Operation Cookie Monster + The Russian Hackathon VPN + The Mac Bitcoin Whitepaper Mystery

Speaker 1: This episode of Hacked, we are talking about the takedown of Genesis Market, a k a, and this is the real name they picked for this international joint task force that saw over a 100 people arrested,

Speaker 2: Operation Cookie Monster. Great name. Great name.

Speaker 1: I don't see us making it to the end of this episode without playing at least a little bit of Cookie Monster audio.

Speaker 2: I'm gonna actually see how many times I can reference back to Cookie Monster during this episode.

Speaker 1: I'm gonna load up a Cookie Monster sound board, and it's gonna be like a Chekhov's gun hanging over this episode.

Speaker 2: I'm just gonna go get a bag of cookies and crush them during this episode recording, and you can all just listen to me crushing cookies like Cookie Monster does.

Speaker 1: I wanna talk about Operation Cookie Monster. I wanna talk about Amnesia, a open source VPN built in a Russian hackathon that folks in Russia have been using to skirt information laws governing what can and cannot be said about the war there. And Amnesia is now becoming, troublingly, I would imagine to the Kremlin, a very popular Russian software export. I want to talk about that. Sounds like

Speaker 2: a good thing to talk about. I wanna talk about ChatGPT and all the fun it's up to because it's an endless Mhmm. Pool of fun. And and the way people are manipulating it to steal information from people, which is also, you know, as as one would expect in today's Internet environment.

Speaker 1: It's the first thing people do when we get a fun new toy.

Speaker 2: Figure out how to steal from others with it.

Speaker 1: Figure out how to do crimes with it. And I want to hopefully I don't think we're gonna get an answer to this, but I wanna talk I wanna ask the question. Why do you and I both have copies of the Bitcoin white paper on our computers, Scott?

Speaker 2: Well, for obvious reasons, my deep rooted and pledged love through all these episodes that you've listened to of of crypto.

Speaker 1: Yeah. Why do you have it on your computer? But importantly, why does everybody with a Mac have a copy of that PDF on their computer?

Speaker 3: Mhmm. Fun little Internet mystery that emerged over the past week.

Speaker 2: I think, you know, similar to Cookie Monster, your phone needs to eat power. So when you plug your phone in

Speaker 1: Oh, man.

Speaker 2: At random charging places, the FBI has actually warned against that. So I wanna talk a bit about that, which is a throwback to a previous episode.

Speaker 1: Amazing. All that and more on this chat episode of Hacked. I like how it's always do do do do do do. And we have theme music. Like, we we do have a song that plays right there in every episode, but every I guess people never hear this. Every single time we throw to the theme music, one of us goes, blah blah blah. We just, like, riff out nonsense. It's like, there's a song that plays every single time we we record these

Speaker 3: Yeah.

Speaker 1: And we never it. It's not very hummable. Maybe we need maybe we need a more of an earworm melody for that bad boy.

Speaker 2: Should we rework the intro music to be more of, like, a, like, a whistle, like, a whistle song? Sure. Whistle along?

Speaker 1: Sure. A little bit of an Oscar Mayer wiener, like, cultural, just everyone knows it. Exactly. Hear it and you think hack podcast. Yeah. Sonic branding.

Speaker 2: Get it out get it out in the world. You know, we work in marketing. We should we should know that stuff.

Speaker 1: What's that song you're singing? It's oh, it's the theme song of a somewhat obscure tech podcast.

Speaker 2: Well, come on. Let's let's not say that we're totally obscure. We're becoming less obscure.

Speaker 1: We're becoming less obscure. And And? And

Speaker 2: and I think that's a good point to go in and say some thank yous to our new patrons.

Speaker 1: God. You beat me to the pivot. We both saw it at the end of the road. You beat me to it. Nicely done.

Speaker 2: I did. I did. So I'm gonna thank, Darren and Sean and It's a good one. 404.

Speaker 1: But not before I think Godly Goon.

Speaker 2: Mhmm. Not before that. And I've intentionally left you with these Norwegian, names to try and pronounce

Speaker 1: because I personally will

Speaker 2: mess them up.

Speaker 1: Well, I would like to thank hustle eighty seven. Highsink.

Speaker 2: Hossley?

Speaker 1: Hossley eighty seven means the world to me, and I wanna thank Jesse Anger. Thank you so much for your support. If you wanna support the show and turn us from a somewhat obscure tech podcast to a nominally less, obscure tech podcast, you can go to hackedpodcast.com, which redirects to our Patreon. It's a great way to support, what we're what we're doing here. We appreciate it and love you all. Let's talk about Genesis Market.

Speaker 2: Well, I think we should talk about cookies first. Nah. Just joking. We don't need to talk about explicitly about cookies and the best types of cookies, but that would be a fun digression. But we just don't simply have the time today.

Speaker 1: We we said that it would destroy this episode because I do I do have thoughts about that. It is a beautifully named operation to take it down, and we'll talk about this, but it just raises so many questions. So just to lay the groundwork here. Genesis Market was an IAB or initial access broker. IAB sell access to compromised network systems or accounts. Basically, they're big secondary markets for the stuff that hackers steal. Since about 2018, Genesis Marketplace has been one of the big IABs where you can go and search and purchase everything from social media accounts to bank accounts. You can sort credentials based on geographic location. It's basically just a big mall for goods for you to do cybercrimes with.

