Hotline Hacked Vol. 16 | Shutting Down the School During Finals

Speaker 1: Welcome to Hotline Hacked. It's the call in show where you can share your strange tale of technology, true hacker computer confession. It's a call in show about all the weird crap people do with computers. Scott, how you doing?

Speaker 2: I am great. One note, last time we did this episode, we got a lot of feedback about text to speech and AI voices. This time, we're gonna try something new, which is if you sent in a text story, Jordan or I will read it, except for we do have one text to speech, which was provided by the person telling the story. We will be playing that. If you hate text to speech, we kinda get it. But at the same time, please bear with us.

Speaker 1: Us. People are confessing to things that they would wish were anonymous. So I respect the authorship of the voice. But as Scott said, we're gonna try reading it. It's gonna be a little different this time. In this episode, brought to you as always by our title sponsor, NordLayer Intelligence by Nord Stellar, the threat exposure management platform that helps companies see what attackers already know about them, tell you more about them later. Let's get into the first message. I'm gonna start off by admitting that I did this because of a girl.

Speaker 2: Classic. Classic.

Speaker 1: At the time, my girlfriend and now many years later, my wife, so maybe it was worth it.

Speaker 2: Yeah. Sounds like it. Yeah. It turned out well. Good payout.

Speaker 1: Good payout. Back in college, we took a trip to Czech Republic to Denmark by train. And along the way, we encountered a delay for some reason. Her parents asked her to send a message when we arrived at the place we rented out, and she was getting worried that they were probably freaking out not hearing from us. We had phones, but without a cell phone plan that functioned in different countries, Wi Fi was the only way we could connect on the road with our laptops or iPod touch that dates this story, which is what we use because we didn't have smartphones. The train had Wi Fi, but it was paywalled with no free tier. Technology slash networking had always been a hobby of mine. I was studying something entirely different in university, a choice I later regretted since I now work in tech and web development. Hey, man. I make a tech podcast. I sure didn't study that in university either.

Speaker 2: I did.

Speaker 1: You… Yeah. You did. But I kept scripts and step by step guides on my laptop for things that I found fun or could one day be useful. While she was worrying about her parents worrying about us, I noticed another passenger actively on their laptop typing away. They were clearly using the train's internet. They had a MacBook just like me, possibly even the same year, light bulb moment. I had saved a step by step guide on how to change my MAC address to something else, But how do I get that other machine's MAC address? This is an excellent question, Scott.

Speaker 2: Than you think is the answer. This this story resonates with me because I feel like where this is going is something that I do occasionally or have done.

Speaker 1: Have done. Allegedly have done. Let… That past tense is very important. There's only, like, three paragraphs left, so I I have a feeling it's going where you

Speaker 2: think it is and quick.

Speaker 1: Well, I noticed that when I connected my iPod to the access point, it kept you on the network even after you closed out of the login payment screen just long enough to open an app I had on my iPod Touch called Fing, f I n g. Fing is a network scanner, that at the time displayed each device's MAC address on the network. Just FYI, Apple stopped that completely. Although I read somewhere they're allowing it on iOS 27, and maybe we'll get that feature back. Once I scanned the network, the app displayed devices connected, but there was only one that showed up as an Apple device. It's clever. Had to be that passenger. I saved that MAC address and one or two others without manufacturer names on the computer, and as luck would have it, that passenger gone off at the next stop. So with them gone, I changed my laptop MAC address to theirs and done. We were in. No login payment screen. Because we had no idea how long that pastor actually paid for, we quickly went to Facebook, messaged the parents about the delay, and let them know we're okay. Fifteen minutes later, we no longer had access, figured the credits ran out or we rebooted off. Gentlemen, she was impressed. Gentlemen, I was impressed and relieved that it worked. Thank you all for listening. Love the show. Love these episodes. Thank you all for the time and effort you put into making this. You are so welcome, and thank you for sending in this story. We really, really appreciate it.

Speaker 2: This is this is a classic. The airplane Wi Fi back before it was mostly free. Yeah. I don't know if you traveled lately, but, generally, it's kind of free now. You could easily do this. This was a classic free Wi Fi, free Internet hack.

Speaker 1: I feel like one of the first episodes you and I ever did this, the way that you got through me, I think, just gone, I both like to travel. The way Scott kind of got through to me was, like, you know, Wi Fi. You know, paying for Wi Fi. You don't have to. And it was, like, I remember that being kind of how he, like, got me with this

Speaker 2: whole world. He baited you in with free Internet.

Speaker 1: Exactly.

Speaker 2: The… And and look at you now.

Speaker 1: Look at me now.

Speaker 2: Yeah. So thing I've never used, I typically go to terminal and use ARP caches. So your computer, when it connects to another device, instantly, like, puts it into a table, and you can scan through that table and take a peek. Sure. The… Lots of the new Wi Fi scanners, even if you're using something like a Wi Fi monitor, anything like that, we'll show you other devices around you that are sending out Wi Fi signals typically with their MAC address. And there's a ton of tools to do this. Right. The old school way was to go in a terminal, look through your ARP tables, determine something, change your MAC address, and bang, you were, like, instantly certified through on most of these systems. Anybody using a MAC address lock, for paid, if you've paid, they approve your MAC address, you could easily bypass it by just stealing somebody else's MAC address. Oh.

Speaker 1: Did Did you have a sense that most sort of, like, paid public Wi Fi has moved on from this type of thing, or do you think this is still, like, no. If you could just spoof a MAC address, you're in.

