very, very recently. You got like the really mundane stuff that is most of chat GPT, like cleaning up an email. And then you got super sensitive documents and deeply personal dilemmas. People were tackling with chat GPT, which there's another story there. 4-04 Media was reporting on this. They did a really good coverage.

It's worth checking out. There was like uploaded non-disclosure agreements to like for visitors to open AI. Like the call is coming from inside the house. There's like mental health chats. There's like contracts being drafted by like businesses of various sizes. It's a there's been like different. different numbers of these reported, but it's looking in that 100K range of these things that were publicly indexed and are still up.

It's fascinating. To me, it just seems like feeding the robot its own output to learn and grow from. It's like exponential hallucinations. When you say that are you referring to by its outputs being indexed on Google and Google being fed into the system, I understand. Yeah. It's like, it's a great group situation. Yeah, exactly.

of Gemini is consuming chat GPT's outputs and vice versa. All of a sudden, you've got hallucinations that are then compounding off previous hallucinations. Yeah, sure. It's like where will we end up? That was a thing when, oh my God, what was that open source model that everyone was talking about six months,

us included? Gwen? Lama? Not Lama. It's the like, who made it? Came out of China. Yeah.

Probably Gwen. Gwen. Was it Gwen? Was that the name of that? QQ. There's a bunch of Chinese models. Alibaba puts one out. Deep seek.

Deep seek. Oh, yeah, the big one. The big one. It was the big one. I remember when that came out, there was a lot of speculation that the training data that they might have used on that was largely text outputted by other models. You would have like models write you just tons of different styles of writing on different subjects and then ingest those into the system as part of to make the training

data set bigger than just what was already available. So I think that's already kind of happening. That is one of the ways that they fine-tune these things now. Yeah, totally. So that's gone from like an intellectual property theft discussion to a standard price. Yeah, like an incremental augmentation of existing models. Bingo.

Yeah, super interesting. And they're indexed on the internet. And now probably have been fed into other systems as well because they were indexed, which is less of a question. It's like this is tricky because it's like, there was technically a box that you checked that said make this be Googleable. So like the point at which this goes from just being like bad user interface design to a privacy breach is like very blurry in something like this. But it's like the thing I'll say as a as a open AI product user is it's changing all the time.

So just like when it changes, look at it. See what's changed. See if there's a toggle. Make sure you don't check the one that says index this on Google if it ever reappeared. Like, just keep an eye on the tool you're using because that you're feeding it a lot of data. Similar to all the applications on my phone that add new notification types, even though I've turned off all the notifications. It's like, hey, we added new privacy settings. They're all defaulted on.

Yeah. Yeah. As somebody who kind of passively enjoys peering into the darkness of the internet, I occasionally go on Reddit. and the slash R slash Grock, since they've released their animated companions, there have been, I'm not going to get into the details on any of them because some of them are pretty adult.

Yeah, I've seen them. But the slash R slash Grock has made me laugh dozens of time in the last week with people having like remorseful posts. about what they've done and shared with Annie and Valentin and all the rest of the people. And I'm like, oh, my God. Apparently there's a camera mode where you can turn on your camera and Annie will see you and comments about you and talks to you.

That's darker than you investing in a crypto company. That's extremely dark. So anyway, if you need some dark humor slash R slash Grock. Yeah, I'm going to sub. I mean, that's interesting because there was another thing just on the opening eye front that feels really relevant to that, which was, so I didn't watch the whole interview. I just saw a clip of it. Sam Altman, the CEO of an opening eye, appeared on this past weekend with Theo Vaughan, extremely popular podcast. And there was a section where he talked about like the privacy. He acknowledged that people are using it as a therapist.

And that had started out as like a marketing copy thing of like, you can use it as a personal thing. And now we're at the point of like, there's a problem with people using this as a therapist. And he spoke, the quote was people talk about the most personal shit in their lives to chat GPT, which was a quote from Altman. I was talking about how young people are like treating it as a therapist, a life coach, asking these very personal questions. And he brought up something that I found really interesting, which is that doctor privilege confidentiality and the fact that a doctor cannot be subpoenaed in a vast, vast majority of situations to disclose something a patient told him. sure does not apply to a chat bot. Totally. The quote that I liked was,

if you talk to a therapist or a lawyer or a doctor, there is doctor-patient confidentiality. There is legal confidentiality. We have not figured that out yet for when you talk to chat GPT. Quote, I think that's very screwed up. I think we should have the same concept of privacy for our conversations with the AI that we have

with a therapist or whatever, and no one had to think about that even a year ago. I find, I'm like, this is a very interesting conversation of like there is a great deal of support for the development of AI as an industry within the government broadly but at what point does there become resistance to like okay when we can offer people privacy given the breadth of uses that exist inside this technology and like is that going to become a conflict at some point in the future are there going to be people to start pushing

for that it's a I think this is like I'm seeing the beginning of a story I think we're going to be living with for a while yeah yeah there's a a that weird and shocking, but not shocking at the same time. B, a fun game to play. If you go to the bar with your friends, is you all open up your chat, CPT, GROC, whatever, AI, Gemini, and you pass your phones around, and you get to look at the conversations that your friends are having with these things.

You'll learn more about your friends in those 20 minutes than you will over a lifetime. It invites an emotional back and forth. It's very different than Google, I'll say. Because Google was always the thing that if someone could see your Google searches, they could truly get to know you. But the fact that Chad GPT responds and asks more questions, it's like you drill down to stuff a lot quicker with these tools. Yeah, I don't really use it on my phone very much.

