148: Dubsnatch

22:15No. So Dino had a nefarious plan for visiting Excision's house. Yeah. Oh, my gosh. So Excision wasn't around and trusted. So this is betrayal at this point. He trusted Dino to come on in when I'm not around. It's cool. You're a musician. I like your stuff. We're hanging out. We're friends. Yeah. And now Dino's like, it's working as planned. I've got full access to your stuff. That's exactly it. I'm going to grab some hard drives. We were sitting there on Skype like, oh, look for this and that and this and that, sending him file names like, can you look if there's this thing and this Skrillex thing and blah, blah, blah.

23:02Meanwhile, Excision was out at the gym. We'd just be sitting there like, get this, get that. But eventually, Dino ran out of old hard drives to comb. So we're like, well, there's stuff missing from here that should be there. So the final location that was searched was Excision's actual sock drawer for CDs and USB drives. And what did he find in Excision's sock drawer? Old CDs with the things on that we were looking for. I'm not kidding. There was a demo from Skrillex called Dimbo, which was a demo of one of his biggest songs, Kyoto. And there was just all kinds of things on there, just work in progress, things that had never come out, that no one had ever heard before.

23:56Mostly made by Excision. Well, there was some Excision, there was some Skrillex, there was some Knife Party, some nausea, all kinds of things that these communities have been looking for for years and begging for. It was right there on these CDs in the sock drawer. And they were now being sent to us on Skype. Dino was pretty careful to just copy everything right there in the house and put it all back exactly where it was. So Excision wouldn't know anything got taken. and then he passed it around. Yeah, he shares it with me and Spintire and we just listened to it together like, this is amazing.

24:41This is really interesting stuff. That's kind of unbelievable.

24:51And I thought that would be the end of it. But no, after a week or so, literally just a week, some of these things started to leak onto Reddit. Dino was trying to blame me for it and saying, oh, well, you must have traded this and telling everyone that I was trading it and leaking it and this and that. And I nearly got the blame pinned on me for it. I nearly did. But the way that I found him out was that some of the things that leaked were things that I was never sent. So it must have meant that he traded two batches of things that were slightly different. one to me and other batches to whoever else which contain different files.

25:36So I caught him out and I managed to spin it back around and say, no, I can prove that it was you, that that's the reason for these leaks. So Dino leaked it and blamed it on you. Yeah, well he didn't leak it, he sent it to the traders. Like Jay Brown. Hmm. Mm-hmm. And um... The traders like this idea of providing the public this stuff. It gives them a thrill. They're like, oh, look at that. I'm getting a lot of upvotes, getting a lot of downloads, making some waves, got an article written about it. This is going great. Like that's what they thrive on, right? Sort of. It's more that the traders themselves thrive on just the status of having these rare things.

26:21So they can go to people and say, oh, I've got this and that. and I want that and this and I can trade them for that and then eventually it just everyone goes in a loop and carries on doing that between each other until eventually someone posts it online then once it's posted that song is burned in the trading community it's no longer a rare item to have Christmas 2015 there was an event called Leakmas where hundreds of things got leaked onto Xtril, onto Reddit all of the things that Dino had taken from Excision's house, all of them leaked. There wasn't one single thing that didn't get leaked.

27:00And it was all just because it was being traded like crazy. Did Excision ever figure out that Dino did this? No, to this day, he's never realized. Never, never, never found out.

27:17We're going to take an ad break here, but stay with us because this story is going to go way off the rails.

27:26This episode is sponsored by Vanta. Customer trust can make or break your business. And the more your business grows, the more complex your security and compliance tools get. It can turn into chaos. And chaos isn't a security strategy. That's where Vanta comes in. Think of Vanta as your always-on, AI-powered security expert who scales with you. Vanta automates compliance, continuously monitors your controls, and gives you a single source of truth for compliance and risk. So whether you're a fast-growing startup like Cursor or an enterprise like Snowflake, Vanta fits easily into your existing workflows so you can keep growing a company your customers can trust.

28:02Get started at Vanta.com slash Darknet. That's V-A-N-T-A, Vanta.com slash Darknet.

28:13Professor Dubstep was getting deeper into the unreleased Dubstep trading scene. 2016 comes around. The tactics that traders were using to obtain the unreleased music files was changing a little bit. And there were a couple of incidents where artists had played a DJ set at a club, and someone would go up after the show and just take the USB drive straight out of the mixer. Whoa! With all the secret stuff on it. Yeah. They'd go right up on stage and grab their equipment. Yeah, well, it's Pioneer CDJ systems there. You basically just put a small USB flash drive into the top. So if someone walked past it, they could just swipe it really easily and no one would notice until it was too late.

28:54Well, I mean, doesn't the music immediately stop? If it's after the show's just finished, there's like a small window where someone could grab it and no one would notice. Woo, that's some balls, you know? To go to a live show, see that performing artist you like, and then to steal their files right from under their nose. Yeah, it's been known to happen about three or four times in the space of one year. Holy moly. The lengths these people go to to get unreleased music is unreal. And I think it's a testament to just how dedicated and motivated the fans were to hear more, to get the latest stuff.

29:33Like, you don't see consumers just, like, going to a sewing trade show and stealing the latest sewing machine from the demo booth, you know? Because that passion doesn't exist there. Music has this way to give us a meaning to life. It can be our therapist, our best friend, our lover, and our dance partner. It moves us in a way that not much else can. So some people would risk getting arrested to steal a thumb drive with new music on it. Yeah, it happened plenty of times. There was a guy called Snails who was blowing up in the scene in late 2015. He had his USB stolen. All of the files from it leaked onto Reddit.

30:13Skrillex had his USB stolen as well. All of those things ended up leaking in late 2016. On to Reddit again. You know, it's something that keeps happening. I think it still happens to this day that artists have their USB drives stolen out of the equipment on stage. What do you do here? Weld your USB drive into your equipment? Or what about putting a decoy USB drive in, but it's really a trap? If somebody goes to grab it, electric shock. It's also interesting to just parse the idea that music is just files. It's data on a computer or a USB drive in this case. And I never thought about applying cybersecurity to music, you know, like it's acoustic sound waves, not computer files, but no, it is computer files.

