Hacked - Vegas Gets Hacked + So Does Sony + The Crypto Reality Show

Episode Date: October 2, 2023

On this chat episode we discuss the twin hacks of two of the biggest casino companies in the world, the recent claims of a new hack against Sony, another piece of stalkerware hacked, and a very entertaining looking bit of reality TV programming coming soon. Learn more about your ad choices. Visit podcastchoices.com/adchoices

In Las Vegas, the house always wins. But this past month, the security department did not. That's my opening line. That's my way into this story. I would actually say that the shareholders also lost quite substantially. Yeah, they didn't do so hot either on this one. This chat episode of hacked, we are talking about the recent twin attacks of two of the biggest casino companies in Las Vegas. what we know so far about the hacks that happened this past month against MGM and Caesars.

Scott? Me. You? Just very, very recently, Sony had to come forth and say that they have again been breached. Not sure if it's related. This hack is still pretty new as of recording, but definitely something I want to talk about. And I want to talk about, oh, I've got a couple things to talk about, but I would like to talk about what I'm guessing is probably going to be. the new reality TV show of 2023 that everyone's going to be talking about.

The crypto shark tank killer whales. I've been shopping my pitch for this. Getting ready. Getting ready to go in. Yeah. Yeah. Dear killer whales. I have a project to tell you.

Yeah. No, I can see it. I have some ideas for this show. Let's do it. Let's do it. All that and more in this chatty episode of half. How you doing, Scott? I'm good.

I'm good. How are you doing? Doing good. I'm enjoying the, we're in the, where I live, we're in the 72 hours of fall. So it is cooling, very beautiful, lots of rainbowy leaves, gradients on the trees. So trying to enjoy the last little bits of weather that isn't killing you the second you leave your house. So yeah. Sure.

Sure. You're talking about the, yeah, the four days, give or take where stuff is orange before the six months where it's just white. It's just white out. Yeah, exactly. Just white. It's white. I'm happy to announce the seven months of rain set in over this past weekend. Yes, that's true.

You were into the slumbers of British Depression. Dude, I'm in it. I really am. It hits so abruptly. I went from shorts a week ago to like full-blown Pacific coast kind of rain gear. Jackets and Blundstones. Yeah, you got it. Yeah, nice.

So I'm just like staring at a sun lamp from about six inches away with my eyes held open like the clockwork orange guy just trying to like beam vitamin D into my skull. Well, I think under that rain jacket, something that would look exceptional is one of the new hacked hoodies that are coming very, very soon. Very, very soon. I'm actually just waiting for samples right now. So you've got the merch store set up. The products have been set up. I just ordered a few things to make sure that it's not, you know, bad. And so we're just waiting for the samples.

Then the shop will be live very soon. I think we are coming up on a calendar year since we said we were going to put it up. So good by us. They told us that no one could get an enamel mug made in less than a year. And they were right. It's simply not possible. But we've finally done it. We've got hats.

We've got hats of various types. I'm putting a controversial product in the store. You're a bucket. I'm putting a controversial hat in the store. That I think is going to be on the comeback sooner than you think. I'm not going to say what it is, but I think if you imagine, seeing as fashion is cyclical, something that was like in style 25 years ago, 28 years ago, I feel like it's got to make a comeback.

I feel like it's coming back. So we're putting one of those in the store and we'll see. We'll see the analytics will tell us, whether it's on. the come up or not. I'm so intrigued. You said old-timey hat, and you said 20 years ago, which is not what I'm picturing, but I was picturing immediately like a peeky blinders cap, which just doesn't match with the sort of techie hacked things.

Just paper boy hats. Little newsboy caps. Yeah, totally. I do like a newsboy cap. Don't wear them. They don't suit me, but do like them. Find the day of aesthetic. No, I bring too much newsboy energy just when I wake up in the morning.

Like if I then add a newsboy cap, it's no. I can't pull it off. I can't rock it. I feel like the long Gortex trench, you know, the blundies. I feel like the newsboy cap could fly in that world. Yeah, maybe. I said maybe like I agreed, but I didn't. I'm not sure it's good.

I do really want to talk about the last episode, the one that I missed your interview. I thought it was great. but I think before we jump into that, we should maybe thank some patrons. I think that we should probably thank some of our new patrons at hackedpodcast.com. A really fantastic way to support the show. Absolutely. I would like to thank Heather Scott.

Thank you very much. You know what? I too would like to thank Heather Scott and Chris Fawn. As I conjure the list in front of me, I'd like to just double down on thanking our dear friends, Heather and Chris. Okay. Well, then also we should direct that thanks to a Rachel Jess and a Mikhail Okskowski. Mikhail Okskowski and Rachel, Jess.

Thank you so much. Okay, we're double dipping this whole thing, Rachel. Okay, let's do it. Michael, thank you. I don't know if you've seen the top of this list, but the last one is going to be a trial for even you. I would like to thank Avant. Gardner, which I'm sure is probably not your name. No, but thank you so much anyway.

But it's a heck of a handle and I really like it. Thank you so much, Avant. And last but certainly not least, cool it jidgast. Cool it, it gassed. Cool it gist gist gask. You know? Thank you so much. Whatever your name is, we'd love you nonetheless.

Whatever your name is. I did. Just. drugging in the darkness. Like, you two. Honestly, it really does mean a lot to us. We talk about this before we start recording. Thank you all so much.

I actually know a bit of Dutch and was thinking that this might be some word that I've never heard. So I googled it. And I found a Twitch streamer with the same name. So if that's you, thank you very much. But I could not find a definition or a pronunciation guide for this word. So we are very, very sorry for how bad we've butchered it. We're flying without a parachute. I can't remember what it was, but in the hacked Discord, which you can get access to,

if you support the show on Patreon, it's a lot of fun, very little fun, nerdy community. I was talking with a guy who I believe is Polish, who correctly roasted my Polish pronunciation in a past episode of something. So I feel like for whatever the dynamic is, that I'm good at riffing out a pronunciation off the dome, not that good at it. Well, I'm sure he'll have something to say about Mikhail, because I believe that's also Polish and I apologize. It looks very Polish.

