Doxing Strangers + Mexican Cartels and Timeshare Cybercrime + Facebook’s Big Password Fine

Speaker 1: Wait, are you a Betsy? Yes. Oh, okay. I think I, I think I met you through, like, the Cambridge Community Foundation, right? Yeah. Yeah. Yeah. It's great to meet you. I'm Kane.

Speaker 2: I've always really loved the expression off the shelf parts.

Speaker 3: Mhmm.

Speaker 2: When I was a kid, my dad would take me to this electronic shop, and we would pick up these little 30¢ electric motors, and I would go build stuff with them when I'd get home. Like, plug a battery into it and hot glue chopsticks to it and just see how long till it, like, clacked itself apart.

Speaker 3: You you and I had the same childhood. I had the same shit.

Speaker 2: Like, I don't know why. I used to tear

Speaker 3: I used to tear the motors out of RC cars though, so mine was a little bit more rugged,

Speaker 2: but Nice. I've always loved the phrase off the shelf parts. And sometimes what's available on the shelf changes in pretty weird ways. And you're able to build new things out of it. For example, for example, machine vision has advanced pretty significantly over the past few years. And if you look at the kinds of off the shelf parts that are available, you're going to find some pretty remarkable tools. Take, for example, a for profit reverse image facial search engine. Its name, I'm not going to say for reasons that will become clear. To quote the BBC, which is featured on the site for this tool, It's quick. It's accurate. It's facial recognition on steroids. This service lets you upload a picture of someone's face. It cross references images found online, correlates a name to the image, does a search of the name online, and generates a detailed report linking a person's identity to any associated information that exists. I have all kinds of thoughts about the availability of a tool like this for 42.99 a month. But as it was widely reported last week, originally by four four media, some Harvard researchers thought it was a pretty powerful off the shelf tool. So they hacked something together based on it and published this very compelling cautionary video. Yeah. Okay.

Speaker 1: Is your address 4 Valley? Atlanta, Georgia

Speaker 2: 302.

Speaker 3: Is oh my god. Yes. I can get anything, but yes.

Speaker 2: Meta Ray Bans are a consumer technology product released by Meta, the owners of Facebook, Instagram, WhatsApp. They look like regular Ray Bans, but they have a small computer that connects to your phone. They have a camera for photos, videos, importantly, here live streams. They're very popular and they look just like normal glasses. So Tell. We have another very powerful off the shelf tool. Glasses that can discreetly live stream video and they look just like Ray Bans when someone's wearing them. Them. The researchers said, okay, we're going to build a program that monitors an Instagram account's live stream, that is streamed to buy this specific pair of meta Ray Bans. Anytime you start streaming with those glasses, the program starts watching that feed And it takes a screenshot from the stream and sends it over to that other off the shelf part, the facial recognition service. There's a face in the camera feed. The facial recognition tools detects it, runs it through that facial recognition system, and generates the results report about that person, which is then summarized by an LLM and delivered back to the user's phone. The outcome of this project by these researchers is that if someone's just walking down the street looking around, and the camera feet clocks a person's face, a few moments later that person, the user, is going to receive a detailed report including the name, identity, and any publicly available information about the person they just happened to glance at. And the researchers posted a video where they're walking up to strangers in the street with an uncanny amount of information about them. It's like just walking up to people being like, oh my god. Are you like Frank from the institution for and like, they just know everything about them. Like, you talked at that event the other day.

Speaker 1: Oh, wait. Do you happen to be a person working on, like, like, minority stuff for, like, Muslims in India at all or something? Yes. Really? Yeah. Are you the chief? Yes. Oh, I've read your work before.

Speaker 2: And you see the people, like, all of their their filters, all of their sense of, like, like, all of their guards just fall away. It is, terrifying and fascinating. Yeah. They called it eye x-ray.

Speaker 3: Like, it had to happen with Google Glass. Google Glass was the was the like, when Google Glass was announced and came out, I thought this was like, it's a logical step. You know? It's so it's such an easy step to make. Mhmm. Like, when I was doing my graduate school in in computing science, there was a ton of people focused on image recognition and kind of kind of this field, and you just knew where it was all gonna end up. It was gonna end up in a pair of glasses on our face that told us everything about the person that we're looking at. And it it had to get here. It had to happen, and I'm not surprised at all. And it'll probably be a very expensive app that you buy for whatever virtual reality or a AR headset that you are wearing in the future. Like, we're only years away from when we're all wearing these things. And I think that it'll be a pretty standard feature. Like, people will just move past it. Privacy is maybe gone.

Speaker 2: It's, even if the manufacturers of the device say this is outside of our terms of service, the fact that for $42.99 a month, I can go use a, a facial recognition platform speaks to the fact that people are going to hack together ways to do this even if the, the manufacturer of the hardware doesn't want the heat of officially endorsing it. To quote the Google Docs white paper that these researchers published, which to their credit features very little info on how to actually reproduce this, which is why I have avoided saying the name of the service they used. Initially started as a side project, I x-ray quickly highlighted significant privacy concerns. The purpose of building this tool is not for misuse and we are not releasing it. Our goal is to demonstrate the current capabilities of smart glasses, face search engines, LLMs, and public databases, raising awareness that extracting someone's home address and other personal details from just their face on the street is possible today. That's the wildest part of the video. They walk up to someone and they're like, hey, are you Katie at and then just read her address. It sucked.