31:04And so it needs its own version of cybersecurity too. Okay. So let's talk about Reddit. The pop and subreddit for all this was Xtrail, which is a place to post links to unofficial dubstep music. You know, live recordings from concerts, radio mixes, stuff that wasn't on the artist's official Spotify or YouTube or SoundCloud, but it is from that artist. And these alternate versions are sometimes better than the original version. And fans were loving this subreddit to listen to new mixes. Leakers in the scene were frowned upon. So things actually being leaked, Whoever leaks something, it burns their reputation.

31:43That's the nuanced thing about it, though. While people went crazy over leaked tracks and would get a lot of people excited, the subreddit had to take action on this to avoid being labeled as a leak site and get shut down. So they'd remove the leaks and ban the leakers. Because it just goes, one thing, they're traders. They don't like things leaking. And two, it does damage things. Three, it invites trouble. It invites legal trouble. if you are the one to leak something. The Extral subreddit is layered like an onion, though. Basic stuff was on skin level. Peel it back, and you find some juicier content.

32:18Traitors with rare stuff. There were rules, though. No piracy allowed. And no posting unreleased music. But the rules were often abused. So the outside, Extral, looked like a place that was just a rampage of things, totally uncontrolled, but actually behind the scenes, it was kind of a front. So if an artist was cool and contacted the moderators of the subreddit or the people in charge, they could say, please prevent this thing from leaking. There's release plans for it soon. Would you mind keeping it off? And if they were nice about it, they could get their brand added to the filter so that nothing could be posted.

33:03It really takes a certain set of eyes to understand what's going on in X-Show. because even when something is posted, are you familiar enough with that band and that track to know if this is legit or made up or a leak at all? So late 2016 rolls around. Spintail comes to me on Skype and says, look, we've got this old password of Skrillex's. I say, okay, well, how? How does this happen? And he kind of hesitates to explain it at first and just says, oh, just look at it. Just try it on these things. Just try it on the old Skype account. Oh, okay It works It logs straight in To Skrillex's Skype account Yeah, it was an old inactive account It was dead, it was not being used But the password worked And I said, well, how do you get this?

33:51Yeah, good question Skrillex is the biggest name in dubstep He's a Grammy award winning artist Loved by millions of people He has millions of followers on Twitter too To get his password on Skype Is a pretty big deal And I said, well, how do you get this? Eventually he explains, he says, databases have leaked from all kinds of sites. There was quite a lot of databases that got stolen and uploaded online in 2016. There was Dropbox had their database stolen, Last.fm had their database stolen, MySpace had their database stolen as well. And they're all just uploaded to this thing called, I think it was Leaked Source.

34:32and you could basically pay$20 a month for access to this. And it would give you access to all of these databases. So you could just view the results, the hashed passwords and things. And you could just take the hash and just decrypt it yourself because they were really poorly protected. Just standard MD5, which almost the whole MD5 table had been cracked by that point. Oh my God, this is about to get insane. Huge database breaches with millions of usernames and password hashes. Combine that with the ravenous fans willing to stop at nothing to break into dubstep artists' digital lives and steal whatever they can to post it to Xtrail.

35:15And Skrillex is one of the first to get a working password for the biggest dubstep artist in the world. My goodness, my brain is running a million miles an hour right now. There is going to be an all-out onslaught of people. They're going to be trying to hack into these musicians' files. Hey yo, I'm eating Fun Dip right now. So what we've done basically is just put the email in that we knew of these artists. And if they had a result come up from some old database that had been leaked, that was poorly encrypted, you could take that hashed result and decrypt it. And just hope that their security was not so great and that they kept reusing this password for all the time and used the same one on every site or whatever.

36:04And dang, that is a sweet combination of Last.fm, Dropbox, and MySpace. It pretty much means every dubstep artist would be somewhere in those database breaches. It was just a matter of finding the right username or email they use because those three sites were used a lot by musicians. Dropbox is extremely popular for file sharing. And if a musician has a label or a manager or someone else that they're collaborating with, sharing their work in progress on Dropbox is very common in this circle. Last.fm and MySpace are places where you can go to post your music, which when you're an up-and-coming artist, you definitely want to be posting everywhere.

36:40And yes, MySpace is still around. So, yeah, I'm just imagining, like, wait, hold on a second. We've got Skrillex's password. It works on an old Skype account. This has got to be the pinnacle of the whole story. We got into Skrillex's Dropbox. Skrillex's Dropbox is the... We actually didn't manage to get in there, but we tried a bunch of different accounts after Skype, and none of it was working. So all of the other things had been closed off. So you couldn't get into his Dropbox? No. Nice job, Skrillex. Either he wasn't reusing passwords or heard about this database breach and changed all his passwords.

37:20Either way, he was ahead of the hackers here. And my goodness, if they got into Skrillex's Dropbox, that would be the most epic thing. To hear his latest stuff before anyone else, that would be insane. But they couldn't get in. No. So we decided instead that maybe his manager would be a good target to try and look, to see if there was anything leaked in the databases for his manager. And so we had a look in, and there was. It was a really old result from 2008, but it had been... The same result appeared in all of the databases, so it had a good chance of working in some maybe old sites that had been inactive, would have been used in the past for sharing music and stuff internally.

38:15So me and Spintai, we sat there on Skype and we tried it on Mediafire page, which worked. and logged us in. And there was some interesting stuff in there. There was Photoshop documents. There were a couple of on-release tracks that had never come out before, never even been heard. Skrillex tracks? Mm-hmm. Yep. Hot diggity. That's, I mean, I don't know if you're seeing it the way I'm seeing it, but that's got to be the biggest find ever, so far, at least in this story. In a way, it was. But at that time, we were hearing so many tracks from the traders that it kind of didn't seem as big to us as it actually was.

