The (Hacked) Spy In Your Car

0:03Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist-founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Getting access to that content at 404media.co. I'm your host, Joseph, and with me are two of the 404 Media co-founders, the first being Sam Cole. Hello. And the second being Jason Kebler. Emmanuel retired after last week we attained top podcast status and he's done you won, you beat him so I haven't listened to the episode yet but I get the emails actually I'm not really sure how I saw it but someone commented on the podcast saying wow I love this episode because it was just Jason and Emmanuel last week I love this episode it was almost like two kids without their teacher being there?

1:09Was that the vibe? That was the vibe, first of all. And second of all, it wasn't just one person. It was like dozens and hundreds of fans being like, Oh my God, you dropped the dead weight. Get him out of here. Should we just leave, Joe? Should we get out of here? I'll do the solo pod this week. We did miss you. We did miss you. But there was, I believe, two people who enjoyed the podcast. well now now it's double our numbers yeah am i like a tyrannical host i mean i keep the pace going i'm just trying to be you know well that was that was the running bit is that we were like we're gonna have let this segment go for like two hours um but in the end the podcast actually was about the same length as always i feel so yeah yeah uh well speaking of moving along quickly and being a tyrannical host.

1:59Here is the first story. It is written by me, but Jason's going to help me out with the questions. The headline is, this company turns dashcams into virtual CCTV cameras. Then hackers got in. Yeah, so this is, I guess, a follow-up story to a scoop that you had a few weeks ago, which we'll get into. But I guess to start things off, what is Nexar and what do they sell? Yeah, so I'd never heard of Nexar until our earlier story, which involves Flock, and we'll get to that, the surveillance company. But what Nexar does is that it sells these dashcams to ordinary drivers. So let's say you're driving around and you just want to have some record of what happened if you get into an accident.

2:48They do that sort of thing. They also market the dash cams specifically to rideshare drivers so uber lyft uh whatever and those cameras will look outwards obviously uh at the road in case there's a crash but they'll also look inwards presumably for driver and passenger safety as well in case anything bad happens uh in the vehicle during the ride so they sell those sorts of things and i imagine that some listeners might even have a Nexar dash cam in their vehicle. I got lots of comments and emails from people saying, wow, I had no idea this happened. I'm a Nexar user, blah, blah, blah. That's the normal business.

3:32The other thing that Nexar sells is kind of like a data broker business where they take footage generated or, you know, streamed from these dash cams. They upload it to a public map that anyone can access. And what Nexar does then is that it basically uses AI or machine learning, something like that. They don't really specify too much to identify things inside that image. So you'll click on this map and you'll bring up an image taken from somebody's dash cam. It'd be like, oh, there's a road sign here. That means there's lots of traffic here. Oh, there's roadworks here, for example. You know, maybe that's going to be useful information to somebody else as well.

4:18and Nexar then sells that data to a bunch of other companies. You can see they're basically trying to do both sides of the transaction. They're trying to sell the hardware to ordinary drivers. And then all of this data that's being collected, why don't we monetize that as well? I really wonder if these dash cams are a loss leader. As in, I looked up these Nexar dash cams and they seem like they're pretty good cameras. I'm like, wow, these seemingly have a lot of features. and they're quite inexpensive. And so I'm not an expert in dash cam economics, but it seemed to me I was like, this strikes me as data is probably their main business.

5:03And I feel like when you first discover them and wrote about them, and again, they're a huge company, but I guess it was a company that we hadn't reported on before. I was pretty... It makes sense. I guess what they're doing makes sense to me. It's almost like a distributed Google Street View vibes in terms of what they're creating. And I don't know, it's pretty alarming. But anyways, tell us about that first story. You wrote about them, I think maybe like a month ago or so, about a partnership that they were doing with Flock, or at least that they're planning with Flock. Yeah, something like that a month ago or a few weeks ago.

5:49And so regular listeners will know we cover a lot, a company called Flock. Now Flock has AI enabled cameras all over the United States. It's they continuously scan vehicles that pass by them as part of a surveillance capability called ALPR, automatic license plate recognition. And you drive past a Flock camera, it will get the plate, obviously, but also the color of vehicle, maybe the model or the brand, potentially the condition of the vehicle as well. So it gets all of this data. And then what Flock does is it sells access to that to law enforcement. We've done a ton of coverage now where we found that local cops were doing searches inside Flock on behalf of ICE.

