Tech Brew Ride Home - Thu. 03/24 – Is A 16-Year-Old Behind Lapsus$?

Episode Date: March 24, 2022

Have we uncovered the hackers behind Lapsus$, that crazy new hacker group? Another crack in the App Store wall as Google unilaterally decides to test alternative payment systems? Uber is actually teaming up with the Taxi drivers here in New York City. And would you buy a 15 inch MacBook Air? Sponsors: Policygenius.com NewRelic.com/techmeme Links: Teen Suspected by Cyber Researchers of Being Lapsus$ Mastermind (Bloomberg) A Closer Look at the LAPSUS$ Data Extortion Group (KrebsonSecurity) Google Play to pilot third-party billing option, starting with Spotify (TechCrunch) Twitter’s DM search will finally actually help you find conversations (The Verge) Uber Reaches Deal to List All New York City Taxis on Its App (WSJ) Report: Apple developing new 15-inch MacBook Air that could come in 2023 (9to5Mac) YouTube is taking on over-the-air TV with nearly 4,000 free episodes of TV (The Verge) Learn more about your ad choices. Visit megaphone.fm/adchoices

On April 4th, 2023, around 2 in the morning, a man was found stabbed multiple times on a sidewalk in downtown San Francisco. Hey, who did this to you? What happened next turned the story into a political firestorm. Reports have identified the victim as Bob Lee, the founder of Cash App. From Bloomberg Podcasts, this is Foundering, the Killing of Bob Lee, beginning April 16. Welcome to the TechMeme ride home for Thursday, March 24th, 2022. I'm Brian McCullough today. Have we uncovered the hackers behind Lapsis, that crazy new hacking group? Another crack in the App Store wall as Google unilaterally decides to test alternative payment systems. Uber is actually

teaming up with the taxi drivers here in New York City. And would you buy a 15-inch MacBook Air? Here's what you miss today in the world of tech. Okay, I've been waiting for someone to figure this out. Who is behind Lapsis? Haven't you been curious since this hacking group seems to have had success getting scalps that you don't normally see hackers get? Samsung, Nvidia, Octa, as we've been talking about, even Microsoft. Well, if you were writing the script for a movie about this, you'd probably make it, I don't know, a 16-year-old hacker from England, right? Which makes me think we're still in the current version of the Matrix, because yes, researchers say a 16-year-old year old from England is the mastermind behind the Lapsis group after seven unique accounts associated

with Lapsis were identified, quoting Bloomberg. Cybersecurity researchers investigating a string of hacks against technology companies including Microsoft and NVIDIA have traced the attacks to a 16-year-old living at his mother's house near Oxford, England. Four researchers investigating the hacking group Lapsis on behalf of companies that were attacked said they believe the teenager is the mastermind. The teen is suspected by the researchers of being behind some of the major hacks carried out by Lapsis, but they haven't been able to conclusively tie him to every hack, Lapsis has claimed. The cyber researchers have used forensic evidence from the hacks as well as publicly available information to tie the teen to the hacking group. Bloomberg News isn't naming the alleged hacker, who goes by the online alias White and Breach Base,

who is a minor and hasn't been publicly accused by any law enforcement of any wrongdoing. Another member of Lapsis is suspected to be a teenager residing in Brazil, according to the investigators. One person investigating the group said security researchers have identified seven unique accounts associated with the hacking group, indicating that there are likely others involved in the group's operations. The British teen in question is allegedly so skilled at hacking and so fast that researchers initially thought the activity they were observing was automated, another person involved in the research said. Lapsis has publicly taunted their victims, leaking their source code and internal documents, When Lapsis revealed it had breached Octa, it sent the company into a public relations crisis.

In multiple blog posts, Octa disclosed that an engineer at a third-party vendor was breached and that 2.5% of its customers may have been impacted. Lapsis has even gone as far as to join the Zoom calls of companies they've breached, where they have taunted employees and consultants who are trying to clean up their hack, according to three of the people who responded to the hacks. The teenage hacker in England has had his personal information, including his address and information about his parents posted online by rival hackers. At an address listed in the leaked materials as the teen's home near Oxford, a woman who identified herself as the boy's mother talked with a

Bloomberg reporter for about 10 minutes through a doorbell intercom system. The home is a modest, terraced home on a quiet side street about five miles from Oxford University. The woman said she was unaware of the allegations against her son or the leaked materials. She said she was disturbed that videos and pictures of her home and the teen's father's home were included. The mother said, the teenager lives at that address and had been harassed by others, but many of the other leaked details couldn't be confirmed, end quote. British authorities are apparently looking into this as we speak, as you would imagine. Meanwhile, Brian Krebs has an in-depth look at Lapsis's operations.