Thank you all so much. It means a lot. Hacktopcast.com if you want to support the show. Okay. Let's talk about the last episode. Sad I missed it. Honestly, when I was listening to it, I was really sad I missed it because the gentleman, Damien,

sounds like totally somebody that I'd get along with. I think he would. Yeah. Mathematical and nerdy. Totally. He was, he was, it was all I look for in a podcast interview partner, you know?

You and him, we're going to have to link you two up. Yeah, he was a really nice dude. He made time to talk with us. He's done a lot of interviews about this, which is always interesting to sit down with someone who has been able to talk through something.

And he's still, he's still really engaged in it. Like he's finding fun, new ways to think about it. He's an interesting guy, unique intersection of tech, law, and a really passionate creator and consumer of the arts. Cool guy. Interesting story. And like we talk about in the episode, it is fun to imagine or interesting to imagine what a less altruistic person with the same idea Damien had might have done with this idea. And kind of just being thankful that it was Damien and his buddy Noah that cooked it up. One of the things I found interesting is when he was talking about the connection to Spotify and

looking at like, you know, cataloging songs based on the melodies that were in use. Yeah. There's a, and it was, I think, a question that you asked him that brought him into that realm, talking about, like, looking at it and evaluating melodies and using AI to predict what it will be good. Sure. There's actually, years and years and years ago, I read kind of like a white paper from this group called Hook Theory. Okay. And it was kind of in a similar thing where they'd taken,

like almost all the pop songs they could get their hands on and essentially cataloged and archive their chord progressions and melodies. Oh, I remember this. Yeah. I've been to this before. This is really cool. Yeah. So when I first saw it, it was literally like a white paper that they had written.

But now there's like software and they have this entire suite of things. But you can be like, I want the first note of my progression to be an F sharp. And it'll be like 76% of the time this is followed by a C. Or like, you know, it'll kind of give you these predictive measures. And then it'll show you what pop songs kind of were constructed using the same mathematical process. So anyway, very cool, very cool little add-on. I'm not sure if it relates, but it'd be interesting to look at taking their melodies and running them through that. And it'd be another interesting way to use the data and marry it up.

I think just a cool tidbit that I would have thrown in had I been there. Yeah, I think it's super related. And it would be cool to almost like take the data set that they created and cross-reference it against what hook theory knows about popular songs and see, okay, well, a lot of popular songs would go from a C to a G minor. How many times does that transition take place inside of this data set? It would also be cool to build the antithesis set or the anti-set of that, take all the back. ads that aren't popular. Yeah. Catalog them and then build the, construct the anti-hook theory of being like, if you started

this with this, definitely don't use this. These songs are bad. Anyway. No, it's interesting. Very, very cool interview. Two things come to mind. Thank you, man. I appreciate that.

And the next, our next fun interview, we won't spoil it. But we're all, all three of us, you, me and the subject are all going to be there. And I think people are going to really enjoy it. Yeah. It's hope. It's hope. It's the last thing I want to say about this, and it's just because you brought up hook theory. So I've been using chat GPT for music. And it's pretty good. Say you're writing a piece of music. And you're like, okay, I'm going from A major up to C sharp minor down to F sharp minor. Generate me a couple options for a next court to go to if I wanted to do a country shuffle turnaround style thing.

You can give it that sort of natural language prompting. And it's really good at help you figure out what the next court is. Really? It's pretty good at it. Yeah, it has, and it, it seems to understand what it's talking about. It's not like when you ask it to do math and it's like, I'm pretty confident, this is the number and you realize, I don't think you know what numbers are. It's not doing that.

It is scraped the right data set to be able to answer some of these questions. But the thought I had was it can write music for me to then play. It can only write out text. the thought I had was, could I get it to play music? Is there a way to wire ChatGPT together so that it could produce something that I could listen to? So... That should be very easy. You'd just be pumping out MIDI.

So ChatGBTGPT can't produce MIDI files, but it can create event lists, which are a plain text version of the information that is stored inside of a MIDI file. You know what I'm talking about where it says at this moment turned this. than this velocity. So what I had it do... Gate open, gate close. Exactly. I went down

Jordan's first programming exercise. I, using ChatGPT, installed a little MIDI library for Python, and I had it write a little Python script to convert event lists into MIDI files. Then I created a prompt to have it take whatever musical prompt I've given it and convert it into one of these event lists,

which I then run through the Python script, which kicks out a MIDI file, which I brought into logic, and I had it play. I had a natural language thing, play some piano chords, and it worked. Wow. Was it good? No, it sounded like shit. It wasn't very good at all.

So you and I both know that music is math. We both know that chat GPT is bad at math. So we can then infer that chat GPT is bad at music. You know what it is? it's pretty good at it's okay at writing music it's atrocious at playing music the second I asked it to play

it was like you want these chords played rapidly then like one two three four it's like no I slow it down you know give me four beats between the core transitions and it just I don't know it had no soul the midi it was kicking out had no soul so we've got a ways to go on that

but it was pretty fun experiment okay so so we can fix chaty BT MIDI the Jordan Blumen project by giving ChatsyPT soul. We have to train it what soul is. I should give it that prompt. Define what is soul in regards to music and then implement that in the generation of my MIDI, please. Honestly, you should see some of these prompts.

We should move on. But some of the prompts I was giving it, once I'd gotten the thing stitched together, but it was churning out really, really bad piano performances. I was like a director trying to coax the performance out of an actor. You're like, no, you slow down. It's soulful. I want you to think about your relationship with this person. I was just trying to get something out of it.

And it couldn't do it. It couldn't do it. Imagine you were a teenage girl in love. Just experienced your first heartbreak. Take that energy and apply it to this chord progression. Exactly. And it's like, do you mean bong? I'm like, no, I didn't mean bong.