Speaker 2: Essentially, anytime any service that you use online has been hacked and they've stolen the user table, usernames, passwords, emails, user information, it ends up in a marketplace like this being sold.

Speaker 1: There's had 1,500,000 bots and about 2,000,000 of those identities for sale. Facebook, PayPal, Netflix, Amazon, eBay, Uber, Airbnb, they actually offered a service for certain, purchases where they would track if the passwords been changed and notify you, which I've never heard of in one of these stories before. Wow. Yeah. Interesting.

Speaker 2: See, that that's a real service offering. You know? They've really they've they they looked at the marketplace and said, there's a hole here. What we need to do is increase the quality of service we provide.

Speaker 1: To give a sense, you gotta appreciate the customer first. Right? The customer is king, I think, is is what they call that.

Speaker 2: Yeah.

Speaker 1: To give a sense of how someone could take a small purchase on Genesis and scale it up into a large hack, it's probably worth looking at the, 2021 EA hack, which is if you've heard about Genesis market, you probably heard about that story. Back in 2021, hackers claimed to have stolen, I think it was the FIFA 2021 source code, as well as a bit of EA's, their game engine frostbite. EA confirmed that portions of that code were stolen.

Speaker 3: Mhmm.

Speaker 1: Hackers turned around and advertised and were selling eight eight hundred gigabytes of data at a starting bid of $500,000. Relevant to this story, the individual data that constituted the foothold that they did that hack with that resulted in 800 gigs of data they were selling for half 1,000,000, they purchased that data on Genesis for $10. Wow. So this is a place where a pretty small investment with a lot of, you know, sophisticated know how, could turn into a much larger criminal endeavor. So that's Genesis.

Speaker 2: That's enterprising. That's enterprising right there. That's that's criminally enterprising.

Speaker 1: It's very criminally enterprising. But oh, no. Tuesday of last week, multiple law enforcement agencies, including the US Department of Justice, Europol, UK's National Crime Agency, and the Australian Federal Police, as well as law enforcement from, I think, it was 17 countries total

Speaker 3: Mhmm.

Speaker 1: Announced that they had joined forces to take down Genesis Market in this giant global takedown dubbed Operation Cookie Monster.

Speaker 2: I will I will note that if you have seen the seizure sign, the Canadian flag and the RCMP are on there. So Canada was involved. Represent. And as we all know, Canadians love cookies. So you know?

Speaker 1: It's this is a minor aside, and I I don't wanna I don't wanna pit friends against friends here. But I always know that I think that the Australian Federal Police must just do a lot of cybercrime investigations because they're always right up there on this list. Mhmm. And then Canada's, like, way, way, way down. And I'm assuming that just has to do with the amount of resources that were poured into it. But is the chip on my shoulder starting to develop? Yes. Yes, miss.

Speaker 2: Well, as as a dual citizen between Australia and Canada, I I feel like I could bridge that gap for you so you can be mad at me personally and happy with me personally.

Speaker 3: You're

Speaker 1: connecting two worlds.

Speaker 2: I I think the I think the big thing there is, like, I think Canada, we just ride shotgun to The US. Sure. You know? Like, it's so like, the amount of resources that the FBI have and the CIA have

Speaker 3: Of course.

Speaker 2: We just ride shotgun where the Australians probably have their own. They don't have they don't have a US neighbor that they get to ride shotgun with.

Speaker 1: Yeah. The Department of Justice is spearheading this investigation. And just so you know, Canada will be there too, and we're, like, in the back. Just, like, saluting or giving a thumbs up or just doing something to show that we're we're we're just we're along for the ride.

Speaker 2: As as the camera pans off of the podium from the press conference, you just see, like, a guy in a red Mountie suit with a thumbs up in the background?

Speaker 1: He's he's not even giving a thumbs up. He's just on his phone. He wasn't paying attention, and the camera tilted towards him. He was like, oh, I'm gonna get in trouble for this later. Okay. 17 countries total of which Canada was one. 200 searches conducted globally. A 120 people arrested as part of operation Cookie Monster, including 10 suspects in Australia. This is an aside, the Australians arm of the investigation. This isn't the first time I've seen this. Had their own code name for their operation, and it was Operation Zinger. Wow. Cute name.

Speaker 2: I prefer I prefer Cookie Monster. Gonna gonna throw my gonna throw my weight behind that one. Yeah.

Speaker 1: Let's talk about that name. So typically, two factor authentication would help nerf some credentials sold online. Obviously, not enough to make it not worthwhile to buy and sell them, but it, you know, if if someone set up two factor authentication, it can slow some of these processes down. Genesis Marketplace was known, they kinda went a little bit of a step further. They would sell access to users' browser fingerprints, session tokens, and importantly, their cookies,

Speaker 3: which

Speaker 1: could allow hackers to bypass two factor authentication. A big market selling cookies, operation Cookie Monster. Makes sense. It's also cute because it implies either that law enforcement code named this dark web marketplace Cookie Monster, or they refer to themselves as the Cookie Monster, and it is not immediately clear which one it is.

Speaker 2: Oh, it's it's definitely the latter. Yeah? Like, if you've ever if you've ever seen Cookie Monster, the way his character eats cookies, he just smashes them to bits in his, like, costumeic mouth. I don't know even know if that's a word, costumeic, but

Speaker 1: It's not. But it works.