6:41then Jason did something about how Customs and Border Protection actually had direct access to 80 ,000 of these cameras as well and then we also found that a Texas official did a nationwide search on the Flock network for a woman who self-administered an abortion. Again regular listeners will know that that is what Flock is. What I reported a few weeks ago as you say was that Flock is exploring a partnership with Nexar. I got this through sources, confirmed it with the company, wrote up that article somewhat quickly. And that was, of course, interesting because Nexar has all of these dash cams in all of these vehicles, and it's trying to partner with Flock, whose business is selling basically intelligence to law enforcement.

7:33I want to stress like we don't know exactly what flock wants to do with the data what it plans to do with it and again it's only exploring it at this point and that's why it was described to me by sources and then um by the company as well but that's how nexar originally got onto my radar is that well they're planning to integrate and partner with this fairly controversial surveillance company which brings up all of these questions about well what are they going to do with this dash cam footage, you know, which is a totally fair question to ask, I think.

8:18Fall is planting season. Did you know that many plants and trees actually do better when planted this time of year? But you have to know where to start. That's why I love fastgrowingtrees.com. Doesn't matter if you live in the sunny south or if the air is getting chilly where you are, their plant experts can help you find the perfect fit for your space. I love plants, but I don't feel like I have a green thumb. Whenever I go to the hardware store or a nursery, I feel like I spend half the time googling whether any given tree or plant is going to thrive in my yard or home. Then, surprise, surprise, I buy the wrong thing.

8:54I don't know how to take care of it, and a lot of them die. Fast-growing trees, on the other hand, makes it easy to start your dream yard. Order online and get your plants delivered directly to your door in just a few days without ever leaving home. Their alive and thrive guarantee ensures your plants arrive happy and healthy. And I found their website incredibly useful when trying to determine which plants I should buy and which would do well in my particular situation. I picked up a citrus tree that is going to grow fast and which I'm hopeful will give me the fruit I've always wanted to grow myself.

9:28Their 14-point quality checklist ensures you're getting the best quality plants possible. And they have more than 6 ,000 types of plants. They're more than just trees. This fall, FastGrowingTrees.com has the best deals for your yard, up to half off on select plants and other deals. And listeners to our show get 15 % off their first purchase when using the code 404media at checkout. That's 15 % off at fastgrowingtrees.com using the code 404media at checkout. Now's the perfect time to plan. Use 404media to save today. Offer is valid for a limited time. Terms and conditions may apply. Check out the link below or in the show notes to support the show.

10:11Do you struggle with procrastinating saving? You know, when you put off doing something that could save you a ton. I used to be a huge procrastinator until I heard about Mint Mobile's best deal of the year, but it's ending soon. 50 % off unlimited premium wireless for new customers. Stop overspending with big wireless and cut your wireless bill to$15 a month when you switch. All Mint Mobile plans come with high-speed data and unlimited talk and text on the nation's largest 5G network. You can bring your current phone and your phone number on any Mint Mobile plan and bring along all your existing contacts.

10:48Don't miss out on three months of unlimited premium wireless from Mint Mobile for$15 a month. But hurry, because this deal ends September 22nd. Listen to me and stop being a procrastinator. Once I switched to Mint Mobile, the only thing I noticed was a lower bill. Quit stalling and start saving when you make the switch. Shop plans at mintmobile.com slash 404media. That's mintmobile.com slash 404media. Upfront payment of$45 required, equivalent to$15 a month. limited time new customer offer for the first three months only.

11:33Right. So anyways, you write about this company's plans to partner with Flock. And then soon after, as seems to be the case often, you get another tip because we've signaled to people that we're interested in writing about this sort of thing. And so you had a source reach out. And it turns out that this company was hacked. What was the hack and what was compromised? A lot of really, really sensitive stuff. So maybe just step back and walk through how it was done. This hacker who reached out to me, they found that every Nexar dash cam, at least as they described it, contained a key to an AWS bucket, Amazon Web Services.

