Logo

    148: Dubsnatch

    en-usAugust 06, 2024
    Who are the Apple Scruffs in relation to the Beatles?
    What risks do fans take to support their idols?
    What tools help organizations ensure data security?
    How did hackers exploit the music management label's oversight?
    What ethical dilemmas arise with unconventional access to music production details?

    Podcast Summary

    • Fan Devotion and Data SecurityFans show unwavering devotion to their idols, going to great lengths to support them, while in the digital world, individuals risk legal and ethical implications to discover and share unreleased content. Corporations prioritize data security and use tools to mitigate risks and maintain privacy.

      There are dedicated fans, like the Apple Scruffs for the Beatles, who go to great lengths to support their idols, showing an unwavering devotion that defies logic. Meanwhile, in the digital world, individuals like Professor Dubstep and Spin Tire use their skills to discover and share unreleased content, often through unconventional means. The risks and sacrifices these fans make, whether it's dedicating years of their lives to supporting their idols or potentially exploiting vulnerabilities to access unreleased content, highlights the deep connection and passion fans have for their favorite artists and the lengths they'll go to experience and share their love. However, it's essential to remember that actions like unauthorized access to private information or unreleased content can have legal and ethical implications. In the corporate world, the importance of securing data and maintaining privacy is paramount. Tools like Veronis' Least Privilege Automation and ThreatLocker's Zero Trust Endpoint Protection Platform help organizations mitigate risks and ensure their data remains secure, even when they're not actively monitoring it. By continuously eliminating data exposure and making intelligent decisions about access permissions, these solutions protect against potential breaches and help organizations maintain a strong cybersecurity posture.

    • Dubplates, Deception and DubstepProfessor Dubstep's teenage years were marked by obtaining unreleased dubplates through deception, which led him to the music industry and the dubstep community's culture, but he later recognized the harm of leaking unreleased tracks.

      During his teenage years, Professor Dubstep explored the world of unreleased music, specifically dubplates, by engaging in a scheme to obtain them through deception. He would edit existing tracks to make them seem like new, unreleased mixes by the original artists, convincing traders to share their rare finds. This practice introduced him to the inner workings of the music industry and the culture of trading unreleased music. However, he eventually recognized the negative impact of leaking unreleased tracks and stopped sharing them publicly. Meanwhile, he also discovered a peculiar trend in dubstep music - the frequent use of dolphin sounds as if they were lead singers. Despite extensive research, he couldn't find any explanation for this phenomenon, leading him to formulate his own theories about the potential significance of dolphins in the dubstep community.

    • Underground dubstep scene file tradingIndividuals in the underground dubstep scene traded unreleased music files, some going to great lengths to obtain them, including stealing from artists, leading to a massive leak of unreleased music in 2015

      The underground dubstep scene in the late 2010s was known for the trading of unreleased music files. A select group of individuals, including Dino Driller, Professor Dubstep, and Spintaya, would trade these files amongst each other. Dino Driller, a young and talented dubstep producer, managed to gain the attention of big-time artist Excision, who invited him to his house to work on new music. While there, Dino couldn't resist the temptation to search for unreleased material from Excision and other artists. He found a trove of unreleased tracks and CDs in Excision's sock drawer and shared them with his trading circle. These files eventually leaked online, leading to a massive leak of unreleased music during an event called Leakmas in 2015. Despite the leak, Excision never discovered that Dino was the source of the leaks. The traders thrived on the thrill of possessing rare and unreleased music, trading it amongst themselves and eventually leaking it online. The lengths these individuals went to obtain unreleased music was astonishing, with some even stealing USB drives directly from artists after their live performances.

    • Music cybersecurityMusic, as digital data, is vulnerable to cyberattacks and unauthorized access, which can lead to damaging leaks and legal trouble for artists.

      The passion for music can drive fans to extreme lengths, including risking arrest or even hacking, to obtain new releases. The underground subreddit "extra" served as a platform for sharing unofficial music, but leaks could damage artists' reputations and invite legal trouble. In 2016, a massive database breach combined with fan determination led to the uncovering of Skrillex's old Skype password, but despite gaining access to his account, the hackers were unable to breach his Dropbox. Instead, they successfully accessed his manager's MediaFire account, discovering unreleased tracks. Music, as data on a computer or USB drive, requires its own version of cybersecurity to protect against unauthorized access and leaks. The dedication and motivation of fans to obtain new music illustrates the profound impact music has on people's lives.

    • Music Industry HackingHacking into music industry accounts and cloud storage providers can lead to damaging consequences for artists and the industry as a whole, and is both illegal and unethical.

