Hacked - Gamescom 2025

Episode Date: September 1, 2025

Reboundergame.com ( if you wanna wishlist our work in progress game on Steam

Okay, coming at you live from the airport. There is a lot of intellectual property at big video game conferences. So it's not very surprising that the security is very tight. Nonetheless, there's room for error. Back in 2002, shortly before the launch of Doom 3, a demo of the game leaked online. It was version 0.02. The leak looked great. That specific build had been briefly shown months earlier at E3 2002.

E3 was a large gaming conference. It died during the pandemic. And now this build of Doom 3 from E3 had leaked online. Big deal. So who did it? The suspect pool is small. In order to prepare for the demo and to optimize hardware performance, id software, the makers of Doom 3, had to share the demo code with companies

so they could tweak their GPU drivers. So Doom 3 would run smoothly on their hardware. So that E3 demo leaks, and everyone goes, which one of you did it? And pretty quickly, a bunch of IRC chat logs and forum posts start going around publicly that said that the number one suspect internally at ID software was a graphics card provider called ATI, who had been provided version 0.02 to optimize for it ahead of the talk. The culprit.

ATI Technologies was a Canadian semiconductor company based in Markham, Ontario. They made graphics cards. Their graphics cards were in the GameCube and the Xbox 360. None of this is relevant. It's just historical flavor. Anyway, an internal memo from IdLeaks in which John Carmack, the lead programmer, explains, we believe the leak of Doom 3 came from ATI. Someone at ATI has since been fired as a result.

This is done. Let's consider this a sneak peek. we're going to forge ahead. And they did. And Doom 3 was a commercial and critical hit. And ATI got bought by AMD. I am talking about this in an airport because I am traveling to a video game conference.

I am in the Vancouver airport right now. I'm sitting in a weird little... I think it used to be a telephone booth, but now the telephone is gone, so it's just a small metal booth opposite a Tim Horton's. This is going to be a little mini road episode. I have a bunch of little weird text stories set in the world of gaming and game conferences. I'm going to include travel color.

For example, I'm about to try and go find a sleep mask for the plane because I forgot to pack one. We'll be back at it with a normal episode next. If this isn't your cup of tea, no worries. We'll catch you in the next one. For everyone else, let's go find that sleep mask on our way to Gamescom 2025 here on Hack. Okay, just got myself a sleep mask scoured every single duty-free and miscellaneous airport stuff store in this terminal. I think I found the best one. Next stop is going to be, well, next stop is a 12-hour flight to Europe.

At which point, we will reunite in a hotel room in Amsterdam and I'll tell you all about where we're going and share some more stories. Hope any of this is usable. Wish me luck. Catch you on the other side. Amsterdam. 12 hours of flying and some trains and a lot of jet leg later, I am in Amsterdam. But Amsterdam, as cool as it is, and as much as I'm liking all these canals, is not relevant to this story. So I'm going to tell you some stuff about where we are actually going on this trip, which is Germany.

And specifically the city of Cologne, or Cologne, as German people say it. Kohln is Germany's fourth largest city. It's this historic cultural center that has a, I've heard, generally pretty chill, relaxed vibe. It's got a big Gothic cathedral. If you like a good kulsh beer, it's the city for you. Kohln has a population of about a million people. And when Gamescom arrives every August, Kohln is, so normally a million people, an additional

300,000 people show up to the city for what has become the, world's largest video game convention. Hotel rooms vanish. And the ones that are left ain't cheap. Trams and trains are packed. There's people in cosplay carrying merch bags. There's demos. The fairgrounds at Colnumis, one of Europe's biggest convention centers, become the epicenter of global gaming. There's big publishers showing off new titles. There's fans queuing up for hours to try the newest thing. And importantly, for us, There's indie studios hustling. That is why we are going there.

I'll tell you about the game later. But for now, I found another story set in this world. I was curious if I could find any instances of real-time intellectual property theft actually happening on the expo floor, like the booth itself, not a build sent before, corporate kind of back and forth. And there was one. in March of 2010, the very first Pax East was held in Boston. It was like a new big gaming convention for fans and developers, kind of like Gamescom,

and among the many different demos on the floor was a new shooter from a company called Atomic Games, a game called Breach. And on the final day of the show, one of the only known cases of live hacking at a Game Expo happens. A 20-year-old attendee, Justin DeMay, was caught trying to steal the game's source code. And he was trying to steal it directly off of a demo station on the show floor. May had snuck behind Atomic's booth, plugged his laptop into an Xbox 360 developer kit, and started downloading the in-progress still kind of prototype-level game. And he managed to copy about 14 megabytes of a roughly 2-gibite build

before Atomic staff spotted like, oh, hey, there's a guy under that table. I go over, I imagine they pull the curtain back. and May reportedly just said like, yeah, you got me. I was stealing it. I think the quote I saw was to share with friends. And he said, quote, it wasn't a big deal. Security thought otherwise. At some point in all of this back and forth, May like cooks it.

He rips off into the crowd. And he's chased down by Expo Security and eventually the Boston police come. And they arrest him there at the show. authorities take his laptop. I think they go back to his hotel. They get his laptop. When they're there, they find a bunch of modded game consoles. Like they find a modded PSP, a modded DS.

And they throw him in jail for four hours and decide, you know what? We got this attempted theft. We've got these modded game consoles. We don't really know what any of this is. So we're going to charge him with larceny and attempted theft of trade secrets. They pegged the estimated value of the 14 megabytes he was zes. he had stolen at around $6 million, which is a number. Anyway, May posts the $200 bail, misses his initial court date, gets issued an arrest warrant,

again, 14 megabytes, which was dropped. In court, May shows up, please not guilty, and is placed on pre-trial probation under these strict conditions. And they say, okay, what you do is really, really dumb. Stay in school, kid. that was a term of his probation. You have to give up your computer, you have to stay off of the Xbox Live platform,

and you have to stay out of legal trouble for 18 months. If he followed those rules, the charges would be dropped, which it seems they were because that was the last newsworthy thing about this I read. If the first story was all about how intellectual property between different gaming companies got locked down at these events, that one's more about like the conference floor.

itself. And it's kind of around here that more developers start tightening booth security and Blizzard notably banned laptops from its BlizzCon show floor when demo builds were present, all because of Justin DeMay and those 14 megabytes. I'm hoping the bells go off while I'm recording this in my hotel room, just so you can hear. Okay, so why am I going to this event? Why have I flown so far for this? Well, myself and some buds are announcing a video game this week at the event. The game is called Rebounder. I'll tell you more about it after another story later in another place. But if you've ever wanted to do a really, really nice thing, it would be to Steam wish listed.