It didn't work. But we'll check in in six months. see if the event lists it kicks out or any better than the ones that it was giving me. I think we should give you some commendations. You did your first programming thing. I did. You wrote a bit of Python. You installed an external library and used it in your Python. You probably took input from a command line. Very good. I'm impressed. I really appreciate that. It was such a small deal, it doesn't matter at all, that I brought it up on my podcast for everyone to hear about it. Did you have to parse like the open text, like the event list?

Did you have to dump it in as text and then iterate through line by line parsing it? I didn't have to parse the event list, though probably I could have gotten better results if I did. But yeah, I had to grab the event list as text and bring it into the Python script every single time I was doing this. There was essentially like a little area where I plop that in. So you had like an open variable that was the event list. Exactly. Yeah. I'm sure there's a better way to do it than that.

So in week two of Jordan's programming thing, you can open an external file and read the contents in. Oh, dang. Okay. Next up. So we'll execute three more weeks of Python tutorials and then we'll get back to everybody that listens to this podcast about how you're coming as a junior programmer. Stay posted.

and I'll drop the record whenever I think it's ready. I'll teach it how to chop samples. Somebody must have, this is, we're just completely in digression land here, but somebody must have written an API into chatch EBT. So you wouldn't even need to give it prompts. You could put the prompts inside of the Python file

or type them into the command line as you're generating it. And then you probably wouldn't even, it wouldn't even have to bring the MIDI into, I believe you can play, do you remember original music on the, internet. This might be before your time, but people would input MIDI and it would like essentially be, you'd put a MIDI file on your like, you know, GeoCities page and it would make like bings and bongs and stuff. Yeah, yeah, yeah, yeah. So I wonder if you could actually coach Python into

auto playing it. Exactly. Exactly. scrolling, flaming text and auto loading MIDI. Yeah, there's a reason that didn't come back during the website, nostalgia, a little wave that we're in right now. No, honestly, I mean, you bring up a good point. I think this whole thing, about a week after I did this, I was fiddling around in chat GPT and I was getting some new plug-ins installed. If you have chat GPT4, you can run plugins, they've gotten quite good.

And I was like, this is, someone's just going to make this into a plugin. Like this whole silly work around, they're just going to figure out a way to let it produce MIDI files. It'd be very easy. This is like a plugin ready type thing. It'd be really, really easy. And honestly, it sounds like Dolly 3, the image generation, also created by OpenAI, is going to be woven directly into chat GPT4 in the coming weeks,

which sort of just paints a world where you can do natural language prompts to create images, and inevitably you'll be able to do natural language prompts to create audio files, eventually video files. Like that's, they want to be the big dog. They're probably going to weave it all into that system. and anything they don't will become like market share for plug-in developers. Yeah, Microsoft wants to see it as soon as possible. Okay, Vegas. Let's talk about Vegas.

Let's talk about Vegas. Jordan, what do you think about Vegas? Do you love Vegas? Do you hate Vegas? Have you been to Vegas? I've never been to Vegas as an adult. I have memories of going as like a little kid on a family trip, but I've never had the like modern,

I've never had the full Las Vegas. experience. How about you, Scott? You've never had the Bachelor Party, the Vegas Bachelor Party? No, none of them have gone there. No. I recently went to Vegas. I hadn't been there since I was a child on the same kind of thing, going to see the Grand Canyon, et cetera, et cetera, and just flew in it out of Vegas. But loved it because I was a little skater rat and there were plenty of places, a skateboard, and it was kind of a vibe down there. I can see that. But the, yeah, went back. I was a little bit. I went back. as an adult two years ago.

Some friends that got married in COVID, had no wedding, no bachelor party, no stag party. So we went Vegas to them for like a weekend away. And had a terrible time. Definitely don't think I'm a Vegas type. I do like gambling, which is like, should mean that I love Vegas. But it's just kind of like a, let's just say that the vibe is not my vibe down there.

It was, I didn't have a terrible time. I had a lovely time with friends and ate some good food and stuff like that. But everything's, you know, very opulent, very over the top. And then you leave the strip and it's very much not like that. And it's still kind of like seedy and dirty. I don't know. Didn't love Vegas. Let's just say that.

No reasons to go back. It's one of those places where I know I'm going to have a strong reaction to it in one of two directions. I'm either going to have the intuitive one, which is that this city exists in defiance of God's will in the middle of the desert. everything costs a fortune and I'm not having a good time or it might like twist all the way back around to being like this is the tackiest thing I've ever seen and it rules like I don't know which of the two it's going to be but it's one of the two not to call Vegas tacky it might be a lovely city when you're under the baby Eiffel Tower yeah it like it's definitely got a thing like if you if you're like a conference like defcon or something like great place to have it because you're

probably not leaving a confined area. Yes, sure. Hanging out with a bunch of people. Lots of services, lots of restaurants, lots of things to do. There's always things to do, which I think it'd be the best thing. I think we've got to check out DefCon next year.

But the vibe of it, yeah, the like thousands of like drunk college people, you know. And I don't know. It's an interesting place. Let's just say that. It's an interesting place. Interesting place. Anyway.

What else happens in Vegas? Well, 20 minutes deep into this cybersecurity show, some stuff got hacked. This past month, Las Vegas was the epicenter of a significant cyber attack, targeting two of the most prominent casino chains. You've heard of them, MGM Resorts and Caesars Entertainment. Did you happen to stay at either of those two, Scott? I did.

I think I did actually stay at an MGM property, because that's the thing is like these are such massive consortiums that they own so much. Because I know this hack also affected their, what's the little part in China, the little Las Vegas of China? Why can I not remember? Oh, Macau.

Macau. Also affected their Macau properties. So I think it completely turned off most of their casino operations globally. Yeah, you got it. Macau. There I have been. Very cool place.

You've been in Macau. As you said, I have been to Macau. Yeah, I made the trip when, my partner and I were in Hong Kong. We kicked it over there. Take a crazy, like, bridge. It's really cool. A very cool place.

I think different than Vegas in a lot of ways, but similar in some other ways. But in any case, yeah, so as you said, MGM isn't one resort. The affected properties here, the whole line that they have, Mandalay Bay, Bellagio, Aria, a bunch of different places.