38:58And what we were doing as well, logging into the accounts and things, we didn't really kind of realize how deep that was really going because that's way further than just trading something in a small circle that's been got from another trader. That's going into someone's account and taking something directly. and we were just doing it as if it was nothing, really, which is really ridiculous. When I think back to it now, it's ridiculous. That's a huge invasion of privacy. But, you know, it worked. We got these tracks and kind of made a resolve to ourselves that other people would be doing this at the same time as us.

39:41Other people would be figuring this out. Who would get these things and then trade them and leak them? So that's what me and Spintyre were basically saying with each other. It's better that we're doing it and we can keep these things safe and listen to them between ourselves and have the interest with it and then keep it secret. Keep it from leaking. So part of keeping it from leaking is changing this manager's password or deleting it out of there or something, right? Yeah. So we'd go in, we'd grab the files and then either just change the password straight up so that no one else could get into the account or to contact the person that we'd logged into and say, you know, we've compromised your account.

40:25You need to change this password. And which many of the times we actually did that, we contacted them and said, you know, you've been compromised here. This is how it happened. You need to change your passwords. Whoa, what a weird moral compass that is. They knew breaking into someone else's account is wrong. But their attitude was, if it's not us who breaks in, it'll surely be someone else who breaks in, and they could cause big problems. So it's better that we do it so we can fix it, and for the incentive of getting in and fixing it, we'll just take a listen to whatever we find along the way and just keep it for ourselves.

41:00We decided to look in these databases for Dino's, if he'd had his passwords leaked in some database and that we could try them out on the Skype. Oh, wow. Dino was that guy who stole things from Excision and then leaked that stuff to other people then tried to blame Professor Dubstep for the leak yeah this is where it gets good so we had a look and there was one there was well, there was one password that had been leaked five or six times on different services so that just indicates that he's using it on everything and maybe hasn't realized that it's compromised. So we took that password and we logged into his Skype.

41:43It worked, first time. It was six characters. It was really basic.

41:52We just logged straight in and we could see his chats and we could see him talking to some guy called Shane. Shane was the owner of Xtril. And they were talking with each other about trying to hack into accounts using these databases. So they were doing it themselves and trying to figure it out, as me and Spintire were also doing it between each other. Oh, interesting. It's almost like there are two teams on this now, Spintire and Professor Dubstep, and then Dino and Shane. Spying on the other team might be really useful here. So one of the targets that Dino was trying to hack into while we were watching him was us, me and Spintire.

42:33So he was looking in these databases, is trying to find our info, and we were watching him do it and watching him attempt to get into our accounts, like, live, in real time. What accounts of, like, your Skype account? Yeah, anything he could manage. Our Skype, our Dropboxes, SoundClouds, anything, basically. Oh, so Dino's talking with Shane, like, hey, you have Professor Dubstep. Do you see them in this at all, in the data? Yeah, I see them in the database. Oh, cool. Let's check their password. Try logging in. Like, this is the chats you saw? And then it's like, no, it didn't work. Ah, bummer.

43:13Yeah, exactly that. Literally just a real-time feed of watching him try to hack into us. Now, I think more what it was was that he was paranoid and he was trying to see if we were sharing stuff behind the scenes and keeping things from him. Because everyone in this little trading game was backstabbing each other. It's just what was happening. Everyone was backstabbing each other. Well, I mean, so what is your reaction to that? Like, if somebody's trying to hack me, I'd be like, whoa, whoa, whoa, this is now, I've got to be very careful with this person. How did you react to this? Well, me and Spintai were just sat there like, wow, we're actually seeing this.

43:51They're actually trying to get into our stuff right now. This is strange. This is a lot to break down. But we were just sat there like, oh, well, good thing we have proper security on ourselves, otherwise we'd be screwed. But here's the funny bit. It's like, yeah, you're scared. You feel like, okay, I could be screwed here. This person is clearly attacking us. But you're in their Skype looking at their messages, so you're also attacking them. Yeah, exactly. I don't know whose side to take here. You're both in the wrong. We are both in the wrong. Everyone in this story is in the wrong. There is no right here whatsoever.

44:38The only thing that is marginally right is contacting people to say that you're compromised. That's the only good thing. I got to have a hero that I want to cheer for and I don't know what to do. I'm telling you now, you're not going to get one. I don't want to glorify any of this because it's not. It's a terrible thing. The double-plate trading, the hacking, it's all just damaging to everyone involved. The artists, the people doing the hacking, you know, it's dangerous stuff. And it's just a bunch of kids who don't know better doing it at the time. You know, we were 14, 15, just sat there. Spinty was a lot older.

45:18He was about 30. All this reminds me of one of those old heist movies where the criminals steal the cash. But then when they get away and they're all just sitting around looking at the stolen money and each other, they all start wondering if they can trust each other. Clearly, these are criminals you're working with willing to break the law for this money. Are they going to steal it from me? And then you realize, yeah, someone is going to steal my cut. So then you steal their cut first and get out of there. Well, here we have both sides completely not trusting each other and are actively trying to hack into each other's accounts to keep an eye on them.

45:52But it's interesting that Dino was working with Shane, who was the moderator and owner of the Xtril subreddit. Through these chats, they could clearly see how involved Shane was in the trading scene. He really liked collecting dubplates and getting his hands on unreleased stuff. So we carry on. We try and get some more targets. We think of other sites that we can try and log into. So we take a look at Box.com, which is a cloud storage provider, usually used by small businesses, big businesses, record labels, production companies, anything. It's very popular because they offer great group collaboration options.

46:35So we take Skrillex's manager's password and we try it on the Box.com account, and it logs straight into the inner workings of Skrillex's record label.

46:50We get in there and we can see all their upcoming releases and their production files, promotion plans. Upcoming releases for Skrillex? For Skrillex and all the artists on his label. Wow. That sounds like a big treasure trove. There was a couple of terabytes worth of files in there. Holy cow. Box.com is a little bit more advanced. They send login notifications for unrecognized logins. So one of the first things we did was go into the settings and have a look. Did it say that we'd logged in? And this guy, this account that we'd logged into, he turned off the login notifications. So he had no idea that we'd got in there.