Steam is a gaming platform. Steam's algorithm is one of those algorithms that makes or breaks a thing like this and getting that algorithm to notice. Rebounder means getting it added to wish lists. So if you are at a computer with steam installed on it, please follow the link that's attached to this episode. Reboundergame.com will also take you there. If you're out listening but you like games, please go to reboundergame.com with your computer.

It means the rule to me. I'll tell you about it after. I'm going to go see more Amsterdam canals and I'll catch you somewhere. in Germany at the conference. And welcome back. I have just teleported as far as you are concerned to Germany. In reality, I think it's been about five days,

and I don't know if you can tell, I'm about to lose my voice. So no cat yelling in the background like last episode, but a host that won't be able to talk for much longer. This is how we do it here at Hacked. I've just stepped outside to try and find somewhere quiet to record this. Hope it sounds okay. After all this, we're going to teleport back to Canada.

You're going to teleport. It's going to take me, like 26 hours. But we're going to catch up with Scott with some classic hacked news to wrap it up. But for now, I got one more story for you. Before we get to that, what have I been doing for the last four days and why have I lost my voice? I have been standing at a booth showing off our new game rebounder. Gamescom is spread across this giant complex, hundreds of thousands of people walking around. I've just been handing this game to people standing at a big booth, giving a spiel, probably getting very sick.

And now I can talk about it because we've done our official world announcement. Rebounder is a platforming game that me and some friends have been making set inside of a comic book. It's a game about bouncing off of these explosive spores, juggling yourself through the air, doing crazy trick shots. I'm really proud of how it looks and plays and sounds. It's going to be coming out about a year. Reboundergame.com. It'll be in the description. But for now, before we teleport back to Canada, check in on Scott.

A final road story. E3, 2003, same conference I mentioned earlier. Valve's Half-Life 2 is the bell of the ball. Steels the show at the show in Los Angeles. It's got this new source engine. It's got realistic physics. The enemy AI is supposed to be just totally new. And they say September 30th, this bad boy is coming out.

Mark your calendars. September's approaching. Half-Life 2 doesn't seem to be shipping. Goldmaster discs aren't going out to production. There's no review copies. And inside Valve, the president, Gabe Newell, starts to notice some unusual behavior on his computer. Some activity that doesn't make a lot of sense. And IT staff starts suspecting maybe there's some key loggers running in the background.

Valve issues a brief statement saying Half Life 2 is going to be delayed to the holidays. They don't give an explanation. But on October 2nd, they post this plea. Newell posts publicly on Valve's fan forums, outlining what happened. He says his email was compromised. Someone had access to our networks over multiple weeks. Source code was copied around September 19th and there were custom key loggers detected on multiple internal systems. And he says basically, hey community, help us find you did this. Days after that plea in October, a torrent of the entire game Half Life 2 leaks online.

This isn't the first couple of levels like our first story. It's the whole game. Fancy compiled that raw code and assets into a playable but very unstable build. All those levels shown at E3 and 2003 are people have them running on their systems. And suddenly one of the most anticipated titles on Earth is like circulating unfinished on file sharing networks before launch. Morale sinks, development kind of slows a little bit. People are trying to figure out what the heck happened here. An investigation begins. Thousands of fans respond to Newell's posts. Tips start accumulating in Valve's inbox. You got usernames, emails, emails. IRC handles. Valve is like passing all this intelligence onto the FBI who's open to case.

In February 2004, Valve gets an email from DeGai at hushmail.com. And the writer admits to having infiltrated Valve's networks kind of like six months earlier, during which time he's just been roaming around, claims he never wanted the code to leak instead saying he'd shared it privately and other people spread it publicly. He actually blames this griefing clan, My Gott, for taking that private leak and putting it into the open and he says, I want to talk. Valve replies and over weeks start to develop a correspondence and the suspect explains his intrusion. Basically he had found an account that didn't have a password and he started using that to escalate his access through their networks and in

March Valve comes up with this scheme and they conduct a phone interview with the guy pretending to be recruiters. Hey are you interested in a job at Valve? Explain to me the techniques of how you hacked to Valve. He does. Afterwards, he actually emails them a resume signing off. I really hope you hire me. I'm not a bad guy. Just a little misguided. This is a crack at a sting plan. Valve and the FBI prepare to fly him to Seattle for a job interview. They're like, oh yeah, we'll cover travel and relocation, salary. Come through. It's a trap. Once he lands on US soil, he'd be arrested. Not the first time FBI has done this with a cybercriminal. But before the American sting can be executed, the German police, where I currently am, strike first.

Acting on that U.S. intelligence, they raid a small home and show now in Schwartzwald, wake up a 21-year-old in his bedroom, you're under arrest. His name, Alex Gembe, alias, Ago. Born in 1982 in Southern Germany, known in Underground Circles as the author of a thing called Egobot, this very powerful, modular, IRC-controlled worm that was perfect for things like what he did to Valve. trivia, Agobot actually spawned thousands of variants and was used by criminals worldwide for years. And the FBI already had him on their radar for all that bunch of botnet related crimes way before

the valve breach. 2006 in November, a German court convicts Gambay of computer crimes, including the valve intrusion. He gets two years probation. No prison time due to being young and cooperating and saying he's sorry. U.S. prosecutors later tie his malware to a bunch of other cases, but Germany refuses extradition. In November 2004, Half Life 2 ships, and its acclaimed is one of the best games of all time. Gabe Newell kind of later reflected on this publicly saying that the real cost of all this didn't have that much to do with the leak, and it was more than months of lost focus during this crazy pre-launch time.

