Adrian the Video Game Hacker and GDC 2023

Speaker 1: I did some napkin math and the shallow markets that happen outside these games they are potentially at least two, but up to five times greater than the actual revenue of the underlying game.

Speaker 2: So for the first time since the pandemic, 20 to 30,000 people converged on Downtown San Francisco to talk tech and game design at GDC, Game Developers Conference twenty twenty three. It was a lot of fun, learned a lot, I got some some fun stories to share.

Speaker 3: Jordan was there and I wasn't, upsettingly.

Speaker 2: Scott was not there.

Speaker 3: I was in the backcountry skiing. It wasn't that bad, but I was not in Downtown San Francisco enjoying joining the game developers conference.

Speaker 2: Did you interview any hackers in the mountains?

Speaker 3: No. No. There were oddly a lot of a lot of engineers in the backcountry.

Speaker 2: That tracks. There was

Speaker 3: very little surprise. Yeah, exactly.

Speaker 2: So I got some fun stories to share about San Francisco. But most importantly, I managed to track down and have a conversation with a guy named Adrian. Adrian has had a very strange job for, like, twenty years. He's a guy who, if you listen to other shows about weird tech stuff, you might recognize him from back when he went by his alter ego, Manfred. Adrian is a professional video game hacker. He's been doing it for profit for about as long as there's been any profit to be made hacking video games. So amidst all the craziness of GDC, I managed to track him down for an interview. He was kind enough to sit down with me in a quiet corner of this giant place where it's very tough to find a quiet corner, talking into our cell phones. Game hacking has changed a lot over the last twenty years, and how he's navigated the ethical boundaries of a line of work where those boundaries are shifting and blurry was really, really interesting. So this is that. Adrian the video game hacker and g d c twenty twenty three recap here on hacked. You're back from the mountains. How are you doing, Scott? You're back

Speaker 3: from San Francisco. How are you doing, Jordan?

Speaker 2: I'm doing good. I'm happy to be back. I had a really good time, but, you know, it it is a busy time, so it's nice to be nice to be back home. You're you're back from the mountains. You you feeling feeling

Speaker 3: I am.

Speaker 2: Recreationed up, rested up?

Speaker 3: Yeah. I don't know if I'd say rested is the appropriate adjective, but, recreations, definitely, if that is an adjective, that is how I feel. So the the, no. It was fun. It was fun. It's always good to get away. It was spring skiing, so it was, conditions were I I thought they were gonna be far more questionable than they were. We ended up having really good snow, and, the hikes in and out, we were touring. So we were hiking in the backcountry and skiing, and then hiking back into a hut to sleep in dirty little pack cabins, eating dehydrated food, which is always fun.

Speaker 2: Yeah. Sounds awesome. But

Speaker 3: But but it was, it was a good time. We had a we got out of the backcountry, had a day off, and went hot springing, which is always nice for rest of recovery. And, yeah. Then we're back. Endured the twelve hour drive home, and got home last night just in time to make this lovely episode.

Speaker 2: Just in time.

Speaker 3: Just in time. So so wait. I need to know how in a conference of, like, what, 20,000 people you managed to track down down, like, this one person who's super relevant.

Speaker 2: Well, I'm just like an intrepid reporter, you know? Like, I'm I'm just just like a gumshoe detective, boots on the ground. No. I I I found his contact information on the Internet like anybody would. A buddy of mine oh, we'll talk about this later, but a buddy of mine went to a talk that he gave at this event.

Speaker 3: Oh, cool.

Speaker 2: And I was like, oh, wow. We gotta talk about that.

Speaker 3: Very cool.

Speaker 2: But before we get to that, I've just been thinking about something pretty much the whole time, which is that I want to thank Zach for supporting us on Patreon. Really?

Speaker 3: Yeah. Just Zach? Are there more people you'd like to thank?

Speaker 1: Well, I

Speaker 2: want to start with Zach. Okay. Who who who went to hackedpodcast.com and supported us on Patreon. Great way to support the show.

Speaker 3: I wanna thank Zach and I I wanna thank Danzar. Oh, that's that's a good point. And Alan and and Yee and Yohan.

Speaker 2: And Nelish and,

Speaker 3: Darren. Yeah. And Evan, Ryan, Jacob. Sure.

Speaker 2: But don't forget about Rob.

Speaker 3: Oh, of course not.

Speaker 2: Okay. And finally, drum drum roll, Anders,

Speaker 3: who

Speaker 2: are all kind enough to support the show at hackedpodcast.com.

Speaker 3: And and many of whom have popped into our Discord.

Speaker 2: Yeah. So Who have popped into Discord? The Discord has been fun. So we produce all the music for the show, and someone was asking kind of just about the music and then brought up the idea of sharing some stuff they've been making. So we created a channel in the hacked discord where you can share cool stuff you made. It's called share cool stuff you made. And it it's great. Like, there's very talented people in there, like funky tunes, rapping that easily puts Razzlekhan to shame. There's a lot of really talented folks in there.

Speaker 3: They they they listen to us, so what's the best way to put this? We lack the talent, so they must bring it.

Speaker 2: Yeah. Sure. There's an equilibrium of talent. It's mostly on them. Exactly. If you want to join hackedpodcast.com. Sweet. Let's start with GDC. Let's chat a little bit about Start with GDC. Game Developers Conference. Like I said, 25,000 people, all converging on Downtown San Francisco.

Speaker 4: It's a bit

Speaker 2: of a pressure cooker. Talks themselves? Fantastic. Learned a lot. Game design, game music, everything from writing, like big AAA musical themes, sampling Kawasaki motorcycle engines to make anti gravity racing sound design, hiding Easter eggs in music with spectrograms. Just cool, fun stuff. Also, a very funny experience.

Speaker 3: Tell me more.

Speaker 2: Yeah. So, San Francisco, kind of birthplace of the gig slash shared economy.

Speaker 1: Mhmm.

Speaker 2: Wild how many times it just collapsed out from under our feet. Question for you, Scott. Shoot. Have you ever wondered what happens if your Airbnb host

Speaker 1: dies?

Speaker 3: While you're staying there?

Speaker 2: Prior to your arrival, but too late for you to book something else.

Speaker 3: Okay. I've never thought about this. See, I would assume if you've checked in that you could just claim, like, salvage rights almost and just squat there as much as you want. Squatters rights? But the yeah. Squatters rights. Yeah. But prior to your I'm hoping Yeah. That there was some form of property management company in the middle of that Right. To facilitate. Why don't you this sounds like you have experience in this, so why don't you share this lovely story?

Speaker 2: Yeah. I'll spare all the gritty details, but when the guys I was traveling with got there, it was a VRBO, they got there before me. Mhmm. There were people just living there. If anyone has seen the film Barbarian, it evoked that, and those folks that were living there had bought it a month before from whoever inherited it, from whoever owned it, who did die. And our reservation, through some confusion, over like two months, just sort of persisted through all of that. Wow. So we found ourselves trying to book a hotel on the first day of a massive conference that sells out every hotel in the city for, like, a mid sized group, which was tricky.

Speaker 3: And very expensive, I'm sure.

Speaker 2: Not not an affordable proposition, let me tell you. We we ended up in the last group Airbnb in San Francisco. It was like the last one that could accommodate all of us that was available. We managed to get it.

Speaker 3: How far away from the venue had to be far?

Speaker 2: Medium far price, like value for what you got. I'll just say it was the nicest concrete box I've ever stayed in.

Speaker 3: See, I was thinking about this actually just yesterday on the drive home. I was thinking about how, like, you know, you know surge pricing in Uber? Yep. It's like, it's truly based on, Oh, I got a story about Uber. It's truly based on supply and demand. I'm sure you do. When 24,000 people try to get Ubers back to their Airbnbs, I'm sure the price of them goes wild. But like air airlines, it's funny how we've accepted, like when people hear about surge pricing, people still get mad about Uber, you know? But the hotel market and the airline market have been running this model for years, for, for yeah. Like like since they existed. Like, if you buy a ticket on especially on a discount airline, the first 10 tickets on the plane are, like, free.