47:36None. Oh my gosh. There's a lesson there, isn't there? Yeah, leave something on for something like that, which is heavily relating to your business. You need to have these notifications turned on to tell you if your security is compromised. Unreleased tracks are worth more than demos. Demos are just early versions or remixes of songs people have already heard. But unreleased tracks, nobody's ever heard yet. Okay, so give me a list of things you found on there. There was unreleased Skrillex songs, there was individual audio assets for some Skrillex things, and the other artists on his label, like the individual master stems and things for songs, multi-tracks, so that you could basically break them down into their parts and things.

48:25Everything was stored in there. There was Photoshop documents, promotion plans, documents saying what they were going to be doing for the next year or two years even, internal voice recordings, meetings between the label executives and things. It was all kinds of stuff that really should, you know, it's confidential things and it was really unprotected files. There was no individual passwords on folders and things. It was all open with 50 other accounts shared on all of them. My gosh. I'm just trying to think of what that could, if that did get in the public, what kind of ruckus that would have caused?

49:04It would have caused a lot. A very large amount. What we did is we copied the share link for each folder that was in there. And we set the permissions on that so that anyone with that share link could still view the folder even though they're not logged in. And we also copied the collaborator invite links for the folders because that option was not password protected. So we could invite a new burner account so that we would still have access for ourselves on new accounts altogether. and the original one would be closed down, so no one else would be able to get access to it apart from Oz. Oh, that's interesting.

49:40I want to make sure you understand this. The accessed Skrillex Managers Box.com account, okay? And they saw these folders there and made the parent one shareable. And what this means is that anyone with that link can now view the contents of that folder and all the subfolders without needing a username or password. So now they don't need to log back in to see what new files were uploaded. They can just use that share link to get in there and view it without logging in at all. On top of that, the manager had the ability to invite new collaborators. So they just made a new email account and invited themselves as collaborators and then told the manager, hey, look, your account is insecure.

50:20You should change the password, which fixed the manager's account so that no one else could use this same exploit to get in. No other hacker could get in the same way. This is a backdoor persistence into Skrillex's whole media company. Yeah. But it's a backdoor in a way that I never thought would be a backdoor, right? If I say, oh, I have backdooraccess to Box.com, you're thinking, oh, wow, you've got some malware planted and reverse SSH shell. Nope, just a share link. Oh, yeah. It gives you a total different perspective of what a backdoor even is. Yeah, because it's a backdoor that you can just, it's built into the site.

51:00It's built into the site, exactly. The only reason we were able to get these in the first place is because people don't exercise proper security. They use the same password on every site for years and years and years and don't enable two-factor authentication on their accounts either. So it's just open. If you've got the password, then you can just walk straight in and do whatever. You'd ransack the place if you so wanted to, which is ridiculous.

51:25I'm just sitting here thinking about this, letting it sink in. A backdoor is built into all the file sharing sites, like Box.com, Google Drive, iCloud, Proton Drive, Dropbox, whatever. Because if there exists a shared folder link, anyone with that link can see into that folder. It's a feature of the site itself. You can't take that away or it ruins the point of the site. And what you think is yours in private really isn't if there are public links to it. When you make something shareable and you say, only people with this link can see this file, it feels like this is still private, but it's not.

52:04It's security through obscurity. Your link is hidden, but not secure. And if that link gets out, it's viewable by anyone without a username or password. And I've been doing cybersecurity for decades, and nobody is talking about auditing Dropbox links to make sure only the stuff that should be public is public. Because every file and folder may have that option and going through them all is simply unreasonable to do by hand. And when you're moving at the speed of business, nobody's going back to clean up or check what folders have sharing links or what don't. I say it's best to treat everything on your cloud storage as if it is publicly accessible and only temporarily put things up there if you want to share it with someone privately and then remove it as soon as they get it.

52:49I also want to draw your attention to websites like urlscan.io. This is a site that is attempting to look at URLs to see if they're safe or malicious. But users can go there and search the site to see what URLs are in the database. And sometimes you can find URLs that probably shouldn't be in the public, but they are. Like, imagine if you take a photo of your kid and it's on Google Drive, but then you want to create a link to show it to grandma. And you specifically say, only people with this link can see this photo. And you email the link to grandma. Well, then grandma has some browser plugin that examines all the links to make sure they're safe to click.

53:27So when this link gets examined somewhere, bingo, bango, suddenly that link to your kid's birthday party is now floating around on the internet in all kinds of databases being clicked on by who knows who. URL scan collects links like that. Hybrid analysis is another tool. Cloudflare radar URL scanner is another. Not to mention DNS providers all over the world are logging things too. It's not just Google Drive and Dropbox. There are tons of other online storage websites that you could look for. iCloud, Box.com, Sync, Ignite, IONOS, HiDrive, AWS S3 Buckets, ProtonDrive, and so many more. the list goes on and on.

54:06So the data is available. It's just a matter of sifting through it to find something juicy. In this case, they were looking specifically for dubstep music and stepping over anything else that they came across. Okay. So it was just you and Spin Tire that got access to this. Yeah. And you just kept it between you. Nobody shared it beyond that, right? So I thought, how I wish. Because as usual, a few weeks went by and other people started to hint that they had these files or, well, the traders got access to some things and there was no explanation for it other than that Spintyre must have shared it with someone.

54:51So I quizzed him on it and I said, you know, if you have, I'd rather you just tell me. I won't be angry, I just want to know. He still denies it. So I started thinking, oh, well, someone else must have got access somehow. Like, aside from us, someone else must have initially got access to the account. So I treat it as that for a while. I let Spintire have the benefit of the doubt. We carry on going. We think of some more accounts to try and get into different people. Another thing we were trying was a management company for Diplo and Major Lazer, who are a bit closer to pop music. and we tried it, his manager's box.com account based on what we'd found in these leaked databases.

55:35And sure enough, password worked. It logged us in. There was another couple of terabytes of data in there. There was a lot more than just major laser in there. There was Diplo, there was Atrack, there was Dylan Francis, Kill the Noise. There's just, there are about 20 different artists under this management company, and we could view all of their stuff from within this Box.com account.