Speaker 2: This is a risk that they accept. Right. Occasionally, certain people know that MAC address… Like, typically, MAC addresses are are the… Like, the the physical ID of the hardware, and most people kind of assume that those are a permanent address, but they're not. You can change it with a couple of command lines, and it's… Yeah. It can open some paywalls for you if you want to get through

Speaker 1: them, allegedly. Allegedly. Gentlemen, she was impressed. I'm reminded Yeah. The hardest tangent we've ever… Maybe ever taken in a 150 plus of these episodes. Here in Canada, there was a Canadian version of the show Tool Time called the Red Green Show. I think in the superior product in my opinion. And on that, they had a slogan, she may not find you handsome, but she can at least find you handy. I think they said that at the end of every episode of the fake show they filmed within that show, five people in the audience got that reference. Anyway, super relevant here. That's some let me just crack open the… Let me just hack into the mainframe kind of moment on a train. It's a good look. It's a good look.

Speaker 2: So I, I commend you. Great, great use of tools and great way to let the family know that you're all safe.

Speaker 1: Mhmm. I think that stealing public Wi Fi… Let's just pontificate on this for a second. That's always okay. Right?

Speaker 2: Are we the moral authority on these sort of things? I don't know. I Sure. We… You taken a hard stance on stealing free laundry. Yep. You said that that's always okay. Yep. Yep. Yep.

Speaker 1: I think may… Maybe not… No. Not always. Not from, like, a small community laundry. I think there's nuance there. I think it's often a cool thing to do. And I'm I'm wondering, do I add public Wi Fi to that list? What are the Yeah.

Speaker 2: What are

Speaker 1: the exceptions? What are the… You know what I mean?

Speaker 2: Totally. The the other way that I would twist this is I I don't wanna… I… I'm not a absolutionist. I'm not gonna blank and say that it's okay to steal Wi Fi. I will say that there's a high probability that I've done this exact thing in the past. Right. So that that… There's your answer. Lots of network security can rely on MAC address filtering as a way of keeping people out. So anywhere there's a network plug in… Like, imagine you walked into Apple's head office and you just jacked in your laptop. Would you immediately get LAN access? Probably not. They're probably doing a Mac filtering to make sure that your device has been approved for the network and they have some off layer between it. Maybe Apple's the wrong because they'll have the cream of the crop. But say you walk into a small business or a medium business, you might be able to jump straight out of their land with something as simple as a a network cable. Same thing goes for Wi Fi. You go in for a meeting. Maybe they don't have a guest Wi Fi account. You get put on the thing on on the main network. You've been approved to be there, but maybe you haven't been given rights

Speaker 1: Mhmm.

Speaker 2: To your MAC address to stumble into the rest of the network. You can't look at the file shares, can't do all these things. There is a good chance that if you change your Mac to something that is approved, that bang, all of a sudden that stuff shows up.

Speaker 1: Sure. It

Speaker 2: can show up. So Right?

Speaker 1: Yeah. You're getting out of the territory of just using public Wi Fi and just, like, getting onto someone else's network that you shouldn't be on at that point.

Speaker 2: Exactly. Gotcha. If you jump into a network you're not supposed to be, and one of the first things you do is clone a Mac for a computer that's supposed to be in there and change your computer name, the network has a really hard time identifying that you're not that computer.

Speaker 1: Yeah. Right.

Speaker 2: So any kind of network security permissions that depend on what computer you're on would open potentially for you. Yeah. So this, this is a tool in the toolbox of people that do network penetration.

Speaker 1: Sure. Using that tool universally, maybe frequently no bueno.

Speaker 2: Using it for free Internet when you're on a overpriced train or plane, maybe so.

Speaker 1: Who am I to judge?

Speaker 2: Who am I to judge?

Speaker 1: Speaking of judgment, let's move on to the next call. Not because I'm judging the person, but because of the language that they use.

Speaker 2: Bless me, father nerds, for I have sinned. I have a confession for hotline hacked. If you use it, please give me an AI voice. Well, I'm as close as you're gonna get to this story, sir. If needed, let me know, and I'll record a voice myself. That's okay. Apparently, I'm doing this for you. I am your AI voice.

Speaker 1: It's what we're here for.

Speaker 2: This story takes place back in the early two thousand and tens in a small town here in Western Canada.

Speaker 1: Let's go.

Speaker 2: Surprisingly close to us. In my youth, I was an avid gamer. So let's cut out the part we've all heard. I fell down the gamer to hacker pipeline. An online friend I had gave me access to a tool he used called Network Stressor. The instructions were clear. Insert an IP, select the type of attack, and press the big red button. If you're a DDoSer in, like, multiplayer games, which is where I kinda feel like this is going Yeah. I, Yeah. We'll see. I use this stressor to turn off Internet for people I played against in games, and there is the resolution. In Minecraft PVP, if the opponent disconnected during combat, it was considered a death, and they would drop all their inventory. Unfortunately, I learned I could use this power in the meta space to turn off the Internet for my high school, and I started using this to disrupt any part of class. For months, I wielded this power and used it often. As the end of my final year approached, I was called to come to the principal's office. My hands were shaking. The jig was up. I must have been caught. DDoSing your school offline to to to bypass

Speaker 1: learning. I'm reading ahead. This gets good. Also, it was meet space, not meta space, but keep going. Keep going. They're redeemed in the office. Hands are shaking. Knees sweet. Knees weak. Whatever. Like, keep going. Knees weak. I'm just shaking. Yeah. That that first.

