Fraudsters: 'We Know Where You Live'

0:28It's safe to say we all hate podcast ads. podcast where we bring you unparalleled access to hidden worlds both online and IRL. 404 Media is a journalist founded company and needs your support. To subscribe, go to 404media.co as well as bonus content every single week. Subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm clearly out of practice with that intro script. I am your host, Joseph, and with me are 404 Media co-founders, Sam Cole. Hello. And Jason Kebler. Hello, hello. This is the most number of co-founders we've had on a podcast in several weeks.

1:15It's true. We've had bad luck. Yeah, I didn't get a chance to talk about it yet but I've been so sick so so so sick with COVID and still don't feel great but I wanted to be on the pod so take COVID seriously I guess is what I would say it's just like I've never been this sick in my life be careful out there is what I'm saying yeah it's derailed our production a little bit but hopefully next week or the week after So we will all be back here and back to normal. All right. And we will jump straight into our first story. Sextortion scammers try to scare people by sending photos of their homes. Sam, you wrote this one.

2:06Just a basic question. First of all, can you describe these emails? I actually imagine that a few people listening have probably received these. from the top what do they actually look like what are these emails saying and showing yeah i was with a friend who got one of these emails when he got it and he was like well that's horrifying someone just sent me a picture of my own street and my address so when you open the email like there's not a subject line first of all or if there is i think it might be your address but the ones that I've seen haven't had a subject line um but the body of the email I believe just had the address and it was the correct address um and then there's a pdf attachment and like you can see you know like in gmail or I don't know how other email clients were like usually you can see like the preview of what's in the pdf like you can see like the first quarter of the page or whatever you could see that and that was a picture of his street like the correct address and also a photo of his street and like you you could kind of see like um words that were on it but i couldn't i couldn't read it and i was like don't click it because it might like you could you can like inject malicious stuff in the pdf so it's like don't click anything don't open an attachment because you don't know what it is.

3:31And yeah, I ended up sending it to Jason and Jason opened it on like, I don't know. Did you open it on like an old machine or something? I opened it. On your iPhone? I opened it on an old, yeah. I opened it on my old computer. Yeah. That I then lit on fire. Yeah. Is it the computer that we tried to find the malware on the vibrator? Probably the same one. It's the computer we plugged the vibrator USB into. It's the sacrificial lamb computer. We're thankful for its service. The most fucked up MacBook in existence, just with malware upon malware. Actually, so it's actually not a MacBook. It's an iMac, which is important because I then unplug it.

4:10Oh, yes. So I'm like, yeah. As soon as the screen locks down and goes red, you pull out the power cable. Yeah. So that's why I'm keeping this throwaway device. Yeah. Yeah, so instantly the preview of it is scary enough before you even get to what's in the body of the message or the threats or any of that. Well, what does it say in the body? I mean, I'm not asking you to read it out, but they send a photo of the person's address. Then what are they claiming and what are they asking? What do they want? Yeah, so the ones that I've seen, it's like they list your name, your address, your phone number.

4:51and then there's like a letter underneath of the photo of your street that says I suggest you read this message carefully take a moment to chill breathe and analyze it thoroughly just like I don't know it's like such a crazy thing and then it goes on to say you know I don't play games I'm paraphrasing but it's long it's really it's a long like a full page letter it was big Kanye Reeves I'm happy for you or sorry that Yeah, it's like, okay. You should get to the point. Yeah, I was like skimming to the bottom. It basically claims to have installed... The wording they use is, I installed a spyware called Pegasus on an app you frequently use, which doesn't make any sense, right?

5:39Like, that doesn't make any technical sense. But Pegasus sounds scary, but it's a real thing. It's a spyware product that governments use to spy on journalists and political dissidents. But it's not something you install on an app. And it's also not something that the average dipshit hacker has accessed. Right. So yeah. So anyway, it sounds scary. And then it goes on to say that it's through Pegasus, quote unquote Pegasus, It has been remotely controlling your system to watch everything that you've watched on your screen and then switch your camera on and off in your mic. And you never knew that it was happening.

6:20And it also got all your contacts and emails. So basically, it's a sextortion scheme. It's saying your filthy secrets will remain private. I will destroy all the data and evidence once you send payment. And they're asking for a Bitcoin ransom. So it's claiming to have watched you basically watch porn or something and has this like secret footage of you. I think the wording I used was it was like, you've been in the dark corners of cyberspace or something. And it's like, yeah, that's my job. Like, yeah, you're trying to scare me with that. I do that all day, every day. I've definitely been in some dark corners.