Speaker 3: Well, funny enough, one of the the biggest recommendations, and this is a a throwback to our sponsor of Hacked hotline, but, is they recommend using services like DeleteMe, join deleteme.com/hacked,

Speaker 2: code word

Speaker 3: hacked at checkout. But they recommend delete me as, like, one of the things to start avoiding and kind of scrub some of this private data from the information. So, like, getting yourself out of as many databases as you can is a good thing.

Speaker 2: Call that brand synergy, Scott. The article contains a lot of instructions on how to remove yourself from these databases. This episode hacked. I think we gotta talk about it. We should discuss eye X-ray and the building of surveillance tools with off the shelf parts. I want to talk about another story involving Meta, the legal resolution of a case from 2019 that involves them storing passwords in plain text. Cool stuff.

Speaker 3: Mhmm.

Speaker 2: I wanna talk about we talked about LARPs and, like, live action role playing kind of experiences in the last Hotline Hacked, I think. And a indie game designer is doing what at a really big scale. It's very cool.

Speaker 3: And I wanna talk about it. Absolutely.

Speaker 2: I think all that and more. And a lot of brand synergy.

Speaker 3: And whatever we feel like talking about on this episode of Hacked.

Speaker 2: It's fun. It's weird being in a different space. It changes the energy. It's weird seeing you. I know.

Speaker 3: It changes the energy.

Speaker 2: Oh, I can't see you. I had to, like, put put it away, and I keep remembering. Like, I see the light on, and I'm like, I don't like this one bit. Yeah. Scott, how you doing?

Speaker 3: I'm good. How are you doing?

Speaker 2: I'm doing good. I'm keeping busy. I've got house guests. It's all a little frenetic, but I'm getting through it.

Speaker 3: I hear you have a specific large haired house guest. Harry. Very large and hairy.

Speaker 2: His name his name is Terry. You can no. Yes. We do. Our our house guests have a large dog with them, and our small cat is just furious about the whole situation. I heard it hiss for the first time. It was very alarming. It's a lot.

Speaker 3: I feel like when you name your cat goblin, you should expect it to hiss from time to time. I feel like hissing and goblins go hand in hand.

Speaker 2: Yeah. Way to just dox my cat. Way to just privacy breach my cat.

Speaker 3: There you go, people. Jordan has a cat. If you haven't heard it crying in the background of the recordings before, and its name is Goblin. It is Goblin. Right?

Speaker 2: It is Goblin. Yeah.

Speaker 3: It is Goblin. Should we should we finish chatting about this, Meta AR stuff? Because

Speaker 2: these, like,

Speaker 3: glasses that peer into our souls. The, yeah. I I just it's just it's it's something that it's like, to me, it's expected, but it's also scary. Like, I've given my face to the government part of my we've talked about, you know, airport security clearances and stuff in previous episodes and

Speaker 2: And my gripes with the TSA. Yeah. You don't Longstanding.

Speaker 3: You don't even need a passport anymore once you're in all their systems. I literally walk up and look at a webcam, and they know who I am. They see my ticket. They know everything about me, and they're like, oh, like, what are you going for? And I'm like, conference on computer crime. And they're like, cool.

Speaker 2: Have fun. Sounds trustworthy. Sounds trustworthy. This guy seems to buck forward. Go on. It's pretty certain.

Speaker 3: But the, yeah. Yeah. I just the the next gen of these AR glasses, like, the Meta Ray Bans don't actually have field of vision stuff. Like, I don't think there's actually projection inside of them. But I think the next version of them, the in the Orions that they've introduced Mhmm. Have that ability. So not only will you, like, have your phone app receiving dossiers on people you're looking at, but eventually those dossiers will just be showing up in your sight lines.

Speaker 2: Mhmm.

Speaker 3: And so I think it's I think it's yeah. I don't know. I think it's I think it's natural that humans built this because it feels natural for something that humans would build. You know?

Speaker 2: Yeah. Nilay Patel over at the Verge, Vergecast, great podcast, has long had this theory that the killer app for AR glasses is, name tags. It's as simple as that. Totally. That if you could just see people's names, boy, would that solve a lot of problems and would put AR glasses on the right side of the useful finicky matrix for facial tech of, like, do I wanna wear this? It's finicky. I gotta charge it. It's like, oh, I I know people's names. In order, however, to build that technology, you do need a vast, surveillance network that is immediately parsable and query it. Like, what you would need to build in order to have that tech isn't great. But it just turns out we already have it. It's called the Internet. And this giant vast thing that you can query and find information on people using, tools like these researchers did that while costing $42.99 a month do have free versions, which, again, I I can't stress enough does suck.

Speaker 3: My biggest fear is that when AR gets so good Mhmm. Is there a use for education anymore? Is there a use for us to, like, learn to think? And, like, if we're building a name tag app, it's like, we're not doing that because we're meeting new people. We're building a name tag app because we're like, oh my god. I forgot that person's name. Yeah. And it's like, at what point do you just start failing your memory and failing your critical decision making because you can just rely on the data that you're being presented all the time. Sure. So my like, if you have, you know, like, you don't need to go to school to be a surgeon. You just have to have the the the physical

Speaker 2: The right subscription. Hit the

Speaker 3: in the right subscription level. You know what I'm saying? It's like at what point like even a lot of AR, like AR had its first big breakthroughs in industry where they were looking at repetitive, process injuries injuries and things like that. Like, they were using AR to identify, you know, repeated tasks that could cause injury, etcetera, etcetera. And and and it only makes sense that you then just take that information, and you're like, this is how you do it. Sure. You know? It's not like we're evaluating you. It's like we're literally just giving you the instruction book, and we're teaching you how to do it in real time. And it's like, well, if you're doing that, then what's the point of even learning things and having to store things to memory? You know, at what point do we replace, you know, jobs that computers can't currently do? At what point do we replace the people the training for those people with just real time instruction?