So it's worth talking about the differences between these two. hacks. We're going to get to Cesar's. Suffice it to say it was milder. The MGM resort hack was not just a data leak like we've kind of talked about here before. This was

a real physical infrastructure compromise. Throughout the casinos themselves, just the basic functions of the building were being interrupted. Key cards were not opening doors into rooms. slot machines were going dark. ATMs were malfunctioning. The credit infrastructure for things like

food and beverages throughout the resorts, those weren't working. There's been a slow recovery, but early, I think as of time of this recording, some of those systems still are technically offline. The name of the hacker group, I find interesting, Scattered Spider. That's the name, right? That's who's being implicated as being behind it. Yeah, you got it.

Scattered Spider. Scattered Spider, also known as UNC 3944, scatters swine or ms. Swine or muddled Libra, but the name you hear most is Scattered Spider. So we should talk a little bit more about what happened in MGM and Caesars, but just to give you a sense of it, the high level, like the big headline for Scattered Spider Group is young and social engineering. Best estimates are that they're between the ages of 19 and 22, probably based in the U.S. or the UK, which is pretty novel for these groups.

across a couple of different axes. And the last big important thing is that they're voice fishing people. They work with another group called ALPHV. I guess AlphaVee you might call that. Alph. Who is providing the ransomware is alpha, alpha, who is, I'm not trying to mispronounce their name at all. They're the group providing the ransomware as a service

that's scattered spider seems to have deployed in this hack against MGM. but their role in it was they did the calls. Remember we're talking about some of the lapsus hacks. This one was similar-ish in the sense that right at the beginning of like the first thing I read about this hack, OCTA got mentioned. And I was like, ooh, is this another octa-related one? Because I remember that was coming through. And I was like, so then OCTA eventually came out and said,

yes, we were related in this. There were compromised Octa servers. And apparently they were sniffing, like they'd set up sniffers and stuff on those servers and we're actually using them to expand their access into the domain. Interesting. Yeah, it's like I feel bad for Octa

because I feel like the last bunch of big hacks like this I've read about, they've been not implicated, but like their name is in the credit role, you know? And it's for somebody who makes cybersecurity software and two-factor authentication stuff, when major hacks come out and you're getting talked about as being a origin point or something like that for an attack vector, it's like bad, bad.

So I feel bad for them. I know probably like everything that I've heard, this happens to be more of like a social engineering. They got a bunch of access, use that access to gain more access, et cetera, et cetera, but just another point of interest that they're in the

credit role for this hack. It's tough. It's sort of like market share invites a law of large numbers problem. Exactly. You make by all accounts one of the best products in this category, which has earned you all of this market share, which just means eventually you're going to be involved in some compromises.

Yeah, exactly. Yeah. It's the sharp edge of success. So, yeah, as you said, it looks like they scattered spider collaborating with alpha alpha i gained access to mgm's internal systems on september 11th twenty 23 looks like they posed as an employee that they found on lincoln and called mgm's help desk to obtain internal access uh this is how they were able to get that toe hold and basically just turned the whole operation off you brought this up earlier correct there's pretty severe financial fallout uh there's two

different prongs to this. The first one is just sort of the basic operations of the casino. It's tricky to get the exact numbers right, and we'll talk about why in a little bit, but insider coverage spoke with a professor at the University of Nevada, Gregory Moody, who crunching out an $8 million a day expense at a 10 days of this compromise really being in full swing puts the cost of this at about 80 million. Moody also flagged that the revenue is about $14 billion, which would suggest a $270 a week in revenue. So somewhere in the hundreds of millions of dollars just for interruptions to a casino floor and hotel rooms.

They were like issuing handwritten receipts for casino winnings. They really did manage to disrupt these businesses in a pretty profound way. The other thing is like stock prices. Oh yeah. I fully suspect that they went down here. Let me have pulling this up. I saw enough to know that they didn't go up when this happened. timeline, September...

I think September 11th is when it... September 10th or 11th is when it started and I'm not sure when the news broke. But I think it was pretty quickly after that. The door's not opening. I'm canceling your bookings. September 11th, September 7th was when the attack

was launched in September 11th is when the statement came out. As per a timeline. So let's just put that with the share price. So let's say So funny enough, September 8th, the day after their share price hit a bit of a mid-range high at about 44 U.S. a share. And as of now, it's about 36, 37.

So, yeah, it's down considerably, but not, you know, completely broken. It's not like they took like a 60% wipe, which is good. They still own a bunch of casinos. They'll bounce back. They got money machines. They got money machines. Called humans. It comes through the door.

A little bit. The other thing that's worth bringing up here is that so there's MGM. Physical infrastructure affected, still sort of recovering. Alternatively, Cesar's was hacked at the same time. So it's important to clarify here that we're in like a real fog of war situation when it comes to this. This is all a couple of weeks out. And the people involved in this are social engineers. So there's an element of it's really, really, really hard to know.

know if a statement is coming from a true source, if it is coming from the real source, but they're misrepresenting what happened. Basically, it's not totally clear that MGM and Caesars are being done by the same people. They did happen at the same time, but to wildly different effect. Caesar's reportedly paid a ransom of $15 million to the hacking group responsible for their hack, a negotiation down from the original demands of $30 million. And it seems like they kind of got away okay. They didn't suffer any public outages.

They seemed to have managed to have worked their way through this. It looks like the hackers did gain access through social engineering, but that doesn't necessarily mean it was scattered spider. Sure could. It's a pretty remarkable coincidence if it didn't. But at this point, it's kind of just too early to know. I think that's part of the danger of a lot of these things is we're just talking about secondary reporting. but I read a couple of stories that I won't bring up where claims were made that were later denounced by Scattered Spider on their official blog.