I use it in browser and I tend to like I don't want every dumb little email rewrite to be stored. So I'm in a temp mode, the vast majority of the time, because I'm like, quickly clean the sentence up, quickly do this and then just go away. Yeah. So the vast majority of it is just vanished into the ether to an extent. And thank God for that. I have a friend of the pod. I won't call any names out, but they've been using, so I put them onto perplexity like perplexity labs and how cool it is and stuff. And they've been using perplexity. They've been using perplexity spaces to be their executive coach. So they uploaded their personality test scores.

They uploaded just so much stuff about themselves into the space. So kept it in contextual memory. And now they like have conversations with it as an executive coach. And apparently it's been wildly good. So even even like in in the office like you know, a meeting comes up that is with a senior superior that's going to have some conflict in it. They'll have a discussion with the coach to prepare them for that meeting and kind of talk through how to address it, how to best coach it and build the context for it and all the rest of this jazz.

And it's been wildly good for them. They have nothing but rave positive things to say about it. So people are still, I think, finding and people will be. Not that that's a new use for it, but it's just very cool, I think. Yeah, that's fascinating. Did they check a box that makes it indexable by Google? I hope so. I really hope not.

Can you imagine Googling your team member and finding conversations being like, how do I break it to when you read your name? I'm upset about this thing. It's like, oh, no. Yeah, I'm going to say, if you're one of those people that Googles your own name, eventually you start seeing other people's like chat conversations. That's the hell. That's so bad.

Oh, that's pretty, that's a good one. Yeah, those two stories about the chat GPT being indexed and the privacy statements that all made on Theo Vaughn felt of some kind of a set. The, uh, I got a, I got a knock on to this. Um, not sure if you kept up on the comments of the last episode. Somebody took great, um, offense to me stating that our children would be trained by LLMs or taught by LLMs in the next coming years. And they needed to really

really let me know that they were opposed to that and that I don't know if they called me a shill for the AI industry but it wasn't far from it. Oh, interesting. Yeah, like I don't, I'll say I don't want that to be the case. But I don't think that someone acknowledging that there will be probably people that want to realize that is, I don't know. Thanks, Jordan.

A value at all. It's like, yeah, I don't know. Are you, wait, are you a show for the AI industry? Not yet. I'm becoming a shield of the crypto industry first. Sure. But it's a long tail thing. Yeah, right.

Yeah, okay. But the more conversations I have with people around AI, the different perspectives you see. And I think the different amount of consumption of knowledge around it, you decipher from your people you're talking to, I feel like I read a lot with them. I utilize them a lot. I do a lot with AI.

And I've developed a pretty real understanding of where it could go. And I know some other friends of ours, another friend of the pod that you're going to Germany with. He and I share very similar perspectives as to where this is going. And I can't help but think that being, I'm not a doomer, but like I think I have a realistic perspective on. it and the power that it can hold. And I think we're only seeing that now with people utilizing as therapists as executive coaches. It's actively and continuously replacing small, menial

tasks that people used to get paid to do. And those tasks are going to get bigger and bigger, like the coding space every week. Like Cloud Anthropic just announced today that they've expanded the context memory for Cloud so large that you can essentially feed it a massive software systems code base. and it will keep it all in context. So that means it will be the largest and best programmer on your team because if you have a 10 million line software project, no single coder knows all of those lines.

So anyway. Yeah, it's interesting. I hope, how do I put this? I hope it is embraced as a tool to make the jobs that people do better and less menial to borrow that word. And I hope that it is not used as a tool to not have to do important roles in society. Like, I want there to, I want there to be teachers.

I want there to be things. It's like, I think that there's a human touch is needed for a lot of really important things. And they can be using those tools to eradicate menial tasks. And I'm sure students will end up using them. Like we give kids Chromebooks. it will become part of pedagogy.

I think those can both be true. Yeah, yeah. I wrote something a few months ago that kind of talked about how my entire life has existed during like the technological revolution. You know, it's increased our economic productivity. We got email on our phones. We're accessible everywhere. Back in the day, you used to have to like, you know, go to an office, send things

by mail, fax machines. You know, we've constantly got better at getting more productivity out of people. And I'm hoping that AI is the thing that inverts that correlation. So instead of there being an expectation that you're always working, that you're always available, that you can always be reached, that maybe AI facilitates it so we can have a bit more of our life back, but keep the similar productivity level. I don't know if that's where we're going to end up, but boy, would it be nice. like I would love us as a society to utilize AI not to replace the things that bring us joy but allow us to focus on them better and also maybe get us to a two or three day work week. This is my hope.

This is your hope. This is my hope. I hope for a world where everyone works two days a week and gets paid like they work five. Yeah, because the two day work week without the pay for five is a, is a, new much larger problem called exploding unemployment. Knowing you and myself, Jordan, I feel like if our day jobs went down to two days a week, we would just find two more jobs to put in the work week. Yeah, the things that are wrong with me are a plenty and well documented.

And that's pretty much top of the list. Yep. And on that bombshell. On that note. We'll see you next. What an episode. Hunkers Union, chat GPT scraping. All sorts of stuff.

This has been a fun one. Brought you, of course, as always by Push Security. I'll be back. We'll be back for the next episode. It'll be a little bit different. But I hope you come along for the ride. And until then, we're going to catch you in the next one. Take care.