I have to get back to my booth. Thank you so much for joining me across a couple different countries. Next stop, we'll be back chatting with Scott. See you in what for you will be mere moments. and what for me will be like a week and a bunch of jet leg. Really appreciate you coming on this adventure. Catch you on the other side. Welcome back.

I'm happy to be back. Before we hit the record button, which was our regrets, we were talking about how Jordan has now got virus and flu bugs and the cold bugs from every corner of the world as he shook 1.3 million hands. There's not a hand that I have not shaken. I think the last thing I shouted before we hit record was I have nothing. I have nothing.

Well, I disagree. I think you guys have something. Oh, I appreciate that. You're too kind. First and foremost, I have, like you, the listeners, just listened to the intro part of this. Jordan just sent it to me as he has just returned from Germany. And I think it's great. A, I think it's great.

I think we need to do more travel reporting because, boy, is it fun. I'm missing Defcon from last year, didn't get to go this year. You got to go to Germany, which is super fun to Gamescom. And B, love it because we've never really done anything self-promoting on here. And I love the fact that you're like, hey, I'm about to put a game out. I'm going to make an episode about it. And good for you. I was like toss and turned about it a little bit.

So you could tell I like front-loaded. I'm like, but don't worry. I have all of the little stories to balance it out. It means a lot. I appreciate that, man. Thank you. I think we talk about your game. Oh.

I think if we're going to do it, like there's obviously great stories and there's other things that I want to talk about too. Me too, me too. We got tagged on X in some very interesting stories about like Gemini CLI for coding and Anthropics code. So I'm excited to talk about some of those things. But I think right now let's talk about your game. I've seen it. You've seen it.

So I get to say it looks great. Play is fun. Thank you. Very cool. So let's talk. Potential release date. Start us with the big details. A little over a year.

We have a lot of stuff left that we want to work on. So yeah, we're about a year out. We wanted to be on Steam, which as you mentioned. We'd like it to be on console as well. Our last game was on... Any consoles or all consoles? All of them, baby. Wow, let's go.

Let's go. I mean, our last game, I have the Nintendo Switch. cartridge and that thing, I really like that thing. So I would sure love to see it on the old Nintendo. What do we think in mobile? We think in mobile? A big old TBD. Big old TBD controls might be a little more challenging on mobile. It might be the issue. Yeah. Yeah. If you don't know anything about Jordan and his friend's last game, I had a couple names. I know it is run gun jump gun, but then it got rebranded to Atomics. Yes, Atomic. And Atomic, sorry. Yeah. No, no. You're good. Very challenging.

platformer. Yes. So if you're into challenging platformers, dig it up. I'm sure you can find it still, Jordan, with the hit. I'm sure it's on Steam. You obviously have it on Switch. You can get it on Steam. You can get it on Switch.

You can get it on mobile. You can get it wherever you like to play your games. Atomic spelled with a K. We had to tweak the name partway through launch. So we did that. We've done some other kind of games in between, and this is our kind of big return to platforming. We learned a lot of lessons from that game.

It was very, very. challenging. This one is still challenging, but in a different way to try and bring more people in. It was really cool. It was like we saw tons of different types of people playing it, like seeing kids play it and get through it and have that experience of like the way a kid plays a video game and their eyes like light up when something new happens. It's like, oh, that was very, very cool to get to see. The previous game, being somewhat of a gamer myself and somebody who makes games and has played games my entire life. I think I got to 75%, 70. Pretty good. Pretty good. I'm pretty proud of that. Yeah, no, you feel good about that. I don't know.

You feel good about that. If you guys have stats on how many people actually completed it, I imagine there's going to be like a steam trophy for it. But I would be curious to know how many people actually made it all the way in that game because it gets insane. It gets really, really hard. And that was kind of the point of it. It was like a proudly challenging game.

I think we said it was not for babies in the market. in a copy. I don't know how many people finished it. Anecdotally, I know it was quite challenging. This one's all about tuning that difficulty curve just a little bit differently. Yeah, yeah, yeah, yeah. Let's talk about inspiration, because I know you guys pulled some inspirations for this game from a few pieces. So let's talk about that. What was your guys' inspiration in making this game?

Thank you for asking. So there's a couple. There's this genre of like underground. speed running ROM hack of like retro platforming games. And our designer and developer, Jeremy, found this mechanic buried inside of those. And it's like inaccessibly hard. And it involves kind of throwing a ball and bouncing off of it. Super hard.

But if you can play those types of games, it's really, really fun. And the idea was like, can we bring that core loop to a much bigger audience of people? You take that core mechanic and then we combined it with this kind of audio visual mostly aesthetic idea of what if you had a video game that felt printed rather than like rendered. So everything was like piles of ink layered on top of each other like an old comic book where you had the dots and you had the little misregistrations and glitches of printing

rather than say pixels. So you get that look and that feel and that sound of a noisy analog print kind of world with this core gameplay loop of grabbing, throwing, and bouncing. Those were the two big influences we were bringing together. And then just a world of great indie games that we've loved over the years, Celeste and Super Meat Boy and all the classic platformers. Nice, nice. So we're going all the consoles, about a year out, really cool art style, very cool gameplay loop, gameplay mechanic.

What do you think in runtime? How long do you think it would be? How many levels are you guys thinking? I don't want to spoil it or send any expectations, but just give us like a... So there's like tears, right? There's get to the end of the game. We're saying like eight-ish, eight hours maybe. Complete the whole thing, like 20 hours.

You want to get everything 20. And then for speed runners and people that want to like just really get good at it, bottomless. You can just play this thing forever and get better and better and better and keep finding stuff. Yeah, yeah. So the toss something in the air, jump up, bounce off that thing. Sounds like a mechanic I'm remembering from my childhood. You might. Distant foggy memories.

Distant foggy memories. Distant foggy memories. Great. Well, I'm pumped. I'm pumped to see it. I think that's the good plug for the game. Let's talk about Gamescom itself. What else do you see that was cool?