Now, they're social engineers, and that's a pretty great way to engineer a little bit of distrust about the people covering you, but it could also just be that it's really easy to trick a journalist on, you know, a signal chat into thinking that you're a hacker. So it's still pretty early days. The fog of war is thick. We don't totally know what happens, but something went down in Las Vegas. I do know, however, I'm just going to call it Alpha for the sake of it. Let's call it Alpha. Let's just call it Alpha. Alpha, the group, they actually did claim responsibility for the MGM attack, but then they also denied involvement in the Caesar's Act. So I'm not sure.

I'm not sure. You never know. Exactly. What a day on the strip in Las Vegas it would have been. Yeah, I want to go to Las Vegas for DefCon at some point in the future because it seems like it would be. an interesting experience and some great content for the show. But honestly, I would swap it out to be on Las Vegas the week that this hack would have been. I think that would have been quite the experience. I just love, would have been a fly on the wall in, like, the CISO's office or something,

like the chief security persons. Just be like, oh, no. You imagine. This is the worst thing that could have happened. Yeah, the doors aren't opening. All of our systems are compromised. It's amazing. It's amazing when it comes to infrastructure.

how usually the biggest walls are on the outside. So the second you can get through, you can get, like the second you can get the door open and get in the building, it's way easier to, you know, have your way with the rest of the infrastructure. If you think about it in the sense of a crime thing, it's like you break into the gallery. And once you're in the gallery, you get to kind of choose

and, you know, kind of suss things out better. So kind of get that same vibe. Yeah, well, clearly that's what happened here. one lie to the right person and some technical know-how. Pretty much gave him free run of a Las Vegas casino chain. Not even a Las Vegas casino change. International casino change. Yeah.

That's wild. Because wasn't there, it didn't, was it alpha? Alpha, I'm going to call them Alpha. Wasn't it alpha that tweeted out that it was like all of this pain came from a 10-minute phone call or something? It was like they like were, they were mocking it. Yeah. I remember I saw that.

I think I might have seen it on X, on Twitter, on X. Yeah, it's a lot of the press coverage, I think rightly focuses on the social engineering and age and native English proficiency of the hackers. There's something, it's just a little bit different than a lot of these groups to suddenly have a person who, you know, I understand the Western context intimately because I'm from Denver or wherever they turn out to have been from. to be like, no, it's just a lot easier to lie to someone when you share all of that cultural background. We don't know exactly where they're from.

But if those early reports are true, it suggests a generational shift, I guess. Because the Lapsis stuff, they kind of traced back. That was out of Great Britain. So it wouldn't surprise me if this was in a similar. But also, again, too, if your name is scattered spider, I wouldn't. doubted if it was a number of people from a number of English speaking countries that coordinate and collaborate would make sense. Honestly, you really just need one person.

It's like the Ocean's 11 thing. You really need one person for each job on the crew. And as long as one of you is really good at getting on the horn with someone and just bullshit in your way through some kind of a system, that's really all you need. Should we take a little ad break? I think we ad break. When we come back from the ad break, let's get it. into some console wars stuff before we talk about the hack of Sony and then talk about the coolest

new TV show ever. Think about the last time you heard a breach story on this show. It always starts the same way. Someone somewhere saw something too late. An alert buried, a signal missed, an SOC that just couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already using AI. They created the Aurora superintelligence platform, a fully agentic system powered by the swarm of experts. Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the

critical decisions and keep everything trustworthy, and all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than nine trillion telemetry events every week and over a decade of real-world incident response. The system reasons on real signals and real context not synthetic training data. And the result is the new Aurora Agent SOC. It's the first SOC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts.

Arctic Wolf didn't try and bolt AI onto an old model. They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI-driven decision reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy, production-ready AI and security operations actually looks like, go to arcticwolf.com slash hacked. Never feel like cyber threats are evolving faster than anyone can keep up? Last year, 2025 was nothing short of a record-breaking year for major breaches, from sophisticated

ransomware operators to AI-enabled attacks that turned defenses on their head. Organizations around the world saw headlines they never expected and cybersecurity teams were tested like never before, but here's the thing. These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th diving the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded, and most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights in how

threat actors are evolving, how defenders are responding, and what strategies can help you stay ahead of the next big breach. It's not fear-mongering. It's practical, actionable, intelligence from experts in the trenches. Register now at arcticwolf.com slash hacked. Well, before we get to the Sony hack, I have a really important question to ask you, which is PlayStation or Xbox, Scott? Hmm. Tough, tough, tough question, Jordan. Hard hitting.

That's what we do hear it happened. I get, I get asked this quite a bit, actually, by people that I know. Because they're like, hey, you work in the games industry. Sure. How don't you tell me which console I should buy now that you can actually get one of them? Yes, that's true. Here's what I'm going to tell you. I've been a PlayStation ride or die.

Mm-hmm. and I think Xbox is the way to go going forward. I am intrigued. Yeah, so here's my... Talking about that cloud gaming clout? No, I'm talking about the fact that I think when you see how the sausage is made, video games are built often for PC

and adapted to console. So what that means is that the games are, tuned essentially to run in a PC world in a Microsoft structured world often. And the thing with an Xbox is essentially nowadays it's just a PC. So when a game developer decides to release new cutting edge features or, you know, implement better use of the graphics infrastructure, to release that on an Xbox is like a couple of like, you know, switches in the code to release that on a PlayStation is a much larger problem.

So I think just for the fact that the games industry has gone to a ship it and will fix it later structure. Right. I think, I think, I think my recommendation is Xbox just given the fact that the developer community responds to the, any changes in things and fixes that they're, making on the PC in the code for the game. Sure.

We'll hit PCs and Xboxes at the same time, which are often the priority. And then the PlayStation will be the leftover. So I've seen that in a number of large point patch upgrades for certain games, is that the PC version gets better access to new features and field of view changes and things like that where the PlayStation has to wait three, four months for that change. Inside Lane. Yeah, I got you. Exactly, exactly.

Great, great, great analogy. Inside lane. Xboxes have the inside lane and PlayStation's have the outside lane. Well, before we get to the Sony hack. But that being said, PlayStation Rider die. No, I'm with you. I was like a PlayStation kid for years. Xbox's new cloud gaming stuff is really, really cool.