Speaker 2: To my relief, I was only there for an entirely different problem. There was a class designed to be completed online in our own time between the tenth and twelfth years. I neglected to do this class and considered it optional. Well, it was not. I was told that I would not be allowed to graduate unless I finished it. With a little over a month ago, I had to come up with a clever way to finish it. They obviously didn't have AI back then. That week, I stayed late in class. I was the last person around and took the opportunity to rifle through a teacher's desks. I found some papers with all of our student emails, IDs, and numbers. That was enough information to log in to all other students' accounts who had never changed their default password. I downloaded the work from other students, changed the name in the info, and over a few weeks submitted all of their work as my own. My online work was accepted, completed, and I was allowed to graduate. I held a lot of anger towards the school for this, and I hatched a diabolical plan. I decided that when my final provincial exams came, little break here, the… In Canada, all of the provinces, especially in grade 12, you have something called a provincial, which is like your end of year test. In my day, it was worth 50% of your total mark for the for the year. I think they've now reduced that to 30, but provincials are the big scary,

Speaker 1: like, hey.

Speaker 2: You're about to graduate. We wanna make sure that you actually retained something before we let you out the doors test.

Speaker 1: I had a mild panic attack when I read the word provincial. It was first time in, like, mid… Decades that I've thought about that. I was like, oh, yeah. That thing that just could ruin my life if I did bad on the multiple choice exam. Canada does not joke around when it comes to standardized testing. Quick quick quick aside here, it took me a second, and I'm still trying to make sure I understand it. I held a lot of anger towards the school for this and hatched a diabolical plan. The fact that they let you graduate or maybe the fact that they made you take this class was the thing that he was upset about. Okay. The dumb optional class.

Speaker 2: Feel like I already know what this class is. I think this is career and life management. Calm. Yeah. We all had to take it as Western Canadians. Yeah. We had to take this dumb class as well. It was really stupid. It's like, this is how the stock market works, and here's how you should… Like, I don't even remember who was in it. I did have to learn how to

Speaker 1: make a budget in that class.

Speaker 2: Yeah.

Speaker 1: Which is more useful than a lot of the other stuff I learned in in high school. But keep going.

Speaker 2: That's a that's a fair fair point.

Speaker 1: That was like a good… I was like a teacher being like, you're gonna have to pay rent. And I'm like, sorry. What? And they're like, yeah. No. Like, do you make this much money and you can only spend this much money in, like, two tables in a kind of thing. And I was like, that was the most valuable thing I learned that year. Anyway

Speaker 2: Anyway, jumping back in, I decided that when the final provincial exams came, I would ruin them for everyone. The day came and all of us, final year students were taken to the computer lab to do our tests. Mine were in paper in a massive hall, which ages me, but that's fine. With a quill. I raced through my exam. They're… Well, I mean, they're like books. Like, they were like a half asleep. They're massive. I raced through my exam, and I was among the first to finish. I was allowed to leave. I beelined it straight to my locker, grabbed my laptop, sat in the stairwell, loaded the stressor, set the IP, chose the attack method, and I hit the big red button. Minutes went by, and to my shock, the Internet stayed up. I tried a few more times before I hurried away. The Internet never went down that day. I'm not sure what additional security they had put in place for the exams, but I'm glad they did. I'm very thankful my attack failed in retrospect. I was the I was the only and obvious culprit. Yes. I was that kid too. I was the weird kid in the corner who brought his own laptop and booted into Cali Linux every day to do regular schoolwork. Yeah. Big red flag. They would have known exactly who it was. Kali Linux, for anybody listening that doesn't know, is essentially a custom Linux distro built for network security and penetration testing, red teaming, blue teaming. It has all the tools that's built in. You can boot it off of a, like, a portable disk.

Speaker 1: Deeply nerdy shit for a high school student sitting. It's like there… You you are the most noticeable culprit. I I get how you got here, caller. I get how you got here.

Speaker 2: I graduated that year. Did I deserve to walk across the stage? The story is told with a decade and a half of guilt. Oh, poor guy. Since then, I've kept my interest in the pewter and gotten a nice assistant job working with the same school district. Oh my god. That's cute. I feel your guilt. I think a lot of people that send stories in have guilt from it. You know, we were just dumb kids playing around and learning things actively. It's not something that you should hold on to. You know? It's been years. You've learned from it. It honestly set the stage for what is now a great job that you're doing in the same school district, which is even crazier. Thanks, father nerds. So, apparently, we are father nerds. We are the… We are natties.

Speaker 1: We say computer confession maybe on the website, so there's a confession, forgive me father for I have sinned. Sure. Sure. Sure. Sure. There's a there's a larp to the whole thing. You are forgiven, my child. I don't know if that's You are forgiven. Yeah.

Speaker 2: Say that. Read the hacker's manifesto three times.

Speaker 1: There you go.

Speaker 2: Totally. Get to bed.

Speaker 1: Also, I just like pooter. They spelled computer without… They're just apostrophe p u t e r, and I read that, and I I was like, that's fun. I'm I'm gonna steal it. That's really good. That's good.

Speaker 2: Yeah. That's, that's like parlance that I thought you would have known.

Speaker 1: I've seen it before at some point, but just being reminded that it's good. I like that. The decade and a half of guilt is very sweet. I feel like there's… We… That's a recurring thing that we get on this show as folks who have these, like, swadd story they've been carrying around a long time and sort of an itch that they did something that they're not happy about, which I imagine factors in, like, maybe comes from the fact that we have a lot of sysadmins, a lot of IT folk who are now on the other side of it being, like, the freaking rats nest I've had to untangle. Like, is this ethical? Be like, no. But it was just so inconvenient for someone. And now as an adult, I realized that. I'm like, oh, okay. Yeah. Yeah. There's some growth there. I get it.

Speaker 2: It. Network stressor, I'd never heard of.

Speaker 1: Yeah. Is that just a a big DDoS button?