Speaker 2: I would say that point happened whenever I first looked up someone's name on Instagram as I walked up to them because I was like, oh, I know who this person is. I can't remember their name. Ricky. Like, that was the moment that I started to forget things when social utility and the computer I have in my pocket, like, booped into each other. I think we're already we're we're sprinting down that road. Yeah. The Orion glasses you brought up, the hard hard pivot, pretty cool tech. I'll I'll give them that. It's pretty pretty sweet.

Speaker 3: It's like taking the Apple Vision Pro

Speaker 2: Yes.

Speaker 3: Jamming it into a set of chubby Ray Bans. And, and, obviously, like, the I think the Apple Vision Pro was built to, like, control environmental conditions to present the best version of it possible. Yes. But I I haven't obviously tried the Orions. I've only seen some of the the chatter about them and heard people discussing them, and they seem like Google Glass

Speaker 2: Finished. Two point o. Yeah. It's it seems like neat tech. I we don't really talk about consumer technology on this show, but I do want to get invited to those

Speaker 3: with that screw. We talk about it more than we probably think.

Speaker 2: I think the fifth time I've said we don't talk about consumer technology on this show is is about when it stopped being true. Yeah. What I'm saying is why aren't they inviting us to the events, Scott?

Speaker 3: I don't know. If you're from Meta and you're listening, we would love to try these things. The,

Speaker 2: The story we're about to talk about is gonna prevent that from happening.

Speaker 3: Well, that's not true. They they they they'll they'll put bumper rails on it just like they put bumper rails on it. This is true.

Speaker 2: This is true.

Speaker 3: This is whether though how long those bumper rails take to get knocked down.

Speaker 2: No. I'm talking about the them storing passwords and plain text.

Speaker 3: Oh, that's

Speaker 2: lawsuit. That story right over here.

Speaker 3: Yeah. Do we wanna cold pivot over to that story?

Speaker 2: I have it was pretty, pretty, pretty warm pivot as far as I'm concerned. If I detect our events and stop listening for the next seven minutes, please, Meta.

Speaker 3: That's not true. Like,

Speaker 2: we're we're reporting accurately honesty on something that

Speaker 3: happens. Yeah. And, you know, Steve, saving passwords in plain text is viciously risky. Don't. Don't do it.

Speaker 2: Don't.

Speaker 3: The average compensation for somebody at Facebook is something like 375,000 US dollars. Like, those, that's enough that's enough money that nobody on your staff should think it's a good idea to store passwords in plain text text.

Speaker 2: Oh, it's not great. So so Facebook, as it was at the time known now Meta Platforms Incorporated stored hundreds of millions of user passwords in plain text for several years. The incident was disclosed publicly in 2019, and this all kind of came to a head recently with a lawsuit in the Irish courts. Practice dated back to at least 2012. It affected Facebook. It affected Instagram. Looks like it was between 200,000,600 Facebook user passwords were stored in plain text. Archives containing those plain text passwords, as I said, date back to 2012. Over 20,000 Facebook employees had access to those those passwords, and access logs indicated that about 2,000 engineers at meta or developers made nearly 9,000,000 internal queries involving data elements that included all those passwords.

Speaker 3: Just gonna sidebar for a sec. Please.

Speaker 2: Yeah.

Speaker 3: Do you think we should bring up some of the original Zuck issues where he was logging into people's, like, live journal accounts and stuff?

Speaker 2: Get after it, dude.

Speaker 3: Because that was one of his first big like, before it was even public and stuff when he was building it, he was he was using it to, like, look at people's private information.

Speaker 2: Yeah. I mean, it does seem one seems like a a guy in the dorm room, and I'm sure he was not in the dorm room by that, whatever act of the social network that took place in. But it it has the feeling of a a a tech start up where you move fast and you break things versus this multinational corporation that they are now currently being investigated by the Irish Data Protection Commission or whatever it was. Like, it I can imagine that happening in act one of Facebook's timeline Mhmm. Prior to all of the forcing Mark Zuckerberg to put on a suit and sit in front of Congress and testify type stuff that happened around 2020. The Irish Data Protection Commission, DPC, launched an investigation into Meta's practices after being notified in twenty nineteen. Nineteen. There was a €91,000,000 fine in 2024, which is why we are talking about it. Based on the findings that Meta did violate several general data protection, you know, regulation rules. A big old list of articles we won't get into, but basically, you can't store passwords in plain text. Meta took immediate steps to to fix this once they were they were notified. They'd said that nothing bad happened, basically, for lack of a better word as a result of this. These this information should not reach out. No. And and that to their credit, it it does I mean, to your point, it feels like sort of a relic of a bygone Facebook Mhmm. This age where they were they were so big, and they had so much power and so much data, and they just weren't sufficiently spooked yet, maybe is is the way I would put it. It seems like this sort of, like, ghost of Christmas past and, you know, they got this what I would call a pretty big fine, but for Facebook, since we have started talking about it, they have generated that much in, like, I don't know, reels ads. Yes. Profit. Like, a drop in the bucket for them.