Speaker 2: Right. Like,

Speaker 3: you're not even paying for the gas. But the last 10 tickets are, like, obnoxiously expensive, like, way more than they should be.

Speaker 2: Mhmm.

Speaker 3: And it's like they've been working that supply demand model forever. So it's like I feel like, you know, the hospitality and hotel thing, same thing. So it's like if you're booking the last one, if the person managing that listing is, you know, halfway economically inclined, you're probably paying four times what you should be.

Speaker 2: For sure. It was the end of the first day of the conference too. So by that point, you just ratchet up the price and see what you can get. It's like you're going fishing. Of course. Maybe

Speaker 3: Yeah.

Speaker 2: Someone is desperate enough to, to do it, and we were because we needed needed shelter.

Speaker 3: So you you literally, like, Uber from the airport to a house that is full of people who were like, who are you and why are you here? Or were they, or were they so used to this at this point because this guy had pre sold out like months of bookings prior to passing away.

Speaker 2: I wasn't there when my buddies my buddies arrived before me, so they got to have this interaction. I just found out about it shortly after. Ah. So I don't know how many times they had dealt with this, but I I have to think it it wasn't the first. Yeah. They've been living in this weird ghost Airbnb rental for the last month and a half waiting for these to sort of just like peter out. And it would make sense the GDC, this giant event would be the last spike of people saying, do I live here tonight? Yeah. And them having to say, no. I live here always. You don't get to stay here.

Speaker 3: Oh, man. That's a that's a that's a very strange one. I've never you're the first time I've heard a tale like that.

Speaker 2: First time for everything. But the conference itself was great. Interestingly, and and this comes up a bit in our interview, so I think it's worth talking about. I went, say, five or six years ago. This all happens in Moscone Center, Moscone. This big center, multiple city blocks in the middle of downtown. It's the big venue for big tech shows in the city of big tech. So it's it's large. And whether you're in the building with talks or the big expo hall, there's always these massive banners billowing from the roof. Brands that have sponsored the event. Five or six years ago, it was Ubisoft, Sony, Blizzard. But now, Metaverse, Web3, crypto. Correct. Metaverse, Web three, crypto.

Speaker 3: That is yeah. I guess when you look at, like, developing markets. Right? Like, the metaverse is, like, the That's the one. Yeah. It's the developing market. Or Yeah. The market that they they hope develop.

Speaker 2: That they're they're trying to brute force it. They're prospecting. All the free talks, that's the stuff sponsoring them. A lot of the parties, that's what's sponsoring them. A big audience that doesn't always love that stuff, gamers.

Speaker 3: Mhmm.

Speaker 2: So there's this constant tension in the talks and on the floor and at these events between people trying to very intensely sell a product to a targeted audience of people that don't like that product. We ended up at an evening event where the sponsor, a big cryptocurrency company I will not name, did want to speak to this live audience, but didn't want to physically show up. So we got to watch this emcee of this in person kind of boozy event, subject a large audience to a Zoom call with the sponsor projected on the wall. Oh my god. And think what you will about that whole space, but this dude just launched into like a crypto bullshit speed run. Like, he was just knocking down all the big hits. People were not happy. People walked up and left. It looped all the way back around from being pretty irritating to the funniest thing I've ever seen.

Speaker 3: Oh, man. That's that's such a strange like, to spend all that money, like, we've been to some big like like film and and and TV production events and stuff. We've been to these big parties before. They cost a boatload of money. And and and they did not even show up for it.

Speaker 2: Let me zoom in. Yeah. Yeah. What are you doing?

Speaker 3: Was it Sam Bankman freed live from his, like, penthouse prison?

Speaker 2: I have a story about that. Okay. But regardless. It was. I also met No, it wasn't, but yeah. We'll talk about that. I met someone, if we're just kind of going through the the funny stories before we get to this this long interview that's coming

Speaker 3: up. Mhmm.

Speaker 2: I met someone. I'm gonna be very discreet because he was a very nice, smart guy. He spent the last, say, six months to a year working on what is probably gonna be a very successful startup. But he was doing the van life thing during all this. He was living in a van, working on his his startup. And he mentioned off handedly that he'd ended up in a van commune, like a proper commune. People doing peyote in the woods type thing.

Speaker 3: Okay.

Speaker 2: Which like Checks out? Yeah. Like, tell tell me more. Like,

Speaker 3: this is You've you've peaked my interest.

Speaker 2: You've peaked my interest. But it's San Francisco at GDC. So I slowly started to realize, like, it wasn't an old fashioned peyote van commune. It was like a crypto peyote van commune.

Speaker 3: I kept getting hints.

Speaker 2: I was like, oh, it's governed by a DAO, which for anyone that doesn't know is a decentralized autonomous organization, like blockchain government, basically.

Speaker 3: Wait. The commune is governed by a DAO?

Speaker 2: The co the the Peyote crypto van commune is governed by a DAO. Oh, man. And it costs a lot of money to park your van, which is a very Silicon Valley innovation of monetizing parking a van outside. And then I found the website, and it's just it's great.

Speaker 3: You gotta be slacking that to me, or putting that in the Discord.

Speaker 1: I'm a

Speaker 2: slack it to you. We're not gonna say the name. Nope. Because I don't think they recognize themselves as a peyote van commune, even though it sounds like people are doing peyote there. But it's like a a van commune where you can do peyote, but it has the website of like a millennial meal prep kit start up. So it's like Burning Man, but brought to you by a drop shipping mattress company.

Speaker 3: Oh, man. I just don't think you and I live enough, Jordan. Like, we aren't experiencing these things. Like, when did we get old?

Speaker 2: I wanna go live in the woods, governed by a DAO Yeah. Doing drugs with crypto bros.

Speaker 3: Was is the the gentleman you're speaking of, was he starting a crypto startup, or was it, like, a a startup of something that provides utility?

Speaker 2: No. He was starting, like, a real company that provides utility. Really nice dude, and I think the company is, like, it's a cool company. He was not of that cohort.

Speaker 3: Let's let's let's let's just while we're hitting on on crypto here.

Speaker 2: Yeah. Sure.

Speaker 3: Did you see the NVIDIA CEO? No. Like, NVIDIA's record profits for the last, like, ten years have been paid for by crypto miners. Right? Like, their their graphics cards Yeah.

Speaker 5: Sure.

Speaker 3: Cost us lowly gamers so much money because there's crypto bros that wanna buy them

Speaker 2: and make crypto with them. Sure. Especially during the pandemic, it was this, like, face off between people that wanted to game at the highest quality level and people that wanted to print cyber bucks. Yeah. I'm familiar.

Speaker 3: When Ethereum changed from, what was it, proof of work to

Speaker 2: proof of

Speaker 3: stake, It just collapsed the need to mine. So all of a sudden, Nvidia was selling no graphics card. Anyway, so long story short, the Nvidia CEO gave a speech the other day and essentially came out and said that crypto is providing no utility to mankind and they need to pivot away from it, and that AI is the and that AI is the future. He essentially told people that they'd like they should just be deserting crypto and walking away from it after, like, taking their money for, like, ten years. I was like, oh my god.

Speaker 2: The guy selling the gold picks was like, gold is useless.

Speaker 3: This is This is

Speaker 2: This is This is This is

Speaker 3: this is this is this is this is this is this is this is this is this is this is this is this is this is this is this is this is actually all fool's gold, but, but

Speaker 2: So many of the things we saw that were weird. It there's a lot of money in games. There's a lot of weird stuff. But there's a lot there there's also a higher percentage of, like, really creative, talented, passionate people that we met there than most other industries. I I know you do games work. It's like there there's just a lot of really cool people. So for for all the weird stuff you see when you're where you're when you're at a thing like this, it's it's kind of impossible not to also have a pretty great time.

Speaker 3: Yeah. Yeah. Yeah. I'm very envious, and I think next year, I'm gonna have to preschedule it into my calendar.

Speaker 2: Yeah, man. Come come with. We'll we'll all go down to San Francisco and, hope our Airbnb hosts make it.