Speaker 2: No. I don't think it is a DDoS button because it was a standalone app. I can't imagine without paying some subscription, you could activate the world of DDoS. It was probably something like, like, the different attack types. Like, you could flood the local network with, like, ACK packets or something that would cause network disruptions would be my guess. I can't imagine it was a DDoS because if it was a DDoS, it's pretty crazy that you could just, like, download one for free and just point it at whatever you wanted and hit the go button.

Speaker 1: The implications of that are a lot.

Speaker 2: But even then, he was using it for Minecraft players, so it would be across the Internet. I was

Speaker 1: gonna say it's over the

Speaker 2: Maybe it was a DDoS attack. I'm not sure.

Speaker 1: We had kinda two little… There were two little hacks here, really, or, like, an attempted hack. There was the there was that tool that they attempted to use to take down the network. And then there was the just good old fashioned opening the drawer looking at the other students, like, ID name and then just

Speaker 2: Is that a hack?

Speaker 1: I'm like, I don't know if that's a hack or not.

Speaker 2: Intellectual property theft? Is that are we calling the hack?

Speaker 1: I don't I don't even know if it's intellectual property. I don't know what to call it.

Speaker 2: I think that's, like, closer to the, like, breaking and entering side

Speaker 1: of the law. That's more of a b and e.

Speaker 2: Than than the, like, cybersecurity crime part of the law. Yeah. Knowing that most people are idiots, sorry, people that don't change their default passwords. And then just using those passwords, your gain, I would say, is more in the cyber realm.

Speaker 1: And maybe some slight social engineering with the, like… And then I knew they wouldn't be there, and I would go to the drawer. Like, I'm not… You know? Yeah. Some thought went into it.

Speaker 2: Totally. There… The gamer to hacker pipeline is an interesting thing. We never really talked about the connection between how, like, technology integrates into our life as children through games, and then we get more interested in the technology than the game. And then all of a sudden, you become a hacker, which is kind of like an advanced mode of the game of of pewters.

Speaker 1: Of of pewters. Yeah. There's, I was listening to someone talking about this of sort of the shift that's happening in the gaming space right now, and it… I wonder if part of that is the fact that there was a generation or two where the video game console, the video game console now is a thing that lives in the living room and probably sort of belongs to the parents a little bit. It was… It's like a… It's like the VHS was when I was a kid. I was like, that's

Speaker 2: in the

Speaker 1: big living room.

Speaker 2: This is the PS five. It's dad's.

Speaker 1: The PS one was in my room. Do you know what I mean? Like, it was like the kids thing. And so there's a little bit of a sense of, like, well, this is mine. I can kinda do whatever I want with it. No one understands this more than me. How much could I understand it? So there's an interesting shift there that I imagine is is maybe taking place right now.

Speaker 2: Oh, that's the millennial parenting as millennials who grew up in the technology space. This is a weird aside, but it's something… I just had this conversation again about, like, phone addictions.

Speaker 1: Yeah.

Speaker 2: So people that, are addicted to their devices, addicted to screens, social media impacts them stronger. I kinda look at it like a drug where if your Gen z, you kinda grew up with it. So you've developed a natural immunity to it a bit more than somebody that's a Gen x. I got you good on that one.

Speaker 1: You got me good on that one. Yeah. You got me on that one.

Speaker 2: But if but if you… But if you're a Gen z or even, like, a, early millennial or late millennial, you kinda grew up with screens your whole life. So you've got a natural immunity to them. You use them differently. Where, like, Gen x and boomers got seeded social media and stuff later in life where they didn't develop a natural immunity to it. Like, I see… Like, when I go to something like a concert or a sporting event, all of the younger people are, like, grooving with the music and having a time.

Speaker 1: And the older people Interesting.

Speaker 2: Are messaging their friends and posting on Facebook and looking at the responses and waiting for hearts on their Instagram. Like, they're looking for that dopamine cycle. And I I just feel like there's… And this is my own crazy hypothesis, but Internet addiction is something that the later generations have developed a natural immunity to where the earlier generations the dopamine hits them even harder.

Speaker 1: K. This is really interesting. Because, like, on one hand… So there's a different way of reading it. Right? You could say Yeah. The younger generation has far more nuanced, like, social protocols of when it is and it isn't appropriate. Where it's just like Totally. No. Like, I can tell you within it and, like, a… This much of whether I should or shouldn't have it out right now. It's been with me forever. I have, like, so much feedback socially. Because then the flip of that… Yeah.

Speaker 2: The social norms are totally different.

Speaker 1: And they're tuned in. Right? Like, you gotta you gotta be, you know, locked in with that kind of thing. Because the flip of that of, like, you're more inured to it in some way because you've had so much of it. I'm like, I don't know if that's how addictive substance is given to someone in their youth works. Like like, I think… I don't think you have a natural immunity. But

Speaker 2: I'm like calling it an addictive substance. I'm calling it a virus.

Speaker 1: Okay.

Speaker 2: Sure. And and they've developed a natural immunity to where the older people haven't, and they just get so… Like, the amount of boomers you meet that are so addicted to Facebook is… It's shocking. The

Speaker 1: reason they're not on that is because it's bad. But, yes, I know what you're saying.

Speaker 2: You know what I'm saying.

Speaker 1: Yeah. I know what you're saying. Yeah. Interesting. This is Yeah.

Speaker 2: So that… That's my crazy theory. So Sure. Roast me in the comments.

Speaker 1: Me in the comments. They're gonna just… It's just gonna be a bunch of Gen Z's with, like, their screen time being like, no. That's not that's not where this

Speaker 2: is going. Eighteen hours like Instagram A

Speaker 1: 100%. Like, I

Speaker 2: wouldn't wanna share that.