12:20This is, you know, very common internet infrastructure. You'll be running a company, you need to store a bunch of data, you will pull it in an AWS bucket. This hacker found that the key to access that database inside all of these NexR cameras didn't only allow that individual camera to upload its own footage, which obviously it needs to do, it needs to be able to access Nexar's servers, right? They found that the key had two high privileges in that it allowed a third party, a hacker or somebody else to actually access everybody's dash cam footage, which is obviously really, really bad. And they found something like 130 terabytes of video inside this AWS bucket.

13:13They didn't, as far as I know, download all of it. Obviously, that's an absolute ton of data. They didn't send all of it to me either. They, of their own accord, just downloaded, I think, a dozen, maybe a couple dozen videos and then sent them to me for verification purposes. And crucially, that public map I was mentioning, which has sort of the Nexar dash cam footage and it shows a road sign and road works or whatever, those are blurred and anonymized somewhat. Nexar blurs the actual dash of the car in case there's identifying information on there. It blurs faces and also blurs license plates of other vehicles shot in that vicinity.

14:02These videos that the hacker accessed were not blurred at all. This was basically the raw footage taken from these dashcams all over the States. Maybe they're all over the world, but I think the vast majority of the ones I saw were definitely in the United States based on the locations and license plates, that sort of thing. So just to clarify, the blur happens at some point after being recorded, obviously. but they were getting it like pre-blur. The hacker got this in like pre-blur. So that was one of the reasons I was really interested in the story was that you go to Nexar's privacy policy and it says, hey, all of the blurring and the anonymization happens on your device.

14:49So even we can't see it. I'm like, well, how does the hacker have all of this non-blurred imagery then as you're reporting a story, more information comes to light. And how Nexar described it to me was that, yes, the blurring does happen on the camera. It's uploaded to one bucket. What the hacker had accessed here was the backups of the individual user. It was basically almost the dropbox of the individual user. So it does appear that, yes, they do blur and anonymize on device as they claim in the privacy policy. But there's this other database which has it as well because these people want to back up their footage as well.

15:33Got it. That's very wild, though. I feel that's very wild. So what types of videos are in there, though? This is sensitive data in that you're getting people's license plates. You might be getting identifying information from their dashcams. but like what sorts of things did you see? Yeah, it is very much what you would expect. A lot of cars driving on a lot of roads, a lot of other cars in front of them. That's not really surprising. I would say there was more information in there than you might expect. For one example was clearly somebody answering a call on FaceTime. You know, there's that very distinctive sound on Apple devices when you pick up a FaceTime call.

16:21I heard that. And then somebody having a conversation. In another example, someone was in their car with a crying baby. I didn't have the full context of what was going on. But obviously, you know, that's a private moment where you don't assume a camera or a hacker may be listening in or a journalist after the fact. And then there was one where, again, I mentioned the Nexar markets these cameras to rideshare drivers as well. The camera was pointing inwards to the vehicle. You could clearly see the Uber or Lyft or whatever driver, and then the passengers get in and they're having a conversation.

16:59I can hear everything they're saying very clearly. I can see their faces very clearly. I could probably make out where they were just picked up. So this is all information that, sure, maybe it's okay that your Uber driver knows where you got picked up or whatever. I don't think you anticipate there's a camera in there which is uploading to a server which a hacker has accessed which has then been sent to a journalist and of course this hacker was acting um somewhat in the interests of the company and i'll reframe that slightly in that they didn't steal this data and post it on the internet they came to me because they were considering about well how do i get this fixed and often hackers or information security professionals will do that through a journalist because the companies will actually fix the issue.

17:47And this wasn't actually in the article. I learned this maybe a day or two later, but somebody who I already know who's done research that we've covered before, they said they also found the same vulnerability. They reported it to Nexar before all of this, and they never received a response, and it was not fixed, clearly, because the hacker got all the videos and sent them to me. I mean, I feel like people have really... People talk shit in cars all the time. If you're able to hear the conversations that are happening in a car, it's like, I don't know, you go to a party and then you get back in the car with your partner or whatever.