56:03At this point, they've gained access to terabytes of data from these music managers, which was just too much to download at all. Their hard drives would fill up instantly, so they had to be selective of what they were grabbing. Like, I don't know what this is like to come across this, but I imagine you cancel your weekend plans and you're like, I got a whole bunch of cool stuff that just arrived in the mail and I can't wait to dig in there and listen to stuff because you can't speed through listening to these things. You've got to really be like, wow, I'm going to let this one play the whole thing.

56:37Nobody else is hearing this but maybe four people in the world and Diplo made it. Like, wow. Wow. Yeah, this is where it gets a bit more dangerous because some stuff that they had in that box.com account, they were basically keeping all of their artists and people that were involved in touring and things, production crew, this management company was keeping all of these people's personal documents in there. They're calling them contact sheets. And that contact sheet would have more than just their contact information on them. It would have their artist's social security numbers, bank routing info, passwords, all kinds of insane stuff that was just supremely dangerous to keep in largely unsecured folders with no extra passwords on them and seemingly no reason to put that info in the document whatsoever.

57:28And then to not secure your own account properly, it's exposing all people that are millionaires. It's kind of just lucky that none of me or Spintire or any of the people that eventually were doing this, that none of them were interested in anything more than just the music because the amount of damage that could have come from that is insane. Here's a situation where the management label for musicians was being careless with the artist's private data. Driver's license, social security numbers, and safe passwords were sitting there on these online drives. And while it wasn't meant for the public to see, there were gobs of people who did have access to this that worked for the management companies or even other musicians could see each other's files.

58:12it just goes to show if you're not protecting your own private data, nobody else will either. These folders all had upwards of 50 people shared on them. Everyone in the business could access these things. The interns could access these things. Anyone could grab these things. Or anyone that got into the account could grab these as well and just have it. And there'd be no notification that it had been compromised. Man, that's too many people to have access to all this. Because the more people you have involved, the more back doors might be created. Because just think, if a music production company is going to use Dropbox to store all their work in progress, it sounds to me like they don't have an internal file storage system and maybe no internal network at all.

58:57They probably need things like email, chat system, they got to make social media graphics, a merch store, blog, social media accounts, newsletters, project management, and collaboration tools and an internal knowledge base for Wiki. Chances are small businesses today are using public-facing websites for all these solutions and not self-hosting things on their own servers and their own data center. So that means if 50 people work at this place, that's 50 accounts times however many services I just listed. What, 10? So we're talking 500 various logins to different websites now. Who's got permission to see what and where?

59:33Small businesses are not auditing these things, and it's an auditing nightmare even if they tried. No, this isn't an ad. I'm not going to try to give you a solution. I just want to tell you about the problems that arise when you start using cloud-based solutions and there are a whole bunch of kids who are desperately trying to exploit those. So these kids had valid usernames and passwords to get into people's accounts, right? Okay, well, that's a problem to begin with, but whatever. They were grabbing things, but they were also being smart at trying to establish persistence. If the owners of these accounts changed the passwords, they'd be locked out.

1:00:06So they created share links so that even if the account gets locked out, they could see what files are being uploaded later. Cool. But you can really take this to crazy levels. I'm talking about creating ghost logins. Let me geek out on this for a second because I want to try to break your brain. Okay, so let's consider Zapier and how it can be used maliciously. Zapier is a tool that lets you automate things. So like, if I get a new invoice in my email, I can automatically upload that invoice to Dropbox so that the accounting team can see it. Okay, Zapier can do that for you. But in order for that to work, it's got to have the ability to see your inbox and have the ability to view and upload things to your Dropbox.

1:00:51So to set it up, you need to give it permissions to do that. Well, now if a hacker gets into your Dropbox like these kids were doing and they wanted to maintain their access like these kids wanted and they could see that you hooked up Zapier to do automation. So now they can create their own fresh Zapier account that they control and connect it to your Dropbox. And this could give them visibility into your Dropbox from Zapier. And you wouldn't even know they're there because to you, all you see is that Zapier has permission to view your files, but you set that up when you were setting up your invoice automation thing.

1:01:27And this is what I mean by a ghost login. Someone who's in your account who doesn't even need your username or password to stay in. Change the password all you want. They're still going to stay connected to your stuff. Another way to create a ghost login is to create a secondary login. Some sites allow you to log in through like Google or Microsoft or Facebook or even SSL. And suppose that's how you set up your account, by logging in using your Facebook account. Now, if a hacker has your password like these kids did and gets in through that, some sites might have the option to connect another login.

1:02:00Like if you used Facebook to log in, the site might let you also connect your Google account too. And so yeah, a hacker could just create a brand new Google account and connect it to your account and start using that to get into your account from then on. So even if you change all your passwords, that access would persist. So if you really want to change your passwords, you really need to go through all of the websites that you have to see all of the connected services and alternate logins and everything. It's a mess. It's a mess. And of course, another way is if the site has a way to generate an API key, you can do that and then access stuff from there.

1:02:40There's so many options to create ghost logins to maintain access to an account, even if the user changes their password. So this is what I mean. If 50 people all have access to someone's driver's license in Dropbox, then perhaps nobody is looking closely at permissions. And if that's the case, there's a high potential of being able to create a ghost login that stays working for years. And I must say, this is a new territory for security teams to navigate. You hear about this in general terms, like least user privilege and this sort of stuff, but you don't have people who are experts in Zapier account security who will audit what apps you have given permission to regularly.

1:03:17This is a big challenge to keep up with. So with all this data, like terabytes and terabytes from some of the biggest stars in this dubstep world. Do you ever think like, you know, we can make some money off this? I wasn't into that but I would later find out that Spintire was sort of starting to get into that I mean after a while of these things keeping leaking, starting to leak on Reddit that were meant to be just kept between us and that no one else was supposed to have access to I clocked on that that Spintire must have been being dishonest about it. So I confronted him in mid-October I said, are you sharing these?