Speaker 3: Yeah. 91,000,000 is not not pushing them back into the stone ages. The the the the idea like, I can see how they got there, obviously. You know, he built it in his dorm room, probably built a very primitive database table for user accounts. And but the problem is is, like, it would take a senior software engineer, like, a couple hours to fix that. Like, you could just reprocess the password table into a new table, migrate it, and migrate a login credential or, like, a new login process. It'd be done. And, like, a sign up process, it, like, it it would have taken no time at all to fix. Surprising that they never fixed it. But

Speaker 2: Yeah.

Speaker 3: I guess that's why you gotta pay $91,000,000.

Speaker 2: And this is a very expensive error. Well, the error wasn't just the security breach. There was, like, I think there's, like, four or five different articles of, like, what it is you what laws did you break here? And there was lacking the proper security measures to ensure the confidentiality of those passwords is one of them. Failure to implement encryption is one of them. But then a lot of them had to do with, like, they failed to notify the DPC of a personal data breach. Right. They did not necessarily consider this that even though it, like, by the definition of the law was, they did not maintain adequate documentation of the breach once they figured out that it was going on. Like, a lot of this had to do with the corporate response to the breach in addition to the technical failure of the breach. Sure. There's an engineering problem, and then there's a, hey. You didn't tell us about this type

Speaker 3: of problem.

Speaker 2: Those are different and interesting.

Speaker 3: Well, the the fine works out to about 15¢ per user, 90,000,000 divided by 600,000,000, which is still, like

Speaker 2: Yeah. No. For sure. It Like It is it

Speaker 3: is both a lot and vanishingly little. So that that is what your privacy is worth, 15¢ above? About 15¢. Yeah. Yeah. Yeah. Yeah. So, k. I think we pivot off of this story. I think we've been talking about meta a little too much, maybe.

Speaker 2: I think they got the whole first half of the show.

Speaker 3: Yeah. Kudos kudos to you, Mark. Marky Mark. Add his because

Speaker 2: I Mark, I like his little Latin shirts from the events. I don't know if if you watched any of those those Ray Ban meta events, but he's looking pretty flocked.

Speaker 3: I was about to sidebar to the same thing and be like, whoever this whoever is, like, stylizing Mark Zuckerberg now, like, he's looking hip. Like, he's True. Black t shirt, gold chain. Like, he's got his little, like, vibe going now. He doesn't look like, you know, the Mark Zuckerberg we grew up knowing. Yeah.

Speaker 2: Because he he was the the sort of, like, archetypal wearing a gray hoodie.

Speaker 3: Yeah. He was Billionaire. He was in the in the Steve Jobs camp of, like, I have one out outfit. I can't remember what they call this. It's like a a life

Speaker 2: hack. Right.

Speaker 3: It's like if you only own the same pieces of clothing, you remove the decision from your day of what to wear, which makes your brain more effective for the rest of the decisions you have to make in the day. Is what it is. But I feel like he's passed that era. Maybe he's not making his main decisions. He's got enough, you know, 375,000 a year plus people making his decisions and doing his biddings. But now now he gets to dress a little cooler. Latin shirts, you know, black tees, gold chains. Totally.

Speaker 2: It's the chain it's the chains in in the in the curly hair. It's working for him.

Speaker 3: Totally.

Speaker 2: Don't do so many privacy breaches. Clean glasses, nice shirt. Why don't we kick it over

Speaker 3: for you? Information. Please. I beg of you.

Speaker 2: Why don't we kick it over to the ad oasis when we get back? We'll talk about a a very cool, game design meets real world puzzle design story. Deal. Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 1: Study and play. Come together on a Windows 11 PC. And for a limited time, college students get The best

Speaker 2: of both worlds.

Speaker 1: Get the Unreal College deal, everything you need to study and play with select Windows 11 PCs. Eligible students get a year of Microsoft three sixty five premium and a year of Xbox Game Pass Ultimate with a custom color Xbox wireless controller. Learn more at windows.com/studentoffer. While supplies last, ends June 30, terms at aka.ms/collegepc.

Speaker 4: When you need to build up your team to handle the growing chaos at work, use Indeed sponsored jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications, and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit at indeed.com/podcast. That's indeed.com/podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed sponsored jobs.

Speaker 5: This Father's Day, do more with dad and spend less with low prices guaranteed at the Home Depot. Get him fired with a new grill and accessories, like the next grill five burner for just $299 so you can spend more time together while he becomes the grill master he was always meant to be. Or build memories with savings on top brand power tools so you can tackle projects side by side. Get more and do more together this Father's Day with help from The Home Depot. Exclusions apply at homekeeper.com slash price match for details.

Speaker 3: At Oasis.

Speaker 2: I'm trying to, like, do the music each time, and then I've I I've put the of me saying it over it, and the last time I did it perfectly. I, like, I got the

Speaker 3: Oh, nice. The beats right.

Speaker 2: The timing of the drum. I got the beats right.

Speaker 3: Good for you.

Speaker 2: Alright. But thank you. I appreciate that a lot. It means a lot to me. So in the in the last episode of Hotline Hacked, we talked about, like, we talked about a a story on that episode. You should go check it out. It's a lot of fun where the the caller hacked into a sort of, like, alternate reality game that is being used to promote a new album from a band that they liked a couple decades ago.

Speaker 3: Mhmm.