18:25And you're like, Oh my God, can you believe that person said this at this party? And I don't know. I feel like that's a very universal experience. I feel like that's been part of various sitcoms and things like that. It's such a trope. And the fact that if you had one of these cameras set up in this way, it was recording and then uploading, as you said, to a cloud bucket that a hacker was accessing. It's really, really sensitive stuff. I'm pretty, it's pretty alarming. Like there's not that many hacks these days that I find to be surprising, but this one is pretty big. Yeah, I feel we've seen, we've seen every single sort of hack you could possibly imagine.

19:04And oh, well, they found a new one. They found a new type of hack. Yeah, yeah. Yeah, we said a lot of top secret stuff when we were in Sam's car. a few weeks ago. I recorded all of it. It's all on video and tape, waiting for the right time to release. But yeah. Yeah, exactly. So this is bad for the individual users, the people who may have been saying unpleasant things about their loved ones after a party or whatever. But there's national security concerns here as well. Can you talk more about that? Yeah. So it's like a whole other dimension to the story. Like any one of these would have already been a story.

19:47Like it already would have been an article, hey, there's a map and this company is uploading anonymized footage from it. And I spoke to multiple Nexar users and asked them, hey, did you know this map exists and maybe your footage is on there? And they had no idea. That's already a story. Then you have the hack. Obviously that introduces another dimension. Then on top of all of that, some of the dashcams are clearly owned by people who are either visiting or work at very sensitive US military intelligence agency facilities. And I won't go through all of them, but there's some US military ones, Air Force bases, all of that sort of thing.

20:27I'll focus on the CIA one. So the hacker was able to find through that publicly available map, hey, there's a car which is going to the CIA's headquarters okay that's kind of interesting the hacker was then able to find the unredacted the unblurred footage from that driver in the hacked aws bucket they could do this because i think every video has a unique user id like it has the user id then some other sort of identifier so you can figure out well that's from the this user that's from this user etc they did that and it showed this person taking the turn off, I think, the parkway, not quite a highway, towards CIA headquarters.

21:11And then they clearly take the dash cam off the dash and they put it somewhere hidden in their vehicle, I presume, because the policy is that at CIA, hey, if you have a dash cam, please don't drive with it right into our facility. That said, one of the images on the publicly available map is way closer to the facility than the unredacted footage was. So why does that matter? Well, somebody is driving into or near this rarely sensitive facility, and maybe at some point they screwed up. Maybe they drove in and their dash cam was still going. Again, I only saw a tiny sample of these videos. But if this person is going to CIA every day, every week, like whatever.

22:00They're a contractor, maybe they're a worker there, who knows, right? But if they've screwed up even once or a few times, hey, that could be beneficial. Now, I'm sure Russian and Chinese intelligence operatives don't necessarily need a hack of a dash cam installed in people's cars to get that sort of information. But I don't know, maybe a lower tier country might need a lower level intelligence service. But regardless, it's not good that these cameras are in people's cars who are affiliated with these sensitive facilities, and the hacker was able to get into them. It's pretty straightforward. And then the companies that buy data from Nexar also potentially have a reason to be concerned.

22:46yeah so we didn't know again right at the top it was we were mentioning nexar sells these dashcams but also sells this data basically generated from them and the hacker also got this list of companies which at least have expressed interest or there's they've had a dialogue with nexar some of them when i approached them for comment said you know we've we've never we've never had a relationship or some said we only evaluated it and some did say that they actually used it but there's a lot of companies in there Microsoft Apple Google a bunch of AI companies I mean the Apples and Googles you would especially the Googles you would obviously expect because Google Maps is updated obviously with roadworks information and traffic data so you could see how that could be useful the a bunch of AI companies as I said and then one of the more interesting ones to me was Niantic, which is the Pokemon Go creator, which has...