I've been playing Starfield exclusively over, I haven't installed it. I don't have a disc. I haven't installed it on a console. I've still been playing it purely through XCloud. And it's a pretty great experience. It's like loading up Netflix on an iPad and connecting a controller and you're just playing the game. It's great. Very cool.

It's very, very fun. I have Starfield downloaded and have not started it. I think you might like it. Did you ever play Fallout? I did. I did play Fallout. I also played Mass Effect and worked on it. I hear it has Mass Effective vibes, but isn't.

mass effectie. Yeah. I'll say this. As somebody who is excited for it to come out, set up the pre-download, got it downloaded, and never found the time to play. The initial reviews that came out

made me really want to play. And it seems, last I heard, like, its metacritic score has been sliding. Yeah. So I'm not sure what's going on or maybe the game doesn't have as good a mid-game or late-game play,

but it seems, It seems like it went from, oh my God, this is the best thing ever to, yeah. So I'm not sure what the hot change is, but I have to check it up for myself. Well, I'm curious for your take on it. I've been having a good time. I like me some practical sci-fi. Nice. But beep, beep, beep, I'm going to back this thing back up the road.

Xbox, PlayStation, Sony did get hacked, I think yesterday. Again. Again, yesterday at the time of recording. Yes, yeah. It was September 25th. we were recording on the 26th, and I think the announcement was the 25th. Australian Cybersecurity publication, Cybersecurity Connect broke the story of a hack by a new ransomware crew called ransomed.vc.

Ransom.combe.c sounds like a group that'll be pitching at the crypto whale show, but we can talk about that later. The thing that I, so I find the information that came out on this very interesting because it almost sounds like there's, there's, there's, contradicting pieces of information. Like they say that what I've read is that they've compromised every one of Sony's systems.

But that they only have 6,000 files. And if you think about an organization, is like the... Interesting. The amount of files, like, you think about anything. Like, you guys use Unity on one of your games. Like, just Unity alone has like 16,000 files.

Like, 6,000 files is not a lot of information. Unless they're like 6,000 back. of the entire system. Anyway, every system, 6,000 files, and they're not even holding it for ransom. They've decided that the value of the intellectual property is higher than that they would get for the ransoms.

They're actually essentially putting them for sale in the dark net. So it's like, I don't know, it's a unique spin on it. I would have assumed that they would be like we have the entire, like it's not just PlayStation either. They're talking about Sony as a whole.

So it's like a lot of what Sony does in the electronics world is patented. So it's like, well, whatever you steal regarding patented stuff is less exciting to us. We can rip something that Sony makes apart and look at the circuit board and reverse engineer it. It's like that's not the craziest value of IP. The PlayStation stuff for sure,

you know, any of the Sony gaming, Sony entertainment stuff. The Sony, because it was Sony entertainment that got hacked last time, right? It was the theater side, wasn't it? I think it was primarily the theatrical side of things because it concerned a Seth Rogen movie about North Korea, I believe, was the trigger for that. Yeah, right. What a time.

What a time to be alive, George. Yeah. Anyway, so my, it just seems like I would have thought, well, like if they had said that we have six million files that have been like okay. Right. Like now it's a, but 6,000 files. It's not that big a number. What did you get?

Yeah. They posted some evidence of the hack. Like screenshots of an internal login page, a PowerPoint presentation, some Java files, and a documentary of the 6,000 files. But as a date, we don't really know what it is. I think the specific post date that it's supposed to be going live, I guess for sale of September 28th, which were still a few days out from. But they did.

posts some text with this announcement, as you mentioned, quote, we have successfully compromised all of Sony's systems. We won't ransom them. We will sell the data due to Sony not wanting to pay. Data is for sale. We are selling it. The last two were in all caps. But what probably happened is that Sony has good security systems and they ransomed and locked up a bunch of stuff and they were just like, whatever, we have a hot storage over here with a backup of it and just delete it and redo copy paste and they were like well if you're not going to pay we're going to sell it it also like and this is maybe this is just me and maybe i'm talking too much but i feel like maybe they maybe they just copied all the files off of a shared drive like they found a

samba share sitting in the in the network and they copied those files like to have a directory tree and to have like it just like just seems like something that like an f drive would have on it you It's like, yeah, we found this shared internal network drive and we copied it. It's like cool. Yeah, it's going to be one of two things. Either September 26th, they're going to drop this and everyone's going to go, why wouldn't Sony have paid for this? This includes their plans for the PlayStation 6 or they're going to post something on September 26

and someone's going to overpay for, as you said, some files pulled out of a shared drive that Sony decided were not worth any money whatsoever. Sony has announced that they're investigating the situation, no further comment. And as we mentioned earlier, this isn't the first time Sony has been hacked. Sony Entertainment. Did forget, though, the Sony PlayStation Network was breached and 77 million registered accounts were compromised to some degree during that previous hack. A little over a decade ago at this point. I was one of those accounts.

Are you? I was, yeah. Interesting. I guess it technically would have been, too. I think, but if I remember this correctly, I think Sony afterwards prepaid for a year of like a identity theft prevention system. Sure.

I think this was the PSN hack. It was something that I was on that got hacked. I got like a year of like essentially identity theft prevention where it was monitoring a bunch of different websites to make sure nobody was using my information and all this jazz. So I'm pretty sure that was that one. But, but yeah, I do, I do remember that one. That definitely did hit me. So, um, what else was I going to say about this? There was something else that was jumping to my mind that I wanted to say about this. And now it is completely gone. Was it a bomb ass pivot to stalkerware? Oh, was that what popped into your brain?

it could be it is now it is now does this count this is where we're going it is strap in have you have you never heard of pivot this bon ass before let me tell you so a couple of episodes ago

we talked a little bit about stalkerware for anyone that didn't hear that episode and is unfamiliar broad strokes is just surveillance software installed on a person's device without their consent

These are just apps that are meant to pretend to be a Wi-Fi app on an Android device or something, you know, they're hiding in plain sight and what they're actually doing is uploading the user's behavior to an account that the person who installed it, the stalker in the titular stalkerware can see it. Stockerware, not good. No, boino. We don't like it. Talked about it a few episodes ago. And this is a really quick one, but it looks like some hackers went after a, a piece of stalker work called web detective, not detective, detective. Detetive.

