Reply All - #130 The Snapchat Thief

Episode Date: November 8, 2018

This week, a new Super Tech Support: after Lizzie's Snapchat gets hacked, things start getting really creepy. Alex investigates. Michael Bazzell's Podcast The complete Security and Privacy Podcast Steps Michael Bazzell Gave Alex to Protect Himself How to port your phone number Password Manager Google Authenticator Yubikey Michael's workbook to freeze your credit and remove yourself from public records websites Sudo Stories about Sim Swapping and OGUsers by Vice/Motherboard By Lorenzo Francheschi-Bicchierai The SIM Hijackers How to Protect Yourself From SIM Swapping Hacks ‘TELL YOUR DAD TO GIVE US BITCOIN:’ How a Hacker Allegedly Stole Millions by Hijacking Phone Numbers How Criminals Recruit Telecom Employees to Help Them Hijack SIM Cards Alleged 19-Year-Old SIM Swapper Used Stolen Bitcoin to Buy Luxury Cars Cops Arrest Infamous SIM Swapper Who Allegedly Stole $14 Million in Cryptocurrency By Joseph Cox 'I Could Ruin Your Business Right Now': Listen to a SIM-Jacking, Account-Stealing Ransom The Organization that Lizzie Donated To Byte Back Learn more about your ad choices. Visit podcastchoices.com/adchoices

From Gimlet, this is Reply All. I'm Alex Goldman. And I'm PJ Vote. And this week, we have a super tech support. Super tech support is the segment on our show where someone writes into us with a problem that is bigger than they can solve. And I try to solve it. Because in your former life. Because in my former life, I was a tech support man.

A tech supporter. So what do you have this week? We got an email from a woman named Lizzie. Hi, this is Lizzie. Hey, Lizzie. This is Alex Goldman. How you doing? I'm good.

How are you? Lizzie's in her 20s. She works with teens at a nonprofit. And she told me that when she was on vacation over Labor Day, she had this very weird thing happen with her Snapchat. Where were you when you realized that something was wrong? I was in Asheville, North Carolina for Labor Day weekend, vacation. I think I was in the car and I wanted to Snapchat something.

I'm pretty sure that I wanted to Snapchat a brewery. that I was passing and send it to my brother because we had been there before. So she tries to open Snapchat and she's locked out of it. What do you mean locked out of it? She can't get into it. But the app isn't working or it's like you've been banned from your account not working? The app is working fine, but she can't use it. Okay.

And she's like, I'm on vacation. I'm going to deal with this when I get home. It's not a big deal. I'll just send the password reset, right? Yeah. So then I get home that night back from Apple. Nashville, like eight hours in the car. I'm exhausted. And then I see three emails come in from Snapchat. One email says your account has been logged in by a user on an iPhone 8. The next email says

the password to your account has been changed. The next email says the phone number associated with your account has been changed. So how are you feeling when you see these three emails? Well, so I'm, I wasn't like, oh, man, something has happened. I was sort of like, oh, wow, I guess I just got to, like, reset my password. But then at that very moment that I'm sort of starting to, like, process that, I get text messages. Lizzie gets these text messages, not through Snapchat, but through her phone. And the first one says, yo, if you try to touch Snapchat Lizard or do anything, you're fucked. I'm just warning you.

I've got your nudes and IRLs. Just don't do anything. We'll be fine. Smiley face. You understood? Jesus. Also, what's an IRL? I assume that means like her...

Like her information in real life? Details, yeah. Ugh. I mean, were there nudes in your Snapchat account that could have been accessed by this person? I wish I could answer that definitively. But I'm not certain. Snapchat has a feature. called memories where it saves some of the photos that you send.

Right. I'm not going to pretend that I've never sent a sensitive photo. So Lizzie reports to Snapchat that her account's been hacked. She's getting threats from the person who took it. And they actually get the account back to her pretty quickly. The problem is that when she gets it back, all of her contacts are deleted and her archive photos are gone, which means she can't tell. whether or not the hackers have the sensitive photos that they claim they do.

Almost as soon as she gets the account back, she gets another message from the hacker which says, give it back, else I'm a smoke you. Oh, Jesus. And then she got one final message, which just said, bitch.

I'm, like, pretty scared. I'd been on vacation, and so I, like, hadn't been alone in, like, five days. And then I'm, like, alone for the first time. And I'm just kind of freaked. out. At this point, did you think like this hacker knew everything about you? Um, I definitely was like feeling weird. And I like remember like maybe two days later, I like go to this yoga studio that's like two blocks from my house. And I just remember feeling like so nervous walking back

from yoga. Um, why? Why? I think just because I was like alone and it was just, it was like very early in the morning. So this consumed you. You just felt exposed everywhere. Yeah. And actually, I also made my roommate sleep in my bed with me. So I told Lizzie I'd try and figure out who's behind this whole thing and just like help her get some peace of mind.

Uh, okay. So I have a lot of work to do. I'm anxious to hear what you learn. All right. Thanks a lot. Okay. Thank you. Bye.

Bye. All right. So what have you got? Well, what I wanted to figure out was who it was who actually hacked Lizzie's account, whether they actually had compromising photos of her, and just generally, like, get them to leave her alone. Okay. So what happened? So first of all, I got in touch with Snapchat to see if the hackers really did have some kind of compromising photos of Lizzie or if they were just bluffing. Uh-huh.

And based on the information that we gave them, that Lizzie has a memories folder on her phone that does. doesn't have any explicit photos or anything on it. They said it's extremely unlikely that the hackers have anything. That's great. Yeah. According to Snapchat, if you'd saved any explicit photos, they would have been in there. It would be in that folder. Mm-hmm.

So pretty sure he was just bullshitting you. Unreal. Love to see it. That's great news. So Lizzie was happy, but she had the same questions that I had, which was like, who had done this? why would they take her account? How did they get it?

And like, if they're capable of getting her account, what else are they capable of? What else of hers can they take? How much of a threat are they? Yeah, because it's just like, she's no idea who she's dealing with, actually. Right. And so I started to look into these questions, and I ended up in a very strange world that I got very deep into. So just at the very start, the first clue that I had was that the threats that Lizzie was getting were over iMessage.