23:46Owned by Saudi Arabia now. I was going to ask, could you just briefly, to close us off, just explain what that... And I'm not saying this footage is going to Saudi Arabia, blah, blah, blah. I just think that's an interesting thing that people may have forgotten about. Yeah. I mean, it was a few months ago and I haven't... I did write about it at the time, but basically the Saudi... A company that is owned by the Saudi Foreign Investment Fund, Sovereign Wealth Fund, that's what it's called, bought Pokemon Go from Niantic. And so, yeah, it's now tied to the Saudi government in some way. That's just, I don't know, another layer to this, as you said, it's like lots of companies touch this.

24:28So yeah, I find this whole thing to be incredibly fascinating just because it touches so many different companies, so many different attack surfaces. I find the dash cam, the concept of dash cams to be quite interesting. I understand why someone would want to have one for safety reasons. And also, people drive crazy. And it's needed often to establish fault in crashes and things like that. But if you have one that's connected to the internet and that's streaming to these servers, being used to create big data, stuff like this can happen. Yeah, absolutely. And I think that if you're a listener and you use an XR dash cam, I mean, let me know.

25:17And also let me know if you knew that this publicly available map maybe had your dash cam images in it. But yeah, I just think maybe drivers want to keep this in mind when they're putting on a constant, ubiquitous surveillance technology into their vehicle. All right. We'll leave that there. Thank you for running us through that, Jason. And when we come back, we're going to talk about Sam's reporting trip to San Diego. Again, only made possible due to 404 media subscribers. And the sentencing of somebody that she's followed for a very, very long time. A content warning on that one for sexual assault.

25:57We'll be right back after this.

26:12ExpressVPN is like tinted windows for your internet connection. You can see out, but they can't see in. Wouldn't you want the same privacy online? Because all of your traffic flows through their servers, internet service providers, which includes mobile network providers, know every single website you visit. And if you've been following our reporting, you'll know that a lot of that data gets sold to advertisers, surveillance companies, and data brokers. ExpressVPN reroutes 100 % of your traffic through secure encrypted servers, so your ISP can't see your browsing history. ExpressVPN is easy to use, works on all devices, and hides your IP address, meaning you can maintain your privacy without it impacting your life.

26:52Gone are the days where it's a huge pain to protect your privacy online. I use ExpressVPN to change my browsing habits for 404 Media's reporting purposes all the time. A quick click and I can show a website or service that I'm in another state or country that I'm actually in. But I've also started using it for my own privacy whenever I'm browsing the web. I feel like so much of our private activity is now for sale to the highest bidder and I don't want to make it easy for them. So I use ExpressVPN. Protect your online privacy today by visiting expressvpn.com slash 404media. That's E-X-P-R-E-S-S-V-P-N.com slash 404media to find out how you can get up to four extra months free.

27:34ExpressVPN.com slash 404media. This show is sponsored by BetterHelp. We've all been there. Asking a barista for life advice or unloading on a random stranger in a bathroom line. Is it helpful? Sometimes, but not everyone's a therapist and not everyone is equipped to help us with life's biggest challenges. That's where BetterHelp comes in. With over 30 ,000 licensed therapists, BetterHelp has been matching people with therapists for over 10 years. Here's how it works. You answer a short questionnaire about your needs and your preferences, and BetterHelp does the matching for you, drawing on their experience and industry-leading track record.

28:13If your first match isn't quite right, you can switch therapists at any time at no extra cost. Sessions are fully online, so you can connect with a therapist wherever you are. and even pause your subscription if you need a break. As the largest online therapy provider in the world, BetterHelp can provide access to mental health professionals with a diverse variety of expertise. Find the one with BetterHelp. Our listeners get 10 % off their first month at betterhelp.com slash 404media. That's betterhelp, H-E-L-P dot com slash 404media.

28:59All right, and we are back. Sam, as I said, you wrote this one. The headline is Michael Pratt, Girls Do Porn ringleader sentenced to 27 years in prison. How about I'm going to give the quickest summary of Girls Do Porn I can possibly do so we can get to you immediately talking about the new stuff and being in the Sandia courtroom and all of that. So regular listeners, again, may know Sam has covered Girls Do Porn for a long time. This was essentially, literally a sex trafficking ring operating in the open on Pornhub. Women would travel for what they believe would be modeling or similar jobs. They would go into the hotel room where they would be forced or coerced into having sex on camera.