I won't quote everything from Brian's piece because it's long. Read it yourself, if interested, but here's a quick sample, quote. While it may be tempting to dismiss Lapsis as an immature and fame-seeking group, their tactics should make anyone in charge of corporate security sit up and take notice. Microsoft says LAPSIS, which it boringly calls dev 0537, mostly gains illicit access to targets via social engineering. This involves bribing or tricking employees at the target organization or at its myriad partners, such as a customer support call center or help desk. Microsoft found instances where the group successfully gained access to target organizations through recruited employees or employees of their suppliers or business partners. Microsoft wrote, the post continues, quote,

DEV-0537 advertised that they wanted to buy credentials for their targets to entice employees or contractors to take part in its operation. For a fee, the willing accomplice must provide their credentials and approve the MFA prompt or have the user install any desk or other remote management software on a corporate workstation, allowing the actor to take control of an authenticated system. Such a tactic was just one of the ways dev 0537 took advantage of the security access, and business relationships their target organizations have with their service providers and supply chains, end quote. The LAPSIS Telegram channel has grown to more than 45,000 subscribers, and Microsoft points to an ad

LAPS posted there, offering to recruit insiders at major mobile phone providers, large software and gaming companies, hosting firms, and call centers. Sources tell Krebs on security that LAPS has been recruiting insiders via multiple social media platforms since at least November 2021. one of the core Lapsis members who used the nicknames O'KLAC and White Doxbin posted recruitment messages to Reddit last year, offering employees at AT&T, T-Mobile, and Verizon up to $20,000 a week to perform, quote, inside jobs, end quote. Correct. Google Play is piloting a third-party billing option to select partners globally, apparently beginning with Spotify, quoting TechCrunch.

The program will allow a small number of participating developers starting with Spotify to offer an additional third-party billing option next to Google Play's own billing system in their apps. While Google already offers a similar system in South Korea following the arrival of new legislation requiring it, this will be the first time it will test the system in multiple worldwide markets. Spotify said the pilot will roll out to all markets where Spotify premium is available, which is 184 total markets worldwide. Google, however, caution the pilot will begin with select markets and build on the experience over time and which regions would be first has yet to be determined. As the debut pilot partner, Spotify will introduce both their own billing system alongside Google Play's own when the pilot goes live.

Google did not say which other developers it is lined up for future tests, but noted Spotify was, quote, a natural first partner on the effort given its reach as one of the, quote, world's largest subscription developers with a global footprint and its integrations across a wide range of device form factors, end quote. Spotify, of course, has also been one of the larger developers to push for regulatory changes to app stores existing billing systems and structure, having testified before Congress on the matter, joining lobbying groups and backing app store legislation, including the Open Markets Act, which would require companies like Apple and Google to permit alternatives to existing app stores. This fight is not just about wanting to have a more direct relationship with customers.

It's largely about money. Today's app stores charge commissions ranging from 15 to 30 percent, generally speaking, for apps offering subscriptions in-in-app purchases through their platforms. Even in the case of South Korea, where Google was required to permit alternative payment systems, it only reduced commissions by 4 percent for developers that directed users to their own billing systems. Reach for comments, Spotify declined to say what sort of commission it would be paying Google as a part of this pilot test, noting that the agreement was, was confidential, but a company spokesperson suggested that the commercial terms met Spotify's, quote, standards of fairness, end quote. Google also declined to detail the commission structure

involved. However, it noted that user choice billing such as is the case in South Korea will still involve a service fee regardless of which billing system the user chooses, end quote. So what's interesting here is that this could be the first step toward building a runway, towards eventually walking away from the 30% commission regime for Google, which, as I've said before, strategically, I don't see why they don't do that. It's such an obvious way to jab at Apple. But as Casey Newton tweeted, quote, could be big, but weird that neither company is saying what the cut is. If I don't get a discount from using Spotify billing, why do I care about this, end quote. Well, Casey, you do sell subscriptions to your newsletter, don't you? So any cracks in the app store

wall or potential cracks down the road should be of interest to you. Twitter has finally rolled out something users have been begging for for years, an update to DMs that lets users search direct messages for content, not just names, quoting the verge. Before, you could only use search to search for people's names or the names of group chats, but now if you want to find that one conversation you had with a friend about chili, you can just type it into the search bar. This change has been a long time coming. When Twitter brought DM search to Android in May 2021, it said that content search was coming later that year.