      During a time when unauthorized access to music industry accounts was common, two groups, Professor Dubstep and Spintai, and Dino and Shane, engaged in a cat-and-mouse game of hacking each other's accounts. They justified their actions by believing it was better for them to do it than others, who might cause more harm. They also hacked into accounts to keep information from the other group. However, they took it a step further by logging into cloud storage providers like Box.com and gained access to a significant amount of valuable data, including unreleased music and production files. Despite the justifications, both sides were in the wrong, and their actions were damaging to the artists and the music industry as a whole. It's important to note that such activities are illegal and unethical, and the consequences can be severe.

    • Skrillex data breachUnsecured folders and shared links on seemingly secure platforms like Box.com can lead to significant data breaches. Enable individual passwords, two-factor authentication, regularly audit and secure sharing links, and be cautious when making files shareable.

      Proper security measures are crucial to protect sensitive information. The Skrillex data breach serves as a reminder that unprotected files, even those stored on seemingly secure platforms like Box.com, can lead to significant consequences. In this case, unreleased music and confidential business information were exposed due to unsecured folders and shared links. It's essential to enable individual passwords and two-factor authentication on accounts, and regularly audit and secure sharing links. Additionally, be cautious when making files shareable, as they may still be accessible to unintended viewers. The incident highlights the importance of treating cloud storage as if it's publicly accessible and only sharing sensitive information temporarily and securely. Furthermore, be aware that data from various online storage sites can be found on the web, so it's essential to take extra precautions to safeguard your information.

    • Data security in cloud-based environmentsNegligence in handling private data in cloud-based environments can lead to severe financial and reputational consequences, including hackers exploiting excessive logins and lack of oversight to maintain access.

      Carelessness with handling private data, especially in a cloud-based environment, can lead to severe consequences. In the discussed situation, a music management label failed to secure artists' personal documents, including sensitive information like social security numbers and passwords, in their online drives. This oversight put millions of dollars' worth of data at risk, with potentially thousands of people having access. The issue was compounded by the use of cloud-based solutions for various business functions, leading to an excessive number of logins and a lack of oversight. Hackers exploited this situation by creating ghost logins, allowing them to maintain access even after password changes. The music industry isn't the only sector facing these challenges. Small businesses often rely on public-facing websites for various solutions, leading to a multitude of logins and a lack of internal file storage systems. This complexity makes it difficult for businesses to keep track of permissions and secure their data effectively. The consequences of such breaches can be devastating, both financially and reputationally. Therefore, it's crucial for individuals and organizations to prioritize data security, regularly review permissions, and consider implementing robust security measures to protect their sensitive information.

    • Online betrayalTrust can be easily broken online, leading to consequences like betrayal and data leaks. Strong passwords and avoiding reuse are essential to prevent unauthorized access.

      Trust and loyalty can be easily broken in online communities, even among teenagers. The speaker and his friend Spintire, who initially worked together to access and protect unreleased music files, found themselves on opposite sides when Spintire started selling the files to unauthorized buyers. The situation became more complicated when the speaker had to navigate the betrayal and the need to protect the music from further leaks. They formed a new team with Shane, Arnie, and Professor Dubstep to prevent Spintire from accessing the files and to secure the music. The group used various techniques to gain access to accounts and shared drives, but they also learned about the importance of strong passwords and the dangers of reusing the same password on multiple sites. The incident serves as a reminder of the importance of trust and the potential consequences of betrayal in online communities.

    • Creative content securityUnauthorized access to creative content can lead to significant financial losses and project cancellations. Robust security measures are necessary to protect creative content and prevent unauthorized access.

      Unauthorized access to creative content can lead to significant financial losses and project cancellations for artists and record labels. In this story, the hackers' actions resulted in the cancellation of an unreleased Major Lasers song, "Terrorize," featuring Collie Buds, and the delay of an entire album, "Music is the Weapon." The hackers obtained access to the artists' Dropbox account and shared the files online, causing the label to abandon their plans for the release. The individuals involved tried to prevent future leaks by contacting the artists' management and legal teams, but the solutions proposed, such as offering large sums of money for the hard drives, were not effective. The incident highlights the importance of implementing robust security measures to protect creative content and prevent unauthorized access.

    • Music Industry EthicsObtaining behind-the-scenes details of music production through unconventional means raises ethical questions, particularly in the music industry where collaboration and ghost-producing are common.

      Having access to the behind-the-scenes details of how music is produced by professionals can be invaluable for aspiring artists. However, obtaining such information through unconventional means, like exfiltration, raises ethical questions. The music industry, particularly in electronic music, often involves collaboration and ghost-producing, which can blur the lines between original creation and crediting others. While some argue that the music is the ultimate product, others believe proper credit is essential. The digital underground is a fascinating yet largely hidden world, full of activity and creativity, but it also comes with risks and ethical dilemmas.

    Recent Episodes from Darknet Diaries

    149: Mini-Stories: Vol 3

    149: Mini-Stories: Vol 3

    In this episode we hear EvilMog (https://x.com/Evil_Mog) tell us a story about when he had to troubleshoot networks in Afghanistan. We also get Joe (http://x.com/gonzosec) to tell us a penetration test story.