But they weren't from a phone number. They're actually from an email address. And that email address was O at zan.aX. Like, O at Xanax. Oh, cute. Okay. Mm-hmm. So I was like, all right, well.

This is a teen. This is something. No, I'm just saying right now, this is a teen. This is a teen who likes listening to SoundCloud rap. What makes you so sure of that? I don't know. I just feel like I associate Xanax with, like, teen sound cloud rap. And while lots of people take XanaX, I feel like only a teen would make their user name Xanx.

Do you know what I mean? Like xan.aX. Yeah. Did you try emailing them? I did. But by the time that I emailed them, the account had been deleted. Like, it just bounced back. Okay.

So I went to the website, zan.aX. And if you go there, this is what you see. Okay. So it's like a bad tag of the word zan. Or zan. dot axe, actually. That looks like it was done in paint because like the, it looks like dripping graffiti, but when you look at it, the lines are straight, like, MSPaint. And then it says, quote, in like normal font, Maxime. And then, oh, my God, there's like a link for Twitter,

Instagram, Steam, Discord, contact. So this person's like, here's how to reach me now that I've done something illegal and creepy to you. Right. So I go to the Twitter of this specific person. Yeah. And the Twitter account is Twitter.com slash Hades. Like hell? Yeah. Their Instagram is Instagram.com slash fuck. Interesting. Steam account is steamcommunity.com slash ID slash Satan.

And so at this point I'm thinking this is a person who goes by the name Maxime, who just has like a bunch of boutiquey usernames on different social media platforms that are probably really hard to get. And I think that's why he would have targeted Lizzie because her Snapchat handle is Lizard. L-I-Z-A-R-D. Mm-hmm. She was a very early Snapchat adopter, and so she got a cool handle. So basically, like, Maxime was excited because her account name would just be like one more cool account name. He would have, like, a noun that didn't have numbers after it. Exactly.

So at this point, okay, Maxime seems like a hacker. Hackers, in my experience, love to leave little Easter eggs in the source code of their websites. That's a thing? Yeah. Oh, yeah. that. So I use the developer mode in Chrome to look at the source code for the website. And in it, I find it right at the top. It says, zan.aX, Maxime slash Evan slash Seb. In the code. Yes. Ah. So. Evan slash Sev. I guess those are his friends. Oh. So it's like maybe like a hacking crew.

Yeah, it's like a hacking team. Very cool. So I don't think that's cool. Evan has. I think this is like the day that I turned into. It was my birthday. on Sunday. Yeah, you aged out of like... I really feel like I'm a curmudgeon who ate skateboarding teenagers all of a sudden. So, um, the next thing I do is I follow the link that says Discord. And Discord is just a chat room app where you can meet up with your friends. Right.

I don't really use it. I have like one Discord that I don't check very much. I guess I have two discords that I don't check very much. You have two discords for what? One's, uh, with my Fortnite buddies. They're both so nerdy. One's with the people I play Fortnite with To see if anyone on a given Saturday wants to game

It's pretty lame, yeah And then the other one is like Another one that's different people that play video games Where it's just like, hey, did anyone try the new Spider-Man? Is it good? I am on a Discord about good horror movies I don't really have a place to be funny about it. This is like who these loser teenagers

grow up into loser adults Who judge loser teenagers would have the exact same interests. So I joined Maxim's Discord and there are enough people there that, like, they don't notice me show up. Oh, there's a lot of people. There's probably between 50 and 100. And is Maxime active on the Discord? Yeah, he's in there all the time.

Basically, all he talks about are, like, the new Forza driving video game. Okay. Which he got a special, like, steering wheel-shaped controller for. All right. Buying fancy clothes, like Gucci and, um, He has an Odomar Pige, which is like... Sorry, what? Which one? Odima Pige.

What is that? They make wristwatches. Okay. And he also talks about doing drugs a lot. And like 95% of the conversation on the server is just, it's like, they're all trying to be edge lords by, like, posting shocking photos and, like, swearing all the time. I sound like an old man saying they swear all the time. They cussed flagrantly. But they're just kids who are like trying to impress each other with their miscreant badness.

Yeah, they're like really mean to one another and always calling each other names. And this is how everyone on it behaves. It's like bad kid internet high school. Yeah, basically. So I'm hanging out in this chat room, trying to get as much information as I can. But half of the stuff they're saying doesn't even make any sense to me. It's like they speak a dialect that I don't totally understand. Lots of youth culture.

I mean, beyond just normal youth culture, like, Like, this was the first time I'd ever heard any, seen anybody say weird flex, but okay. What's weird flex, but okay? Whenever someone does something where they're, like, bragging about something, the best, like, offhanded response is weird flex, but okay. That applies to a lot of things you brag about. Me? Yeah. You'll be like, oh, I got the first, uh...

Whatever you're about to say, this is not true. Like when you said you watched all the horror movies on some, like, streaming horror platform? That wasn't a flex. That was more like I don't have anything left to watch. and it was Amazon, and I didn't watch all of them. I just watched all the good ones, so all that was left was the ones that were, like, definitely homemade and just uploaded by a weirdo.

Weird flex, but okay. I feel like you just handed me. I'm so mad because I set myself up. And as soon as you said it, I was like, oh, I just, like, I just, like wound that up, and then I just let it go. It felt like you being like, hey, they invented this new kind of thing you can poke people with. It's like metal and it has a handle. Just hold on to it for me.

But there are other things that these guys... All right, get it out. Go ahead. Let me know when you're done. Oh, God, damn. I hate this. Okay. The other thing they were saying all the time is,

do you guys want to HVH? And I was like, what could this possibly be HVH? And what it is, is they like to go play Counterstrike, and they like to turn on every... single hack you can put on. And HVH is Hacker versus Hacker. That's how they play Counterstrike. I don't know whether I'm impressed or annoyed by that.

I honestly, like, I can't tell. There's like a sound in my head and I don't know which one it is. What does the sound sound like? Oh. Okay. So I'm watching this Discord, and I think Maxime is sort of the leader of this gang that hacked Lise's account. And I wanted to find out who he really was. and if he's actually the person that threatened Lizzie.