Speaker 1: I would not wanna share that number. Before we get to the next call, we should probably talk about our sponsor this episode.

Speaker 2: Why don't you tell us about it?

Speaker 1: I'm gonna tell you about this episode being brought to you by our title sponsor, NordLayer Intelligence by NordSteller. Some that comes up in pretty much all the stories we cover. The attack doesn't normally start with the break in. It starts earlier with a leaked password or a session cookie stolen by an info stealing malware or someone on a dark web forum selling access to your network. NordLayer Intelligence watches that world for you.

Speaker 2: It monitors more than 40,000 deep and dark web sources for your company's leaked credentials, active session cookies, and mentions of your brand executives and partners. It alerts you in real time so your team can act early. It also maps your external attack surfaces and catches impersonation attempts all from one dashboard.

Speaker 1: Most companies take months to realize that they've been breached. With NordLayer Intelligence by NordStella, you can see your actual leaked data in your very first demo. Book one at nordlair.com/intelligence/hackedpodcast. And mention code hacked podcast 10 for 10% off.

Speaker 2: That's nordlair.com/intelligence/hackedpodcast.

Speaker 1: Let's get into the next call.

Speaker 2: Let's do it. This one, we have TTS audio for. We didn't make it.

Speaker 1: We did not.

Speaker 2: This was provided. It was. I haven't listened to it. Hope it's good. We apologize. We heard you. We know that nobody likes AI audio, but here it is anyway.

Speaker 1: See what the vibe of the voice is. I'm ready.

Speaker 3: Hey, Jordan. Hey, Scott. This one's a classic I was just curious story that spiraled into me accidentally being able to stalk a delivery truck for fun.

Speaker 2: Interesting use of your time.

Speaker 1: And definition of fun do go on.

Speaker 2: Do go on.

Speaker 3: Quick background. I'm a software engineer by day, the kind of job where poking at APIs and going, wait, why does this field exist, is basically a job requirement. On the side, I do freelance technical work for a few small businesses too. So opening dev tools on a random Tuesday because a tracking page looked too smooth was pretty on brand. So here's the setup. You know that little your package is three stops away map Amazon shows you with the truck icon crawling?

Speaker 2: We sure do. All of

Speaker 1: us were nodding. Intimately familiar with that. Yep.

Speaker 3: Yep. Toward your house? I got nosy and peeked at the network traffic behind it. And it's this one clean little request, package dash location slash get dash state. And the response is honestly kind of beautiful in an unhinged way. It's not just the truck is nearby. It's a full timeline. Dozens of GPS points pinging every two or three seconds, accurate down to about four meters. Basically, Amazon handing you a minute by minute flight recorder for a delivery van. Cool. That's the feature. Tenish stops out, live map, all intentional. Except, I kept the request saved. And after the package delivered, box literally sitting on my porch, tracking page saying delivered in big cheerful letters, I fired that exact same request again just to see. Truck, still there. Same live coordinates, same ping cadence, like the word delivered was purely decorative. I tried again the next day. Still worked. At some point, I realized I was more emotionally invested in this truck's location than Amazon was. I've actually got it on video, a recording of the coordinates ticking along in real time on a package that had been delivered who knows how long ago. It's weirdly mesmerizing in a I should not have this superpower kind of way. So responsible adult that I occasionally am, I wrote it up and sent it to Amazon's vulnerability research program.

Speaker 2: Smart.

Speaker 3: They asked for the raw request. Sure. Here's the full thing, minus my session cookie, because I'm nosy, not reckless. Then they asked for a video walk through, so I recorded myself very calmly narrating, and here again is the truck after delivery for the fourth time that week. Eventually, after enough we're still looking into this emails to fill a small folder, they fixed it, paid out a bounty, closed the report, and now, presumably, delivery trucks everywhere are enjoying a little more privacy than they used to. Moral of the story, delivered should probably mean the tracking stops too. And, also, never underestimate what a bored person with postman and too much curiosity will do with a public API. This has been hotline hacked. Stay weird. Stay patched.

Speaker 2: Something I just wanna jump just to describe it for you. Postman is essentially an API

Speaker 1: I don't know if it's gonna ask.

Speaker 2: Pull data from APIs. Pretty pretty popular piece of code if you work in APIs. Okay. The fact that a company the size of Amazon was sending live… It looks like they probably use truck IDs rather than product IDs is what I would assume. So when they tell you that your delivery is on a certain truck, and they're sending a live entire roll of the geo data… Because we all know that most commercial vehicles nowadays have live GPS tracking.

Speaker 1: Yep.

Speaker 2: If you didn't know that, you should know it. That's not surprising at all. The fact that they had just given it away through an open call through an API is crazy because you could actually probably use that data for so much more because you could probably mine out the rest of the truck IDs or however they were connecting or what variable was giving you that specific route versus all of the routes. If you were like an investment bank, you could model out increases and decreases in Amazon's delivery flows and how that would affect their share price. You could use that data for so many things. I will also say that this caller did provide the receipts. They submitted the, bug bounty report, how much, they made, which I won't say, as well as just kind of the case. So this is legit, excellent find, and shocked that a company the size of Amazon did this.

Speaker 1: So many of these stories involve, and then the company I'm editorializing here acted like big dicks and didn't take this seriously or treated me like, I was an adversarial force or something. So I'm really glad to hear, like, when it got to the point where it was just like after a lot of back and forth, they paid the bug bounty. I didn't even know a bug bounty was in the table. I was like happy to hear that. I'm like, oh, that's that's good. I'm glad that they did that. The one thing I'll say is, you know, you made reference to being more invested in the location of that truck than Amazon and that is the only part that I would think. I bet Amazon has that thing so jammed full of sensors and knows every inch of what goes on inside that

Speaker 2: truck.