Speaker 3: Well, the I was watching a lot of the announcements. There is some pretty cool tech that came out, you know, all the new changes to Unreal Engine. There was the path tracing and the ray tracing updates for NVIDIA and a bunch of AMD graphics stuff. Like, there was just a bunch of cool things. Really cool stuff. The world of games and AI. Well, we could talk about AI too, but we don't have to. But we could save that for another episode. But but the, yeah. Very, very cool stuff. We're making a lot of leaps. And also, as a strange shout out, the, the gentleman who Moore's Law is named after passed away. Oh. And it's it's very strange because you hear a lot of people talking. Gordon Moore, co founded Intel, created Moore's Law. You hear a lot of people talking now, like the new Nvidia chipsets and the new AMD chipsets and stuff, they're no longer, they're revolutionary increases. And they're breaking You hear a lot of chatter about how Moore's Law is being broken, and then Gordon Moore passes away. Just such a strange coincidence, for me anyway, when I saw that happen.

Speaker 2: So No. Very.

Speaker 3: Anyway, a shout out to Gordon Moore. Thank you for all you did, and, thank you for your law. And rest in peace.

Speaker 2: Yeah. Shout out to Gordon Moore. Kinda changed the way we think about the way computers advance over time. And I think did a lot more than just Moore's Law, like a very interesting human being.

Speaker 3: Oh, for sure. Well, I think about the world without intel.

Speaker 2: Completely.

Speaker 3: Like, love them or hate them. Depends if you're team red or team blue, doesn't matter. But, like, think about the world without intel. No denying the impact. Exactly.

Speaker 2: So I thought we weren't gonna have an episode, and we were probably just gonna wanna do a rerun because you were in the mountains, and I was In in San Francisco. Out with crypto peyote people. But as we discussed earlier, while we were there, a buddy of mine went to a talk. And I thought, well, it seems like someone our audience might really like to hear from for, like, the hour that is about to follow. I'll, I'll read you the talk description. This speaker, Adrian Bednaric, will use his 20 of experience in exploiting online games to provide information for current and upcoming developers on common and advanced techniques used to exploit online games. Attendees will learn what happens in the shadowy depths of online game hacking, along with the threat actors and tools used, and be better equipped on how to protect their games against emerging threats. And I was like, I feel like hacked folks might really enjoy hearing from this guy.

Speaker 3: I feel like I would have gone to that if I was there.

Speaker 2: Yeah. Our our buddy Jeremy went, and it sounded like a really great talk. So pop on my intrepid reporter cap, see if I can get a hold of him. Trouble, it's a talk. I didn't see it, but I get the sense it was relatively technical. So, you know, first step, contact and link up with Adrian, the video game hacker. Step two, get him to take me through this in terms I can understand. And he did a really great job at both. We recorded this on our cell phones, but AI voice cleanup has has gotten pretty good over the last few months. So there's a few moments here where it sounds a little garbled, especially on my microphone, but, I'd say his phone and the software working together did a pretty great job. They chopped it up a little bit to condense things and remove some moments when the garble got bad, but it's relatively intact. Adrian has been hacking games since Ultima online. You ever play that?

Speaker 3: I never did, actually. I have friends that worked on it. Oh, interesting. But I never actually played it.

Speaker 2: I know. So we sat down and we we started there at the beginning of his story, sitting down at the far end of a hallway, off a hallway, off a hallway, where it was quiet enough to talk under this weird lighting thing that reminds you of kind of like a UFO.

Speaker 1: We are in the equivalent of a back alley at GEC behind a purple velvet curtain, I guess. Maybe Elvis performed here back in the day. And there's an arrangement of lights above us in the circle that looks like a UFO that's about ready to beam us up.

Speaker 2: We talked about his history. Twenty years of Wild West games cheating, how games get monetized today, and how they'll be monetized in the future. This idea that rather than fixed prices, or even in app purchases, that maybe the future of games looks less like a store, and more like a government taxing transactions between players. Mhmm. Fortnite just released the design of their player economy two point o. Mhmm. Something's changing in the way that works. And really, a theme we kept looping around to, this idea of digital scarcity that has had such a big impact on his career and whether it is fundamentally an illusion. Here's my interview with Adrian Bednaric, Video Game Hacker. Hope you enjoy.

Speaker 3: Take care.

Speaker 2: Who are you and what is it you do?

Speaker 1: So that's complicated. Online, I'm known as Manfred, but my real name is Adrian Bednaric. I tried to keep the two separate for a while, but people just figured things out. You know, I didn't really care all that much. So right now, I'm just you know, I'm going as both, but, you know, you can call me Manfred or Adrian either way.

Speaker 2: Did you do other kinds of hacking or was that really your identity in the world of video game hacking?

Speaker 1: So Manfred is interesting because, I got my start in cybersecurity. Well, my background is in cybersecurity and software engineering And when I was a college student back in 1997, this game called Ultima Online came out. And I was very much into PVP, like, in that game. That game was pretty ruthless. There were no rules. It was the Wild West. If you died to another player, you lost everything. Like, they just take all your stuff off of your corpse. So I was in a bunch of PVP groups, guilds, and, it was common at the time to have very inappropriate names. That that was the wild west of video gaming back in the mid nineties, and my name was, I I went to run Peking as a character named Phucchop, p h u c k c h o p. I I spell it that way to get past the the profanity filter when naming your character. Right? So one day a GM came up to me and he's like, we're getting a lot of complaints. You're you're killing a lot of players in the game. You're, like, looting their corpses and what amounts to I guess what she'd call this day as as griefing like you know excessive, PVP honor ownership of thing. So this gen was like that's all cool and everything you can kill other players. That's part of the game. You're you're doing it a lot, you know, which is, you know, you must have a lot of spare time on your hands, which I did. Like, I was playing this game, like, eight hours a day, but he's like, I can't have you running around with that as fuck chop. Yeah. And, so he just randomly renamed me to Manfred. And I was like, that's kind of a cool name. It's it sounds fancy. I'll go around PVP ing as Manfred. And I just stuck with that name ever since. So I was named by a game master in Ultima Lane.

Speaker 2: Was that the first game that you ever cheated in? It was the first multiplayer game. Was that the first game at all that you ever cheated in?

Speaker 1: Cheating in games is interesting because it differs greatly depending on if you're cheating in a single player game or a multiplayer game. I mean, I'm sure everybody's played board games and, you know, you cheat to troll or whatever. If you're playing Monopoly, you'll pull some extra money out of somebody else's file. So, I mean, I think everybody cheats. It's natural. You know, whatever. But Ultima Online was the first popular MMORPG that ever came out and that's what really got me interested into the security aspects of it because I was like, how does this game work? How does this client server architecture work? Like, if I delete my game and, like, reinstall Windows, I think it was Windows 95 back in the day. I was like, if I reinstall the game, will my character still be there? Will my house be there? Will my items be there? Everything was saved on the server. So I just wanted to figure out how all that stuff worked. So I took apart the clients, and then I took apart the communications protocol, see how the communication between client and server worked. And then I just started finding exploits. So, you know, create infinite amounts of money out of thin air, create items out of thin air. UO had an interesting thing because they had real estate that was scarce. The the map in Ultima Online was a two d map and you can only place so many houses on there. So there was a real estate boom. And And if you own the house, you're pretty rich in this game. And I was researching the security around player housing, like because there was a function in Ultima Online where you could demolish your house and you'll get the house deed back. So you can, like, place your house somewhere else. So I was like, how does this work? And then I and and I was like, could somebody else leave my house? So I did some some investigative research, and I was like, let me try and demolish my house, capture that data packet that the client is sending to the server and let me change that ID of the house that's in the packet with my neighbor's house. Surely, that can't work, right?

Speaker 2: You wouldn't be able to grab their house kind of thing.

Speaker 1: Yeah. So, so I sent this packet with their house ID and I demolished their house and I was like,

Speaker 2: oh, shit. Found something.

Speaker 1: Yeah. That was definitely, like, my first huge exploit that got me thinking. The the light bulb went off, and I was like, interesting. Interesting.