And I didn't want to just send him a message on the Discord because I was fairly certain that he'd ban me. I saw him ban people in the Discord all the time. Anytime I tried to join their voice chat, because they would use the voice chat function, because they didn't know my handle, they would just kick me out or just ban me from the server entirely

and I'd have to start over. Got it. But you feel like if you could find out who he really was and you like send him an email or whatever, there's a way higher chance he's going to talk to you. Right. And so I'm just watching these guys. guys talk to one another, hoping that he will drop some information that helps me identify him

in any way. And he doesn't. But I start watching his Instagram and I start getting a little bit of an idea of who he is as a person. What does it look like? He posts a picture of himself pretty early on. Really? I guess that's what people do on Instagram. It just feels like a security failure. Right. The thing is that he posts a picture of himself that is obscured in such a way where you only see about two-thirds of his face. Can I see? Yeah. He's using like the Snapchat filter

where you have like cute dog ears and a cute dog nose. Mm-hmm. And he's like he's like a really young-looking, like boy. Like he's got a round face and like pinkish cheeks. And like, like he looks like, he's probably older than this, but he looks like 16 or 17. I'd guess that he's probably more like 22.

And then, also on his Instagram, I find this little video. that has a clue in it. Okay. Interesting. I want to watch it again. Okay, so it's just like zooming in and out with this camera into what looks like... It looks like two ice cream scoops.

It looks like two ice cream scoops, but it looks like they're made out of, like, wrapping paper. Those are two gigantic piles of Xanax. Oh, I am an older man now. And there's an American passport on the side. There's a French passport. Ah. An old man who's never left his own country. Okay, so he's basically just bragging about all this annex he has.

Right. So based on the information I have, I'm pretty sure that Maxime's in his early 20s. I think he lives in France. He seems to really like drugs. He's really into SoundCloud rap. And he's actually a musician himself. Hold on just a second. Here.

Here's one of his songs. This is me if I don't even matter. I don't feel a thing. Almost like I never had it. I know that father's. and she feels a lot sadder because I don't look back any time that I pass her. I don't got the time to play around with the horse. That's exactly why I can fuck with you anymore.

If you came to my house, I'd stand the fucking door, leave you outside while the rain started down poor. That's so bad. Kind of mean? The music's mean? No, you. The music's totally hateful and mean. It's like, I'm going to prove my bona fides by just being like a really weird, sad misogynist. It's like, feel bad for me.

I hate women. are the two messages that that music just communicated. Yeah, totally. Like, the partially obscured image of him, the sad SoundCloud song, like, that's basically all the information I have on Maxim at this point. And as for Seb and Evan, I know Sebs in Stockholm, Evans in the UK. I have a couple of social media accounts and email addresses for them, but that's about it. So I'm in the Discord for a couple of days,

and as I'm watching these guys, I realize, like, they are talking about usernames in a quantity where they would never keep them just for themselves. Like they're getting way more Twitter accounts, Instagram accounts than they could ever possibly use. And a couple days into my stakeout of their Discord, I figure out why, when one of them drops a link to a website called OGusers.com. OGusers.com? Yeah. So here. It looks like every hacker message board I've ever seen.

Like it's a black and gray background and then like garish orange like message board chapter heading things. but just like they're always kind of unpleasant to look at and you have to squint at them and full of incomprehensible computer words. So OG users is like an online marketplace where these guys buy, sell, and trade valuable social media accounts. And what they're looking for specifically

are what they call OG handles, which are like cool handles that would be hard to get, like Lizard, for example. And on this site, you can get OG usernames for pretty much any social media site. So like Instagram, Twitter, Snapchat, whatever.

And if you get the right account, you can sell it for like a ton of money. So how much money? Give me like a valuable name and the amount of money. I saw Antichrist on Instagram sell for $4,000. Okay. Maxime sold it. Interesting. I wonder what is, there must be, the market can't just be hackers selling to hackers.

Like, I wonder who is going to this place. You know what I mean? It's actually kind of hard to know for sure. I've heard stories about actual non-hackers just wanting a really attractive account and buying it from this place, but I haven't seen it. I did hear a story about a representative of Chris Brown contacting someone for an Instagram handle. Really? Yeah. So people on OG users sell specific high-value accounts, but then they also sell accounts in bulk.

They'll get a bunch of sort of low-value accounts, bundle them together and sell them. those. You'll see people actually selling the techniques they use to get the accounts. Oh, they'll just literally sell their methods. Yeah. As a matter of fact, that's exactly what they call them. And you see users saying, I would really like X or Y account. Like there are people who want specific accounts. They're like putting up bounties, basically. Yeah. So I still couldn't figure out much about Maxime, but I wanted to know how he might have hacked Lizzie. And thanks to Joseph Cox, who's a reporter at Motherboard, who does a lot of stories about cybersecurity,

I was able to get in touch with a guy who's a lot like Maxime. He hacks accounts and sells him on OG users. In fact, he actually fronts a gang that's pretty similar to Xanax. Hello? Hello. Thanks so much for taking the time to talk. I really appreciate it. Uh-huh.

He goes by Worthy, and I recorded a very long phone call with him. He was happy to just talk about it. Oh, yeah. Very happy to talk about it. Huh. And to be clear, Worthy made a bunch of claims that I had no way to. of checking. Like he said that he is extremely rich from this line

of work. You know, we run a very, very high ring on the deep web, pretty big. I'm talking about like $8.7 million. We make a year. And he claims to have sold tons of OG handles, including one

Instagram handle, the Instagram handle car, for $70,000. So take everything he says with a grain of salt, but he told me that he and his fellow hacker actually have a pretty reliable method for how they usually get accounts. And it's called sim swapping.

Okay. So here's how sim swapping works. You, PJ, have a phone number. I'm not going to say it on the radio, even though that would be such a good troll. Do you have my number memorized? 610. Okay.

I think we're done here. So what they do is they find out that you have a valuable account and they find out your number. And they call the phone company and pretend to be you and say, I've got a new phone that you need to transfer my phone number to. So the phone company transfers your phone number to the hacker's phone. And then they have logins on all your apps?

They don't have logins on all your apps. But since everybody uses two-factor authentication on their phones... Then they go to Instagram and they're like, I forgot my password. Exactly. And then Instagram sends a password reset text to the phone number, which they're now in control of. and just like that, they have your account. You know what OG users is, right?