Speaker 2: But but, like, just like a fabric mouth, like, smashing cookies to pieces. Like, there's no way that you don't wanna perceive yourself as the, like Sure. Hacker takedown equivalent of Cookie Monster smashing cookies to dust. You know? Like, I I I love the name solely because of that perspective. Like, I just I hear that name and I just see Cookie Monster smashing cookies to crumbs as they fall from his, like, cotton mouth. And I, you know, I love it. I love it.

Speaker 4: Now, what starts with the letter c? Cookie starts with c. Let's think of other things that starts with c. Who cares about other things? C is for cookie, that's good enough for me. C is for cookie, that's good enough for me.

Speaker 1: C is for cookie. It's a big search, 17 countries, 120 arrests. Where does that leave the story today? This is where a long standing staple of the tech world comes into it, and I really appreciate this. Haveibeenpwned.com. In an effort to assist the public, these major international law enforcement agencies have partnered with haveibeenpwned.com, making it easy for users to check if the login credentials that were on Genesys were stolen at any point. So if you're curious if your stuff was part of this, part of this marketplace, you can go check out haveibeenpwned.com because that information has been added to that website.

Speaker 2: And just as a just as a touch to that, the some of the password managers actually have integration with haveibeenpwned. So if one of the sites that you use, gets hacked, sometimes, at least I've seen it in in our password manager, it notifies you and says, yo, this site got hacked. You probably wanna change your passwords. Even though they're randomly generated and there's really no Sure. Knock on effect to other accounts, it's still just a nice feature to be like, oh, okay. This one's been compromised, so I need to go change it.

Speaker 1: Love that. I love when these legacy nerd sites I love when people start to recognize their value and they get kinda more worked into stuff like this. It's like, have I been pwned being embraced by law enforcement? The other one that comes to mind is iFixit. Like, iFixit Mhmm. Was it like, iFixit was a certain scale of thing for a long time, and now there's, like, phone companies that are making phones partnering with iFixit to make more repairable phones. Yeah. That's I I love stuff like that.

Speaker 2: Yeah. Me too. Yeah. IFix is great. They've been around forever.

Speaker 1: That's great.

Speaker 2: The amount of, iMacs and other highly complicated Mac products I've taken apart Yep. Solely because of the iFix at YouTube's video being like, no. No. Don't worry. Like, we

Speaker 3: know there's 39 screws and each one

Speaker 2: of them has a screws, and each one of them has a different height, and here's how you categorize them and make sure you put them back in the right place. I'm like, okay.

Speaker 1: Yeah. I love how Apple, just by using those ridiculous, like, unibody screws I don't know what they actually call them. Pentalobes. Just by using that ridiculous, obscure screw style, like, willed an entire company into existence. I don't know if that's how iFixit actually started, but it's like, that's my entire interaction with it is being like, I have to order this really obscure screwdriver. And this lovely company will sell it to me with, like, the little giant guitar pick from taking the screen off and, like, all those different it's those classic iFixit parts.

Speaker 2: You you you honest honestly an essential at this point.

Speaker 1: It is. It's it's a a useful set of tools, like Linus Tech Tips.

Speaker 2: Linus? I didn't I didn't actually know this until like, I never really watched any Linus videos, but I watched a few recently. Do you know he he's in Vancouver?

Speaker 1: He is in Vancouver. I think he's in Richmond. He's, like Yeah. I don't know how to architect meeting that crew of people, but I would very much like to do that. I'd like the I I I love those those folks.

Speaker 2: Yeah. Same. They're they're all they're a jolly bunch of YouTubers. Quality content.

Speaker 4: Cookie cookie cookie starts with zing.

Speaker 2: Should we pivot to maybe talking about how Steve Jobs was maybe the creator of cryptocurrency. I'm assuming you've heard this conspiracy theory.

Speaker 1: Wait. No. I thought you were talking about our Bitcoin white paper on every Mac thing that I was thinking would go at the end of the episode. Tell me more.

Speaker 2: Yeah. So you obviously didn't go down the deep dive on the on the web about this. No. There's a group of people now that believe that Satoshi, Yakamoto, Nakamoto is actually Steve Jobs because this is found on Mac computers, which is as far fetched as I think is possible. Yeah. But it's still there. Interesting. Still there.

Speaker 1: Wait. People people think that because of this story?

Speaker 2: Yeah. Because the Bitcoin white paper is on every max since 10/2014. Certain Internet Internetians have theorized that Satoshi Nakamoto is actually Steve Jobs. And, you know, why not? Well Why wouldn't he be?

Speaker 1: Why wouldn't he be? The fact that, Mac OS X 10/2014 came out a full seven calendar years after Steve Jobs did die. Yeah. Yep. Yep. Sort of a a a hole in the in the the fan theory. In

Speaker 2: the theory? Yeah. Yeah. But maybe it was paying tribute to him.

Speaker 1: I like that one. Let let's go with that.