6:54um but yeah that's the and then it's it contains like a bitcoin like a like a wallet um a crypto wallet address and the amount of bitcoin that they want to send which is like a crazy high amount and then um it says you know if you send this we'll we'll delete everything that we have and if you don't we're gonna make your life hell basically yeah so what is new here is basically the inclusion of the physical address and especially the photo, right? Like, while I was away, I saw you cover this and then I read up on it. And I was like, huh, that's funny. I remember being in like a short BB, well, not even a documentary.

7:32It was like just a news item or something for, I think, their tech channel. And it was when there were all these extortion emails going around. And it was when people would send the email saying, hey, look, this is your password. And it really grabbed your attention because right at the start it's like huh that's something that should not be uh publicly available at least that's what people's you know understanding is and it did everything the the email you read uh basically asked for as well like i've been watching you uh view porn basically i have videos of you i've hacked into your webcam now you need to send Bitcoin to this address.

8:13And we covered it a motherboard like a little bit, I guess. I think I looked at like how much money maybe some of these scammers were getting. And, you know, and then the BBC did it a few months later or whatever. And that really grabbed people's attention. I don't just mean from the people who opened the email, but sort of the media's attention as well. Well, oh my God, they're extorting people with their own passwords. But it felt a bit silly at the time because, of course, we know how readily available passwords are with services like, have I been pwned? Or, well, you don't get the password like that, but it shows the exposure rate and just the amount of data breaches all over the place.

8:51Gotta admit, having your address there is something else, you know? And that's scary, right? yeah it's like the the address combined with the photo which i assume um is from like google maps or something that gets screenshot and it also has the person's name later in the letter like it's it's like blah blah blah and then it says they're like addresses you by name so it's like it's pretty customized i know it's pretty personalized i would say it's pretty advanced like someone put a lot of effort into this the word like the the conversational wording is very true to how someone would write a letter it's not like someone used ai or something to write this it's like very like realistic um so when i first got it i was like oh my god like or when i first looked at it it was like oh my god like this is like like you've definitely got your shit exposed uh well which addresses are everywhere to say though, Sam, is like, you say that AI wasn't used to do this, but very often the types of people who are scamming this are often in other countries and often English isn't their first language.

10:00And so that's kind of how you identify it. It's like, oh, this is like fully broken English. Like, it just doesn't seem real. And I wonder if they are using like AI to make something that reads a little bit more real. Yeah, maybe. It could be. If you told it to be like a competition. We can't say either way. Yeah, but I just... Because I think personally that like AI is going to lead to better spam and better scams like this. Even if an average person would be able to be like, okay, this is like... Or even if we would be able to tell like, hey, this is AI. like someone who's scanning for oh is this like in the english language is it was it written by someone who like plausibly has command of it um i feel like this passes that test as you said um and i wonder if they're using some sort of like ai prompt to do so yeah i mean when it comes to how it's been made obviously have to speculate a little bit but my guess is that they they just have some sort of database which has a person's name, a person's email address, and a person's physical address.

11:19And unfortunately, that is actually not that difficult, either from a data broker or a data breach. Or you go to these underground services, which combine that already for you. Like you can go to Telegram, you can search through a service, and it will basically aggregate all of these breaches, all these sources at once. And you can dox people very, very easily with that we've done that before i think someone has access to a database like that they have the script which is basically what sam read out or paraphrased right and then you're just saying well substitute the name here put the address here and then presumably like a google maps api call to well here's the here's the address please type that into google via the api and return the street view photo for me uh i agree sam like looking at the photos it looks like it's grabbed from street view or something like that right and if that's the case which just seems like occam's razor like the most likely one you can do that very very quickly and at scale and we definitely don't have numbers for how many emails have been sent out but i feel like people are talking about this like you got one somebody else sent one to me i saw a little bit stuff on mastodon that have you heard of anybody else getting it as well or is that just the one you saw and i've seen mine or um i like i as i usually do when i'm trying to figure out how prevalent something is um i looked i read it and i like searched some of the phrasing from the um from the email and lots of people were talking about it like within like less than 24 hours of the one that I saw it was like lots of people on reddit were talking about it and talking about how they almost fell for it or like it really scared them or they still weren't sure if it was like real or not maybe they were like holding on to like maybe this is actually someone targeting me um yeah and like it's definitely I mean just in the last like week I would say more people have been talking about it.