Speaker 2: And we talked about how, neat, big, open world, like real world puzzles and live action role playing games and alternate reality games, like how neat that kind of stuff is. And, like, the next day, this big story dropped, about something going on from an indie game designer that it reminded me of that. I wanted to talk to you about it. Let's hear it. So Jason Rohwer is a indie video game designer, makes these very, like, thinky indie games, Passage, One Hour, One Life, Castle Doctrine, very philosophical.

Speaker 3: Mhmm. Puzzle? Puzzle games on this thing.

Speaker 2: Yeah. Exactly. And the new project that he's launching, is called Project Skydrop, and it's like a physical treasure hunt. It's a real world game. It's a departure from digital work, and it kinda came off of the back of him just thinking a lot about, like, you make these digital only experiences. And on one hand, it's great, but there's something maybe that could be more satisfying about it. So it's a treasure hunt, the Northeastern United States. It blends together like game design with physical outdoor experiences. There's a gold trophy cast from 10 troy ounces of 24 karat gold worth worth around $25,000 And you'll love it, a Bitcoin bounty, with a total prize, depending on the number of participants. It started 09/19/2024 with this YouTube trailer kind of unveiling the project and participants, solve the puzzle by analyzing these little daily updates from a map that shrinks and gets smaller over time, kind of battle royale style and drone images captured from higher and higher altitudes above the treasures location. Very high concept. I I just find it fascinating.

Speaker 3: I feel like the GeoHacker guys, like the

Speaker 2: GeoGuessr guys. Yes. GeoGuessr guy.

Speaker 3: I feel like this is like

Speaker 2: a this

Speaker 1: is a

Speaker 3: game for them. Like, I think it's all a GeoGuesser in, like, one second. Like, I want them to be like, it's here.

Speaker 2: Just ruin it?

Speaker 3: If they if they posted a photo of the the first of all, the trophy looks cool. It's very cool. It's cool AF. It's I got dig it. If I want it, I'd have a hard time not wanting to melt it down and take the money from it. But at the same time, I think it just is very cool looking. It did a nice job with the trophy. But, That's cool. I feel like if they ever if they posted a photo of it in its final location, the GeoGuessr has

Speaker 2: a bill. They must have thought of them. Those men must be just compromising military operations around the world. Like, they did it is this I was talking with someone about this over the weekend. It is such a super power when you see these guys. It doesn't even make for good content because, like, an image flashes on the screen and they were like, that's a road sign from Nicaragua. And you're like, that I don't I didn't even get to watch you solve the puzzle, man. You just knew immediately, like, that soil that is the loam of Senegal. It's like, why did you know that? My god. Totally.

Speaker 3: Totally. But, like, if you look at the way that the power pole design is, it's definitely Eastern Japan, not Western Japan because the power poles use an extra pillar on this side and only Eastern Japan, and you're like, oh my god. But I from a concept perspective, I love this. Everybody loves a treasure hunt. It's great. It's like a child's birthday game, but, like, for a 100. Like, let's go.

Speaker 2: For a 100. It estimated to be a 100. And you'll like this. So the gold trophy, everyone look, look it up. It's neat. It's this kind of spirally thing. He machined it in his basement and it has like a mechanism in it that when you manipulate it the right way will reveal a 12 word sentence that unlocks the crypto wallet. So the gold is worth a bunch of money and then a portion of the entry costs, which it costs, I think, $20 to take part in it and go punting for this gold trophy that's worth 25 k, gets pooled into the crypto wallet. So you're the entry fee kind of goes into the prize sort of like a lottery.

Speaker 3: So it's a puzzle within a puzzle.

Speaker 2: It's a puzzle within a puzzle within a just the two. It's a puzzle within a puzzle. Maybe there's a puzzle. I don't know yet.

Speaker 3: Yeah. Yeah. Once you get in the crypto wallet, it turns out it's not I don't well, that that's whatever.

Speaker 2: We won't go there. We just we had a whole episode about that. Yeah. That's really funny.

Speaker 3: I think I I don't know. You know, we were before we started recording, we were talking about how fashion's kinda kicking back to the nineties and stuff, and I feel like this is kicking back to Indiana Jones kind of Yeah. Nice. Vibes. Lara Croft, Tomb Raider. Like, this is like, we're we're in it. You know? The the cycles of society, and I I I love it. I wish it was closer to here so that we could participate, but, you know, obviously, I think it's on the Eastern Coast Of The United States.

Speaker 2: It is on the Eastern Coast. Do you wanna know what's wild? Literally, since we oh my gosh. I think I think yesterday, someone solved it.

Speaker 3: Really?

Speaker 2: Since we put together the notes and did the reading about this, literally, I was doing a, like, final Google as we were talking about this. Someone someone solved it. Okay. So it's looking like it was near Irving, Massachusetts. Sorry if we got you jazzed up to take part in this. It literally just got solved.

Speaker 3: It's done.

Speaker 2: It is it is over. It was a GeoGuessr guy? No. Probably not. That's fascinating.

Speaker 3: Dan Leonard, a meteorologist in Andover, Massachusetts, was identified as the winner.

Speaker 2: They used weather tools? Not by

Speaker 3: the project SkyDrop, but by NBC affiliate News Center Maine.

Speaker 2: That's incredibly fun. Good for you. That was quick. We were just yeah. They just announced this pretty recently and made a whole slick YouTube video about it. Oh.