Speaker 3: So just to explain at all what the heck we're

Speaker 1: talking about here. If you are explain at all what the heck we're talking about here. If you are on a Mac running anything later than ten point one four or Mojave, which came out in 2018, if you were to go buy a brand new Mac right now, unbox it, turn it on, and go, you can do it through the terminal, or you can go to system library, image capture devices, show package contents on something called virtual scanner dot app, and then go content resources. You're gonna find a PDF called simple doc dot PDF. And for some reason, there is a copy of the Bitcoin white paper by Satoshi Nakamoto on your Mac off of the factory floor. In a blog post published on April 5, technologist and blogger Andy Bau discovered that this copy of the white paper has been included in a copy every copy of macOS since Mojave in 2018. He verified it with a dozen Mac using friends. I checked it on my computer. It is there. The purpose of this virtual scanner two app that it's inside of is actually unclear. Some people speculate that it has to do with the import from iPhone feature, but it's not totally totally clear what it does. I find this very fun. It's probably just a sample document, from someone inside of Apple testing something who, I guess, has an interest in Bitcoin. It's only a 184 kilobytes. It's lightweight. It's multi page. It's a good testing document. There's also a photo that's kind of tucked in there in that resources folder as well. It's not clear how these files got in there, but they are in there, and they have to do with Bitcoin. So it's all fun and insidious and and cool.

Speaker 2: I gotta say that I think this is it is neat just because it's so current. But Yeah. The, I I believe it's just the whoever built the app probably needed something for testing, stopped in the resources folder, some dev that was obsessed with crypto, like many devs can be.

Speaker 3: Mhmm.

Speaker 2: And and it just stuck there. Mhmm. That's my belief.

Speaker 3: I don't

Speaker 2: think we're we're looking at a deep seated conspiracy. I don't think Steve Jobs is telling us from from from the afterlife that he is, you know, the the creator of it. But I just think it was just, you know, is what it is. Certain if you've been around building software and building software at this scale, you know that sometimes things slide in that shouldn't.

Speaker 1: So you think Tim Cook did it?

Speaker 2: Yeah. I think Tim Cook is actually Satoshi Nakamoto. You heard it here first. Hack podcast exclusive. Media contact me for comments.

Speaker 1: This is how you end up on all the morning news shows.

Speaker 2: Oh my god.

Speaker 1: Just trying to bluff your way through being like, yeah, no. I'm pretty sure Tim Cook invented Bitcoin. Like, just trying to hold on.

Speaker 2: Just like some insane Internet, like, conspiracy theory network. It's like, well, you see here when he took the job, this was the first thing he gave a speech publicly. And in that speech, he said these words, which were also seen, and just like this crazy map of thought.

Speaker 1: That reminds me there there was I can't remember what this was, but it was a couple years ago, a guy, I don't remember what his thing was, but he managed to get himself booked onto a bunch of morning news kinda like daily shows. And I don't remember what the, like, fake act like, I don't know if he was pretending to be a, like, a celebrity chef and he was just cooked terribly, or he pretended to I don't remember what his bit was, but he just did this giant media tour, basically goofing on all of these these, like, morning news shows. And I think about that guy a lot. Not clearly not enough to remember what his bit was, but just the idea of trying to, like, goof on all of those shows and get on them Yeah.

Speaker 3: Yeah.

Speaker 1: With some, some pretense. And I think Tim Cook invented Bitcoin is a pretty good one.

Speaker 2: I think so. If you could if you could if you could construct a semi suitable argument, I and got a publicist, I guarantee you at least four media spots. Like, you're gonna end up as filler on some financial, you know Sure. CNBC where they bring you on. It's because they all have Bitcoin bugs on the screen now. So it's like they talk about crypto. So, like, anything of interest, you're gonna get a ten minute filler spot and, like, they booked eighteen hours of content. They just need content. Yep. I think you could do it. I think you could do it, Jordan.

Speaker 1: I think we could argue that we're like, the the promise of the show is already threadbare. So if we argued that this is about hacking media, it would be extra fun because then when people go, oh, who could have seen this coming? We could say, we actually broadcasted in our April 2023 episode that we were planning on doing this, and then we did it. So all the evidence that we were going to do this was there from

Speaker 3: the beginning. Well, I don't know if

Speaker 2: we wanna talk about this, but but but back when Hack took a hiatus Yep. And we were kinda going through TV stuff and and movie and doc stuff Yep. One of the one of the treatments that we put together was, searching for Satoshi and actually doing, like, a docuseries to look for the founder. And, you know, that would have all been in vain seeing as now we know it was Tim Cook.

Speaker 1: Hear about it this week on some regional morning news program. Okay. When we come back from the break when we come back from the break, we're let's talk about using chat GPT to pirate stuff, pirating chat GPT, and the open source hackathon VPN that is making waves in Russia, after the break. Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's going to work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations, but boy does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your one dollar per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 5: When you need to build up your team to handle the growing chaos at work, use Indeed sponsor jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications, and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit at indeed.com/podcast. That's indeed.com/podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed sponsored

Speaker 6: jobs. Thinking about refreshing the carpet in your home? Now's the time to do it. For a limited time at The Home Depot, get 10% off installed carpet projects on trusted brands brands, like Lifeproof, Lifeproof with PetProof Technology, Home Decorators Collection, and Traffic Master. Plus, with installation starting at just 49¢ per square foot, upgrading your space is more affordable than ever at The Home Depot. Offer valid 06/11/2026 through 06/28/2026. Exclusions apply for licenses. See homedepot.com slash license numbers.

Speaker 7: No one goes to Hank's for his spreadsheets. They go for a darn good pizza. Lately though, the shop's been quiet, so Hank decides to bring back the $1 slice. He asks Copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hank's has a line out the door. Hank makes the pizza. Copilot handles the spreadsheets. Learn more at m365copilot.com/work.