Speaker 2: So you'd found something with scarcity in this in the system, and you'd found a way to just sort of, like, pluck it out from in the, like, almost like the crawl space on the walls of the game. You found a moment when it was vulnerable.

Speaker 1: Yeah. So so there, I like to say there's there's always a a bigger game behind the curveball. And this illusion of scarcity that existed in Ultima Online by having items and currencies and housing be scarce was, you know, it's an illusion. And if you dig into how the game works and go under the hood, you'll find the game behind the curtain and that that you can play it in different ways.

Speaker 2: Starting something new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's going to work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations, but boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button is used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 6: When you need to build up your team to handle the growing chaos at work, use Indeed sponsored jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications, and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit at indeed.com/podcast. That's indeed.com/podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed sponsored

Speaker 4: jobs. Thinking about refreshing the carpet in your home? Now's the time to do it. For a limited time at The Home Depot, get 10% off installed carpet projects on trusted trusted brands like Lifeproof, Lifeproof with PetProof Technology, Home Decorators Collection, and Traffic Master. Plus, with installation starting at just 49¢ per square foot, upgrading your space is more affordable than ever at The Home Depot. Offer valid, 06/11/2026 through 06/28/2026. Exclusions apply for licenses. See homedepot.com slash license numbers.

Speaker 5: Marvel Television's Wonder Man, an eight episode series, now streaming on Disney plus.

Speaker 2: A superhero remake. Not exactly what we'd expect from an Oscar winning director. Action. Simon Williams audition for Wonder Man.

Speaker 1: I'm gonna need you to sign this, assuming you don't have superpowers.

Speaker 2: I'll never work again if anyone found out.

Speaker 3: My lips are sealed.

Speaker 5: Marvel Television's Wonder Man. All eight episodes now streaming only on Disney plus.

Speaker 2: What was your next step after that? You figure out this way that you can grab a a house deed or something. You where where do you go from there?

Speaker 1: So when I discovered that, obviously, I deleted my neighbor's house and I felt pretty bad about that because, like, players in Ultimate Online typically had around 20 to 40,000 items that they stored in a house. So when I did, demolished that house, everything fell to the ground. And over time, it just decayed and disappeared out of the game. So I I felt, pretty bad about that. And, you know, I didn't wanna go around and deleting or and and delete other players' houses because that's kind of an ethical line I didn't wanna cross. But then I continued on and investigated other features in the game to see if there were exploits. You know, being able to create gold out of thin air was interesting. And I created bots to place houses, when other players houses were demolished. So so Ultima Online was interesting because when you place the house, you had to log back in to refresh it. Otherwise, you know, you could have a dormant account, you know, tie up real estate. So they implemented the cleanup system. Like, if you if you didn't log into the game for two weeks, your house would automatically demolish. So I wrote some scripts and bots to go around and find houses that are about to be demolished by the game, and I placed other houses and castles in their place. And I was a broke college student back in the day, and I knew that people wanted houses in this game. It was very valuable. And eBay was also a thing. I think eBay came up in, like, '95 or '96, and, I was, like, what would happen if I sold a castle on eBay? So I listed the castle on eBay, and I was expecting to get, like, 50 or $100 because there was nothing else like it. I didn't have anything to do market research on. So I did a three day auction, was expecting to get 50 or $100. And then two days in, a bidding war started. When the cast was selling for like $506,100. Whenever I'd refresh the eBay page, it went up by like a $100 and then the auction closed at like $3,200 So, I was very happy.

Speaker 2: Yeah, for a broke college kid that's pretty wild.

Speaker 1: Oh, yeah. That was a pretty good payday. There was also a follow-up challenge to that because the person that bought it from me, he was an airline pilot out of Alaska And, you know, we had communications back and forth, and I was like, hey. Send me the money. I'll log into the game, and I'll transfer my castle to you. And he was like, no. You log into the game first and give me the castle, and then I'll send you the money. Because, you know, we didn't trust each other.

Speaker 2: Yeah. Why would you trust each other? Yeah.

Speaker 1: There did we're on a trustless, wild west, metaverse of the nineties. So, we tried to use an escrow service out of New York that typically dealt with fine art. Like, if you own a small painting, they'll take possession of the painting, and they'll take money, and then transfer everything to the appropriate parties. So we called them up and we're like, hey, can you guys install well, do you guys have, like, Windows 95? Can you install Ultima online? And then can I transfer a castle to you, and then you guys take a payment from this guy and then, like, settle settle this deal? And long pause, a couple of umms, and we basically got hung up on. So by this point, we kind of have as, you know, this was going on for a few days, we kind of developed a little bit of trust. We exchanged phone numbers, shouted on the phone. And he he was like, fine. I'll just send you the money. Give me the gas flow. And we did that. We were both happy. And then, I continued doing that, selling houses in gold and Ultima Online through my college days. And I know, graduated in 2001 debt free thanks to thanks to this video game called Ultima Online.

Speaker 2: Woah. Where did most of that money come from? Was most of it in fungible stuff? Was it mostly gold or was it mostly these houses?

Speaker 1: The this is a huge rabbit hole. I sold many interesting things. I sold some bugged items in the game that would give players an advantage. It's it's it's it's a it's a bit of a technical rabbit hole. But, I'd say fifty fifty. Gold was in very high demand. I think a million gold was selling for, like, $300 in, like, around '98. Over time, the value of gold went down. As players quit the game, there was less demand for gold. I think when I stopped selling gold in Ultimate Online around 2002, I was selling a million for, like, $50 or something like that. But the volume was great, like, you know, you're making pretty good money every week, and the payouts were good. I mean, you you you list something on eBay, you get paid, you trend you log into the game and you transfer to gold. So, I mean, it was really quick rapid transfers, and then eBay banned the practice of selling virtual goods something around 2003. Good. But, anyway, when I graduated in 2001, I had a decision to make. Do I wanna go work for Microsoft in a cubicle or or some other big tech company, or do I wanna keep hacking games? So I I was like, you know, hacking games for profit in an ethical way, you know, because the game companies weren't selling gold and castles and houses to the players directly. I was filling an unmet demand. So I was, like, this really isn't a job. I'm playing video games, figuring out puzzles, you know, hack hacky puzzles, cybersecurity puzzles. Like, how does this game work and what are the security guarantees and kind can can they be bypassed? So I just continued doing that for about twenty years, and my main source of income was from, you know, hacking online video games and and their virtual economies, from '97 to 2017.

Speaker 2: I mean, that marketplace has evolved so much since then. If you're talking about from when you would have graduated college when, you know, eBay was still selling digital goods. That was so early in all of this. Like, was there anybody looking for you as you're rummaging around doing all this stuff? Was there anyone on the defensive side side trying to stop you? Were you just alone in the house with the lights off by yourself?

Speaker 1: Yeah. So, I mean, I was when I was signing up for my accounts, I was using my real name. I was using, like, a VPN. I wasn't trying to hide. There were really no efforts made by the game company back then to, like, monitor or have analytics on the sort of activity to identify, you know, people that are using accounts for real money transactions and things like that. So it's pretty much free reign. Ultimately, I had a lot of a lot of exploits. Whenever an exploit would go public, and there was an uproar from the community, the game developers would fix it. But if you found your own exploit and you, you know, you didn't pass it around or make it public, then it I think it existed until, you know, you got bored

Speaker 2: of it. After Ultima Online, you graduate. Where do you go next? What game do you kinda, like, move your your operation to?

Speaker 1: So there was a small game that most people don't know about. It's called Anarchy Online from Funcom. That was my technically the second game, around the same time this game called the Arcadia for camera Camelot came out. That was my major game. I had an exploit in that game. Well, that game had multiple exploits where you can create infinite on the other thin air and items, But that game had one exploit that lasted for thirteen years before they discovered it. And I think they discovered it by accident. The exploit lasted from, like, year 2001 to 2014. What was it? Without getting too technical, I was able to shortcut or, I guess, abuse the login system is a is a bad phrase, but exploit the login workflows and logout workflows to basically log into the game, pass a bunch of items and gold to a mule account, and then cause the game to reload my character again before it got a chance to save my old character. So I could log in again with everything I had five minutes ago and just infinitely do that over and over again, like, log in, pass all my stuff over to a Mule account, trigger another login event that would act on stale data that was stored in the database. So I could just reload an old safe state of my character and just dump a bunch of golden items onto a Mule character. And that lasted for thirteen years.