Oh, do I ever? Yeah, so basically OGs like that, OG handles, those are easy because it's normal people like me and you. As long as I got the number, done. All I got to do is call T-Mobile, any phone companies, and you'll have it for about 24 hours before they noticed, you know, it was obviously a fraud. But by the time, you know, that happens,

you've already swapped that OG handle, you've got it, it's yours. It's done. I mean, I don't know if this is true, but there's probably a lot of people at T-Mobile who are trusted to port a number. Yeah, like my experience at every phone store I've ever been to is that the people there are moving phone numbers from one phone to another all day every day. Like, anytime you buy a new phone, that's what they're doing. And what they don't think is like, oh, somebody who comes in for this job

might be illegally conspiring with a global ring. of teen jerk wads who are like plundering our customer accounts because they want like funky shits at Instagram or whatever. Right. So, I mean, the sim swapping community is getting, it's getting larger because it's getting easier. Like, it's not challenging at all. Worthy told me that he has this weird little ritual to destroy the evidence where after he

sim swap someone, he takes the SIM card that he used. out of the phone, he tosses it in the microwave, and he blows it up. How many SIM cards are you microwaving a week? A lot. I probably went through like 11 microwaves in probably a month. I mean, I assume you use a different microwave for your SIM cards that you do for your food. Yes. Yeah, so, I mean, if you came in my front door, you know, I should be a whole lot better than this,

but as all hackers, we all get fucking lazy. And it's just, you know, I got sim. I got piles and piles of SIM cards laying on the desk, laying on the kitchen table. I've got it even on the stove. Can I also just say that Worthy made me very uncomfortable? What do you mean? It just felt like he's like an agent of chaos. Like, not only does he sim swap for OG handles, he'll go after Bitcoin, bank accounts,

and he'll go after anyone. Like just for the hell of it. Sometimes we target random people like me and you. We just target them just to see what they got because we got their phone number. We can go on the deep web or any website really, you know, and buy a list of phone numbers. And sometimes we do that. We'll swap them, take them, and see what they got. So it's more of a kind of just pick your target.

Just pick, you see a phone number online, take it. that's basically how it is. We go after everything. Anything that can make us a dollar we take. Over the course of this interview, Worthy told me a lot of crazy stuff. Like, he told me that he'd gotten people's houses sold out from under them. He told me that he'd gotten people's cars repossessed.

Like, he just said that he ruined people's lives. And for all I know, everything he was saying was a lie. But it still freaked me out because it got me thinking about the Xanax crew. Like, they have the same tools. They can read. the same kind of havoc, they can do a lot more than just take usernames. Does he like, is he somebody who would like know these guys or just like he's in the same world?

I actually asked him that. And he told me that he'd heard the name Xanax before, but he didn't know any of my guys. But also, after talking to Worthy, I'm pretty confident that Lizzie wasn't sim swapped. Why? Because when someone is sim swapped, it's not just like, oh, suddenly your account's gone. It's like you look at your phone and you have zero bars. It says no sim. Right.

It looks like your phone before you set it up. Right. So this kind of leaves me where I started. I don't know how Lizzie's account got hacked. I don't know who the Xanax guys

really are. But then this very small window opens up for me. So I'd been watching Maxime and the Xanax crew for a couple of weeks on the Xanax Discord. And they are voice chatting.

But remember, every time they go into voice chat and I try to join the voice chat, it shows that there's another person in it and they just they just boot me out because they like don't know who I am. Right. And then one of their friends decides to, um, hack, uh, Logan Paul's Twitter. Wow.

And one of the tweets he sends out while he's in that Twitter is, hey, join the Xanax Discord with a link to the XenX Discord. That's crazy. So all these, like, because Logan Paul is like extremely YouTube famous and has a bajillion fans. Yeah. millions of fans. And so Logan Paul's fans flood the Xanax, the Xanax Discord. And at first I was like, oh, this is much worse for me because they're getting all this attention.

They're going to hide out. But in fact, it, like, was much better for me. It allowed me to, like, hide in the crowd. And they were kind of strutting around being so proud of how cool they are for being friends with the person who hacked Logan Paul. So they started having conversations in the public voice. chat. Oh, wow.

And just a bunch of people started joining it. And, like, so I just started recording it. Can I hear them? Sure. So the first person you're going to hear in this is Maxime's friend, Seb. And then the second guy with the British accent, that's his friend Evan. I don't know. Remember when we played HVH?

I thought like a hundred bucks was a lot. How much you pay for what? Like 1.2K. Steel. I paid like 2K for AdLoser, though. wait you have a loser on foot yeah it matches you bro you are lose alone

no I need a few more pair of lubeaton's don't like no you don't they hurt they hurt like fucking bitches this is Maxine this is Maxime

this is Maxime right now yeah here I'll play it again no you don't they hurt they hurt like fucking bitches dude I have one pair I'm never buying them again

they hurt so fucking you know I used to wear like the easiest the fucking 350 is like

all the time and then like everyone in Paris started getting pairs because they're like it's not limited anymore like everyone

has a fucking pair it's crazy to actually just get to hear his voice I know he sounds like a French nihilist I got so mad

and just like don't wear them the Yeezes stopped making me happy Gucci Aces are like my favorite fucking pair of shoes

yeah I mean, they're really nice. So when they talk to each other, it's the exact same as when they're talking in the chat. Yeah, basically. I mean, they spend a ton of time talking about buying expensive designer clothes and a lot of time just humiliating each other in like really unpleasant ways. And I feel like I got a better sense of who these guys were by listening to these conversations. For example, I caught this one little moment of conversation where they were talking about how a couple years ago, Maxime had told him that he was going to commit suicide a bunch of times.

Really? Yeah. And honestly, I find the way that they talk to Maxime about this pretty upsetting. Like, Maxime was talking to Seb at one point, and Seb is like... I remember when we all bullied, like, Maxime, like, when... Oh, my God, dude. That's so sad. For real.

We just to joke about you all the time when you were, like, retarded. Yeah, you know that should actually make me sad because, like, you guys were, like, my best trends at the time. But now we're like, no, no, now we don't bully you that much because you don't do it. Yeah, but like, back then, like, I knew, I knew what I did was fucking retarded and I regret it. You faked suicide 12 times. If that's not dumb enough, I don't know. I mean, no, sometimes I actually, like, tried, but, like, I know what I did was retarded and I know I was a huge retard back then. Yeah, I regretted. About it now, it's fine.