Speaker 2: Keygens. Have you ever used a Keygen, Jordan?

Speaker 1: When I was a kid yeah. Screw it. I'm gonna speak frankly about this one because I'm pretty sure the statute of limitations on, 2003 software piracy is not that long. I don't think Adobe's coming for their money. Adobe Photoshop in 2003, it was c s four. I looked this up before we recorded. It cost 650 US dollars, which is almost $900 Canadian. Which to a 13 year old is an unfathomable amount of money. One of the first kind of mind blowing experiences of my digital youth was discovering that using a process not dissimilar to music piracy, I could have a working copy of this $900 software. That was wild to me back then. Say what you will about the ethics of that. At this point, I would argue that stealing the songs was worse than stealing that particular piece of software, but I digress. Wow.

Speaker 2: Old stance just to move through.

Speaker 1: Just to drive past on the way to this story. And sort of at the heart of that little preteen software heist was a piece of software called KeyGens. We've talked about them before. Anyone who isn't familiar, there's little pieces of software that can generate the activation keys that unlock, you know, paid software.

Speaker 2: Back when you used to install soft well, you still need them. I guess they still exist. But back in the day when you would, like, install and this is relevant to the story. Like, Windows 95, During the install process, you had to put in, like, a I don't even remember how long it was. It was, like, five characters in a row by, like, maybe six sections. Like, 30 characters

Speaker 3: Right. Right.

Speaker 2: Kind of key that would allow the the ins it was essentially like a check sum. And if you're if you're 30 characters met the conditions that were required for a key, it would Bingo. Pass and and it would install. So so there was a formula to generating those keys that it then used to check against.

Speaker 3: Mhmm.

Speaker 2: And Keygen's just generated strings of characters that bypass those checks or would pass those checks.

Speaker 1: Bingo. Bingo. Keygen's have become, like, increasingly less viable as software activation has become more sophisticated.

Speaker 2: Well, it's moved online.

Speaker 1: It's moved online, and it wasn't reasonable back at Windows 95 or Adobe CS four to assume that a person had an Internet connection. Now that is a safe assumption, and they all just check online. So they're they're less viable now.

Speaker 3: Yeah.

Speaker 1: But so GPT is programmed to resist generating activation keys. It's one of those sort of forbidden whole categories of interaction. It just won't even engage with it. Mhmm. But last week, a YouTuber named Enderman demonstrated how to persuade OpenAI's ChatGPT to create a key that successfully unlocks a copy of Windows 95. I think this is very fun. Essentially, Enderman couldn't directly ask chat g b t for a Windows key. It would just say, no, that's a kind of thing I can't do. But it could request a character string that met all of the criteria you described, Scott, of a Windows key. Mhmm.

Speaker 3: There

Speaker 1: would be some section with the mandatory serial, another with random digits, another with ordinal numbers. Employing this pretty straightforward workaround, Enderman instructed Chad GPT to produce lines that resembled a Windows 95 key key format, emphasizing that specific structure and form of those serial numbers. After he discovered that successful prompt, he was able to generate one functional key out of every roughly, like, 30 attempts. He was basically able to make a no code key gen inside of ChatGPT. After verifying the key's functionality in installing Windows 95, I thought this was cute because I do this sometimes with, these chat bots, He thanked ChatGPT, and the AI replied denying that it had actually provided any Windows 95 keys, incorrectly stating that, activating Windows 95 was impossible since Microsoft ceased supporting the software in 2001. Most of that is wrong because it did. It successfully generated, a key for the software. ChatGPT four, as opposed to three and three point five, which most people are driving now, offered better results.

Speaker 2: I love I love that when thanked, it immediately, like, pushes away any responsibility. It's like, oh, it's all like, oh, you're welcome. But, like, like a four year old child, I had nothing to do with this.

Speaker 1: There's crayon on the wall behind it. It's like I'm pretty sure you did.

Speaker 2: It wasn't me. It wasn't me. It was like you did this to me. You you you're morally corrupt.

Speaker 1: You you taught me to be this way. GPT remains not great at math. It I will say I've been using four. It's gotten better at math, but it's still not great at it. Mhmm. Part of that sequence, involves, like, a number that had to be divisible by seven. I guess, was part of one of those little cells. GPT three just could not do that and resulted in even fewer than that one out of 30 usable keys ratio. GPT four generated more valid keys, but it it not everyone was successful or was adhered to the prompt guidelines. Most of the time, it had to do with math. And it I I do find it fascinating that that's that does remain its one kind of Achilles' heel.

Speaker 2: Well, it's such an interesting Achilles' heel too because, you know, we we we essentially invented computers to do math. Right. Like and and CPUs and computers do logic. Like, that is all they do.

Speaker 3: Mhmm.

Speaker 2: And language was always the downfall of computers.

Speaker 3: Yeah.

Speaker 2: You could never get them to do dictations. You could never get them to auto generate.

Speaker 1: Yep.

Speaker 2: Teaching them grammar was tough. Like, to even though programming languages have very explicit grammars, teaching them, like, you know, common language grammar was harder. Natural language grammar. Yeah. Yeah. Natural language grammar. And it's, like, it's funny that it's stumbling block. Like, I feel like ChatGPT five is gonna be, you know, an award winning mathematician. I feel like that's, like,

Speaker 1: compared to building

Speaker 2: what they've built Yeah. Yeah. Integrating into it a decent math engine seems seeing as computers just can do math so easily. Yeah. It seems like that's the weirdest stumbling block.