Speaker 2: I mean, that's such a long period of time. You're going so many different games and you'd be doing some things where there's scarcity and some things where there isn't. When there is scarcity, did you ever did you ever find some, like, ethical red lines that you weren't really willing to cross where you go, yeah. There there's a way to make a buck here, but I'm not sure that I should.

Speaker 1: My ethical red line that I never crossed was I never wanted to do anything that would hurt the game company's profit or reputation. There's an asterisk to that because I didn't if you look up hackers put the bane in shadow bane, that was back in 2002, and that was a game that had many security flaws, and I kinda went wild with that one. But it was interesting. So in that game, I was able to basically have admin like powers. I was able to log into the game, look at other players' bank accounts, teleport to other players, insta kill other players, summon NPCs or monsters. So me and a few of my friends, we were like, no, this game really isn't that great. Probably doesn't have a future. Let's let's have some fun with it. We have all these cool exploits, so let's let's go and troll some people. So we logged in. We teleported entire cities of players under the water. So they were they were they started slowly drowning, but they were drowning fast enough. Like, it would have taken them a few minutes for their characters to die. So we're like, this is kind of boring. They're just down there, you know, kind of filing GM help tickets to help them get out of this, you know, drowning situation. So we started spawning dragons and monsters under the water with them to, like, shoot fireballs at them and just create complete mayhem and in the aftermath of that, you know, we were looking at the forums of Shadowbane and some of the players were like what what what just happened? That was insane and there was a bunch of players that said this is the most fun I ever had in this game.

Speaker 3: So, I

Speaker 1: mean, on one hand, I kind of went overboard but on the other hand everybody had fun and it is just a game. Nobody got hurt.

Speaker 2: Yeah. Something really funny but we maybe went overboard and then the visual of just like a city underwater with dragons attaching it. You're like, I should think so. Yeah. Okay. So where does it go from there? You've been working at this for a while. You've it sounds like you've really perfected your craft at this point.

Speaker 1: Yeah. So, you know, hacking for profit sounds really bad, but I knew I was doing it in an ethical way, so I had no problem with it. But, you know, you wanna stay stealthy. You don't want your exploits to get discovered. So I pretty much stayed underground for for the longest time. Like, my job was to just target the game, reverse engineer it, see how it works, find some exploits in it, and then, provide virtual currencies and items to players, in games that didn't provide these items to the players directly. And if there was a game that provided items and currencies to players directly, that's a game I wouldn't target. For for example, around 2013, it was kind of a lull in the gaming industry. There were, like, not many new MMOs being released. So I was talking with a person I was selling good goods and items wholesale to. They were based out of China. And I was like, hey. What are some good games these days? Like, there's there's not really much going on. And the guy told me he's like, hey. Can you do FIFA online? And, I was like, interesting. I've never, like, really looked into it. And then I was like, is it pretty good? Is it worth my time? Like, how much could I make? And he's like, dude, the demand is insane for this game. Like, everybody loves trading, you know, FIFA Ultimate Tokens, I guess they called them back then. And he's like, I could buy, like, $500,000 worth of tokens per day from you. And I was like, let let me think about this one. So I did some research, and it turns out EA was selling these tokens directly to players. So I I passed on that. Right. So, definitely don't wanna cross that line. If people wanna look into that story, just search for FIFA hackers. There there's a few people that went after FIFA. They actually made millions off of it, and

Speaker 2: the result was a a set of sad stories. Yes. So you developed this personal rule that if this game is willing to create marketplaces, sell products to players, allow them to sell to each other, You weren't interested in touching that. You were only gonna create those markets and games that weren't. FIFA was on the far side of that line. So you said you weren't gonna touch it, but some other people did.

Speaker 1: Yeah. 100%. And they got burned. I knew that would happen. That's why I didn't do it. You know, it was unethical. It was crossing a lot of red lines. He opened you up for legal exposure and that's exactly what happened to, you know, the guys that went after FIFA. You know, they did really well at first. They made millions but the law came down on them and, you know, was it was a very sad outcome out

Speaker 2: of that. Yeah. Sure. It's, it sounds like a well written rule in retrospect to have to, like, don't yeah. Okay. So you you've you've gone from I'm just I'm just a hacker. I'm a throw cities under the water, attack attack them with dragons. You've you've sort of refined what you're doing, and you've moved into, okay, if there's not a marketplace, I can create one using this skill set, and I can facilitate these transactions and stuff.

Speaker 1: Right. Exactly. Yeah. So early on was hacking for fun and profit, then it became a business. And then, you know, I tried to remain as ethical as possible to make sure, you know, I wasn't stuck in any toes, hurting the company's profit or reputation. So, there there's a lot of interesting rabbit holes we could follow on this because, for for example, a game that had a very negative player experience to to people coming in and trying to cater to players, farmers. For example, Final Final Fantasy 11 came out in 2003, there were a ton of gold farmers logging in, hoarding resources, camping spawn spawn spots, camping spots for people with, like, mine ore and minerals and gather plants and things like that. So if you're, like, a legit player trying to play, you wouldn't be able to, like you'd have to compete with, you know, farmers just completely camping in the shrine, the the ecosystem of the game. So when I came in and, found a few exploits in that game and I was able to, like, create gold with, out of thin air, those farmers went out of business. So there's something interesting that happened there. Like, me finding an exploit and pricing them out of the game cleared up the the environment of that game and, you know, made it a better game for the players. But, yeah, there's a there's a few cases of of that or, you know, if you do something in a way that's stealthy, that drives the farmers away, it's it's a net benefit for, you know, the game company, the players, and, you know, for myself. Gassy the obvious. Yeah, sure. Yeah.

Speaker 2: You're not going to complain about that part.

Speaker 1: Right.

Speaker 2: What are some of the strangest, exploits of some of these systems you've ever seen?

Speaker 1: Without getting too technical, there have been a few exploits that I've seen, and I'm not gonna name the game. The exploits are really difficult to find, but they're once you know what you're looking for, they're very obvious, if that makes sense. There were a few exploits I've seen that were very obscure, and it seemed like the exploit itself was, you know, was obfuscated. Like, they knew somebody would find this exploit, so they took an extra step to obfuscate how it would work. So it feels like there was a bit of an insider threat, you know, programming exploits into the protocol that they would then exploit themselves. So this is putting on your tinfoil hat and, you know, maybe you had a game dev that, you know, slipped in a few little Easter eggs or cheat codes, whatever you wanna call it. And then, you know, after, they they go back home and, you know, use these to their advantage.

Speaker 2: So so

Speaker 1: there's been a few weird ones like that where it feels like it was planted on purpose. But, yeah, I found in in close to examining 30 games, I found over 200 exploits. They they mostly have a common theme. Like, the most common one is an integer overflow or underflow, and that's where you, like, wrap your money value around. Like, sometimes you can, like, subtract. Like, let's say you have zero gold and you find a way to select subtract subtract one gold from your account balance, that would roll over to the maximum value that, that data value could star, which typically in the 32 bit integer land was four or 2,000,000,000 depending on how it was configured. So that was very common. I think that's the most common exploit class even in 2023. Oh, wow. The other common exploit class was data race conditions where things weren't being checked and acted upon in a sequential manner. So you could, like, sell two of a single item very quickly, and you get profits from two items for selling one item. Right? And then there's just crazy logic bugs. There was another game that accidentally and this is a huge game company that had a really huge game, probably the biggest MMO that existed back in the day. I'll try not to name them, but it it rings with buzzard.

Speaker 2: And then your insecurity, you say? Yeah.