Yeah, I'm better now, that's for sure. But, like, just like, that's the past now. I don't care about it. We went from being, like, poor fucking HVHR to, like, rich fucking retards. Yep, pretty much. That's weird. That's sad.

Yeah. And that's all I learned, because shortly after that, they kicked me out of the voice chat. And at this point, I still don't know if Maxim is the person, who hacked and threatened Lizzie, or who he really is beyond, like, a few details. But I found someone who said they could help me figure it out. After the break, I find out just how huge a mess I've stumbled into. Hello?

Hello, this is Michael. Hey, Michael, this is Alex Goldman. How you doing? Alice, pleasure to talk to you. Doing real well. So I got in touch with this guy named Michael Bezell, who's actually a listener who wrote in at one point to offer his services because he's a cybersecurity expert. Getting a level on your voice. Could you do me a favor and tell me what you had for breakfast? I had nothing for breakfast because I gave a keynote and I never eat before a keynote. Because of nerves?

No. I think it's just better on an empty stomach. I think I can speak clearer and I'm not holding back a burp. I just choked on a little bit of trail mix I ate earlier. He used to work on the FBI Cybercrime Task Force. Now he's a security consultant. actually consulted on the first season of Mr. Robot. Cool.

And he told me basically like... Oh, what a nerdy reaction to that piece of information. Um, and what Michael said is that he has a bunch of databases on his computer, and he can do searches that are way more advanced than I can do. And so, if I can give him the social media accounts and emails that I have for Maxime and his pals, he'll look for them. So how do we go about doing this? Like, should I just give you the information right now over the phone? Should I email it? Like, should I email it to you?

I've got one of my machines pulled up. If you have an email address, I'll take a quick look and just see if the person's even exposed or not. Oh, let's see here. The one that I have that I'm kind of most interested in at the moment is Maxime, M-A-X-I-M-E at X-ZAN. Okay. So he runs Maxine X-ZanX email through the database. So I'm getting nothing back on that one at all. That one's pretty much, which tells me it's just not used publicly. It's probably used for this thing. Nothing comes up. Okay. Then we try with Sebastian and Evan, also nothing. So Michael told me he's going to try a bunch of other ways to identify these guys, but he thought it might take a few days because they are very good at covering their tracks. And so I say to him like, look, at this point, I'm starting to get really nervous because I'm trying to expose a group.

of hackers. Who do not want to be exposed, is their official position. And I'm actually starting to feel really afraid because I don't have any idea what this particular gang of kids are capable of. But what I do know is that Maxime is credited with a hack where 135,000 accounts were stolen. And so at this point, I'm like, I'm poking a hornet's nest. I want to know how badly I am going to be stung.

Well, I'm glad you're at least thinking of that because if this comes out and you uncover one of these, they're going to unleash this fury on you. They're going to docks you and they're going to probably try to post a home address or something like that, which maybe has happened to you before. So I would just prepare and accept that all that's going to happen and then identify which of those things bother you the most and do something to maybe help, you know, remedy that. So I asked Michael to do the exact same kind of search that he's going to do on the Xanax Boys on me. Just to get a sense of like how vulnerable I would be, my mind. assumption is like he'll find my address he'll find my phone number and that won't be great but

that's what he'll find and what did he find am i clear to say anything that i find yeah yeah go ahead does the password go go 13 mean anything it's an old password g-o-l okay so that's an old one that's good to know um oh this is good go-go-13 exclamation point come on you just added an exclamation point to your password? That's still my old password. Okay. So he finds my old password and then things take a turn. He pops up my address in no time. And it just gets worse from there. Your social ends in is that sound right? Yes. Okay. Did you have a driver's license in Texas? Yes. Okay. Do you have a brother named Dylan? Is that you're right? Family line. That's my brother. Okay. And I found Sarah's date of birth and her social Indian in F, Father Mark, Mother Mary. Does that sound right?

Yep. It is like getting punched in the stomach over and over again. It felt so bad. What else was he able to say? Like, I don't know if you know this, but I have a second middle name. You do? I do. Really? Yeah.

Michael, Alex. Tara Bello. No, you don't. I do. Really? Yeah. But I don't really use it. Are you messing with me?

No, I'm not. Terabello? Yeah. You're not messing with me. I'm not messing with you. That is like, that is really, really the feeling of like, oh, I thought, I didn't realize that like my clothes don't cover my body in the back. And I wear the same clothes every single day.

Where I would have went from here, which I did not do because I did not have your consent, I would have went to annual credit report.com. I said I was you and requested your credit report because I have everything they need to give that to me online. Cool. How long did all of this take you in total? Phase 1, 11 minutes, phase 2, 20 minutes, phase 3, 18, 20 minutes. So that's roughly an hour. And I'm not that good at this. So the people coming after you, they will do better.

So at this point, I am very worried. And not just for myself, but for my wife and my kids because like all my information's out there anything that anyone would need to swap my house which is something that I've seen people from Oji users do before anything that people would need to sim swap me and get into my bank account. Yeah. And so I asked Michael like, okay, what do I have to do to keep this from happening? And so he told me what I needed to do. And it is so much more involved than I ever could have imagined. Like just for starters, I have to change my phone number. Get a new phone number and never use it for anything. Don't even call your friends with it because let's say that you call me with that new number and I put you in my contact list and

then I download some rogue Android caller ID app that shares my contact list with the world. Well, now all I have to do is search you through that app and I get your cell phone number. Michael, can I just say this fucking sucks? I've had that phone number for 13 years. I've had my email address for 18 years probably. I think I got it in 2003 when I was in college, 2002. It's time to let it go, man. Now, let me offer something you could do to make it less painful. You can take your current cell phone number and port it over to Google Voice and still own the number, still get your messages, still get your phone calls. You can still use that number, but it's no longer tied right to your SIM card. That's smart. That's a good idea.