Oh, man, so much good stuff. That is a wild event. I know I kind of alluded to this. I'm delirious and definitely sick right now from it. So I can't even remember what I said. But I think I mentioned a million people live there. 300,000 people converge on it. A 30% increase in popular.

for a week. Wild. Absolutely wild. The, like the fairgrounds themselves, Colmiss is huge. You want to go see something and you're walking for like 20 minutes to get to it conservatively. It's colossal. Let's hang on the name Colmus because it sounds so Christmassy. Colniss. Go down to coldness. Yeah, I don't know what it translates to. Coln something. I don't know what this means. Place, I'm not sure. And I won't get. Hall. Yeah, probably. It's like a nice facility. It's wild in there. It's a pretty cool place. There's, like I said, there's, you know, families, just fans, adult fans rolling around. Like there's everybody, all over walks of life, obviously a ton of other like exhibitors from the big AAA studios down to like Indies.

Very different vibes in the different halls. You know, you go to the big hall and it's almost, like a theme park kind of setup where it's like Nintendo's setup is just bigger than life and it has Yeah, they've got that $8 million installation and you guys have like a unrolled sign. Totally. The sign actually turned up pretty good. But yeah, it's like a big television and some steam decks. And that was kind of the energy as you go over to the major booths. And it's this huge installation.

It's really cool production design way over the top. And you're talking with like staff members basically. theatrical trailers playing on monster screens and the trailer budget was 15 times the budget that you spent on your game. Exactly. Like, no word of a lie. Yeah. Directed by like a real international famous director. Totally.

Ridley Scott did the trailer for Pokemon A to Z. And there's like, you know, seven foot tall statues of a Pokemon and Samus. It's just wild, wild stuff. And then those are all manned by like, you know, staff, people that were brought on to man this booth. Then you go over to the indie hall and there's some big spectacle type indie games because indie games have gotten really big. But a lot of the time you're talking to, in many cases, you're talking to devs. You're talking to people actually making this stuff over in that hall. So it's just a really different energy.

I ate more conference food than a person my age should. It's not that. Don't do that. Bring groceries. One guy on our team was pushing for groceries. We should have listened more. I didn't, my body just sort of hard shut down when I got home. Yeah, your 13th order of spatzel.

Yeah. Yeah. Yeah. No, not good. Not great. Spassely. Yeah. And you're kind of, you're sort of held captive there a little bit because, like, you're

going to go get coffee 35 minutes away off site. It's like, no, you're going to get coffee at the coffee booth. It's the one coffee booth that you can get coffee at. So it definitely. got Groundhog Dayish. The last thing I'll say about is that by the, not even by the end, like midway through, you know, like Tetris effect where you play Tetris and you close your eyes and you see Tetris? I was having that, but for the act of exhibiting this game on a conference room floor, like I was dreaming about having interactions with people where I was like handing them

a steam deck or a controller. And then I would like wake up and go in and do it. And then I would go back home and go back to sleep and be dreaming about it. And I was like, I'm, I feel crazy. I am broken. I can't believe you guys didn't just like slide three or four days of just like lakeside Germany or like go to the Swiss, Swiss lakes or something and just lay on a in a lawn chair and drink my tides for like three days. Would it could have should.

That was kind of what Amsterdam was for. That part was great. Yeah, yeah. That was on the way in though, right? Yes. Yes. Yeah. So that was more of like, because what was your total days in Europe like nine?

Yeah. Yeah. I think I was gone for 10 days. It doesn't matter. Yeah, so you're not even touching getting over the jet leg. And then you're on a plane coming home. Totally. Brutal.

As I age, I hate those style of trips. Yeah, you hate that for me. And I do hate that for you. Yeah. But how have you been? I've been good. Good. I've been watching a lot of tennis, U.S. Open.

I've been playing a lot of tennis. I've been golfing and I've been working. And that's mostly been my life. I went mountain biking to Ferney, British Columbia. Beautiful place, one of my favorite places. And while I was there, I golfed, tennised, mountain biked, and fished, fly fished. So I've been, I had a meeting yesterday where I described living in Canada's north summer as like a fleeting affair we have with enjoyable weather every year.

Yeah, there's like a month where it's the most beautiful place on earth. Like the longest days, the sunniest days, it's incredible. And then it just in an instant goes away. Yeah. And we're getting very close to that transit. Usually it's mid-Septemberish. It is very, very hot here right now. I don't know what it's like in Vancouver.

It's toasty. But I think it was 36 yesterday. 36 Celsius, so that's like a hundred and nine-ish Fahrenheit, I think, 100-something. Above 100. So, yeah, just trying to enjoy the last gasps of summer before we're into snowy winter video game season. Indoor time. which I signed up for the rebounder playtest and wishlist it on Steam, and I recommend all of you do too.

You're far too kind, Scott. Hey, man, we got to use this platform for example. So as I was shouting before we recorded, I have nothing. Like I have a handful of stories I read while I was gone because that has become a compulsion. Anytime I see an interesting tech tale, I do make note of it. But I got nothing prepared. I just have links and subjects to talk about. I've got something.

Okay. Take me through. So this gentleman Bruno tags this on interesting stories on X, and he tagged us recently about a story that I think is just the cross-section of everything that we've talked about in the last few months. It's about vibe coding and AI. It's a cross-section about like taking over like a library, a publicly used library, and injecting bad code into it.

And I think it's great. So I think we talk about this. All right. Let's start here. Excuse me. So a popular NPM package got compromised. So like a popular development package got compromised. Attackers updated it to run a post-and-sall script steal secrets.

But it does so in an interesting way. It looks for Claude Code or Gemini CLI, which are both command line interfaces for some of these like large vibe code platforms. So Claude Code is kind of like this agentic system. Gemini is the same thing, and you can interact with them from the command line if you're a command line developer. Okay. And when it finds Claude Code or Gemini, it then uses those systems because they typically have access to all of the file system. Okay.

So it sends prompts into the Claude Code AI, LLM, or the Gemini one, and asks it to go look for specific things, notably Bitcoin key chains. Because these LELLNs have the access to the file system, they have the ability to rip across the file system and look for things that you ask for because they're your helpful AI assistant. So this malware works by looking for those AI assistants and then leveraging their access to systematically do a bunch of tasks, compile it and return it to themselves, which I think is kind of brilliant. So, okay, take me through because, again, I have two brain cells left and I'm just sort of rubbing them together, trying to get, you know. So someone has one of these systems installed in their computer. One of the cloud code or Gemini CLI, or command line, agentic code developer support AIs. You got some software for vibe coding installed in your system. This malware gets into your system.