Speaker 3: Bang, it's

Speaker 2: over. Bang, it's over. Wow. Okay. Well, you heard it here first. There was a cool puzzle, and then a guy finished it. There we go. He said

Speaker 3: it would have been impossible to solve if they didn't provide aerial clues or if they had cropped the temperature sensor data off the camera images.

Speaker 2: Oh, that's fascinating.

Speaker 3: The temperature sensor data and weather patterns helped him narrow down the area. Sure. How hilarious

Speaker 2: is meteorologist.

Speaker 3: Good for him.

Speaker 2: Yeah. Good for him. Oh, wow. The woods of Wendell State Forest.

Speaker 3: I'm looking at an image of an image that he had mocked up of the areas that it could be in given the temperature data for the time. So he solved it not just by clues and chance, but he used technology to solve it. So good good for you, Dan Leonard. Hopefully, you figure out the other puzzle to unlock the crypto and get all the money.

Speaker 2: I wonder. Yeah. Because those are two very, very different skills. Mhmm. Like clocking meteorological meteorological? Am I saying that word right? Have I ever said that word right? Clocking weather data and use from a video feed and using it to triangulate location is a very different set of skill sets than probably whatever crypto word puzzle is gonna unlock the rest of the money.

Speaker 3: Yeah. I'm looking at the I'm looking at the the trophy.

Speaker 1: Given the I can see the

Speaker 2: words, though.

Speaker 3: And the processes, yeah, I'm assuming maybe it's a binary puzzle. So if you haven't solved it yet, maybe run down that one. It looks like it looks like on off bits based on the where the the holes are punched. Could be, could not be. Haven't looked at it much, but that would be where I would start probably.

Speaker 2: Anyway Fascinating.

Speaker 3: Fascinating.

Speaker 2: You big time share guy, Scott?

Speaker 3: Added to questions I've never been asked by anybody in my life ever That's

Speaker 2: what I'm shooting

Speaker 3: for. But somehow makes sense on this. I'm gonna go with a hard no. I think I've stated them once in my life. Yeah. Once in my life. Had a had a ex, whose whose father was a big tan chair guy. And, so we stayed in a timeshare of his. That was it. That's my only timeshare experience. It's all I got for you.

Speaker 2: One more than me, man.

Speaker 3: Hope that's enough. Hope that's enough.

Speaker 2: I'm I'm not a timeshare guy either. I think, variety is the spice of life. Same vacation over and over again. Not Never really appealed to me. Yeah. Not Not my jam. No. There's a, there's a quote on escapeshieldsecurity.com that warns owners of timeshares in Mexico, that their investment is a target for cybercriminals and and criminals and, and grifters. And the irony of this will become apparent shortly. Quote, by 2015, cyber thieves had realized the amount of funds involved and had targeted the real estate title and settlement industry. As fund became more complex and risky, agents and underwriters had little time or resources to pick up. The industry needs a simple solution that allowed to keep pace with the new funding security needs. Now this is true. Timeshares are often obtuse and really, really complicated investments Mhmm. Air quotes that have customers sort of like riding around between middlemen in a country where they don't live and regulatory hurdles to buy a product that they maybe don't even own and probably isn't a good idea, even if they did. The reason that escapeshieldsecurity.com, claims that is funny is because they are a cybercrime grift targeting owners of timeshares in Mexico.

Speaker 3: Classic fight.

Speaker 2: And the weird part is that it seems like it might have something to do with the Mexican drug cartel.

Speaker 3: Yeah. Why not?

Speaker 2: Yeah. Mix it up. Then why don't you?

Speaker 3: All the Russian, like, crime gangs got into cybercrime. Why wouldn't the Mexican ones follow? It only makes sense.

Speaker 2: Literally. Like, if you think of some of the largest criminal operations in the world, some of which are, like, belong to countries. True. Yeah. Cybercrime. Incredibly profitable. You can do it in countries where your people don't live.

Speaker 3: Fuel fueled by crypto? Yeah. Yeah. I would say it's totally untraceable, but that's not true.

Speaker 2: This is true. Here you go. Kravestone Security broke a story starting in 2022 about this retired couple from Ontario that about whether or not they were ever interested in selling their timeshare. They had an interested buyer in Mexico. The person said, would they be willing to sell it? You can't sell them until they're fully paid off. In a lot of cases, they still owed a little money, but the buyer was willing to cover it. This all led them to a company called ecurrency escrow dot LLC. They started going down this very involved process of trying to sell this, this timeshare to this theoretical buyer. And at some point after all the forms are signed, everything's faxed on over, the couple is asked to send a small wire transfer of $3,000 to handle administrative and processing fees, to try again and navigate all of that bureaucracy that you face, trying to sell something in a country where you don't live. This was a scam. This went on for almost a year. They kind of keep sending them more money to try and pay off this get to get through this process and pay off this balance. And turns out it was a scam, linked to the Jalisco new generation drug cartel in Mexico. Hold on.

Speaker 3: Well, I know timeshares often gets old as I think people buy them optimistically. And, there there's an entire secondary market for buying timeshares if you're ever in

Speaker 2: the market for one, Jordan.

Speaker 3: So so so I can see the desire of why somebody wants to get rid of it, and I can see the hook, like, the bait in the hook here makes sense. Yeah. People often wanna get rid of these things, and they realize that they're long term cash commitments, and maybe they're not gonna use it as much as they idealistically plans to. So, yeah, it makes sense. Easy crime, easy money. You know, the makes sense that it's organized crime as well. Like, the if you're an organized crime group that's not into cybercrime at this point, then, like, you know, what what are you doing? The it's like easy money. There's no guns involved. There's no massive drug busts and governmental organizations. I guess there are governmental organizations after you, but I feel like it's less like shoot them up cowboy, you know, drug cartel bust ups. Cybercrime ones seem a little bit more like people like me.