Yeah. So you have a new phone number? I have a new phone number. My old phone number is on Google Voice. That's why you've been texting me. When you text me now, it comes from an email address. Yep. Like the basic problem with this whole system is that we treat a phone number, the thing we give every single person, like it's a really good password. Kind of. The tech companies are like, your password has to have seven upper and lowercase things and be completely unique and blah, blah, blah. But if you forget it, we'll just use your phone number.

Right. So your phone number is like your social security number now. Right. And we should be protecting it, not giving it out. Okay, so you ported your phone number into oblivion. Mm-hmm. And that was actually just the first step. He wanted me to have a password manager.

He told me to get a separate email account for every account I create on any website. He told me to freeze my credit with all the credit report companies. He told me to get a UB key, which is basically like instead of two-factor authentication where they send a thing to your phone. Which is a little thing you put in your computer. It's just a little thing you put in your computer. I have a UB key. You do. I do have a UBK.

actually. Wow. And then I got this program called Sudo, which gives me nine burner phone numbers that I can use to call people whenever I want. And you live in a bunker underground now. That is a crazy amount of stuff, though. That is really excessive. Is this assumption that these kids are using this level of security hygiene? Yes. And that's not all that I did. He gave me a list of like 80 websites, like Intelius and white pages, places that have my personal information on them and how to remove my personal information from them. Hi, my name's Alex Goldman. And I'm calling because my tax records are listed on a website called njtaxrecords.net. I actually had to call one of the websites. One person in particular, I had to go through old Who is records to find a person who

had posted my tax info on their website. And you were like, hey, could you knock that off just for me? Yeah. And he was like, yeah, sure. I hate the internet. Okay. And then the last thing he told me was to go to my local police and tell that I might get swatted.

Did you do that? I did. So it took me about two weeks to do all this stuff. I told Lizzie everything she needed to do, and then I called her just a check-in. I've changed my life. Tell me about it. I mean, now I'm on my password manager,

two-factor authentication, all these. I've changed my ways. But while we're on the phone, Lizzie tells me that even though she got her Snapchat account back, it's totally sullied for her now. Like a lot of the new contacts that were added when the account was hacked, they've been sending her stuff. I can't use it.

It feels like violated in my phone. I don't like to go into the app. What do you mean? Like I had to actually block someone for sending me a lot, a lot, a lot of pictures of their penis. I mean, it was like really actually became very vile and like many, many times a day. I'm sorry. That's really gross. So I was hopeful that Michael would get me good info on these Xanax guys and tell me who had taken Lizzie's account in the first place. But Michael gets back to me and says he's tried a ton of different tactics, but he can't really find much.

That sucks. Yeah. I mean, Michael worked on this for weeks. He brought in like a co-investigator. But, you know, these hacker kids, they're pros. So I was really disappointed. And I was at a loss for what to do next. Like I felt like we were at a dead end. But then this little thing happened that threw everything up in the air. That's after the break. Welcome back to the show.

So here's what happened. We found a thread on an OG user's copycat website called OG Flip. And it was a posting by Maxime's friend Seb that said, hey, if anybody wants a one character Xanax email address, you can have it for 50 bucks. So like they have a side hustle of selling email addresses. Just at zanx.com. Zan.a.x, right. So there's a chance that O at zan.aX, the original email account that originally threatened Lizzie was not Maxime or Evan or Sebastian. It could have been just somebody from one of these message boards who bought an email.

Right. And then one day this user who's constantly changing his username, so I'll call him Charlie, is trying to impress a girl by buying her the Snapchat Hedgehog. And out of nowhere, he types, L-O-L, lizard, I pulled that. I couldn't believe it. Wow.

Just like an out-of-now-where confession from Charlie. Yeah, it was amazing. It was such a delight. You were literally just staying there watching the Discord? Mm-hmm. So I just wanted to confirm that he was actually the person who did it. Right. So I go to his OG user's account.

It says that he has the Snapchat Wild. And Lizzie had sent me a screenshot of all the new people that had been friended in the account since it had been stolen. And Wild was one of them. Seems good. And then not long after that, he posted a screenshot from within the Lizard account with Lizzie's name on it. That feels very conclusive. So I start looking through his conversations and I notice that around 10 a.m. every morning, he starts talking about having to go to school. So I start to think, like, oh, he's on the West Coast and he's in high

school. Right. So on the discord, Charlie's like obnoxious and blustery. He totally blends in with the Xanax guys. But he also describes himself as like this shy kind of lonely kid who doesn't really talk to many people. He honestly seems kind of harmless. So I talked to Lizzie and I'm like, hey, we've really narrowed it down. We think we know who he is. Like, what do you want at this point? And she was like, well, you know who he is. I want an apology. So I guess that is, that is kind of of the outside of the criminal justice system, it's like the highest punishment you can extract on a high school. It's like, you're going to sit down and write an apology.

And you're going to write it a hundred times. Yeah. So she wants an apology in what form? Well, in the intervening weeks, I've been sort of giving her progress updates on this. And I told her about the Discord, the Xanax Discord, the OG users Discord. And she started hanging out there and just watching people. So she's in there herself. She knows what's up with Discord.

So I was like, why don't we hop on Discord and see if we can get them on voice chat? So Lizzie and I meet up at 11 p.m. Eastern on Discord, 8 p.m. Pacific Time. Hello, can you hear me? Hello? Can you hear me? Yeah. Excellent. All right, here we go. I said, yo, you pull Lizard on Snapchat?

Oh, nice. He wrote back at LMAO. And I said, is that a yes? And he said, that's an LMAO. So I post a screenshot of him saying, I pulled the lizard account. All right. You send it?

Yeah. He says, Obviously a joke, all those snaps were cracked. If you owned lizard, you're a big dumb. Your boy told me you didn't even put 2FA on. She just reverted with the revert link. He thinks you're an angry contraband customer. He thinks I'm an unhappy customer.

Okay. And so I start asking him if he can hop on voice chat, and he's just like, I don't know. I wrote, so my name's Alex. I'm a journalist. And the owner of Lizard is on Discord, is on Discord too. And I was wondering if you'd be willing to talk to her because she's curious about what happened. Cool.

All right, bombs away, guys. Oh, he says, sure. What? You there? Yeah. Hey, how's it going, man? Good. Lizzie, if you just want to take it away, you have questions.