Correct. Compromise their servers, accessed users' database, and deleted it. Just deleted all of it. Deleteed all the victims' information devices from the spyware network, preventing the uploading of new data from those devices. And they then posted hashtag fuck stalkerware. So if there was any ambiguity as to why they did this, that can make it perfectly. So how do you feel about this one?

I think it's a cool, good thing to do. So you're fully in the Robin Hood camp? It's really, really hard for me to empathize with the developers of this software. It's a tough world. I get you got to make your racket. But own spy developed by mobile innovations in Spain. It makes a product that I think probably shouldn't exist. And it shouldn't exist, not in the sense that it offers no utility,

but it offers negative utility. It's harmful. It's a bad thing. It does bad in the world. And I think it's pretty neat that this happened. Can I say that? I think I can say that. How do you feel about it, Scott?

See, I've known Jordan long enough and know him morally. Sure. And know that when he picked this story, that he picked it because he's happy about this. Yeah, you can hear it in my voice. You can definitely hear your voice. Yeah. How do you feel about it? I think I've said this before on a previous podcast,

we touched on something similar to this, that it's like, you know, if there's two different people breaking the law, one's doing it for a positive outcome and one's doing it for a negative outcome. Yeah. You know, which one do you like more? Yeah. No, this feels to me like peak plays stupid games, win stupid prizes. Totally.

And having one and a half gigabytes of your very precious customer information get deleted off your servers, essentially nerfing your product. I think that's cool. This makes me feel sentimental for when the cybersecurity and hacker community was more like this and less like Russian ransomware. It was more like, hey, there's people out here doing. bad things and they're keeping information from the public and we've liberated that information so that people know it. Unless of people being like, your hospital can't function and someone's going to die if you don't transfer us $12 billion in crypto. That's like cool. I completely agree. It has shades. It really does of like you can imagine the 90s hacker

movie of like, well, we need a villain. It's like, have you heard of a thing called let me just check my notes, stalkerware? Yeah, that's a really, really good. villain for a band of Robin Hoods to borrow your phrasing. Exactly. Yeah. So keep it up. Last but not least. Last but not least.

I want to take this thing over to a place that we haven't gone, I think, about a month. Don't do it. Let's go over to the crypto corner. Don't do it. Don't do it, George. Do it. Don't take me there. Okay.

Let's talk about crypto. Let's talk about how J.P. Morgan, one of the largest, most respected banks in the world, is now not letting its clients buy cryptocurrencies, citing risks from criminals. Interesting. Quote from Chase spokesperson and email to Blockworks. We are committed to helping keep our customers' money safe and secure. We've seen an increase in the number of crypto scams targeting UK customers, so we've taken the decision to prevent the purchase of crypto assets.

on a Chase debit card or by transferring money to a crypto site from a Chase account. So this isn't a matter of Chase was functioning as a cryptocurrency exchange. This is you can't use your Fiat currency stored in our platform to purchase this product. That's kind of why. Well, you think about it like this, Visa has Visa MasterCard, all Amex, all the big credit card companies have some of the most, and banks wrapped into that have some of the most. most comprehensive risk management, risk mitigation, fraud prevention, department, systems,

AIs that the world is seen. Like, AI's, like, somebody that was into AI, like, banking was like one of the first places where it went. Like the public is seeing AI now, but it's existed in detecting patterns and things that violate patterns in payment processing for a long time. And that is unsurprising that like, hey, your visa card gets compromised. And what do they do with it? They immediately turn real fee currency into money that we don't, can't take back.

There's no retailer at the other end being like, hey. Yeah, sure. I can give you this money back. Yeah, yeah. I get why. From a risk mitigation perspective, it makes absolute sense. The bank, quoting again from that article, cited a study from action fraud, fraud reporting agency in the UK, which found consumer loss connected to fraud increased by 40% last year

and suppressed 300 million British pound sterling. And Chase's hard line in the sand said basically, if you would like to continue to do this, you are free to switch banks. Wow, that's fascinating. But that's a great response. I mean, it's a line in the sand, right? It's just like, listen, the amount of money we end up swallowing because people had their identity stolen that was used to purchase this product has reached such a significant point that we are willing to let you switch banks as long as we don't have to let people buy this product using our bank. Exactly.

Like it's a cost benefit analysis. They wouldn't do it if they didn't think it was going to save the money. and 300 million British pounds that I get how they got there. That's an interesting find, man. They're like, we are a real bank that deals with real money. And if you want to deal with that kind of money, quote unquote money, you can go to another bank. I respect the shit into that, honestly.

I honestly wonder if that's going to come to the U.S. It feels much more European. as we're looking at iPhones with USBCs on the bottom of them for regulatory reasons. It feels like a very European impulse that would take several years to trickle over to North America. But I'm curious. I feel like it's coming faster than you think. I think it might be coming. No, I think you might be right.

Like all the telephone grifters and stuff that want you to give them like Google App Store cards. things like that. Crypto is way better. Like it's as an illegal digital quote unquote currency like or as a place to dump you know profits of fraud

and scam. Crypto seems like a great way to do it. You know, if you're stealing visa cards and buying crypto coins, you know, you can then convert those theoretically back to real money at some point pretty easily versus buying like app store gift cards.

Well, maybe we wrap up by talking about, I wonder if anyone will pitch gift cards on this show. I want to talk about a television program called Killer Whales. Killer Whales. Okay. I'm going to watch the trailer. Buddy, crypto entrepreneurs from all over the world face off against the killer whale judges. You put 10 million of your own money into this project. Are you crazy? I'm kind of crazy.

It's coming in the elementary canal, and it's ending up as decentralized diarrhea. Oh, my God. They are the next Disney. I'm a visionary, and I can tell he's a visionary. So this is a major red flag for me. He's pretty exceptional. Anthony Scaramucci. Come on.