It checks your system if you have the. those installed. Correct. And at which point, it basically grabs them, and instead of you vibe coding with it, it uses it to vibe upon you and just go scrubbing through your system for like Bitcoin keys and passwords and anything else it can do. It hijacks the vibe coding system in order to compromise your system more fully than the malware on its own would.

Correct. Okay. So like to go digging, well, kind of, like, like the, Jason to that. Yeah, the thing with these systems is that for them to be effective, they need file system access, right? Like they're opening and editing documents. They're checking stuff into your GitHub. They have so much, we've delegated them so much authority over our data. Mm-hmm.

And that's what the vibe poning is doing. It's taking control of that, that access that we've delegated to it. And it's just sending it prompts. So like the ponage now is not like delivering a rat or something like that that requires a bunch of technical things and might get picked up by a security system or an antivirus or a endpoint detection response. This is just simply saying, hey, Gemini, do you see any keychains in these folders? Can I have them? Summarize them for me. Hey, do we have any API keys for AIs? Like, summarize them into a table and return them to me. You can do all kinds of things.

just plain text and it'll go find it, summarize it, and return it to you. I wonder if the malware has to be, like, is the, I would be curious and maybe this isn't included in the security report, but whether or not the malware has to be pre-baked with all of those like plain text commands to the AI system or if it's a remote thing where once that's on, a person can just have like plain, plain text access of your system, be like, like, can you go ahead and just see if they have any. cryptocurrency and then it goes digging. I think the version that got reported that we got tagged in has a bunch of pre-baked-in prompts

to go look for very specific things. But having it as remote access would not be hard. Right. Like opening up a socket and being able to talk to an LLM running on another person's local computer would be pretty easy. So easy that the vibe coding platform, you could probably quite easily tell it to open up that talk it. Like that could be one of the plain text commands.

Well, what you do is you just have like a package, another MPM package that you just say, hey, go install this package. Like one of the first prompts is install this. It installs a malicious package that does a call back to a server. Then you connect through to it. And then you have full control of the computer essentially.

Wow. Like unless they've put some of the restrictions on Gemini or cloud's CLIs, like you're not allowed to remove files, which is a pretty common one. Like don't don't don't I'm not going to let the AI format my hard drive. Sure. But but aside from that, they pretty much have most access. Yeah, right. So. Yeah. So, uh, Bruno, friend of the show who shared this with us was linking to a, uh,

from a tweet from Zach Overflow and his kind of follow up tweet to this was, uh, this looks to be one of the first documented cases of malware, which tries to coerce AI installed in your system to hone you. And that verb coerce is just so interesting. It's like, I just tries to talk it in you. Because it, to me, that gestures to what the fix to this would be, which is, I guess, finding ways to insulate these systems from, or at least maybe train them to recognize when inputs are coming from a bad source and how you would even begin thinking about that problem, I cannot imagine.

I feel like the easiest way to do it would be kind of how they put the bumper rails on the current LLMs. Okay. So, you know, you're just. training them to not, you know, I don't know, respond with private information, tell you how to build a bomb, et cetera, et cetera. And I feel like they're going to have to do that. But then you're also going to get people that are jailbreaking them. So it's just around and around we go where we stop. Nobody knows. And I feel like the LLM AI security field is going to start having to develop very quickly to respond to things like this because they will be so powerful.

They, like, they already have so much personal information. And then they have all this access now through these coding platforms. So at some point, they will be, like, they are, I shouldn't say at some point. They are currently the target. Yeah. Yeah. Think about the last time you heard a breach story on this show. It always starts the same way.

Someone somewhere saw something too late. An alert buried, a signal missed, an SOC that just. couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already using AI. They created the Aurora Super Intelligence Platform, a fully agenic system powered by the swarm of experts. Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy. And all of this is just off running on their secure operations

A constantly updating intelligence engine fueled by more than 9 trillion telemetry events every week and over a decade of real-world incident response. The system reasons on real signals and real context not synthetic training data. And the result is the new Aurora Agent SOC. It's the first SCC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts. Arctic Wolf didn't try and bolt AI onto an old model.

They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI-driven decision reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy production-ready AI-in, and security operations actually looks like, go to arctic wolf.com slash hacked.

Never feel like cyber threats are evolving faster than anyone can keep up? Last year, 2025 was nothing short of a record-breaking year for major breaches, from sophisticated ransomware operators to AI-enabled attacks that turn defenses on their head. Organizations around the world saw headlines they never expected and cybersecurity teams were tested like never before. But here's the thing. These incidents aren't just news headlines. their learning opportunities.

And that's why Arctic Wolf is hosting a live webinar on February 5th, diving to the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded. And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights into how threat actors are evolving, how defenders are responding, and what strategies can help you stay ahead of the next big breach. It's not fear-mongering.

It's practical, actionable, intellectual, intelligible, intelligible. intelligence from experts in the trenches. Register now at arcticwolf.com slash hacked. On the subject of having a lot of personal information, pivot, this was one that I was reading. It was like batch downloading stuff before I got on the plane and then just mainlining tech stories to be able to talk about. Nice. This was interesting because we've talked about stalkerware before on this show before.

Sure have. Independent security researcher Swarang Wade found this bug in a major stalkerware app called the truth spy, the super critical security flaw that basically allowed anyone to reset user passwords on an account to hijack the account, giving them complete access, not to the, like, when you think about how stockerware works, giving the complete access to a stolen victim data set. So truth spy, the customers often of which are installing this software on someone else's phone without their knowledge or consent, so to put it plainly like an abusive partner, basically. It created the situation where now anyone can break into that account

pretty easily to steal that sensitive information from the person who had TruthSpy installed on their system. The security researcher Swarong Wade reached out to TruthSpy, didn't get a reply. TechCrunch, pals of the show, then reached out to them. The SpyWire's director a guy named Van Vardy Thieu admitted that he couldn't fix the bug bug. quote because the source code was lost. Okay. Yeah. Yeah.