Why don't you go ahead and ask them? Uh, yeah. Why do you want my account? Uh, your username was OG. Like, you know what that means? Yeah, I know what that means. So, pretty much. Why do you, why do you want all these OG handles? I don't know. It's kind of like a person buying designer clothes, but on the internet. It's like a flex.

But my friend, he pretty much cracked your Snapchat. He doesn't like, active Snapchat, so he sold me the login for like, I don't know, like $100. And I resold it for like 1.5K. What? Yeah. So Charlie tells us that he's just the middleman. Like a friend of his steal Snapchat accounts in bulk. Then he sold Charlie like seven or eight of them for relatively cheap.

Lizard was one of them. And then Charlie flipped the lizard account to another guy for much more money. Got it. Okay. So he's basically like, I didn't do anything. wrong. If you don't mind me asking, like, how long have you been into OG accounts? How did you get into this? Yep, he's gone. Oh, oh my God. And I'm like, that's it. That's all I get with this guy. I am definitely not getting Lizzie's apology. Yeah. And then he sent me a message that said,

my dad just walked in, LMFAO. I can talk again in five or ten minutes. We're just waiting for him. It felt like a real compliment when he told me that my handle was OG. I can't believe he said yes. Hey, are you there? Yeah. So then, Lizzie asked him about the threatening messages. Were you the one that was texting me? Someone was texting you?

Yeah. That wasn't me. That was probably the person I sold it to. Like, really messed up stuff. What did they say? Did they do anything? No, they were just threatening. Yeah, that was probably the person.

person I sold it to. So I was like, okay, so you're saying you're not the person who threatened Lizzie. Who threatened Lizzie? And what he said was like, I don't want to tell you who I sold that account to. He is a bad guy. And he was like, something, something bad's going to happen to me. Like, I'm going to get doxed. Uh, if I get dachshed, I could get swatted. Like, that's just bad. Did you believe him? He seemed very, it was the most nervous, this relatively laid back and kind of quiet guy got. Interesting. And we have like a very long, very circular conversation with this kid where we're just like,

Lizzie's asking him questions, I'm asking him questions, we're like, why do you do this? And he's just like, money. You know, he's like just really kind of blazze about it. Even though you're not doing it, even though you say you're not doing anything illegal, you're still part of an ecosystem that's doing illegal shit. Like does it bug you at all that you do that stuff? well I mean like she got it back so but that's not the point dude

I don't feel as bad but I do feel bad that people texted you like I wouldn't have done that that's pretty messed up and that they deleted all your friends and pictures like I don't I don't really like that have you ever thought about the people whose accounts are being hacked well no not really

why did you agree to talk to us I don't know, I'm bored. And he was like, why don't I get the guy who actually stole the account and sold it to me on the line? Whoa. Was it just him talking in a higher voice? He brought this guy on the call who told me to call him Kevin. Is your friend on? Yeah, he's on, but he's muted.

Hi, hello? Yeah, I don't know who's talking. Hi. Hey, this is Alex Goldman. I'm a reporter. Yeah. I told Kevin what happened, and he was. like, I didn't mean for that to happen. My deal is that me and two of my friends wrote a script

that cracked Snapchat's. We set it up to look for handles that were among the most common words in the English language because those would be more valuable to sell. And then I just used the top 500 password list and just happened to pop up. But I didn't sell your account in the beginning because it was active. But then after like a month, I re-signed in and it still worked with the same password. So I just assumed you didn't care or you didn't use it. So then I sold the account. And was she, did she, like, was her password one, two, three, four, and had she not used it for a month? She hadn't used it for a month.

And her password, she hasn't told me what her password is, but it was definitely among the thousand most common. Okay. So the thing he's saying could actually be true. Yeah, totally. Whoa. So wait, can I add you on Snapchat or is that like a big no now? Absolutely not. Also, I don't really use that violated Snapchat anymore.

So wait, what? You can't at it? You don't even use the Snapchat and you're making this big deal? You know, the person my shoulders who's like removed all our friends. Imagine that someone broke into your house, rifled through all your stuff. Ye. And it, and like afterward you're just like, I don't want to go into that house anymore because... Wait, wait, wait, wait. So you're comparing a Snapchat account to a house?

I'm comparing it to a violation of a person's personal security. Uh-huh. It sucks. It's a shitty feeling to have someone break into your... your account. Exactly. Terrible. But I don't understand how that...

You're making it way more serious than it actually is. It's a social media account. I felt like he was just ignoring how scary these threats were to Lizzie. Like he was focusing on the wrong thing. Right. So the four of us ended up talking for a long time.

And Lizzie, she just started asking Kevin about himself. What's your job? I'm curious. What's my job? I work as a cashier at a grocery store. I'm not a hype beast or any of that crap I would rather save my money than spend it on some shoes or car or whatever

So you don't have yeasies No dude do you know how much they are they're like How much they are? I don't even know how much they are like 500 plus right They're like a thousand Yeah that's crazy imagine that dude I gotta pay less Post your shoes man post your shoes Okay hold up I gotta take a photo Give me a second

Yeah I'm uploading my fine. You know, we out here balling. You know, look at my, look at that. Oh, are those A-6? I think they're like $13 on, huh? Are those A-6? No, they're champion. How much were they?

I think, like, I think they're like on sale for $14 or $15 right now. Well, I got two pairs. There was one moment where Kevin had just, just gone to do his laundry. He was like, hold on, I'll be right back. I have to go do my laundry. And then Charlie launched into this thing where he was like, yeah, you know, I feel, I feel like this. And he was like the first moment where I was like he seems kind of, vulnerable. Yeah. How do you feel

about talking to Lizzie for an hour? Does it make you feel any different about what you do? I mean, yeah, like, I kind of stopped the whole OG thing like after I sold the SNAP. Hello? Yeah, I'll be back. Kind of gives me another reason. Closes and washer. To why I quit.

Hi. Say again. Oh, my bad. So, like, after I sold those Snapchat, I kind of stopped, like, selling a lot of OGs your names. Mm-hmm. And, like, I feel like this kind of gives me another perspective of like why I kind of stopped. Like, it's more than just money. Like, you're affecting real people.