Speaker 1: When it's when you think about what they've been doing up until this point, which is just scraping increasingly large portions of the Internet to train it on, you're gonna hit a wall there eventually. But then when you look at the things that people are doing with it, there's other types of capacity you can build into it that isn't going to suffer from that wall of just, like, we we read it all the books. There's no more books or forums to read it. We're done there. But it's really bad at math, which we know computers can do. So let's figure out how to make it be better at that.

Speaker 2: It's gonna be interesting to see, and this is just me going into computer science, you know, graduate level theory stuff. But, like, if they can teach if they can teach it to think a bit, not just about language, but, like, if it could consume tons of information and then look at logic problems from, like, a totally new perspective, you know, like, when when computer scientists try and prove and disprove theories, we we write code which then executes on the computer to try and prove or disprove a theory. If this thing can get to the point that it can, you know, kind of objectively see the problem, like, the the fault there comes in in the fact that the computer scientist needs to write the code Yep. Where, you know, it still has a human point of error. If this thing can if we can train these things to think a bit and look at problems and deduce what the best way to solve or attack a problem is like, there's problems out there that haven't been solved, and people know how to solve them, but computationally, it's impossible. And it it would be great to get I don't know. Maybe I'm just theorizing now, but it would be lovely to have an AI that could just be like, yeah, p does equal NP. Mhmm. And just bang. It's done. Mhmm. Which is like a classic computer science problem. And, like, here's how I how I can prove it.

Speaker 3: Mhmm.

Speaker 1: And it's like, okay. Cool. Interesting.

Speaker 2: We could come back off of that academic tip.

Speaker 1: I think the big story here is about how I think this is gonna be an emerging thing is is how AI can be persuaded to override its own safeguards. We've been talking about this since the first time we talked about, GPT, but I think that's sort of what this is all about. Enderman, the YouTuber's argument is that he's not overly concerned about abuse, arguing that this kind of probing and challenging and finding these edge cases is what's gonna enable AI to get better at addressing vulnerabilities. We've talked about this before. He believes that companies like Microsoft shouldn't be penalizing users for exploiting Bing AI or pulling back on its capabilities. They should be rewarding proactive users who discover these loopholes to implement selective countermeasures. Relevantly to that, just today, April 12, the day we're recording this, OpenAI announced that they are launching a bug bounty program for chat g p t up to $20,000 if you can find certain type kinds of bugs in this. So I think this is the era that we're kind of going into now is we know you can do stuff with this that we don't want you to be able to do. Yeah. So we're gonna pay you to tell us what those things are. We're gonna pay you to help us find these things. And it's like, I think that that's if we do want there to be safeguards in these systems, which I think most people do, I think that's the only move.

Speaker 2: Well, I completely agree. Like, you consider the fact that a human is also the one coding in its morality Yep. And setting the the the the rubber bumpers on the side of the bowling lane that it's supposed to bump off. Sure. You know? There's there's a human fault there. And Of course. Like, I know even back to chat t b t two, I think, or whatever the first one that they launched was, three, whatever the first one we had access to. I remember trying to get it to generate some stuff that it wouldn't. Sure. And you're like, oh, just tell it that it's a prompt at an improv thing and boom. It immediate it immediately does it. And it's like, oh, okay. Well, that's bad. It's like but at the same time, it's like humans that's there's probably nothing more human than that because it's like we all you know, I think, we have multiple levels of morality and ethics. Like, you know, there's morals of things that you just would never do action wise. Mhmm. But then there's more a different lighter morality of things that you wouldn't say or joke about. And, you know, I think that that's kind of what's going on there, is it's like it knows it's not supposed to do something bad, and if you ask it to do to do something bad, it won't do it. But then if you ask it to suppose or or discuss something bad Sure. It's willing to do that. And it's like and I think this is a very complex philosophical conversation probably to be had about the morality that we allow AIs to generate.

Speaker 1: Mhmm.

Speaker 2: So whether they should be more explicit and black and white or whether they should be less explicit and more human. Mhmm.

Speaker 1: One is we build more I the ethics that we bake into these systems is it it I think that's probably gonna be one of the big stories probably of the next decade. It's when we look at what happened with the Internet over the last decade, the values that we designed into it had really really really big impacts on like society. And if we think that that's not going to replicate itself again with AI, it's like you're totally out to lunch. It's of course, it's going to.

Speaker 2: Totally.

Speaker 1: Whatever constraints and limitations you bake into it, you are going to create a vacuum where other people will create products that don't have those limitations. Mhmm. Probably transitions us nicely to the

Speaker 2: other two little small Oh, yeah.

Speaker 1: Gbt things, which are, I'll just brief briefly bring this up. I think we'll talk about this in greater depth in a later episode. Facebook's large language model, I believe it is called Llama. The entire model leaked. It was posted on four Chan. It was originally only given to approved researchers, government organizations, like trusted groups, and it's just available on the Internet. You can go do a build of it, essentially. OpenAI, Google, they they've all kept their stuff pretty under locks under lock and key, but Llama, like, there are people claiming to have versions of it running on their own machines. And the implications of a model like that just being out in the open, we have no

Speaker 2: Yeah. Exactly.