13:20So yeah, it's like, they've definitely, they found a new trick, the scammers have. Well, yeah, like I know two people personally who have gotten this, like extended universe, but people who I've met in real life who have gotten this and have asked me about it. This was like after Sam wrote her story, so I could just point to the story. but then a reader also sent us some or a reader also got it so I get it so it's a new wave for sure yeah and Brian Krebs I think reported on it as well and I should say that just while we were talking at the start I actually brought up one of the examples that someone sent me I then searched for the relevant Bitcoin address just on blockchain.com, you know, very easy tool for exploring the blockchain.

14:16And the address has received zero Bitcoins. And like, you may not be surprised by that, but that kind of shows me that potentially this scammer is using a different Bitcoin address for each victim. Like, I feel like somebody has probably fallen for this somewhere over the past week, 10 days or whatever, right? So the fact that there's absolutely nothing has ever hit this Bitcoin account makes me think that they're generating addresses, if not per victim, at least for like a large group of victims or something like that, and nobody's bitten yet, which is going to make it a little bit harder to figure out the actual impact of this.

15:00I'm sure like a firm like Chainalysis or whoever, which have way more visibility into the blockchain than me just searching on blockchain.info could figure it out. But I'd be interested if anybody listening does know anybody who received it and who did send them cryptocurrency. You know, let us know. I think more broadly, we haven't talked that much about the problem with sextortion on this podcast before and we don't need to get deep into it. But it definitely does work and it's really terrifying. I know people who have done it, who have like to send the money. And often that's not where it ends.

15:39It just becomes like a nightmare situation. They very often like prey on teenage boys as well, like specifically. And there have been cases of like teenage boys getting this, thinking like, oh, the fact that I watch porn is going to be outed to my mom or something. And there have been cases of like teenagers killing themselves over this. and there have been a couple high profile FBI extraditions of people who run these rings. So it's like a very bad crime and it's a very, I think it's a pretty effective one, unfortunately, because it does prey on people's insecurities. Well, yeah, I mean, especially with the teenage boys example and sometimes in those cases, the extortionist actually does get compromising material because they will pretend to be like a young girl or someone of the same age or whatever, and they will engage them and they will tell the victim to put themselves in a compromising position and film it.

16:47And then they actually do have compromising material. They add the family and friends on Facebook and they start distributing it or threaten to do so. I mean, that's terrifying. and you can see why people would pay. But to be clear, that's not happening here. If you get this email, you're okay, you know? But it's definitely part, as you say, of a broader trend and it does work because, I mean, what's going to be more sensitive than that is terrifying. All right, we will leave that there. When we come back, we're going to talk about one of Jason's stories about the right to repair your own body.

17:19There's some amazing quotes in this one. I'll say that. We'll be right back after this.

17:32we all know home-cooked meals are so much better for you but you don't always have time to pull it off but with hello fresh handling all the meal planning shopping and most of the prep it's easier than ever to get dinner on the table quick and painless plans change and life gets busy that's why hello fresh lets you easily customize your delivery from week to week Tailor everything to your schedule by adjusting your delivery date or just skip a week when you're not able to cook at home. Between being sick, travel, and generally just running around, I've saved time and energy by using HelloFresh's quick, easy, and delicious recipes.

18:10A recent Cavatappi beef ragout with parmesan and parsley was a hit with me and my family, and I was able to put together the home-cooked meal in just about 20 minutes. For free breakfast for life, go to HelloFresh.com slash free 404 media. One free breakfast item per box while subscription is active. That's free breakfast for life just by going to hellofresh.com slash free 404 media. HelloFresh, America's number one meal kit. This episode of the 404 Media podcast is brought to you by BetterHelp. I've made it a personal goal to always be learning. As adults, it's so easy to get stuck in a rut and lose that curiosity we had as kids.

18:54So I'm always seeking out new hobbies that keep me on my toes. Stuff like surfing and learning new languages, meeting new people. A few years ago, I found therapy and I realized it could help keep myself open to new experiences. I'm someone who struggled a lot with anxiety and therapy has really helped me understand my body and my mind. And it's really taught me coping skills for working through stressful situations. One thing I really like is it's helped me see the joy in trying new things, not just the anxiety it can bring. If you're thinking of starting therapy, give BetterHelp a try. BetterHelp is entirely online, convenient, and flexible, so it fits really nicely into busy schedules.