And you don't really think about that when you take people's accounts. I'm glad to hear you say that, even if you don't mean it. Toward the end of the call, I asked them both to apologize to Lizzie, but we basically just got mealy-mouthed I'm sorry is that they clearly didn't mean. But like, I'm sorry. Like that sort of teenage monotone apology? Yeah, exactly. it was kind of a bummer.

All right, guys, stop breaking into people's accounts, okay? Yeah, okay. Yes, sir. All right. Wait, wait, wait. Wait, can I like plug my Bitcoin address? Fuck, no. Bye.

I mean, I'm glad that we got to talk to them and figure out what actually happened with Lizzie's account. But it just sort of felt like that's it. Like, that's all we get. And then the next morning, I wake up, I open up Discord, which is what I always do. Because I wanted to, basically, I wanted to see, like, if they had named me and if there were going to be people harassing me. Yeah. And I had a message from Kevin, which was like, hey, I wanted to get in touch. I think Lizzie might have blocked me.

I want to talk to her again. Huh. So I was like, okay, cool. What time? And he was like, let's talk at 1130. That's when I get off my shift at the grocery store. Uh-huh. There you are.

Hello? Hey, how's it going? Great. How are you? So Lizzie and I get back on the phone with him. Hey, can you hear me? Hello? Hey, how's it going?

Hey, how are you guys doing? Hey. Hi. And he was like, he was like a completely different person. Yeah, last night after the call, I feel, I don't know, it felt weird. I didn't like how I introduced myself and how I, how I talked to you guys. So I just wanted to come back and apologize for what I did and how everything turned out. If I knew you were going to get harassed or threatened or whatever happened, I obviously wouldn't have taken your username.

And he was like, getting hacked sucks. I know. I didn't think that anybody was using the account. Being threatened is awful. Not too long ago, I got doxed. They contacted my big sister and my little sister and everyone. And I was just, yeah, scared. Can I ask you, what did it feel like that day that you got docks?

Like, what did it feel like just like walking around in the world? I was still at my grocery store job. And I don't know. I just, I was really paranoid. Yeah. It is like, I mean, it's weird to like hear you say that. I just like remember looking around just like not knowing where in the world this person was. And like if like they could have figured out like where I live and like it's just it's like hard not to get paranoid. It's just like creepy like violation. They figured out everything about me.

I actually just recently moved because, well, not because of it. but I kind of pushed my mom into moving into a new apartment because of it because they found out where I lived in my old phone number and everything. And yeah, no, it was terrifying. They told me they were going to swat my high school and so on. So, yeah, it was, it was not fun at all. I guess I'm wondering if this is changing, if this is going to change the way that you behave in the future. How I do things? Yeah.

I don't know. Honestly, I don't want to sit here and lie to you and say that it's changed me. but I don't think I'll be cracking accounts anymore because I just don't think it's worth all the drama or not drama but all the backlash if anything does happen I don't know how to phrase it I don't I don't mind exploiting like a big company like Snapchat but I wouldn't like sim swap someone

or a harasser threaten or doc someone or extort them for money or anything like that and then he was like look do you have a Bitcoin account She was like, yeah? I sold the Snapchat for 100, so I'll just send that directly back to you. So you can do whatever you want with that, since it is rightfully yours. Lizzie, do you have your Bitcoin account number handy?

Yeah. Do you want to drop it into the... Yeah, yeah, let me... It's super long, right? Yeah, yeah, yeah. Host it, yeah, yeah. It starts, it's usually with a three. You have Coinbase, right?

Yeah. Yeah, let me boot up my ledger. All right, I sent it. Yep Got it Yeah Thank you Yeah of course

Yeah you can do whatever you want with that If you wanted to donate it And go for it And if you want to keep it And buy groceries Go for it Awesome Hey uh

Thanks for letting me I mean letting me talk again Yeah I knew I didn't deserve it after last night Because I was a complete jackass But yeah thank you I just had to say sorry again Yeah

Have a good night guys Take care You too Yeah see later Bye Bye Bye Bye

Oh, my God. Lizzie. Oh, my God. That was so nice. And he, like, lives with his mom, and he does the dishes. And he, like, he's like, yeah, I just am, like, trying to, I don't care about, like, exploiting large companies. I don't know why that part is sweet, but it's, like, I don't really take issue with that. Well, this has been, like, a real adventure.

And I'm really, I appreciate you letting me go on it. Yeah, this was wild. Thanks for your persistence. All right, take care. Bye. Bye. Reply All is hosted by PJ Vote and me, Alex Goldman. Our show is produced by Shruti Pinnaminani, Fia Benin, Damiano Marquetti, Anna Foley, and Jessica Young.

Our show's edited by Tim Howard. Our intern is Heather Schurring. We were mixed by Rick Kwan, fact-checking by Michelle Harris. Special thanks this week to Tim Rogers, Juliet Melton, Talia Gilbert, Elizabeth Patterson, Chris Messina, Gene Huang, Phoebe Flanagan, and Lorenzo Francesca Picieri of Motherboard. Lorenzo and Joseph Cox, who I mentioned in the story, are actually starting their own podcast called Cyber. The first episode's out next week, and it is about sim swapping. You should check it out. You can download it wherever you get podcasts. Michael Bezell also has a podcast called the Complete Privacy and Security podcast. I will put a link to that in the show notes as well as all the things I did to protect myself in this episode.

Matt Lieber is a video that you find so funny that you force your coworkers to watch it over and over and over again until they start enjoying it. One last thing. Lizzie donated the $100 she got from Kevin to an organization called Byteback, which provides computer training and career preparation to underserved Washington, D.C. metro area residents. there will be a link to their website in our show notes. You can find more episodes of the show on iTunes, Spotify, or wherever you get your podcasts. Thanks for listening. We'll see you soon.

Hey, did you see those boulders disappearing off the cliff? The air here is riddled with wormholes. The rocks slide into one and come out another. Yeah, it's probably been the same landslide for decades, doomed to repeat itself. So true. Not named after the Tipler cylinder. or the hyper cylinders.

Why do you ask? Because of the wormholes. Right, yeah. Well, it's difficult to picture a four-dimensional cylinder. That whole thing raises the grandfather paradox, though, doesn't it? Well, that is interesting. Birds, they also fly backwards. Oh, yeah, something's wrong.

Maybe I should sit down. God. Why are my dreams so awful? Why do I sound like this?