Why is Anthony Scaramucci there, dude? This 90 seconds has some of the best line, like the density of incredible lines. in this 90-second trailer. I highly recommend everyone goes and watch it. So the broad overview, everyone's familiar with the show Shark Tank, where people go and ship like pitch businesses in front of venture capitalists.

It's that, but for crypto. People are going up in front of this panel of judges. It's not really clear if they're actually going to invest in anything or if they're just like judging the projects, but they're pitching their crypto thing. and these people are responding to it. Lines from the trailer include, they're the next Disney, said without qualification or like context.

We want to reimagine water is such an amazing thing to hear a person say. And the way that they're reimagining is that you can scan a QR code on the can to get your board ape or whatever it is. We want to reimagine water. So it is water. So what am I missing? Tell me the other story. When you scan the can, that's where crypto and web 3 is unlocked. I actually think they are onto something.

Oh, my God. That's, I got to say, I got to say this, Jordan. I think I'm going to have to watch a couple episodes. Oh, dude, I'm, I'm fully in. I'm going to watch this entire thing. I hope somebody shows up and is like, here's my pitch. I'm going to steal a bunch of crypto. Do crimes.

And here's how it's going to work. I'm going to get super rich. And they're just like, yeah, you know, proven model. That's very good. I'm going to call up MGM Grand and I'm going to lie using stuff I found on LinkedIn. And then I'm going to hold their casino ransom for cryptocurrency. Be like, yeah, proven model. This shark will invest.

Proven model. I'm in. Yeah. Well, I think credit where credits do. I think the crypto market is still over a trillion dollars in, completely unbased value. So by allowing people to trade nothing, they've literally managed to create a trillion dollars in real money strictly off of speculation,

which is amazing that the securities commission and the Treasury let that happen, but they did. So the, yeah, there's still a lot of money in crypto, like Bitcoin's trading like 26, 26 plus, 26,000, which is still up a lot for zero.

For sure. Only a half a trillion dollars in market cap. Yikes. Yeah. Anyway, this is, this, this, this speaks to me in like a, in the same way that go, that going on Twitter does. Like I only go on Twitter to like, and this is very obvious to anybody that follows us in social media, even I did reply to somebody yesterday,

is I go on Twitter to like see what the world's fighting about. And like to look at the like, like it's like a, that's the right way for it. It's like when I want to see something bad. Like I'm watching the car crash video. Like I see Killer Whales is the same as something like that. Like I just want to. You're talking about hate watching. Let's just be honest here.

Yeah. If that's the technical term for it. That's the technical term. Yeah, I'm just intrigued by it. I'm very, very intrigued by it that, like, it's reached a level, I'm not sure what this show means, but I know it's pretty entertaining, listening to people talk about these types of projects

using the language and narrative framing of a shark's tank or a dragon's den. There's just something really funny about it. The whole thing takes place in the, Batcave from the dark night. It looks like this sort of like weird, low-roofed glowing ceiling type thing. It looks great. It looks like a million bucks.

An idea I had when I was watching this, a sincere idea they can feel free to get in touch with us is there's a concept in crypto. I guess in a lot of investing, FUD, Fear, Uncertainty and Doubt. Of course. People get criticized in crypto. It's part of sort of like the in-speak of if you aren't excited about the project, everyone else is excited about. you're a fudder, fear, uncertainty, doubter. And I don't know if it's its own whole show or a segment on this show, but I think we need to host a fud hole,

which is just people pitching these projects to people full of fear uncertainty. I want to watch, I want to watch fud hole. Well, here's the thing. I'm just on this TV show's website, and they have a token, of course. Why wouldn't they? So you can buy their tokens, which are not a share in their company. Elsa would be trading securities. They're just selling you a token.

I'm not sure what it's for. Like, do you need a token to access the show? No, I think you can just watch it. But people like tokens. I guess. You can connect your wallet to their site, and you can buy one. with money a trillion dollars in to you can buy a token

and then you would have it oh man gonna be interesting on this episode of Fuddle how can I watch the show due to premiere on hello TV I'm on their fact we should do a we should do a watch party

oh we should for this I'm team Anthony Scaramucci sentence I've never said oh man Okay, let's end it there. Okay. Let's end it there.

Vegas hacked, Sony hacked, stalkerware getting taken down. Crypto corner. Then some fun in the crypto corner. Scott, it's been a pleasure. I think I might make a new, like, handle for myself on the internet of, like, you know, like Captain Futter,

like Chief Fudd. Yeah, like, like, I don't think there's anybody that I know that is cynical towards, crypto is me. So I think that I deserve that. We've made a media property about it, dude. Yeah.

I concur. I think that's a great idea. Maybe we should make a TV show. Maybe we should make a response TV show on YouTube where we literally watch killer whales and respond to it. I've never watched response content. It's not my vibe. But like I can see the appeal for it.

No, totally. I, so, man, we're really off the rails here. I love call-in shows. I think it's a highly, it's very popular, but it's still an underrated format. I think they're great. I think call-in shows, you can get a ton of content. You get to hear a bunch of different people's experiences, and you get to spend time with your favorite call-answering host.

And I think a call-in show where you pitch your ludicrous crypto idea at any stage of development to, indignant people just going like that's the dumbest thing I've ever heard in my life. I would watch that. That sounds great. I feel like we've succeeded at our 2020 or we're succeeding. It's not succeeded yet at our 2023 goal of getting a merch store up. Maybe our 2024 goal is to do some form of routine YouTube Live, Twitch, something and do like a, do like a discord, like drag people into a voice chat discord or something.

actually do some video content because I think that would be fun I would enjoy that I would I would I would like that too okay well I would I would I would love somebody who thinks the crypto is the new world order to tell me why the crypto is the new world order and how I've how I've missed the boat so far and so big no I we're circling something here look back and and with that It took us a calendar year to get those hats. But we'll catch you on YouTube shirt soon enough. Okay. Thank you all for listening.

This was a fun one, and we'll catch you in the next one.