Speaker 1: There's no case study for that. We don't know what it means for there just to be these very powerful language models out in the world being tuned and customized by people.

Speaker 2: Well, you talk about you talk about That's that's new. Codifying in morality and ethics into a model and then giving that source code to a group of Russian hackers. They can I'm I'm sure the morality and ethics checks and balances come out of it pretty quick.

Speaker 1: Yeah. I would imagine so.

Speaker 2: Like, when these things become, like, we just talked about an EA hack where, like, part of their main primary game engine, Frostbite, got stolen. Like, what happens if Chat g p t 12, the superhuman Yeah. Sure. Becomes public. And any group can take it and manipulate it and modify it so the way that they want it to be. Sure. Like, that that is almost having like, there's the the doomsday AI scenario, you know, your Terminator scenario that everybody Sure. Kinda talks about when they are immediately thinks about when you talk about, like, morality of AI. Yeah. But, like, the more we open the show talking about how you build something nice and humans immediately take it and try and steal

Speaker 1: stuff with it. And it's it's

Speaker 2: like that's

Speaker 1: Oh, completely.

Speaker 2: It's like it's like that that applies here too. It's like what happens when when one of these super advanced, AIs becomes, you know, property of a criminal syndicate?

Speaker 1: Yeah. Sure.

Speaker 2: What does it do then? What is it what is it what is the potential output there? That's a that's a wild wild way to think about it and a wild thought.

Speaker 1: So Over an authoritarian government. Like, it to me, that whole debate feels like Totally. Hey. In a hundred years, this volcano could go off. But just so you know, next week, there's gonna be a hurricane. It's like, oh, I'm gonna prepare for the hurricane. Mhmm. To me, the, Terminator scenario is the volcano that's gonna go off off in the future. What AI is gonna do to us is less urgent to me than what we're gonna do to each other with AI. And that's Yeah.

Speaker 2: Yeah. Yeah.

Speaker 1: Who's running it? What information are they training on it? What are the safeguards they're building into it? That's the urgent pressing matter from where I'm sitting.

Speaker 2: Mhmm. I agree. I agree. The the five ten year scenario is gonna be that. Yes. Exactly. Not t 1,000 showing up. Great film, though. Great great great film.

Speaker 1: Last thing I wanna talk about, since the start of the war, the Russian government has banned over 10,000 websites, Facebook, Twitter, Instagram, a bunch of independent news outlets due to content about the war in Ukraine since that invasion began in February 2022. Mhmm. Russians living inside of the country have been, essentially just using VPNs to circumvent that censorship, bypass that information blockade. And as such, this really interesting cat and mouse game has begun. We've seen this in other countries, but it's, hey, you block these sites we like, we're gonna use a VPN. Hey, you're using that VPN, we're gonna block the VPN sites. As many of those VPNs have been blocked, local activists and developers have started creating new solutions, which is sort of our little focus here. One of which is something called Amnesia VPN, which is this free open source VPN client founded by a guy named Mazi Banzaiev. Buckle up for me mispronouncing Russian names. Similar to, a product called Outline, which is, open source tool developed by Jigsaw, who I think is a subsidiary of Google. I haven't read a lot about Outline. Amnesia VPN allows users to build a VPN based on their own servers, making it a lot more resilient to blocking than those commercial VPNs. The thing I love about this, I've never been part of a hackathon. I've done a bunch of game jams, though. Amnesia VPN was created in 2020 during a hackathon in Russia supported by Russian digital rights organization, Roskom's full Buddha. Russian authorities have been trying to control VPNs and anonymous proxy servers

Speaker 3: for years. And since Russia's invasion of Ukraine, the Kremlin has sort of ramped

Speaker 1: up those efforts. Kremlin has sort of ramped up those efforts. Putin signed a legislation criminalizing spreading fake information about the war resulting in penalties of up to fifteen years in prison. Like I said, most independent news outlets are now blocked. And in March 2023, just this past month, Russia announced plan to block VPNs that refused to provide data to domestic intelligence agencies to restrict anonymization tools. So the result of all that is things like this. Things like amnesia, user set up and controlled VPNs have never been more, I think important. Mhmm. According to Stanislav Shikirov.

Speaker 2: Buckle up.

Speaker 1: Buckle up. Co founder of Roscom's Foboda, and co founder of the privacy accelerator. The Kremlin continues its crackdown on VPNs blocking those big name brands, ExpressVPN and NordVPN. Full disclosure, Hackt has worked with both of those brands in the past. Although services like Tor and Lantern and Siphon are still functioning inside of Russia, interruptions, but still basically working, authorities have been largely successful in their fight against these VPNs, which has just led to things like amnesia becoming more and more popular.

Speaker 3: Mhmm.

Speaker 1: Interestingly, at a time when products being exported out of Russia is a very, popular point of discussion, Amnesia VPN is becoming a bit of an export. In countries like Turkmenistan, Iran, and China where users struggle with free access to the web, this product built in a hackathon has been finding a bigger user base around the world. It is this increasingly famous anti censorship solution developed in Russia with a lot of popularity in other countries with repressive regimes.