The company seems to have missed that deadline by a bit, but at least it's available on every platform. The original search was available on iOS for almost two years before Twitter added it to Android. Testing it out myself, the improved search seems to work on the web as well as the iOS and Android apps, While it can search reasonably old messages, it doesn't seem to search all of them. It dug up results from 2020, but on my account, it didn't include any results from 2019 or earlier. It's worth noting that attempts to search for people's names also seem to only look back that far as well, end quote. This is local news, but it's interesting for what it represents, if it ends up expanding to more markets. Uber has reached an agreement to list all New York City taxis on its app, rolling out this spring.

quoting the Wall Street Journal. The company has reached an agreement to list all New York City taxis on its app, an alliance that could ease the ride-hailing giant's driver shortage, and temper high fares while directing more business to cab drivers, whose livelihoods were affected by the emergence of car-sharing apps and the pandemic. While Uber has formed partnerships with some taxi operators overseas, and riders in several U.S. cities can use its app to book taxis if cab drivers choose to be listed there, the New York City Alliance is the first citywide partnership in the U.S. New York, one of Uber's most lucrative markets, has been a battlefield for the company and the city's iconic yellow taxis for years. As part of the deal, the New York City Taxi and Limousine

Commission's licensed technology partners will integrate their taxi-hailing apps software with Ubers. Those apps run by Creative Mobile Technologies and curb mobility are used by the city's roughly 14,000 taxis according to Uber. The two companies enable credit card payments in taxis and also run the screens that display the weather, news, and ads to riders. Passengers will pay roughly the same fare for taxi rides as for Uber X rides, according to the company. Uber drivers in New York City receive a minimum time and distance rate set by the Taxi and Limousine Commission. Uber said its drivers typically earn more than that rate. Cab drivers who agree to take Uber passengers will be paid the same way. The yellow cab metered rate is based on a different calculus,

meaning taxi drivers can make less the same or more on an Uber ride depending on the nature of the trip. Unlike Uber drivers in New York, taxi drivers will see expected earnings before a trip and will be able to decline rides they don't think are worth their while, Uber said, end quote. According to a new report, Apple is planning a MacBook Air with a 15-inch display and an entry-level iPad with a display bigger than the current 10.2 inch size for, for 2020, quoting 9 to 5 Mac. According to DSCC supply chain information, Apple is planning a new variant of the MacBook Air for 2023

that will feature a screen size of around 15 inches. The company is also reportedly planning to increase the display of the current 13.3-inch MacBook Air to something that is slightly larger, but still between 13 and 14 inches. Finally, DSCC also says Apple is planning a slightly larger screen for the entry-level iPad. The current entry-level iPad features a 10.2. inch display, and we are only expecting a, quote, slightly larger display once the change is made next year. Internal emails revealed as part of the Epic versus Apple lawsuit also indicated that

Apple considered releasing a 15-inch MacBook air back in the first half of 2008. The company instead opted to make a smaller 11-inch model, end quote. Finally, today you have a new and chill option. YouTube has made nearly 4,000 TV episodes available for free with ads. in the U.S. and plans to add up to 100 shows and movies each and every week. This makes sense because why should YouTube the pioneer in ad-supported internet video miss out on the gold rush to replace ad-supported over-the-air television, quoting the verge? Shows available include Hell's Kitchen, Andromeda, and Heartland, and you'll be able to watch them in the U.S. on the web, mobile devices, and most connected TVs

via the YouTube app, YouTube says in a blog post, There are already many options for streaming ad-supported TV for free, including Tobe, Jumo, Plex, Roku, and offerings from Vizio and Samsung, just to name a few. So YouTube is late to the game. That said, YouTube is also already where many people spend a lot of time watching videos, so it's not hard to imagine people checking out TV shows they can stream for free while scrolling through other YouTube content. The free shows could also entice people to switch over from Roku, a company that YouTube owner Google has had some very public disputes with. Roku isn't sitting still, though, according to a November report, it is planning to develop more

than 50 original shows that could appear on its free and ad-supported Roku channel. If we're going by potential users based on hardware ownership, then Roku, which says 155 million people live in households with Roku devices, is far smaller than YouTube. Google last said there were more than 3 billion Android devices in the wild, and that is only a portion of the potential devices that have easy access to YouTube. YouTube's free TV shows join the platform's available lineup of free movies. with ads, which currently include Gone in 60 Seconds and Legally Blonde. The company plans to add up to 100 shows and movies each week, end quote.

Tonight, 9 p.m. Eastern, 6 p.m. Pacific, a Twitter space. We're going to be talking to the Apple Scoop King, Bloomberg's own Mark German. Chris wants to try his grand unifying Apple conspiracy theory on Mark, and I'll have questions about the Apple Car, the studio stuff, among other things. But if you have questions for him, we'd like to do a better job of including your questions for this interview. So questions for German about Apple stuff, tweet them at us with the hashtag Ask German. That's G-U-R-M-A-N. Ask German.

And if you're in the room when the discussion is happening, tweet us live while you're in the room with the hashtag Ask German. And make sure to say in the tweet that you're in the room, then raise your hand. And depending on, you know, time and the type of question, we'll let you ask Mark directly. Talk to you then.