1:04:03Just tell me right now, are you sharing these? And he says, no, it's not quite like that. I said, well, how is it then? He says, I can't say. I say, is someone paying you for them? He says, yeah. So I think, oh, well. Finally, he's admitted it. I've caught him out in his whole game plan. And he goes on to explain that he quit his actual job to sell these files to some rich kid on the other side of the world. I say, well, this goes against every, you know, the whole reason that we were doing this in the first place was to keep these files somewhat safe and prevent these people from getting access to them so that they can't do this thing with it.

1:04:44And then he's doing it himself. It really made me quite angry because I felt misled on the whole thing. Huh. This is a tricky situation to navigate for a teenager. Like, what do you do when your partner in crime starts doing things you don't approve of? Together, you made a map of all the buried treasures, all the shared links and logins and passwords and ghost logins, terabytes of downloaded data, and a whole system of techniques and piles of data to sift through to find more. And suddenly, both of them are now highly suspicious of each other. Now that it was known that Spintire was selling this stuff, Spintire offered them a cut of the money to keep things quiet and stuff.

1:05:23I said yes, but what I meant was I'll agree so that he keeps, you know, he thinks that I'm on his side still. So I end the chat and I go and talk to Shane from Xtril. Shane was the moderator and admin of the Xtril subreddit. Professor Dubstep was like, listen, these leaks that have been happening lately, I know where they're coming from. Spintire is selling it and I don't want more to leak out. So here are the other things that might leak. So he agrees and he's like, yeah, we'll do what we can to prevent Spintire from carrying on with the stuff. So we started working together from that point on on these things.

1:06:04Me and Shane and another friend called Arnie Kurtz. Arnie was another guy very tuned in to the unreleased music scene. And he was a whiz with all these online services and how their security can be exploited, which could be really handy to break into more shared drives and stuff. And Shane had seen that Dino wasn't trustworthy, so they stopped working together. So the new crew is Professor Dubstep, Shane, and Arnie. Spintire and Dino were out. And not only that, but they all agreed that Spintire needs to be stopped. So they put filters in place on the subreddit to keep certain tracks from getting posted.

1:06:39But they also started going through the ghost logins and shared links that Spintire had to lock him out. They were changing passwords and disabling shared links. It's kind of funny that this teenage crew knew exactly the steps to take to keep hackers out, yet the music labels themselves either didn't know or didn't want to stop these kids. Yeah, I mean, that's kind of what we started doing. Our main plan was just, you know, prevent Spintire from retaining access to these accounts and these folders that we'd spent so long to gain ourselves access to, and then we're locking them off. specifically to try and prevent things, to prevent this from...

1:07:16It is kind of strange that it changed in that way. I'd cut Spintire off in mid-October. I'd been friends with him for two years at that point. It was difficult to cut him off. It was fun to hang out with. But it had to be done. Damage was actually being caused, and I was recognizing that. What a headfall to navigate as a teenager, you know? Like to be sitting in, what, history class? Just thinking in the back of the class, what stuff Spintire might steal next? And then to rush home and change more passwords to try to lock them out. But then when you're in there cleaning things up, you're reminded, oh yeah, this is the account with all those banking details for this major musician who's a millionaire.

1:07:56Ah, that's funny. Not going to touch that. But I will stop Spintire from getting back in here. Once they were slowing down Spintire and locking them out the best they could, it was time to start looking for new treasure troves. I think at the peak of things, we probably had like a network of 25 accounts. It was a lot. I mean, we were doing this sort of stuff just all day, basically just trying to figure out what could be next, what could Spintire's next target be? You know, what could be something dangerous that he would get access to that he shouldn't get access to and then go and get access to it ourselves instead.

1:08:34It was ridiculous. this. Their standard system was to find a musician's email address, search for that email address in the breach databases, get the hash, crack the hash, then use that on a whole bunch of sites that musicians might use and hope they might be reusing passwords. Yeah, I mean, that's the thing as well with Box.com or Dropbox. If you make a shared folder and you invite other collaborators to it, these management companies are inviting 50 people to a folder. And you could go through and browse that list of people and take their names and their email addresses off there. And then you could run those through the database search as well.

1:09:09So you could, if you spent long enough on it, you could tunnel through to all kinds of places that way by just going on it again and again and again until you get somewhere. And you could build up a network that way. Of course, you all should know by now the dangers of reusing the same password on multiple sites. Here's a clear reminder why you should never do that. But you should also watch out that you're not too lazy when making different passwords? Quite a few times, they'd not change it very much. They'd maybe just add a capital letter or an extra number on the end. There was one manager that we were looking at.

1:09:44His password was the same thing for everything, but he'd just changed the letter at the end. The letter at the end would be the initial of whatever site the account was for. So if the account password had leaked for MySpace, it would be Word and then the letter M at the end. So to get to the password for Box.com or Dropbox, You know, you just change the letter at the end to a D or a B, and it would work. You would also not get a notification that that password was compromised because it wasn't. Oh, yeah, that's interesting because I regularly check all my passwords to see if any of them have been exposed in a database breach, and I change any that do get seen.

1:10:20But if my password is guessable because it's just one letter off on every site, then those would never appear in any database breach to make me want to change it. Now, one of the songs they got a hold of early was Purple Lamborghini. Yeah, Purple Lamborghini was something that came from the Diplo's manager's account. One of the artists that they were managing was called Flostradamus. They do DJ sets at the main festivals throughout the year for trap music and dubstep music. And in one of these contact sheets that was stored on this management box was all the passwords for this DJ duo. and one of them was the password for their Splice account.

1:11:00Splice was a service that offered project file storage for music software. So we got into that and we downloaded their DJ set preparation files. And because they were semi-big players, they had all these work-in-progress versions of tracks from other people in the scene. And Purple Lamborghini demo was one of them. By the way, if you're wondering if there's a dolphin in Purple Lamborghini, there sure is. It's right here.