Because it's going to leave that one up in the air. They make it. Firework can't do it because they don't know where the source code is. It's good, good stuff. You know what? You know what that tells me? What does that tell you? That tells me that they outsource the development to some third party in probably Russia, Ukraine, Belarus,

North Korea. And they don't have access to the source code. And probably that backdoor was put. put in by the real developers. Yeah, that seems about right. It's like a fourth time this has happened with TrueSpy. And TechCrunch sort of in tandem has been doing this. They do great reporting on this.

And they've tracked like 26 different of these spyware companies that have had similarly like guffaw inducing breaches and leaks in recent years, where it's just like a comically low level. It's not even like a low level of security. It's like actively malicious compromises probably by a developer who left backdoor in. I'm speculating hypothetically. Hypothetically. We only talk in hypothetics in this show, right? Of course. They've been around for like a decade. They've been rebranded so many times. Like digging into the history of this company is a fascinating one.

They've been called like copy nine and I spy you and MX spy and what like they're just, it's like a little thing that keeps popping up in new places under a new name and then vanishes and then comes back up. In 2021, there was like a 400,000 victim data breach, 23, happening in with 50,000 more people. TechCrunch was able to come across some like leaked internal files showing the truth by also used a money laundering network to process millions and illicit payments. They are now currently rebranded as phone parental, which is an insidious pivot in their branding, if you ask me. But it's the same like same code. code. Same thing. Same infrastructure. So don't use that kind of software and sure don't use

phone parental or whatever they called themselves next according to this. I did see a news article too that Google had announced that they had been hacked in like a kind of a backdoor way. I think it had come through their like a Salesforce channel, but two and a half billion Google Cloud users were potentially breached. Yeah, I think it was Google thread intelligence group, discovered it in June-ish. And yeah, big two and a half billion. Like, I have a number of Google accounts. A lot of people do.

A lot of people. I think everybody might have been employed. They issue you won now. Yeah, literally. It's like, do you want to do anything on the internet? You need a Google account. Yeah, a little bit. Okay, speaking of, that's bad.

That's bad. That's bad. I like the energy of this weird delirious tired version. Oh, that's straw. That sucks. Speaking of Google, I just found this one. So consumer tech side, Google released an announced a new line of pixel phones. They seem good.

They have a bunch of AI features that I think if you were Apple probably look like what you were trying to do about a year ago with Apple intelligence. Nonetheless, one of them, this is just like a fun little thing. There's a live translate feature for phone calls. so you can be talking to someone and it deepfakes your voice into the language. Whoa. Pretty cool. Like an actual genuinely useful thing. But it's,

so my high level of that is I'm impressed by that as a tech concept and that's really cool and good job. There have been like early reports of like it's glitchy and it's new and that they're just kind of coming out. It's people like on phone calls where there's some kind of error. There's like a loop that emerges. Some kind of problem happens. and the deep faked voice just starts screaming. Like actually screaming? Yeah.

In a foreign language. The verge has a, go listen to the Vergecast episode. They talk about it a little bit. It's good fun. Yeah, I thought that was, I was reading about those while I was gone. I don't think I'm a folding phone guy yet because they still cost $2,300 and I don't know what I do with it. But they are, they're cool looking. I'm shocked.

We've talked about this before, but I'm shocked and like mildly appalled. that Apple hasn't released one yet. I suspect. They will next time. Yeah, they have to. I'll plant that flag. They're definitely going to. So as a, I have a, what,

Apple iPhone 14 Pro, supposed to be waterproof. I was supposed to be waterproof. Supposed to be. No one says supposed to be and then like, and it was. So I went fly fishing on the weekend and did some, some deep creek crossing fishing adventures.

I forgot to put my phone into my waterproof satchel that's on my chest, and it kind of flooded. The phone still works. I put it in a food dehydrator last night, and it worked great because all of the camera lenses, so face ID stopped working and stuff, because all of the camera lenses were actually completely full of water, and you can see it.

So a few hours in a residential food dehydrator at a low temperature, definitely don't turn up the heat on it. Manish to do a really good job, and it is back to full functioning, but it is flagging that I probably need to get a new phone at some point. And if they come up with a folding one, I could be tempted by that, especially if it's only a single screen. I would like to have a smaller profile phone that... Oh, you like the little square one that opens up into a normal phone

versus the phone that opens up into a book. I think they're supposed to announce them next week. But I don't think... I'm betting it's not the fold. this year. I'm betting it's like a everyone's doing skinny phones like real thin little little rascals. So I'm guessing it's going to be a thin thin one this year, maybe a foldy foldy boy next year. Foldy boy. I don't know. I feel like when did Samsung release their first foldy boy? It's got to be like seven years ago.

Yeah, like a long time. Yeah. I wonder what they're waiting for. Maybe it's just simply screen technologies, but I feel like they've gotten so good with the folding panels. Yeah. I think they were probably waiting for it to be thin. That's my guess, is that they didn't want to ship something that felt big and bulky. They were waiting for that. And now we're on like, there's been a few, I can't remember if it's One Plus or Huawei, and then I think Opo and then Samsung recently, really super thin book style folding phones. I'm like, okay, that tech is there.

Maybe it's a thinness and then a screen thing. I don't think they, I'm sure they don't want a dud. I'm sure they don't want to ship a, I don't know, five. $5,000 VR headset that 11 people buy or make a bunch of AI promises. Like you don't want to do that to the iPhone. Like that's their bread and butter. It's like you can get a little experimenty on some of the other stuff and that's cool and exciting.

But you don't, you really want to nail the iPhone. The dumb phone concept is always appealed to me. Yeah. Like I would love to have, I would love to have two phones, like one, a smartphone for what I need to functionality and like at work and all the rest of it. and then I would love to have a dumb phone for when I like go away on vacation. It's like, okay, I'm gone for a week. What do I need?