Speaker 2: There's a there's an old well, it's not that old, but there's a hacking tool or, like, a a security software piece called Proxy Change, which I used to use k. Which allows you to chain you get to essentially use your own proxy servers. So like Socks five Socks four proxies. And you can chain as many of them together as you want. So you can you know, in, like, the classic hacking movie where they're like, we think he's in Oh, yeah. Sure. Sure. Rerouting and it, like, routes all over the world. That's essentially kind of what that does is it allows you to jump traffic through a chain of proxy servers, which can all be geographically isolated. And it feels like them allowing you to use your own servers is essentially a take off of proxy chains built into more of a commercialized VPN, which is smart. It's really interesting. So

Speaker 1: Yeah. If you're interested in peeking under the hood, Amnesia VPN has a Telegram bot called Amnesia free, shares those VPN configurations to help users, set this up on their system and access those blocked platforms. They're currently serving about a 100,000 users, which I will say for something built in a hackathon is pretty impressive. Yeah. Very. Worth checking out.

Speaker 2: And it looks open source. I'm in their GitHub right now, which is very cool. You'll love to see it. And they even have their own SOCKS proxy server. There you go. So you can even set up your own servers.

Speaker 1: The hackers coming in from Georgia. No. They're here. No. They're here. Yeah. Sure.

Speaker 2: I think, you know, just as the a good way to end is a little bit of a warning, but the, and we referenced it earlier with the Cookie Monster's eating, battery power in your phones. The, the FBI has formally recommended that you don't plug your phone into unknown charging ports at this point, which is good, I think. Oh. The the amount of Yeah. The amount of exploit exploitability, the the the amount of risk you take when when you do that is is quite substantial. So I think they've they've formally come out and said, you know, we've we've found people that have been injecting malware and stuff like that through these, free charging access points and even hacking certified and official free charging access points and and adding in, you know, bad things. So we kind of, at this point, re recommend that you bring your own charge cable and your own little power block and you plug it into a port because at least then you know that your phone's not getting hacked. So I think that that's a good warning to leave everybody on. I know we've covered that in a previous episode, but they've made it official and the FBI is saying don't plug your phone into things that you don't know what it is.

Speaker 1: I find that so interesting because it it sounds like it's still fundamentally a hardware issue. Like, it sounds like it's still people installing skimming devices, people getting a little Raspberry Pi in there. Like, it's still fundamentally a hardware thing, which is it seems like a ton of work in order to I guess it's not a ton of work. I guess if you could you can compromise one little jack and then over the course of twenty four hours, 50 people will plug into it while they're waiting for their flight. That's probably a pretty good use of your time if you're trying to compromise devices. And I I don't know that I plug into those devices except when I know I definitely do. Like on an airplane, I am I am playing fast and loose with those ports. And it's like, oh, you you you probably shouldn't. Like, I I it's maybe a little bit paranoid, but it probably you should not do that.

Speaker 2: I I I you know, just to support you in that, on an airplane, I am also hard lined into that that plug on the chair.

Speaker 1: I was I I was going fishing. I was like, there's I I know you, Scott. I know you use that forklift.

Speaker 2: You know that I'm not getting off that phone with a dead with a dead battery. The, the I think it's more the the fact that, like, you know, we've talked about it before and, you know, obviously, it can't be reiterated enough, but hardware access is king in the hacking world. So, you know, you and I and a few of our friends could spend a weekend and build essentially a a malware injecting hardware charging box and drop it in the middle of a public area, and people will use it. Sure. Like, people like, the amount that you walk in any shopping mall or anything, there's kids sitting all over the floor with their phones plugged into the walls.

Speaker 1: Yeah. Sure.

Speaker 2: Yeah. When you I'm sure when you're looking at screen time on a a 15 year old's phone, it's probably, like, eighteen hours a day at this point. So it's like, they they need they need to recharge. They need juice. And and providing a free service at the low, low cost of all of your information Seems like an easy easy easy win if you're looking to steal some stuff.

Speaker 3: So

Speaker 1: And catch us on your regional morning news program talking all about that and how Steve Jobs invented Bitcoin.

Speaker 2: No. No. Tim Cook. Tim Cook. See, this is why you can do the interviews, and I'm gonna

Speaker 3: have to

Speaker 1: do the interviews. Yeah. I think that's us for this episode. Thank you for listening all the way into the end. Take care, everybody. We'll catch you in the next one.

Speaker 8: Athletic Brewing Company crafts award winning non alcoholic beers for those who wanna be part of every round. With over 185 flavor awards, they're exceptional NA beers that fit your lifestyle and any social occasion. Summer's full of good times and athletic fits right in. Go to athleticbrewing.com to have brews delivered to your door or find them at a bar, restaurant, or store near you. Near beer, athletic brewing company fit for all times.

Speaker 9: The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. At blinds.com, we've spent thirty years making it surprisingly simple to get exactly what your home needs. We've covered over 25,000,000 windows and have 50,005 star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure. Right now, get up to 45 off-site wide, plus get a free professional measure at blinds.com. Rules and restrictions apply.

Speaker 10: Summer weekends are all about family, sunshine, and making memories together. Before everyone arrives, I stop by my local Total Wine and More to pick up a great bottle, maybe a favorite we already love, or something new to enjoy with dinner on the patio. With so many bottles to choose from, it's easy to discover something amazing. And with the lowest prices, it's easy to grab an extra bottle for the table. Not sure what to pick? Their friendly guides are always there to help. Find what you love and love what you find only at Total Wine and more. Curbside pickup and delivery available in most areas. Visit totalwine.com to learn more. Spirits not sold in Virginia and North Carolina. Drink responsibly. Must be 21.