Speaker 1: They had, they launched their game, and I was studying the protocol, and I noticed that the messages, you know, were identified in a way that were, you could enumerate the functionality of the system. The the the messages to the server were sequential. So, like, when you log in, the message started with number 16. Like, when you rename your character, it started with 17. Like, if you move around the game, the message packet would start with 18. So I was like, wait. What what's what's going on with zero through 15? And then I started, you know, crafting packets and sending them to the server. I was like, hey, server. Process packet zero. And the server came back to me and was like, hey. Error message invalid format. We need a player name that's in the string format. I was like, what's going on here? So so after, like, some fuzzing and trying to go back and forth and trying to get rid of the error message, I was like, alright. Here's packet zero. Here's a player name. I think it's the right format. Let me send it. Server does nothing. I was like, okay. That's interesting. Then I put in my friend's name. I was like, oh, packet zero. Here's my friend's name in the game. Send it, and I tell first to them. They're, like, across the map in a different zone and they just appear right on top of them So, I was like, this is interesting This feels this feels like a GM command that's that's like, hey, teleport to player So, I was able to teleport to anybody in the game, just by typing in your player name in this packet which was fun because if you teleport to the PVP area so you could, like, teleport on onto somebody, gank them, and teleport back out. So that was fun.

Speaker 2: No money to be made but good for ganking.

Speaker 1: Oh, yeah. So, you know, packets two through 16 were interesting, but not as fun as teleporting and ganking people for for the walls as they called it back then.

Speaker 2: What came between six and fifteen?

Speaker 1: A lot of error messages. I think one of them would one of them also acted on the player name and would, like, give you their chat history, which which was interesting. So click Snoop on people. Yeah. A few of them seemed like they'd let you spawn items. Mhmm. I was able to, like, spawn certain items, but not all the items. Like, I would be able to, like, spawn, let's say, seasonal items like snowballs or something. I was able to spawn those without a problem, but, like, if I tried to spawn gold, it wouldn't error out. So so there was some some some effort made to, like, guardrail this functionality, but it was, you know, it was baked into the game and it was active and live for, like, a year after game after the game got released. So somebody realized, hey. We published the game with debug commands, that the server was processing and and, you know, they're like, oops. Let's let's let's stick that out of the code base. One of my favorites is Final Fantasy 11. That game had about five to 10 points, a lot of integer overflows. Pretty much any time you dealt with a stack of items or selling an item to a vendor, interacting with your bank, you could roll things around and just create item items out of thin air. Final Fantasy 14 came out, I think, eight years later, ten years later, and they used they forked the code base before they fixed all those exploits. So they forked the code base and the exact same exploits worked in the game that they released, you know, almost ten years later. So that was fun. I mean, that cut down my research and development time. I was able to use all my old notes from Final Fantasy 11 and so that was cool and strange. I mean, I could see why they forked the old codebase. It's probably easier to augment into whatever they want to sculpt, other than that. But it's, you know, when you're forking projects, make sure you're forking a version that, you know, has exploits fixing.

Speaker 2: For sure. Don't leave all the vulnerabilities in

Speaker 1: the thing before you. Or do. I don't know. I mean, I just, yeah, just YOLO version one commit. We like

Speaker 2: to have a little fun here. Final Fantasy 43.

Speaker 1: Yeah.

Speaker 2: Okay. Any others come to mind?

Speaker 1: I mean, the Dark Age of Camelot one we went over that lasted for thirteen years. There were a few. Star Wars All Republic and Wild Sword online were, I think, the first games that used 64 bit values to store player attributes like gold. So when I found an integer overflow in that one, I ended up with, like, 18 quintillion units worth of in game currency. And if you translate that into the market value, I had about, like, a 100,000,000,000,000 US dollars worth of, you know, currency in this game. So, technically, I was a trillionaire on paper, which is pretty cool.

Speaker 2: I mean, that brings up a really interesting question which is like, you know, when you when you started this was selling an Ultima online house on eBay. Yeah. That gets axed obviously. How is the market the secondary marketplace for digital assets like this changed over the twenty years you've been doing this? Like, how is it where did it start? Where has it arrived? And, you know Yeah. How did it change along the way?

Speaker 1: That's a great question. So, at first, it started out with peer to peer, you know, you have to trust the other party and you, you know, you transfer money and then you transfer the item. All of that was done via mostly eBay and or maybe some forums. And then eBay banned the sale of virtual goods because they didn't feel like enforcing, you know, there's a lot of opportunistic cameras that would, like, sell you stuff in the game, and they take the money and just disappear. So eBay was getting way too many customer complaint, you know, tickets, on that kind of stuff. So they just banned the sale of virtual goods, period. And that's when all these, mostly of Southeast Asia sites popped up, like EGPAL, IGE, and they basically acted as a marketplace for players that wanted to buy items and currencies, from other players. So I went from, you know, selling or operating by myself and just selling on eBay to supplying wholesale in bulk to, you know, people like IGE. And, you know, my typical workflow was, like, I'd load up an account with, you know, millions worth of gold. Not millions worth of gold. It would be in the thousands US dollars, but, you know and then I'd load up these accounts with money, and I'd transfer I'd give the login credentials to, you know, ig.com, and they'd pay me a few hours later. So it was very easy. Every day, I just log in, stock up a bunch of accounts, and sell them to I g e, and then they'd pay me later at night. And this was done via PayPal, which was interesting because PayPal froze my account many, many times. So, like, why are you getting money? Where's this money coming from? They're they're very nosy. Imagine that. So, yeah, that was challenging. So, yeah, you had this huge underground shadow market. And these days, I know people don't like NFTs and Web three. Well, I won't join wise in that way, but there's it's a very controllable controversial subject that's polarizing people. Right? Some people are like, NFT snow go away, and some people are like, yeah, NFTs are the future. But the cool thing is, like, I mean, we're here at GEC, and we see a lot of NFT related companies down the floor. And, you know, they're trying to promote this sense of player ownership and giving players the power to, you know, control, you know, their assets and giving them the the ability to sell their assets to other players. An interesting side note, like, I did some napkin math and the shallow markets that happen outside of these games They are potentially at least two, but up to five times greater than the actual revenue of the underlying game So game developers in the past and currently aren't harnessing like the full potential of, you know, player to player trading and technically it's, you know, it's a form of user generated content Like if you're playing a game and you're mining or grinding for items, you know, you're technically gyrating, assets in that game that other players want. Mhmm. So, I I think the collision of Web three the Web three ethos and mentality and Web2 gaming is creating this interesting area where where it's recognized that players want to trade amongst each other There's huge economies that happen amongst players And, I think the next generation of monetization isn't going to be in app purchases. It's going to be kind of mirroring a country where you tax, you know, transactions and sales of items to support the game, its infrastructure, and its employees. And it's gonna be a symbiotic relationship between revenue of the players and the game companies.

Speaker 2: That's very interesting. Yeah. We're we're here walking around. I was here about five years ago, and all the banners were epic games, Blizzard, Fortnite. Now it's Web three, Web three, Web three, Web three. So much of it is tied up in blockchain, obviously. Do you think that's essential for that cultural shift towards, player player transaction? Do you think that could be done server side where a game developer could facilitate those transactions, or do you think there needs to be an external, yeah, some kind of infrastructure to allow that?

Speaker 1: There are a few games that people forgot about. Second Life for one, it had the player to player economy that was very much done in the Web three style of way. The blockchain is nice, but it is, for the most part, just a storage technology. Player ownership can be done server side and honored by the game company. I I think some some fairness well, let me take that back. This is a huge rabbit hole. Like, this is this is an emerging market, and nobody knows where it's gonna go. But I think in the end what's gonna emerge is the players will have the power to control their assets in whatever way they want as long as they comply with local regulations and laws. You know, losing a sword in a video game might become a taxable event.

Speaker 2: Or Wow.

Speaker 1: Right. Or, you know, getting your account hacked might be a taxable event. There are companies pop popping up now. I've seen, like, four or five of them pop up in the last six months where they're offering insurance for in game assets. So like if you're in a game and you have a very expensive legendary sword that might be going for a few $100 on like the gray market, they'll insure it and and and that's interesting I I think the future will be a blend of Web three ethos and technologies and Web two style centralization. In the short run, who knows what things will look like ten years out. But but I think in the end players will have ownership of their assets. The underlying technology that's gonna make that happen, who knows what that's what that's gonna look like.