19:34Fill out a questionnaire to get matched with a licensed therapist. Rediscover your curiosity with BetterHelp. Visit betterhelp.com slash 404media today to get 10 % off your first month. That's betterhelp.com slash 404media. betterhelp.com slash 404media.

20:05All right, and we are back. Jason, you wrote this one. Right to Repair for Your Body, The Rise of DIY Pirated Medicine. So there's a lot to dive into here. Let's try and keep it concrete and easy to start. Who is Dr. Laufer and what is he well known for, Jason? Yeah, so Dr. Michael Lauffer is the communications head of 4 Thieves Vinegar Collective. For all intents and purposes, he's the only public facing figure of this collective. It's an anarchist, like DIY, open source everything collective made up of chemists and doctors and this guy, Michael. and basically their goal is to open source already available pharmaceuticals and teach people how to make them themselves.

21:03This sounds insane. It sounds really dangerous, first of all. It sounds really difficult, second of all. It sounds like impossible, third of all. But it's not necessarily any of those things. I mean, to be very clear, this group doesn't tell people to go and make their own medicine. But they're looking at it through a medical freedom lens where it's like medication is incredibly hard to get sometimes. Sometimes it's very expensive. And a lot of it is under patent. And a lot of it is really hard to get um so some people are desperate in the united states unfortunately um and you can end up spending thousands upon thousands of dollars where this collective is like we're going to find ways to make that medication um way cheaper like sometimes like a pill costs like cents rather than yeah so the the big one that they just announced at defcon was sofosbavir which is a hepatitis C pill that an entire treatment of costs$84 ,000.

22:19And it's a cure for hepatitis C, which is a very bad disease. And normally with the virus, you can only treat it, but this like actually cures it. And they were able to make it for$70. He initially told me he thought it'd be $300 for the full course. But after they made it, it was$70. So 83 cents a pill instead of $1 ,000 a pill. We're talking like orders and orders of magnitude less. And I've done some reporting on Big Pharma in the past. I did a big story at Vice many years ago about cystic fibrosis and cystic fibrosis medication. And the line, like the popular line is that the first pill cost a billion dollars to make and the second pill cost five cents to make.

23:12It's like all of the money is spent on that basic initial research. But then these medications stay under patent for a very long time. And so once a new medication is made and approved and pushed through the process, a drug company might spend millions or in some cases like billions of dollars depending on what it is. I don't know if they ever spend billions, but it's very often like high millions. And then they have a patent for X number of years and then they have essentially the ability to charge whatever they want for it. Right, they're the only ones making it, basically. They're the only ones making it.

23:52They charge whatever they want for it. They're trying to make that money back. And then they're basically trying to make their money back until it can go generic after the patent expires. And so if you have a medication that's under patent, it's like, you know, if you don't have insurance, if you're underinsured, like you may have a really bad medical condition, but you, and there might be a medication that can help you, but you just don't have the ability to get it. And that is the problem that they're trying to solve. I think that, first of all, like they are trying to show that this is possible.

24:28I think it's like, is the average person going to be making pills in their garage? Like, no. But is a trained chemist who is able to buy the precursors and understands this stuff, like able to prove that they can make it for two cents a pill? Like, maybe. And then I think that in and of itself is valuable. and some of the public shame that comes with that can help in getting these things decreased in price. Yeah. There's a couple of really interesting quotes. This first one, I think it sort of encapsulates what they're doing. Dr. Lauffer says, we don't invent anything really. We take things that are on the shelf and hijack them.

25:15We like to take something established and be like, this works, but you can't get it. Well, here's a way to get it. Yeah. Pirating the medicine, cloning it, making it more available. And then I think my favorite quote from one of the slides, his DEF CON talk reads, isn't this illegal? Yeah, grow up. I need to have more of that energy in my work. But so how exactly do they do this? Because they have to figure out how to clone, what to clone, what to pirate in the first place. And it seems like they've actually copied or forked in a way some of the technology to do that as well. Like, is that fair?

26:00Yeah. So basically there's a database, I believe it's called the Smile database of like molecular structures. sort of show you like, here's the elements, here's like what you need to make. And as part of the patent filing process and part of like getting through the FDA approval and all that, drug companies need to make that public. So they're like, this is made out of this hydrogen bonded to this oxygen, blah, blah, blah. They have to show the chemical structure in this database. From that chemical structure, they can plug it into a tool that they created called ChemHactica. And ChemHactica will basically reverse engineer different reactions that will create that molecule, if that makes sense.