    Sponsors
    Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet.

    Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.

    Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.

    Darknet Diaries
    en-usSeptember 03, 2024

    148: Dubsnatch

    148: Dubsnatch

    Ever wondered how far a fan would go to get a sneak peek of their favorite artist’s unreleased tracks? In this episode, we uncover the audacious story of some teens bent on getting their hands on the newest dubstep music before anyone else.

    Sponsors
    Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet.

    Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.

    Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.


    Darknet Diaries
    en-usAugust 06, 2024

    147: Tornado

    147: Tornado

    In this episode, Geoff White (https://x.com/geoffwhite247) tells us what happened to Axie Infinity and Tornado cash. It’s a digital heist of epic proportions that changes everything.

    This story comes from part of Geoff’s book “Rinsed” which goes into the world of money laundering. Get yours here https://amzn.to/3VJs7pb.

    Darknet Diaries
    en-usJuly 02, 2024

    146: ANOM

    146: ANOM

    In this episode, Joseph Cox (https://x.com/josephfcox) tells us the story of anom. A secure phone made by criminals, for criminals.

    This story comes from part of Joseph’s book “Dark Wire” which you should definitely read. Get yours here https://www.hachettebookgroup.com/titles/joseph-cox/dark-wire/9781541702691.

    Darknet Diaries
    en-usJune 04, 2024

    145: Shannen

    145: Shannen
    Shannen Rossmiller wanted to fight terrorism. So she went online and did. Read more about her from her book “The Unexpected Patriot: How an Ordinary American Mother Is Bringing Terrorists to Justice”. An affiliate link to the book on Amazon is here: https://amzn.to/3yaf5sI. Thanks to Spycast for allowing usage of the audio interview with Shannen. Sponsors Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet. Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free. Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    144: Rachel

    144: Rachel
    Rachel Tobac is a social engineer. In this episode we hear how she got started doing this and a few stories of how she hacked people and places using her voice and charm. Learn more about Rachel by following her on Twitter https://twitter.com/RachelTobac or by visiting https://www.socialproofsecurity.com/ Daniel Miessler also chimes in to talk about AI. Find out more about him at https://danielmiessler.com/. Sponsors Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet. Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free. Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    143: Jim Hates Scams

    143: Jim Hates Scams
    Jim Browning has dedicated himself to combatting scammers, taking a proactive stance by infiltrating their computer systems. Through his efforts, he not only disrupts these fraudulent operations but also shares his findings publicly on YouTube, shedding light on the intricacies of scam networks. His work uncovers a myriad of intriguing insights into the digital underworld, which he articulately discusses, offering viewers a behind-the-scenes look at his methods for fighting back against scammers. Jim’s YouTube channel: https://www.youtube.com/c/JimBrowning Sponsors Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more. This episode is sponsored by Intruder. Growing attack surfaces, dynamic cloud environments, and the constant stream of new vulnerabilities stressing you out? Intruder is here to help you cut through the chaos of vulnerability management with ease. Join the thousands of companies who are using Intruder to find and fix what matters most. Sign up to Intruder today and get 20% off your first 3 months. Visit intruder.io/darknet. This show is sponsored by Shopify. Shopify is the best place to go to start or grow your online retail business. And running a growing business means getting the insights you need wherever you are. With Shopify’s single dashboard, you can manage orders, shipping, and payments from anywhere. Sign up for a one-dollar-per-month trial period at https://shopify.com/darknet. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    142: Axact

    142: Axact
    Axact sells fake diplomas and degrees. What could go wrong with this business plan? Sponsors Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more. Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com. This show is sponsored by Shopify. Shopify is the best place to go to start or grow your online retail business. And running a growing business means getting the insights you need wherever you are. With Shopify’s single dashboard, you can manage orders, shipping, and payments from anywhere. Sign up for a one-dollar-per-month trial period at https://shopify.com/darknet. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    141: The Pig Butcher

    141: The Pig Butcher
    The #1 crime which results in the biggest financial loss is BEC fraud. The #2 crime is pig butchering. Ronnie Tokazowski https://twitter.com/iHeartMalware walks us through this wild world. Sponsors Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more. Support for this show comes from Drata. Drata streamlines your SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR & many other compliance frameworks, and provides 24-hour continuous control monitoring so you focus on scaling securely. Listeners of Darknet Diaries can get 10% off Drata and waived implementation fees at drata.com/darknetdiaries. This show is sponsored by Shopify. Shopify is the best place to go to start or grow your online retail business. And running a growing business means getting the insights you need wherever you are. With Shopify’s single dashboard, you can manage orders, shipping, and payments from anywhere. Sign up for a one-dollar-per-month trial period at https://shopify.com/darknet. Learn more about your ad choices. Visit podcastchoices.com/adchoices