Speaker 2: That's very, very interesting. Losing a sword in an online game becomes a taxable event. That is wild.

Speaker 1: Right. I mean, think of all the crazy stuff that could happen around that. Because I mean, you have insurance fraud, but if you have insurance on virtual items that there's no traceability on, things get very interesting. There there's it it's very I mean, it's a brand new industry and there's a lot of sharp edges, you know, but as as it evolves, I think it'll be in the players benefit.

Speaker 2: I think about a bank account. Something happens to my bank account, the bank is probably gonna help me out. Something happens to the bank and the government's probably gonna help me out. What does it mean when my digital asset, something happens to it? Does it matter whether it's sir stored server side? In which case, they'll help me like a bank. Or if it's on the blockchain, they go, that's not our problem. It's this giant set of problems that we have no, like, cultural standard for how to solve.

Speaker 1: Yeah. Yeah. The permanence of an item existing on the blockchain has, you know, pros and cons. One, it's permanent. Two, it's permanent. So so if you're involved in the fraudulent transaction, you can't really undo it. There's no there are no refunds on the blockchain. You know, I've seen solutions where they bake in backdoors into smart contracts to maybe potentially give you a backdoor way in for, like, for, like, thirty days somebody else could come in if they have the right, you know, set of credentials. They can, you know, undo transactions, but then you're just creating, like, Web two technologies on the blockchain which is sort of silly. Sure.

Speaker 2: Someone steals my car. They can either find my car or I don't have the car. But if I have insurance, you can give me money I can go use to go buy a new car. And so, scarcity and fungibility in these digital assets becomes really, really important because is it valuable if they can just make another one and give it to me Or do they need to give me a currency so I can go buy another one?

Speaker 1: Yeah. All that is just crazy. I mean, if you take a big step back and and look at all these technologies, they are trying to push the illusion of scarcity. Sure. It's it's all an illusion on the blockchain. That illusion of ownership and scarcity is a little bit stronger because it is baked into the code a little bit, and some of that code might be irreversible up to a point until things get hacked and, you know, you fork to layer one and you create new new things. But it's all an illusion. I don't know. It's it's interesting. It's interesting to watch it evolve. In some ways, it's like reinventing the problems of the nineties in a new way using new technologies. But then again, it's it is really creating cool and and useful features, and they're being used in ways that, you know, we we couldn't have envisioned, you know, twenty years ago. I mean, imagine talking about, you know, NFTs thirty years ago and saying, hey. I made an NFT of a sketch on a piece of tissue paper, and it's sold for $30,000. You'd you'd get committed to an insane asylum. And here we are in Stronghold and it's right here on the GDC Floor and people are promoting, NFTs and video games.

Speaker 2: Digital scarcity is an illusion. I think you scarcity is an illusion. Right. Yet there's such an extraordinary amount of human capital, capital, just everything going into making that illusion feel real. There's so much there's so many things over right behind this giant curtain that only work if we accept the premise that that scarcity isn't an illusion.

Speaker 1: Yeah. It definitely helps. It's I mean, if you if you're an investor and you're investing in the in the blockchain project, that's promising scarcity, you're gonna see some pretty good returns. So it's like, it's like the cycle that fuels itself. And, you know, there is a lot of backlash against Web three right now and NFTs and all that stuff. One, because, you know, there's a lot of scams on it. Two, it could just be seen as a money play to please investors. Let let me go back and and there there's one thing. So there's many positive and, things about Web and how it's evolving the the landscape of ownership and how people and players own things and video games. But I've noticed this one trend that's been bugging me for a while with Web3 is, you know, there's there's a site called site called, Web three is going great. I don't know if you're familiar with it. And it's interesting because it's, like, I think Molly White runs it. Right? Mhmm. And it's a website that lists, like, all the greatest hacks that happened in Web3 and it, like, tallies up how many billions of dollars have been lost. And sometimes, you know, I'll research a specific hack that happened on Web3 that maybe, you know, ended up in the loss of hundreds of millions of dollars or people getting their wallets compromised. And I'll do some research. I'll go on forums, and people will, you know, they'll defend the technology and they'll be like, oh, no. It was the user's fault. They they were using their wallet incorrectly. It's like the Steve Jobs thing. Like, you know, our phone isn't broken. You're just holding it wrong. I'm not sure how prevalent this is or if I just, like, zone in on it, but there's a lot of victim shaming, blaming in Web three. It's like, you got hacked because it was your fault. Don't blame the Web three technology. It's perfect. It's it's it's precious. It's godlike. It's holy. You shall not speak badly about Web three. It was your fault.

Speaker 2: I mean, that's really interesting that that mindset of the technology is perfect. It's your fault that you got hacked. Do you ever reflect on that twenty years in the video game hacking industry? Do you ever think back on users? Like, did you ever hack users or was it always the systems in the games?

Speaker 1: It was always the system. I never went after specific users. I mean, I did use hacks to, like, teleport to players and kill them but that's probably the game ish. That's different. Yeah. I never deprived the player of value. Okay. Of of their items or their game count. I forgot what order of gold. No.

Speaker 2: I think you answered that question pretty nicely. It just seemed it was it's like an interesting parallel when you think about video game hacking as a precursor to a whole new kind of crime that we're encountering for the first time as people start trying to create more digital assets. It's, you know, for years it was just stealing some gold in a video game and now it's like, well that you're you're trying to argue that's money. Like, that this is digital money. Web three people are trying to argue that. It evokes video game hacking and it's it's interesting. It does

Speaker 1: there are some parallels around it. You know, in the video game in the video game hacking, days when I was creating items out of thin air, it was really out of thin air. You know, I was just telling the server, hey, give me a million gold and, like, around about a way through a next point. That That was very technical. But when you're talking about Web3, the ownership lies with the custodian, which is the end user, and it's their responsibility to be their own bank and be as secure as their own bank, which I'm sure has never backfired. Never. Yeah. Being a bank is easy. Yeah. It's superficial.

Speaker 2: Yeah. Nothing bad ever happens to those.

Speaker 1: Right. Yeah. So, the technology of Web3, you know, is evolving. I think, you know, systems and mechanisms will evolve in a way where, you know, people can be their own bank, but they're gonna have to give up a sense of ownership. Things will be a little bit more centralized. I'm sure most people then interact with five zero three acts or interact with it through a centralized exchange. Which for the most part is great unless you happen to be unfortunate enough to do business with FTX.

Speaker 2: Oh, man. So, when did you go from being Manfred back to being Adrian? So

Speaker 1: I quit hacking for a profit in 2017. I went public as Manfred. I tried to create, you know, the separate persona that wasn't very feasible or easily trackable back to me because I didn't know what the reception would have been, and I don't know what the sentiment towards that will be ten, fifteen years down the line. I don't want people googling my name going, oh, this guy was hacking video games for a profit because that sounds bad. And it could be bad, unless you know the backstory, but people tend to read only the headlines and clickbait headlines couldn't really cause some problems. So I tried to be careful in the first few years, but the the response from people I've talked with were very positive. When I went public at Defcon, you know, I met people from a lot of the game companies, you know, I've done, quote, unquote, business with. And, you know, they were very cool. They were like, how did you do pull this off? You know, we have a security team internally, and, you know, we weren't able to catch these things. Well, I sat down. I opened up my laptop. Here's my notes. Here's here's how I did it. So they were very receptive, and I was very happy to hear that. So just over time, the line is just blurred blurred. I didn't really care. It's, like, sometimes I talk publicly as Manfred, sometimes as Adrian, sometimes on my PowerPoint slides, you know, I have a picture of from my UO days of, like, Manfred riding a horse. I kinda stopped caring. The response had has been super positive. Developers are super nice. They love learning, you know, they love security and I love talking about it. So I kind of just melded into man Adrian, I guess. Mandrian.