Speaker 1: And I bet that the driver has an opinion about that too but I am glad they paid out the bug bounty and I was appreciative that you wrote us a fun little slogan for hotline hacked at the end of of your message. Stay weird, stay patched. I will.

Speaker 2: I will. You've got to imagine that Amazon probably uses that data for so many things.

Speaker 1: Oh. They

Speaker 2: probably use it for optimization of routes. They probably use it for efficiency of drivers. Yeah. So many details.

Speaker 1: I bet that the drivers, like, work performance and compensation. Like, I bet there's a lot mapped in and where that drive, maybe the compensation, but I I bet people are held to account for where that truck is and how many deliveries get made and how long each delivery takes very, very, very much so if everything we know about how the warehouse works, I would assume there would be a significant Yeah. A similar amount of data being used on the truck side of things.

Speaker 2: Yeah. I would assume. They use it to to monitor speeding, like, ensure people stay compliant with the law. Like, there's there's there's a bunch of really positive… If somebody steals a truck, you know, obviously, it's pinging. There's probably two transponders on it Mhmm. Honestly. One that's obvious and one that's not. Have you seen the new Amazon delivery trucks? Yeah. They were actually really cool.

Speaker 1: Yeah. They're sleek. They're Sleek little little guys. Yeah.

Speaker 2: Yeah. They're electric electric vans that are full height, so you can walk through them. They're way more comfortable for delivery people. They're actually, like, pretty pretty rad. I'm pretty pumped on them. I I actually went out and met my Amazon driver the other day and made him show me his van. Sure. I I truthfully did that.

Speaker 1: It was friction you standing inside of me, but, like, it's roomy. Like, it's

Speaker 2: I was. I was like, oh, this is really nice.

Speaker 1: I… It is fascinating. It's like I've never thought about the fact that they have to pass through that information to you. And I would have thought there would be, like, a really, really abrupt cutoff point where it's like the moment the system receives that the delivery has been dropped off, that GPS data is not going through. And I I imagine they probably thought they built that as well until you reported this, hence you getting the bug bounty. Next call. So the night was the night before Thanksgiving. Feels like I'm starting to read a poem. So the night before Thanksgiving, a few years ago, I was working a half day earlier in the day for a company as a DevOps engineer. So I was managing their cloud infrastructure, And I was tasked with upgrading my Windows VMs to enable encryption on their hard drives, and this is a really simple process within Azure cloud. So I went through my project. I completed it very quickly. I didn't have anything else to do for the remainder of my half day, so I tried to be proactive. And I noticed that our Linux VMs running in Azure did not have hard drive encryption enabled. So being the go getter that I am, I took the same process that I used for the windows VMs, and I started the encryption process for the hard drives on the Linux VMs. During the same day, we were having some furnace issues. Context. It was the first day of snow where myself, my wife, and our five week old son lived, and so we had an HVAC technician over that day troubleshooting our furnace, trying to figure out why it just kept turning off, wouldn't stay on. And so our house was getting very cold with a five week old. That's real. This was a big concern of ours is that it just started snowing. And so the x HVAC technician came and they did what they needed to do. And they got the furnace working and they left. And I was done with the workday. And in the preparation of dinner around 05:00, I got a text from my manager saying, Hey, did you do anything to our Linux VMs? They're all down in Azure. And I just had this super syncing feeling that I caused our entire Linux server environment to go down because I went through the process of enabling encryption on the hard drives. So stop what I was doing, ask my wife to take over preparing dinner, and I went downstairs to our basement, see where this is going, and started working trying to help undo the mess that I just caused by rebuilding the Linux VM from scratch. In about an hour into this process, my office downstairs, by the way, is next to the furnace room. I'm working. I'm trying to help out my team with getting getting everything back up and running, and my wife starts screaming downstairs into the basement. There's black smoke pouring out of the furnace vent all over the house. We need to leave. This is a wild one.

Speaker 2: Yeah. This is this is a this is a… Like, a real story….

Speaker 1: Story. So being next to the furnace room, I was able to go turn off the emergency shutoff switch for the furnace before we evacuated. We were able to evacuate safely, called the fire department. We were outside standing in socks and t shirts and shorts as it was snowing outside, and we were waiting for the fire department to give us the all clear and evacuate all of the smoke from the house. But that's essentially where it remained. We only had smoke damage. I later found out what had happened is the HVAC technician disabled the safety switch that monitors the temperature of the furnace. First gets too hot, it auto shuts off. In order for that HVAC technician to provide us with the heat that we were asking for over a cold Thanksgiving day, he disabled the safety switch so the furnace kept running and running and running and overheated, and it melted the internal components of the furnace. Furnace technician, this… I don't know anything about furnaces, but I would think that would be a

Speaker 2: force work…. Insurance. Yeah. That's maybe not the best call. Anyway, because you don't

Speaker 1: wanna judge. I don't know your job.

Speaker 2: I don't wanna judge. People make good mistakes….

Speaker 1: Make mistakes, but woof. Now the reason that I say this issue that I caused that brought our Linux server environment down is what saved our house from being burned down to the ground is on a normal night having dinner, I would have been upstairs with my family enjoying my time. Had I not been downstairs working on that issue, we would have just evacuated with that black smoke coming out immediately, but the furnace would have remained on. The fire would have remained burning instead of me shutting off the emergency shutoff switch, which would have meant that the fire would have actually spread beyond the furnace room. By the time the firefighters arrived at the house, it's likely the house would have been engulfed in flames. He was sitting next to it because he was solving the Linux issue that he caused earlier and inadvertently was able to switch it off before it burned his entire house down. So that's the long story short of how I pushed an unexpected, unanticipated change to a production environment the day before Thanksgiving, which caused us to be smoked out of our house. But thankfully, because I was fixing that issue, I was able to turn off the switch, preventing our house from actually burning down. And instead, we just had smoke damage and everything was more or less recoverable. Smoke damage is no joke, but I'm glad your stuff didn't burn. Mhmm. So that's my technology tale. Don't push production the day before a holiday and make sure you know what you're doing when operating in a cloud environment. Also, I guess, probably some lesson about technicians, but that's an aside.