Speaker 2: So what you're saying is

Speaker 3: that also have a gun.

Speaker 2: You think you're saying go do cybercrime is is what I'm hearing from you and and giving the chance to retract.

Speaker 3: I'm say I'm saying at least Sure. I'm saying I'm saying at least once a year, I wake up with a moral Right. With a moral a dream after a dream and I have a moral decision to make in the morning of whether I'm gonna go into cybercrime because it just seems like it's too easy and I always morally choose not to and so should you. But I totally understand the motivation of why people get into cybercrime. Is that is that a good enough attraction or retraction?

Speaker 1: That's

Speaker 2: really funny. We've talked about ad no. I think that that's a really good retraction because I have had similar thoughts. We've talked about ad fraud on this show before and just how easy it is to come up with, like, cool project. And then you sort of, like, walk your way up to to ad fraud. And I had a dream the other day that I had you know, the sleep podcasts where people, like, just, like, kind of, like, inanely droll on so that you can fall asleep to a human voice, but it's not saying anything interesting or relevant to keep you awake. I'd had this, like, nightmare that I had started one of those, And I had inadvertently wandered my way into doing ad fraud. And I was like, well, I'll get it started and I'll build an audience. But and then I just accidentally backed my way into doing a crime. So I'm with you. And I do think it would work, but I'm not gonna, I'm not gonna. I'm not gonna do it.

Speaker 3: But I'm not gonna. We're not gonna do it. You heard it here today. Hopefully, this doesn't come back to bite us in the ass, Jordan.

Speaker 2: But I inevitably do that when, when things get really dark and I, and I start my, my sleeping pod, I don't think there's anything wrong with starting a sleeping podcast. Don't do ad fraud though.

Speaker 3: Your sleeping podcast is just use in a low, like subtle tone telling people about, like, and that's why you should be sleeping on Sleep Blah. This mattress

Speaker 2: Yes. Totally. Starcher. It's like it's doing ad fraud so poorly. And, like, you're just actually reading the ad. Jesus Christ.

Speaker 3: Subliminal advertising, a new trend brought to you by hacked.advertising. Subliminal sleep. Oh, that's

Speaker 2: so evil. That is that's that sucks too. Good stuff.

Speaker 3: Do we want to talk briefly about, something that happened recently, which is, Chinese hackers accessing a US telecom.

Speaker 2: I saw a tiny bit about this, but I didn't read up on it.

Speaker 3: What happened? Yeah. Just, essentially, what it seems like is a highly skilled group of Chinese government hackers, cybersecurity, criminal, but not state operators, I guess we'll call them. They're not is it crime? I guess it is kinda crime, but but they're not criminals because I kind of associate the term criminals with, like, large groups of, like, people that are not government employees.

Speaker 2: Is it a crime if it's at the behest of the people who wrote the laws? I for sure.

Speaker 3: So they've, apparently infiltrated a number of US telecom firms, looking for social information and comparing to national security. So not good. Again, not surprising, but also not good. Justice department, FBI both declined to comment. Shocker. Wall Street Journal, I think, was the first to break it.

Speaker 2: Chinese embassy in Washington, he denied that Beijing backed hackers had breached US telecom firms, calling the information, quote, I'm just reading directly from CNN here, calling that information, quote, a distortion of the fact. Embassy spokesperson Liu Ping Yu accused The US of politicizing cyber security issues to smear China. Oh, yep. That's what you would say.

Speaker 1: Okay.

Speaker 2: This is fascinating.

Speaker 3: I'm just I'm just sitting here being, like, politicizing. I feel like cybersecurity issues should be politicized, especially given

Speaker 2: When states do them.

Speaker 3: Yeah. And also, like, you can't say that when it's like like The US is mandating that you like, TikTok recently got like, this is another story that we talk about is, like, TikTok's recently getting sued. I think that dropped yesterday at time of recording about mental health issues that they're seeing in in teenagers. So TikTok is being sued by 14 United States states. So it's not actually the nation. Like, the nation is obviously attacking TikTok from, like, a you shouldn't be owned by the Chinese government or Sure. By companies that have a, like, a connection to the Chinese government. So we want you to sell it. But then actually TikTok is being declared as essentially like a mental health tool for in a negative light, and it's actually being sued by 14 separate American states. So it's like, we're we're politicizing cyber issues already. So, like, what's another one? And, like, when you're hacking into a US telecoms and looking at, you know, first national security information, I feel like that's something that I would like my politicians to talk about.

Speaker 2: Yeah. I don't think it's fair to say that, yes. I would agree. I'm also just trying to Google whether or not, meta products are available in China because there's a there's a fascinating world in which you end up in this sort of, like, regulatory lawsuit arms race where American courts are suing companies with ties to Chinese the Chinese government. The Chinese court starts suing American companies. Like, if Instagram and Facebook are available inside of China Mhmm. And the argument is that social media is a blight on our mental health, that that swings both ways.

Speaker 3: Totally. Totally. The yeah. It's a really complicated relationship The US has with China. Yeah.