26:51And I will explain how ChemHactica works. ChemHactica is a fork of an MIT DARPA project called ASCOS. So basically, it's like an open source project that MIT and DARPA made that was like, here's how you make different chemical compounds. It uses machine learning, it uses AI, like, you know, good uses of AI, good uses of machine learning. And this is how like a lot of drug discovery is actually done these days. It's like a chemist will have an idea for a compound that they can make. And then they will, you know, use a simulation to be like, oh, will these materials doing this reaction, will that work?

27:36and that's what ASCOS does. ChemHactica makes it like a little more user-friendly, and it also is like designed for a home lab versus, you know, like a university or pharmaceutical research lab. So that's the first part of it. The second part of it is they have something called a micro lab, which is the DIY chemistry set, for lack of a better term, that you can then use to make these things. And so they basically open source how to build one of these. They have a parts list. They have instructions for building it. They have like, here's how to make sure you know what's working. Here's some basic recipes that you can use to ensure that it's working.

28:23And so let's say you wanted to make a pirated version of a pharmaceutical. You would use ChemHactica to figure out the base materials that you need, many of which you can buy legally online, the type of reaction that you need to do to do that. And then you can build essentially a recipe using what 4thies has created and use the micro lab to not automate all of it, but it automates a lot of it. And right now, they're only doing a few different specific medications. It's like Sovaldi, as I mentioned, which is a compound called Sofospevir, the hepatitis C1. They also do meso, which is... What is meso?

29:16It's one of the abortion drugs, but I forget the full name of it. Which they spoke about previously, yeah. Yeah. They distributed it potentially. And they've been distributing that. It's like a chemical abortion pill. And they've been putting those on business cards, like little droplets of it, and putting them in states where it's very hard to get these or where abortion has become criminalized to some extent. They've also done it with Daraprim, which is Martin Shkreli, Pharma Bros, like HIV medication. So they've made that much cheaper. And they've also done it with EpiPen. so they have chosen these drugs that have been in the news for having like astronomical prices and like uh big pharma ceos who have been like accused of price gouging and stuff like that didn't they show you how easy it is to sort of figure out the the makeup of a particular drug i think you had a phone call right but like what just briefly sort of what happened there Yeah, so I video chatted with Michael Laufer.

30:30And I was telling him, I'm interested in this because my best friend died of cystic fibrosis when she was 25 and I was 25 also. And cystic fibrosis is a genetic disease that affects the pancreas, the lungs, a lot of other things. And there's like many, many, many treatments for it. Um, but a lot of the treatments are maintenance treatments and a lot of them are very difficult to get and they're very expensive if you don't have good insurance. And my friend didn't have great insurance always. Um, this was like pre Obamacare for much of it. And it's like she, once she fell off her parents insurance, it was hard for her to work.

31:13It was hard for her to get health insurance. And so she was like fucked at different times. and during this period there was like a miracle drug called Kalydeco that was introduced by Big Pharma that was like one of the best treatments for cystic fibrosis it actually didn't it wouldn't have worked on my friend which has made this like a little bit easier for me to handle because it was like it only treats a specific type of cystic fibrosis that she didn't have but this drug cost$300 ,000 per patient per year to take$300 ,000 and I was so that's the big story that I wrote at vice like I explained how this drug cost so much money it was funded mostly by the cystic fibrosis foundation which is a charity that she was actually very involved with and it It was like this drug company got funding from a quasi-public charity and people still can't get it.

32:24And so I was like, have you ever heard of this drug? I asked Michael if he'd ever heard of the drug. And he was like, no, I've never heard of it. I don't know about it. And he was like, let's take a look at it. So he pulled up the chemical structure. He put it into this system, ChemHactica. and I watched in like 30 seconds. It had two different methods for how you would make this compound and the cost of the underlying materials and the yield and all that sort of thing. And he was like, I'm not an expert in this, as in he has chemists on his team that would need to verify all of this stuff. But he was basically like, you could make this in an afternoon and it would cost you nothing to make.

33:13It would cost you like less than$100 to make. So, I mean, that's just like one very specific example, but there's so many what are called orphan diseases where there's not a lot of research into making new drugs. And when there is research, like when these diseases have new drugs made for them, the prices are usually astronomical because the potential patient base is very small. It's for these like rare diseases, basically. So I know that was a very long answer. I know I'm rambling. I promise mostly because of the COVID. But I mean, that's a startling example of like in 30 seconds or whatever, he's able to go, oh, this is how you would make it.