Speaker 2: That's some of the shows about.

Speaker 1: I love what you guys are doing. Love your podcast. Listen every week and keep keep going. Can't wait for your next episode. Alright. Cheers, guys. Holy. That's a buck wild story, friend.

Speaker 2: There… There's there's two sides here. There's, like, the real life side of the house Yeah. Lighting fire. Yeah. And then there's, like, the tech side of, like, the Linux and and the Sure. DevOps problems. Let's… Where do you wanna start? You wanna talk house on fire?

Speaker 1: Or do you

Speaker 2: wanna talk I have or the or the hybrid, the combination?

Speaker 1: Let's… Let's combo, but let's start with Linux because I I feel like you might be able to make me understand that part a little better. Sure. I was I was wrapped up in the Thanksgiving family drama of it all. So we did something to a Linux VM from a Windows one make make this make sense to me.

Speaker 2: Make this make sense to you? DevOps, cloud operations, typically to support development for a product or the delivery of a product that you have developed. That's his job. He's an engineer that takes care of spinning up instances in cloud, Azure's VMs, things like this, managing them. You know, you need to do Redis server. They kick you up one. You need this. A new instance to that. They do that. So that's kinda what his role is. So the Linux VMs, I'm not sure where they were used. We don't know exactly kinda what he's doing, but they had some form of Linux based environments that they were using for delivery of some part of their product would be my best guess. And he just went ahead, took the initiative as a go getter to change them to be encrypted hard drives the same as they had done for the Windows one. It kinda makes sense. Linear track, we're encrypting the Windows one. Why wouldn't we do it on Linux ones? It only makes sense. Somehow that caused a massive issue, probably, relating to scripts that spin these things up or utilize them not knowing the encryption key to unlock the hard drives maybe Right. Would be my best guess. Again, we're just anticipating. Yeah. And, the day before a holiday, he took down prod, which is what I would call, a badge of… It's like a it's like a… If you're in, like, brownies or something and you get a badge for doing something, most senior people have taken prod down at some point.

Speaker 1: Sure.

Speaker 2: And every major development company that I've worked with, there's jokes about it. There's people that have done it. It's like part of the culture. And you're talking about a rite of passage. Rite of passage is there's the word I'm looking for. It's a rite of passage in the in in the technology space.

Speaker 1: I wonder if almost burning down someone's house is also a rite of passage in the HVAC repair line of work, just to draw a parallel, but please continue.

Speaker 2: Could be. Could be.

Speaker 1: Could be.

Speaker 2: The… In some of the video game developments that I've worked in, this is not uncommon for people to just mash in a massive change to the game The day or hour before they catch a flight to somewhere for a two week vacation, they're just trying to clear their bucket of things they need to do.

Speaker 1: Fix this, and then everyone's like, what?

Speaker 2: They're they're sitting in an airport lounge three gin and tonics deep, and the entire game won't build, and all the QA staff aren't working because something got pushed to prod that didn't need to go to prod yet.

Speaker 1: Partway through that story, it lapsed from sort of an abstract hypothetical to a very specific story, and I could tell when it happened, and it was three gins deep. You know what I mean? I was like, that was the moment I was like, this isn't hypothetical at all, but let's continue.

Speaker 2: The… Yeah. So I I think this is just a standard.

Speaker 1: Yeah. Right.

Speaker 2: It's a learning experience. You pay seniors

Speaker 1: because they've done this.

Speaker 2: Who have done this before, so they don't do

Speaker 1: it anymore. Out of your system.

Speaker 2: Yeah. Yeah. Sure. Exactly. Your juniors… Like, I think even in some of the earlier hotline hacks, we had somebody that took down a database server in a similar way. Just push something to prod and just broke everything. And it's it's just… It's… It happens more than people, I think, would ever think it happens. Yeah. Right. And you see this even some of the big outages is somebody pushes something to, like, a major… Like, a crowd strike or something. Something gets pushed that changes something and then bang, an entire lattice goes off, and, like, 20% of the Internet's gone.

Speaker 1: Yeah. I mean So it's really only two things. Right? Something come… It's x. The call is coming from outside the house or the call is coming from inside the house. And it's like, if it's coming from the inside of the house, it's… I almost never in these stories was it intentional. It's a it's a whoopsie. If someone pushes something they're not supposed to and, like, steam starts to shoot out somewhere else or in this case, black smoke. Yeah. It's it's human error. The most common thing on Earth.

Speaker 2: Yeah. We're we're humans. We're fallible. Yeah. The… And then I got roasted in the comment on Spotify the other day for being too, like, obviously, you didn't do this. So you sure you thought about this. Sure. The… And and and the the the commenter had a valid point. Like, I had… Maybe I do jump to that. And, I guess what I'd lean on is tech, be it development side or IT side. Really, you're there as a risk mitigation device. So if you work long enough in these fields, you start to distinct as risk mitigation. Like, you're thinking about edge case… Edge cases when you're writing code and you're thinking about, like, what could go wrong when you're talking about IT infrastructures. Sure. And and you're being paid to essentially mitigate out risks. You know? IT is typically seen as a thankless job because the only time you're ever talked about or talked to is when things are going wrong.