1:11:30I swear if I listen to this enough, I've got to learn the language. Now the thing is, this is a demo version, which I think is better than the official version, but this demo wasn't released when the official one came out, and I don't think it had any plans of ever getting out. So at this time, only Professor Dubstep and a handful of people in the world ever heard this. Yeah, and basically what happened was it had been a few months since I got Spin Tire off, and I was missing my friend and I went and unblocked him and I started talking to him again. I said, you know, are you still doing the selling?

1:12:01Because we'd been trying to prevent him from doing it, preventing him from getting anything to sell. He said, no, you know, I've finished with that. I've cut off those people, realized that they were trading and leaking the things after, blah, blah, blah. So I say, okay, well, you know, should we be friends again? He said, well, sure. Let's go back to how things were a couple of years ago. just talk about music and not be involved in any of this dodgy stuff. And I say, okay, sure. You know, we kept talking. It led into, oh, you know, I've got these couple of cool new things. Do you have anything cool new things?

1:12:39And so we share a couple of things back and forth with each other. Like old times, the purple Lamborghini demo was one of those things. About a week goes by, and as usual, it leaks on Reddit. the one single possible corporate spin tire. And I just, I blew up at him over it. So I thought, you know, this has happened again. You're the only explanation for this thing leaking. It broke my trust again. So I cut him back off, but it's too late by that point. You know, the thing had leaked. That was my own stupid fault. But December rolls around and we had one last big thing that we wanted to try and do, which was to get into a Major Lazer production account for where they held all their song files and their production files for things that they were working on.

1:13:33Things that you could load up in a music software and see all the individual bits of and change things. So we had the idea to go for one of Major Lazer's production team and see if we could get into their things. So we had one last go on the database and see if we could get the pass to their Dropbox. And we did manage it. We were talking back and forth with each other, me and Arnie and Shane in a group chat, saying, oh, it's here. There was one specific song that we wanted to get. It was called Terrorize, featuring Collie Buds. So we logged into this account. The first thing we searched for was Terrorize Project File, and it was there.

1:14:19The actual one that the group were working on at the very day. So we were talking back and forth with each other like, oh, it's terrorized season, it's terrorized season. GOAT, greatest of all time. But there was more than just that in Dropbox. There was another terabyte of stuff that was being worked on at that minute. Like the inner workings of a major Billboard Top 100 pop artist. And everything was there. individual assets, you know, drum samples, synth files, all kinds. So we grabbed all that stuff. Well, I mean, it was too much to grab. And in many of these cases, it was too much. It was too much there.

1:15:03The things that Spintyra got hold of from before he was cut off had started to, you know, the leaking had really picked up. and me and Shane and Arnie basically decided that we needed to make even more efforts to contact these people who had been compromised. And I'm pretty sure it was Arnie that did this. He rang up actual manager's phone number and left a message on the voicemail to say, you know, this has happened. This is what will happen next. You need to start taking steps to cure your stuff like straight away. otherwise the damage would just rack up like into hundreds of thousands of dollars so their legal teams started talking about this like oh how could this happen blah blah blah blah blah it's impossible we sort of we ended up in contact with it with these legal teams under false identities to explain to them how it had happened why it was happening and how they could prevent it they're basically saying oh yeah you know we we had plans for these for these songs, we had plans for Terrorize.

1:16:09It was going to be like a big thing because so many people wanted the song. And that was, they basically just all canceled all of that because it was, the potential for it to leak early was there. So they canceled all of those plans. Yeah. If you go on Major Lazer's Spotify or YouTube channel, there is no such song as Terrorize. Kali Buds didn't release it either. Even though he sings in it, the song never got released. Despite there being quite a decent amount of people really looking forward to it, And I guess this is why it got canceled. The hackers ruined it. But if you're curious what the dolphin sounds like in it, here you go.

1:16:50This is actually a remix of it I found. The one that got leaked was a little different. But it's wild that this totally unreleased Major Lazer song is out there in the world for anyone to listen to. But because it wasn't an official release, it doesn't have many plays. And it's not an official song by Major Lazer. It could have been a hit. Major Lazer has three songs on Spotify with over a billion plays. And Call Your Buds is pretty popular too. A reggae dubstep crossover song? That's a great idea. But it was never released. The project permanently halted. How odd, you know? Just to think an early version of a song that gets leaked too soon, it upsets the label so much that they just give up on the song entirely.

1:17:32a album that was being worked on at the time music is the weapon that was cancelled too well not cancelled outright but really delayed and it only came out in something like 2020 2021 which was four years after all these incidents but we were basically just talking with each other trying to come up with these plans of how can we prevent these things from leaking you know we want to help you to figure this out because we know these people that are involved with this and these legal teams are coming up with these ridiculous plans like oh well we'll fly spin tire out to new york and we'll you know we'll we'll take him to dinner and we'll hand him thirty thousand dollars in exchange for his hard drives and and then we'll that will secure our files and i was trying to trying to tell him no that will not work he would we'll just make a copy of it you know it's ridiculous and uh and they were not having it they're saying oh well this definitely seems like the best idea to me and I was like, no, no, please, no, don't do that.

1:18:29I'm not sure if they actually did that in the end or if they realized that it was not going to help their case. Well, did they know that you had the drive or, you know, hard drives full of stuff too? Um, well, that's the thing, me, I didn't download all the things. I'd pick and choose a couple of things here and there, but a lot of it was kind of just not so interesting. The thing is, Professor Dubstep enjoyed listening to early dubstep tracks, but that wasn't the driving motivation for all this. Personally, I'm not really a raving fan. I was just more interested in being able to break these things down and look at the production process because it could help me to learn how to make better music myself and see how it was being done, how the Billboard Top 100 stuff was being made.

1:19:16I could use that to help me create better things myself. It's a valuable learning resource. I feel like that's a stretch, you know? Like, you could go on YouTube and watch people making music and learn from them. You can hang out at, you know, groups and circles, other garage bands or whatever the case is. Be like, how are you doing? Oh, wow, that's an interesting method. But you're like, I think I'll hack into Diplo's Dropbox to learn on my own. Thanks, I'm good. it's quite a different path to learning yeah I see your point but at the same time it's kind of unprecedented that you can go into a project file and look at the entire start to finish process of it the entire project files were in these folders all the effects, samples, everything that was used to make the song most of this music is made in a DAW a digital audio workstation.