I need title, podcasts. Yeah, sure. Phone maps. Like, I don't want email. Yeah. I was not that I want someone to just. I don't even want text messages, but you kind of need it when you're going to this group. I feel like the Apple Watch with the cellular in it, like with cellular antenna and

ESIM is so close to just being the like pocket watch of phones. where it's like I don't even want to wear it on my wrist. I have watch. Like I want to wear a watch. I just want that tiny little square in my pocket on like a lanyard. And I can take it open. And it's like I can take it out. It's useless for doom scrolling.

But in a pinch I could like. Yeah, throw your AirPods in and make a phone call if you need to. Make a phone call. Put on a podcast even like Scott Spotify or whatever. Like get me that bare utility of a smartphone where I can bring up a map. I can send a message. I can quickly jot. I can shout an email into it, but otherwise, but that's kind of nerfed.

I think that would rule. And it would still be kind of in the Waldgarden if you're in there. I want, that's what I want. You've never had an Apple Watch, have you? No, I haven't been an Apple Watch. Have you? Yeah, I've had an Apple Watch. They're good. They're nice.

So I've never got one with the cellular, though. So it's always been a satellite device. Yeah, exactly. Yeah, I've had a couple, and I've just realized that smart watch is not for me. Like, my first reaction to getting them every time is to just, go into notifications and disable all notifications. I found it really distracting. Yeah.

And it's meant to be like, don't, you don't have to look at your phone every single time you get a notification. But now every notification is a vibration on your bot, like on your wrist. And it's like, well, that distracts me more. I don't have the willpower for that. Yeah. Could you imagine being like an Instagram influencer and having notifications on on your watch? And it's, oh, I got 13,000.

thousand likes on that last post and your watch is just like buzzing eternally on your wrist. The battery dies in nine minutes because it's basically you've turned an electric motor on. Not great. Another thing that I wanted to chat about was a knock on to something we talked about last time we chatted about random things, which was the revenue split between Nvidia and AMD. The trumpet is installed because there's future growth to it as now Trump is. funding Intel. So I think what the government, like, I'm just, this is hypothetical, just me thinking about it. Like, obviously they want North America and more specifically the United States of America to have its own semiconductor industry. Given how important semiconductors are,

it's now a national security thing, you know, like they are in everything now. Like during COVID when some of those, some of those plants shut down, like vehicles you couldn't buy because they all needed semis, like, et cetera, et cetera. So I think the revenue split that he's taking from AMD and NVIDIA, he's now reinvesting into Intel, United States, is like biggest semi-competter company that was literally on its way to bankruptcy to try and make sure that the United States has a semi-company. It's just an interesting follow-up to it because they kind of happened like a week or two away.

it's interesting because it's the first thing I've heard about Intel since the last thing I heard about Intel which is I wonder what's going to happen to Intel they don't seem to be doing very well and haven't been for a while you know what I mean like the story of Intel was like they don't they don't got it right now

they're not and every time they come out saying don't worry we've got it they then proceed to announce something that people collectively go yeah that ain't it either and that had just been sort of happening over and over and over again. And now this. And it's like, oh, that's an interesting choice in where to pile all your chips. You're not going where the heat is.

Let's say that. Well, it's becoming one of those. Yeah, like Intel has been losing market share at AMD for, I'd say, the better part of the last decade in the gaming PC space, the consumer space. then the Thread Ripper series came out and they've been losing a lot of the server infrastructure space and now the AI piece, they weren't even, I don't even think Intel's really been at the table.

Like it's been at AMD, or sorry, it's been in video so dominant AMD chasing. And then Intel is kind of like not even at the conference center. They're still in the train on the way to Cologne. They'll never get there. Sounds like they're going to try. Like I know they've been,

They might. I shouldn't say that. Yeah, they're new. They've done something really cool with some of their announcements. Like Intel's announced essentially stackable Intel Arc GPUs that are specifically designed for AI. And the thing that they've done that's so crazy is made them very cheap. So if you wanted to do like local LLMs, things like that, typically if you want to run a bigger model, it's going to cost you a lot of money. Like you're going to need to buy premium AMD pro level cards. multiple of them and they are not cheap.

And Intel's kind of like, what if we sold them for 900 bucks instead of like 19,000? They might be a little slower, but they'll have the GPU memory to like actually hold a large model in. And maybe as models get more efficient, speed becomes less.

We've talked about this before where it's like cost becomes more important as the like dynamic range on the quality these models gets compressed a little bit. And it's like, oh, even the worst, slowest one is like pretty workable. And it's like, okay, well, then you're kind of just biasing for cost at that point. And the people that make the cheat pickaxes are suddenly in contention. Totally.

Huh. I hadn't been following that one. I'd fully miss that story. I think before we wrap up, we talk a little bit about your intro stories. I think some of them are pretty interesting. The, what was it, 14 megs? Yeah. The gentleman managed to steal.

14 megabytes. And I think they were dangling at six million. million dollar intellectual property theft a dagger above his head for that one. Yeah. Games have big budgets. I get it. But at the same time, I think the game would have been okay. Well, I got two thoughts to that. One, games are very expensive. Extremely. Do you punish based on the intent of the crime or do you punish based on what actually happened? Totally. So 14, yes, it seems insane that 14 megabytes of like machine code or whatever he managed to steal is worth a $6 million fine, but if he had managed to steal the entire game,

the piracy cost of that would have been probably in hundreds of millions. So, I don't know how much. It's complicated. It's very complicated. I don't know how much revenue it was going to do if it was in that hundreds range necessarily. But I take your point that, like, if theoretically he had gotten the entire game and if theoretically he had gone on to leak it, theoretically the cost could have been really intense. The thing I found fun about it was that you get the sense from reading.

the story that it was when they found like a modded PSP, that they're like, this isn't, this isn't just a young ne'erdu well. This is a serious cyber criminal. It's like, no, that ain't what a modded PSP means. Yeah, we all had those. Let's be honest. A lot of people had those. The, I'm actually old enough to remember the half-life theft and the half-life leak. Okay. And, but here's the thing, too, is, is. That was a big one. Yeah, like back in that where's era of the internet, every game got cracked. I remember going into machine code and, you know,

it's not that hard to bypass an activation check and stuff like that. And literally every game got released as piracy. So it was just a bit earlier than it was supposed to be. I think that's it. It's a bummer. And it, like, like he says in the story, the biggest issue there, or one of the biggest issues there was just like the impact it had in the month's prior to launch.