Speaker 1: Yeah.

Speaker 2: So the the way you try and manage that is to just mitigate away all of the chances that people will come into your office yelling at you for something going wrong. Sure. And on the development side, it's the opposite where it's like the game… If somebody takes the game or the application to a state that it shouldn't be, then they… And there's no edge case to handle it. Boom. The game crashes. Or the or the app crashes. Yeah. Just quit talking about games. I have both apps too. So so that's the Yeah. And having having been

Speaker 1: part of something like that happening is, like, that's not… It's like that's a feature, not a bug. It's like you… There's only two ways you can understand the risk, either as theory or experience. And any student knows the theory, but it's like, no. No. No. No. I've experienced this error before. It's not abstract to me. I remember when it happened. I think that's Yeah. That goes beyond tech. Any kind of professional is like Exactly. Really my value here is that I have been part of this error and this error and this error and I know the shape of them. I can maybe smell it a little early to prevent it from happening.

Speaker 2: One of human's strongest systems is the fact that our memory imprints way stronger when there's an emotional response going on, and that's what these are. Yes. You know, you cause prod to go down, and the stress and anxiety goes from, one, sitting at home making dinner, maybe two with your with your wife to 10. And then all of a sudden, you're like, furnace is on fire, and you're like, you know, you're you're cracking through the glass ceiling of of anxiety and stress.

Speaker 1: But

Speaker 2: it's like you'll never forget that, and you'll never… Like, that's just part of what makes humans, you know, durable. Yeah. For sure.

Speaker 1: That cortisol imprints some… A message to, like, don't do that again. Don't do it.

Speaker 2: Don't do it.

Speaker 1: Make sure it didn't happen before you drink that second gin and tonic at the airport. Like, don't

Speaker 2: do it. And and then the best thing is is that you… It's those experiences that lead to you getting a pay bump as you're now a senior engineer who knows not to make those mistakes or a senior IT person.

Speaker 1: And then there was the whole other side of it, which is just like a truly buck wild story. Like, baller move to be, like, solving this tech issue, hear that thing coming from upstairs and just lean over, like like, just turn it off. Yeah. Run into a

Speaker 2: room that's kind of on fire and, like, hit a a light switch on the wall to turn the furnace off.

Speaker 1: Game recognized game. Like, that's some steely eye shit. It was good. Yeah. There's a good little moment in the story. I like this one

Speaker 2: a lot. Yeah. Yeah. And this is a very Jordan story, very personal. Yeah. You could almost, like, heal it. Sure.

Speaker 1: It was it was nicely written too. The the the caller submitted their own audio, but it was a question of whether or not it get filtered for anonymity. So we we read it out loud, but I really appreciate this one. I think this is a really cool one. As always, big thanks to NordLayer Intelligence for sponsoring Hacked. You can book a demo at nordlayer.com/intelligence/hackedpodcast and use that code HACKPODCAST 10 for 10% off. If you wanna share your call, your story, your text, have us read it, whatever.

Speaker 2: Confession.

Speaker 1: Your confession.

Speaker 2: The father nerds.

Speaker 1: The father nerds. Hotline hack dot com, we have a a phone number you can call into. We have an email you can send in to. Send your AI voice and send whatever you want. We're happy to hear it. We love these stories. These are becoming some of my favorite episodes to do. And like… Yeah. Broaden the horizons. Any kind of weird computer tech adjacent tale. I'd almost say a question, like, maybe not hard IT questions, but like like, hey, pontificate on this fellas, like, get at us.

Speaker 2: Like, why not? Sure.

Speaker 1: I'm curious

Speaker 2: to hear it.

Speaker 1: Yeah. I hope we can do… We… Scott and I were talking about this. This is just vamping at the end of the episode. The comments if you made it to the end of the episode.

Speaker 2: Which we're good at. This could go for twenty

Speaker 1: more minutes….

Speaker 2: Last episode.

Speaker 1: It will be the entire rest of the episode. I wanna do a live one of these at some point. Like, we were talking about it like a Defcon or some kind of a big event having like a little anonymized booth where you can come in and like put on like a… I don't know if it's a mask that's maybe not super hydrated. Some way to anonymize you so that you could actually do it. And I wanna have these conversations face to face with people where it's like, I want you to tell… I wanna do the call in show where it's an actual call in show live

Speaker 2: in person. Yeah.

Speaker 1: I think it'd be super fun.

Speaker 2: I think we could do that. I think we could do it. Our animation guys are amazing. Yeah. They could spin together some digital… We could use the hack, like, ASCII art. Yep. Turn people into ASCII art. Yep.

Speaker 1: They could even build a booth in a certain way. It would also be fun to think about….

Speaker 2: Them a bunch of preset voice changers Yep. Or even they could, like, twist the dials and change themselves.

Speaker 1: You do, like, analog old school voice changing too. Yeah. VOCODed. Totally VOCODed. I think we could have some fun. But in the meantime, submit your story at hotlinehack.com. We really appreciate it. They're super fun to listen to. I think that's it. I think that's our… Another one in the bucket.

Speaker 2: If you're Canadian, happy Canadian Thanksgiving. Or this is coming out right after Canadian Thanksgiving, and we're recording right before Yeah. Little little sneak peek.

Speaker 1: Little sneak peek behind the scenes.

Speaker 2: But, yeah. K. We'll see you soon. Thanks again. All… And all the people that made it to the end of the last episode have been commenting and letting us know. Love that.

Speaker 1: That's really That was great. That's… That makes me happy. Yeah. We'll catch you in the next one. So Thanks for listening.

Speaker 2: Take care.