1:20:19So that might be tools like Ableton Live, Adobe Audition, or Pro Tools, or something like that. These were the tools that you'd have to use to view how these songs were made. And Professor Dubstep had these tools to examine it all. Not only could they break apart the song, isolating tracks and sounds to see how it was composed, but there were different versions of the same song too. They could see how the song evolved over time. What an amazing thing to explore but for someone who wants to make electronic music as their career, to be able to study how the pros do it in such detail, you never get to see these behind-the-scenes bits.

1:20:55I mean, even me as an up-and-coming podcaster, I would have loved to get my hands on the full project files for This American Life or some show that I was really inspired by. It would have been huge, and I bet it would have helped me understand the complexities and details of how all this gets put together. But not only that, but to see such a variety of songs and musicians' project files, It really puts them in a unique position to have such a close and upfront understanding of how all this music was made. You have to know some in-depth music stuff already to be able to figure out what you're even looking at.

1:21:28The fact that I've been able to look at all this and take some insight from it that can help me later on is basically invaluable. It's priceless. Just imagine Professor Dubstep in some music class where the teacher's like, here's the proper way to use this effect. And they're just like, no, that's not how Skrillex does it, or Diplo, or Major Lazer, or Excision. Oh, yeah, well, how do you know? Oh, never mind, carry on. Anyway, it took them a lot of convincing, but they were finally able to get the legal team to fix all the problems. At the end of 2016 was the final, you know, called it quits and stopped doing all this hacking stuff.

1:22:11Which, I mean, it's not right to call it hacking, really. It's not even on ScriptKitty level. It's just searching through things and using logic to try and figure out passwords. It's not really like complex hacker stuff. It's just, I don't know how good a word to use to describe it. I've been thinking for a good word to use here this whole episode myself. Thief and stealing isn't quite right because the original copies are still there. I feel like for it to be stealing, you need to rob the person so they don't have that thing anymore. And if you post something online and someone makes a copy of it, that's not stealing.

1:22:47That's just downloading a copy. And that's what they did, often just downloading copies of things that had public links to it. Was it supposed to be public? No. But was it? Yes. So the term I think that best describes this is exfiltration. They exfiltrated files that were not meant for public consumption, but weren't very well protected. To me, this has the right ring to it. Professor Dubstep, professional exfiltrator. But yeah, fast forward to 2019, and I'd just finished college. I did a music course at college. I'd left all this stuff behind. It was all kind of calmed down. Nothing was leaking anymore.

1:23:26No accounts were being compromised. Well, not by me anyway. and I kind of thought, you know, I'll find out what the old people were doing in modern day. I had a chat with Shane. I had a small talk with Arnie and Shane was still going on with the stuff from what I could gather. Arnie had moved away from doing it and he'd got, I think I'm pretty sure, he went to work for the FBI and got security clearance, top security clearance for something or other. Other people in the X-Drill crew, some of them had got raided, some of them had gone to join the military, things like that. Everyone had gone off to do different things, apart from the one guy who had got the most weird and awkward situation possible, Spintire, had gone from being the seller and the leaker of so many hundreds of gigabytes of data.

1:24:22He had gone from leaking these Skrillex demos and trading them being on Skrillex's production team himself. Whoa. And was now technically Skrillex. Because, yeah, and with that, you know, Skrillex is one of the ones that is ghostwritten, ghostproduced. You know, he's not real. He's just a face for a brand. So you're saying a lot of Skrillex's music today is made by someone else, and then Skrillex just puts their name on it. All of it. All of it? Yeah, there's a team of... In 2019, the team was at least five, six people putting together these songs. And that's what it's always been, really. Skrillex's first release in 2009 and 2010, like Scary Monsters and Nice Sprites, his first EP was ghost produced by Noisia to quite a large extent.

1:25:14Maybe not entirely, but a large portion of all of his sounds over the years have come from other people putting it all together. So yeah, this ghost producing runs deep in the scene. So many of the big players are fake. All right, I can't find any article saying that Skrillex doesn't make his own music. Musicians collaborate all the time with other musicians to make music. That is no surprise. But the allegation here is that these musicians aren't crediting the people who helped make the song. So while you think it was them who made it, it really wasn't. Skrillex is known for being very hands-on with his music.

1:25:50but there are some well-known cases where other big-time musicians have been accused of taking someone else's music and calling it their own without giving proper credit. So this is known to happen. And honestly, I don't know what to think of that. I mean, on one hand, if an EDM musician is just playing someone else's music, that's called being a DJ. And it's a bit of a stretch to say you made this music. But on the other hand, what do I care if you really wrote this song or had someone else write it for you and you just put your name on it? The music is what matters. It's fascinating to me, though, because I'm endlessly obsessed with the dark parts of the Internet.

1:26:26And this digital underground is bustling with activity, but with hushed tones, and it's all right under our noses. It's a world we rarely see, but sometimes hear.

1:26:45A big thank you to Professor Dubstep for sharing this story with us. This episode was made by me, the AI adventurer, Jack Recider. Our editor is the Code Conjurer, Tristan Ledger. Mixing done by Proximity Sound, and our intro music is by the mysterious Breakmaster Cylinder. Ultra Miami, your circuits are about to be blown, because next up is an unreleased track by the legendary Breakmaster Cylinder. Overclock your headphones, compile your grooves, it's time to execute some killer dance moves. No lag, no latency. Tonight, we reach peak bandwidth. This is Darknet Diaries.

1:27:58Thank you.

1:28:23We'll be right back.

1:28:57We'll be right back.

1:29:14Thank you.

1:29:55We'll be right back.

1:30:18Dark Side Dark Side

1:30:44Thank you.

1:31:27We'll be right back.

1:31:52We'll be right back.

1:32:14Thank you.

1:32:44Would you like to know your guidance in detail currently?