Speaker 2: A big old thing. Apparently, they are starting to sell, VR gear there through Tencent. So while the platforms, I think, aren't necessarily available, they are beginning the long laborious process of of making their way back in there. Selling selling neat glasses and cool Latin t shirts.

Speaker 3: In, in another, odd pivot, Tencent is apparently potentially looking at taking over Ubisoft to go and do a hot hack gaming conversation.

Speaker 2: Yeah. Sure.

Speaker 3: Ubisoft's been in it a bit as of late. I think yesterday, at time of recording, yesterday, I think they got hit for a data breach issue where they were illegally giving their data breach lawsuit or or civil case where they've been essentially illegally giving personal information to Facebook. Not to mention some declining sales and and budget overruns on a bunch of projects. I think Ubisoft's not having the greatest time right now. And they apparently Tencent's looking to take them over. Apparently, they're already a major shareholder, and they might just scoop the rest of it up and take it private, which would be, you know, given that Ubisoft has a number of, I would call them, like, great legacy franchises, you know, Assassin's Creed, Anno. I'm trying to think off the top of my head some other ones. But, yeah, I think that would be interesting. Interesting.

Speaker 2: It seems like this is how we end up in a world where, Tencent publishes 19 versions of Assassin's Creed every month, call it. And that's what Ubisoft becomes. That seems like where this goes. If if, private capital and big takeovers of companies have taught me anything, it's this is how we end up with 400 Assassin's Creed titles every single year. One of or several a month. Every month. Yeah. I don't know.

Speaker 3: I don't know. I don't know. I I'm intrigued by it. I know there are some like, this year alone, I think, say, Wukong, Black Myth Wukong? A video game that came out?

Speaker 2: Yeah. People like that.

Speaker 3: Yeah. It's been built by a Chinese studio, received insane, like, reviews. Like, I think it's the highest reviewed game of the year. Apparently, it's also not up for game of the year in itself, which is its own controversy around it.

Speaker 2: Yeah. It's interesting.

Speaker 3: Yeah. So I'm not sure what the deal is there, but the, but a very loved game, a lot of positive feedback, and it was it's built by a Chinese developer. So I could if this is the quality of games that are coming out of Chinese developers now, then Ubisoft being taken over by Tencent could be good for the gaming community.

Speaker 2: Oh, that's true. And to be clear, that was not me making a comment on its ownership being a a Chinese company. It was, a commentary on companies getting bought by bigger companies, just to be clear. And that game does look cool.

Speaker 3: Yeah. Yeah. So so who knows? Who knows what's gonna happen?

Speaker 2: Yeah. I'm hopeful.

Speaker 3: It's our our side step into, hack gaming for the day.

Speaker 2: We gotta do another one of those, like a a full blown one of those. It can't be any more all over the place than this was.

Speaker 1: Yeah.

Speaker 3: Yeah. I wanna do I wanna do so if you're still listening at this point, thank you. I'm trying to do we're putting together an episode content for Hacked AI. So we're gonna do an AI focused episode, which I think is gonna be really neat. Getting some some of the guests on for that one is talk about how AI is changing different parts of their job and and or different parts of their world. Industry. Yeah. It's not just it's not just about work. It's about play and fun too. So so that should be interesting.

Speaker 2: Put doxing people on the street using your Meta Ray Bans.

Speaker 3: The, but, yeah, I think another hack gaming's we're due for. I feel like there's enough Do it. Enough things to talk about.

Speaker 2: I'd like to have some game devs on. I think that would be really, really fun.

Speaker 3: Yeah. We could do that. We could coordinate that. Let's do it. The, if you're a game dev, jump in the Discord, drop us a note. Oh. Oh.

Speaker 2: Yeah. Fire us fire us an email at get@hackedpodcast.com. We'd love to hear from you.

Speaker 3: Yeah. Yeah. Yeah. So if especially, I would love to have somebody that works in an anti cheat department if you're

Speaker 2: Oh.

Speaker 3: Specifically. So if you work in an anti cheat department on a major video game, Counter Strike, Call of Duty, Apex, something like that, I would love to

Speaker 2: Hell yeah.

Speaker 3: I would love to hear from your side of the coin what you're allowed to tell us, because I'm sure there's a lot of people that'll be behind NDA walls. But and

Speaker 2: if you if you would like to breach those NDAs, I'm not sure if I can say that. If you would like to, and share a story with us. Yeah. Don't don't bring that heat. I take that back. Hotlandhack.com is a great place to share stories with us. We sure love to do long form interviews, but if you just got a fun, spicy tale of of technology gone amok, computer confession, whatever you got, hotlandhack.com, which you can get to through hackedpodcast.com. It's a whole whole ecosystem, very hastily put up websites. Share your strange tell. We we love to hear them. We listen to them. We've gotten some great stuff since the last one. We're really excited for the next episode. Totally. Hollandhack.com. Get get at us. And you know what? I'm gonna say the the call, I think maybe for the end of this episode, tell someone you know about Hacked. If you if there's someone in your life that you think would enjoy Hacked podcast, fill them in.

Speaker 3: Fill them in.

Speaker 2: Let them know. We'd we'd we'd love to have them in here. We we love making the show. We love getting new folks in, getting their takes on stuff. So, yeah, sure. Spread the word if you if you got got it in you.

Speaker 3: I can't say it better than that. So I think with that With that we just say goodbye.

Speaker 2: It's another one in the bucket. Thanks for listening. Catch you

Speaker 3: in the next one. Take care.