Speaker 2: I was talking with a buddy before I came up here and he he listened to your talk that you gave, two days ago, I think. And he just brought up that, you know, he's a programmer now and the way he kind of first started mucking around inside computers was cracking video games and and messing around with games. I think that that's such a common experience. And so, while maybe most people that end up in that space don't then have a twenty year intermediary career cracking games, it's such a common experience to say, I love this piece of software. I spend so much time and I want to understand what makes it tick and how to take it apart and put it back together.

Speaker 1: Yep. A 100%. Like, when you're curious and you're technical and you're interested in programming or security or just how things work, games are great because they're very interactive and you get that instant gratification. It's like, let me spend a few hours, like, hooking up a debugger, a memory viewer, maybe a process tracer, see how the game interacts with the operating system. And then if you're doing, like, a single player game, you can be like, hey. This game loads a save file from this location on the file system. Let me pop open the save file. Oh, it's in clear text. It's like a JSON file that says here's my level. Here's how much role I have because it's a single player game. You know, they they don't really want to protect it. Sometimes the save file will be encrypted, and that's in your rabbit hole. It's like, how does this game load the save file and how does it decrypt it? So then you gotta, you know, open up your debugger and put break points on, like, file read and operating system, you know, operations that open files. And then you just walk back and see how the code interacts with that file. Find the decryption function. After that file is encrypted and it's in memory, like, what are the values there? What can you modify? So so we learn a lot that way, and it's it's edutainment because it's, like, you're you're messing with this game, and you're able to, like, give yourself infinite lives or extra items in the game or extra health. So it's definitely cool. The the world the world is pretty instant, and just learning, it helps you learn super quick about how operating systems work, how how games are compiled, how they interact with the file system. And then when you move on to online games, you know, it's it's it's a similar process, but, you know, the game save file doesn't really exist on your computer. It's on the server, and it's, you know, you have to interact with it with, APIs that the server handles. And then you just fall down the rabbit hole, slam a bunch of red balls, and lose your suntan. You know, you become that that person that's in the basement just hacking away and, it's a lot of fun.

Speaker 2: Yeah. Yeah. We're in a building with 20,000 people that are interested or actively make video games and I imagine a lot of them on some level. It there was a moment where they started taking those games apart and that's probably what sent them on a pass towards being here and getting to make these things.

Speaker 1: Yeah. A 100%. I remember my first computer was like a Commodore 64 back in like 1984 and, there were magazines back then and the magazines had actual game code, like, printed in the magazine. So you'd type it from the magazine onto your terminal on your Commodore 64, hit run, you know, it'll probably crash and not compile and then you gotta fix all the typos and stuff and then the game runs. And it's like, oh, cool. I just downloaded the game from a magazine, which is cool. But then you can, like, study the code and see how it works. Like, hey. There's, like, there's, like, a physics function here where you got I can tweak it, maybe jump higher, or here's where my health is calculated so I can make make myself take less damage, and here's my attack, function. Maybe I can, like, multiply my attack by 10 and kill things in one hit. So I definitely enjoyed when I was growing up, you know, creating games from a magazine. Basically, tweaking them, seeing how they work. And then, somehow it snowballed into a twenty year career where I hacked games for

Speaker 2: a living, which is crazy to think about. Yeah. The line between taking things apart and making new things gets really blurry and that's pretty cool.

Speaker 1: Yeah. I mean, a lot of people a lot of people say like, you know, they were very curious growing up and they take apart toasters but video games are basically just really complicated toasters.

Speaker 2: Can I quote you on that?

Speaker 1: Yeah. And they print money sometimes.

Speaker 2: So what's next for you, man?

Speaker 1: What's next for me? I'm doing a lot of things now. Mainly, I'm interested in cybersecurity still. I think I always will be. I I've always had a curious nature and that's never going away. So right now, I'm at GEC, and I'm interested in talking with game companies about game security. I'm like, hey. I have spent twenty years hacking video games, and nothing is really changing. So, right now, I'm trying to build a coalition of big name game studios to back me on creating gaming security standards because there are no gaming security standards that exist out there. So I'm drafting a document that will outline best practices and common attack vectors in single player games, online games, and Web three games. I'll be like, here's what you guys should look out for. Here's all the boxes you need to check to make sure, you know, you validate, you know, code was tested, things are running properly, tested all the things around critical systems where players may or may not lose value on if those systems are exploited. So I'm hoping to create, you know, security standards for the gaming industry, which was a huge project, but, I I think it will be fun.

Speaker 2: Thirty second elevator pitch. What are those standards? What are some of the big themes that you need to see in something like that for it to work?

Speaker 1: Step one, don't get hacked. Step two, see step one.

Speaker 2: It's a short document. It is.

Speaker 1: That that's it. Spoiler alert.

Speaker 3: It's so weird.

Speaker 1: It's it's complicated. Security is complicated. So, after I quit, hacking games for a profit in 2017, I did security consulting for companies like Disney, Netflix, Google. I actually helped Disney craft the Motion Picture Association of America security standards for content distribution. Because studios, you know, wanna protect their content, they all want their movies to leak out prematurely before they hit theaters. There is no silver bullet when it comes to security. If if you Google the MPA security standards document, it's about a bazillion pages. There's a lot of some spreadsheet forms and a lot of boxes you need to check. But, you know, you need to you need to take care of application security, physical security, you need to make sure that the people that working on games, don't have too much authorization and access to critical systems because insider threats are a thing, especially as games evolve and players have assets that are more valuable. I'm a huge fan of Ultima Online and a lot of Raph Koster's, musings on his blogs. And back in the Ultima Online days, game masters would go rogue and they just generate items out of thin air and and sell them on eBay. So insider threats are a huge thing, and they will be, you know, even a larger thing once, you know, these assets get more and more valuable. And especially when you type in some of the Web three ethos of giving players true ownership, which will boost the value of these assets and the, you know, the the legality of them. Because right now, it's against the terms terms of service to sell items for for for money. And when that's legitimized, insider threats will be will be more of a problem. So you, I'm going to cover all those fields and make sure that, you know, steps are outlined to make sure that, you know, you test your code you test your code against these specific functions, against these classes of vulnerabilities. You follow these standards. And, it's a lot of hard work. I mean, I I wish I I could say, like, you know, check these 10 boxes, and you'll be secure, but it doesn't work that way. Security is a process and it needs to be makes sense in the workflow on a continuous basis. It's not something you can just, slap on once and call it done. It's a continuous process.

Speaker 2: Thank you for taking the time to chat with me. I know you're running around. I really appreciate it.

Speaker 1: Yeah. Thank you for having me. Anytime you wanna chat games and hacking,

Speaker 2: I'm around. Convene underneath this, weird UFO again.

Speaker 1: I don't know what's going on. I I've I've had, like, six hours of sleep in the last three days and this seems very surreal.

Speaker 2: Thanks for taking the time, man. Appreciate it. Thanks, man. See you.

Speaker 7: Visible puts the ultimate wireless hack in the palm of your hand. You get unlimited five g data and hotspot designed to keep you connected. All powered by Verizon's five gs network. Plans start at $25 a month or get the premium Visible Plus Pro plan and save $10 on your first month with promo code HACK. Tap the banner to switch today. Terms apply. See visible.com for plan features and network management details.

Speaker 8: Athletic Brewing Company crafts award winning non alcoholic beers for those who wanna be part of every round. With over 185 flavor awards. They're exceptional NA beers that fit your lifestyle and any social occasion. Summer's full of good times and athletic fits right in. Go to athleticbrewing.com to have brews delivered to your door or find them at a bar, restaurant, or store near you. Near beer, Athletic Brewing Company, fit for all times.

Speaker 2: When I found out I

Speaker 1: was gonna be a parent, I immediately felt a lot of anxiety and worry. So I went on to BetterHelp to try to look for a therapist to help me with that.

Speaker 6: My relationship with my family and with my boyfriend and with myself were suffering. I really needed help.

Speaker 9: I was ruminating a lot. Really getting those thoughts out to a therapist and getting feedback was just life changing.

Speaker 2: Discover what BetterHelp online therapy can do for you. Visit betterhelp.com today.