It's like, It did not hurt it. No. Half-Life is still one of the biggest games ever. Did it go on to do pretty well? Exactly. Like the game was going to be fine. It was more just that like you're cooking on this thing and you're about to put it out.

It's a really big deal and you're going to live with it for a long time and it's all hands on deck. And now you have this giant distraction. That seemed to be what the issue was for them. It's just a bummer to be this distracted by something like this when you're about to release Half-Life too. Mm-hmm. And I just for for fun, Googled what Gabe Newell's net worth is. He's worth approximately $10 million. So I think he's doing just fine.

And Half-Life is very critically well regarded, even if you take the money out of it. Like in terms of like you're trying to make some, it's a product, but you're trying to make some art kind of thing. And it's like a Half-Life, too. It's a pretty good, pretty good piece. Well, you can draw a direct line between Steam and Gabe Newell's current. Like, Steam became Steam because of half-life. Yeah. In my eyes, anyway.

And now what they've done with it, now how the success that they found as a platform, not just a builder, is, you know, is what it is. Exactly. It's a, it's like an essential piece of infrastructure of the PC gaming world. And it's a really cool, cool platform. Yeah, no, things worked out okay. And I'm very glad he did. Well, one of the thing, and this is, I guess, the last thing I think it would be fun to chat

about in this regard is having worked on AAA video game titles. Yes. You were keenly aware of the paranoia around leaks. Yeah. Like major, major studios are so concerned with it. You know, they have people reviewing Slack conversations. They look at all your activity that you do on your computers. Like, it is a very serious thing.

One of the games that I worked on had a pretty significant leak. and they were all hands on deck trying to figure out who the leaker was. I'm not sure if they ever did. It wasn't me. Never would do it. But when I look at the leak, coming from a marketing perspective, all I saw was great PR. So like when I saw the leak, the first thing that registered in my mind was, oh, this is intentional. And I get that a lot when I see game leaks.

If I were to be building the communications PR marketing launch strategy for a AAA title, I would integrate leaks into that. You know, they do it in politics all the time. Like leaking a story to the media to get press coverage prior to an announcement or a launch or something to build hype around it. So many of these times, like we've talked about the GTA six leaks. on this show before. To me, that's just good marketing. Like, everybody on the internet talks about it.

And they talk about it not only because it's an insight into something that they're excited about, but they talk about it because it's an insight that they're not supposed to have. Yeah, it's a secret. It's this thing, and you're not supposed to know. Yeah, they got through to the other side of the door that says you're not allowed to enter. The thing I found interesting, and I don't think either of those were intentional, just the response, the way. Agreed, agreed.

I don't think they were. But when you look at the Doom one in particular, where it was this, like the Doom 3 demo was like a big deal. It was exciting. A game, like that game looks passable in moments today. And it's like 20 years old. It was this like, oh my gosh, you've got to see what they're doing with Doom 3. There was this demo at this conference hall. And maybe you'll find images of it on the internet.

You're not going to get to see video of it because that's not how the internet worked yet. Maybe you'd see a screenshot in a magazine. and suddenly this great demo that people were so excited about going around, it's like, well, the number of people that got to experience how good this looked just went up a little bit, not to the point that people were disinterested, not to the point that the majority of people who would ever play it had experienced it, but it was just like a little amplifier on that, like, and it looks pretty dang good. And no reasonable person could expect a janky leaked build to operate properly

that they download it off like a shares site. It's like everyone knows what this is and what it's going to be is going to be pretty cool. The difference for me is leaking like compiled code, like leaking a demo build or a dev build of the game. To me is a much more serious thing. But when it comes just to like video capture of some gameplay like QA testing essentially, to me that's just great marketing. Video totally different. Yeah.

Anytime it's been source code, especially with HalfLife where it was like a whole whole. game and people stitched it together and they did a mid job so it was buggy and crap it was just like that sucks that's just a and a full-blown net negative um and a bad thing for that game 100% um a video comes out yeah like a gta 6 clip comes out and you're like that's just really good news for gta 6 a a game that didn't need much more good news like if if you especially if it's like a sequel to a previous game that was well loved totally all it does is fire that fan base up. That's, you know, slash R slash game name gets pumped.

100%. And just gets ready to put credit cards on wish list items and pre-bys. TikTok explodes. YouTube shorts explodes. Just little vertical video clips. If there's this thing, like the blogs all get a ton of traffic, it's like, it's kind of just part of it at this point. So that, like, when I've been in those environments, when things have gotten leaked, and

typically, like it's never been source code, but it's always like a little story about the game or some inside developer does an interview that they're not supposed to, like an anonymous tip. Totally. I look at those and I'm just like, all this is is feeding a media consumption machine to build hype around the game. And it was shocking to me. Like I saw it as such a positive. And then you go into an all-hand stand-up and it's such a negative. Like the entire team, the executive producer, the V. from like the publisher.

Everybody's like, it's like a bomb went off. And I'm on the Reddit page and everybody's just getting so hyped. And I'm like, what? Where's the disconnecter? You're saying you didn't leak the game. No, I did not.

I would never do anything like that. But to me, when I look at it and when I've experienced it, all I, like, to me, it becomes just part of the communication strategy. of it and it's it's pretty dang good so if you're a triple a studio and you're not doing what they do in politics and leaking out key things to build hype around things maybe you should check it out

because it's pretty dang good yeah a clip or two yeah there's that sweet spot isn't there a pre-trailer trailer trailer so anything else anything else you want to hit about your trip i think that's pretty much you need to have a nap oh i'm a sleepy boy Got too much to do to go nap, but I'm a sleepy, sleepy boy. I got the cat sleeping here. Thank you for your comments that you could hear him in the last episode. Yes, you certainly could last episode. I just found out yesterday that this is a long weekend.

Did you know this? Great news. I didn't know it was a long weekend, but apparently it is a long weekend. Labor Day. There you go. Happy Labor Day. I hope you enjoyed this very weird episode. We'll catch you in the next one.

Take care, everybody.