This Podcast Will Hack You

0:03Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds both online and IRL. 404 Media is a journalist-founded company and needs your support. To subscribe, go to 404media.co as well as bonus content every single week. Subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm your host, Joseph. And with me is just one of the other 404 Media co-founders today. And that is Sam Cole. Yo, just me. just the Joe and Sam podcast today. And Matthew Galt later. And Matthew Galt later in the second section.

0:46I was going to do... What's that meme from the film, you know, Captain Phillips, when the Somali Pirates... Look at me, look at me. Oh, yeah, yeah. We've run the website now. Yeah, this is our ship now, baby. Exactly. Yes. So Jason and Manuel are out. They'll probably be back next week. And Matthew will join us in the second section. I'll just say very, very briefly, we mentioned this last time but we did run a survey to get a better understanding of frankly who are our readers not specifically but you know why do they come to 404 Media how did they get here that applies to the podcast as well and a lot of people replied and I think it's over for the moment I don't think we need to resume it at this time but thank you so so much to everybody who who gave us their anonymous information.

1:39It really, really helps us out better understand how we can serve you and maybe what coverage we can do and all of that sort of thing. It's going to take us a little while to go through the results, but thank you once again. Sam, do you want to take us through this first story as this one I wrote? Yeah. Yeah. So this is a Joe story. The headline is someone is trying to hack people through Apple Podcasts. I think it was probably a week and a half, maybe two weeks ago, or maybe longer. You messaged us at 404 and you were like, something weird is going on with my Apple podcast app. I'm being recommended things that I don't recognize.

2:24You were like, there's something weird going on. I don't know if it's just me or if it's a system-wide thing or if there's a hack going on. And I think everyone was kind of like, that's bizarre and so classically something that would happen to Joseph. So we were kind of like, yeah, okay. But you dug into it and it turned out that it was actually, there was something going on there. So do you want to just kind of explain what exactly you've been seeing on the app? Yeah, I think I only told you and the others at 404 Media weeks into me seeing all of this weird stuff. Maybe I just told you a couple of weeks ago, but it's been going on for months, really.

3:01And honestly, my first reaction was concern, worry, and potentially like, oh my God, is this something that's really, really bad? Is this humiliating or something like that? And of course, worried about the security of my device and that sort of thing. those worries did subside after i looked into it more and i and i spoke to an expert that we'll get to but yes what basically has been happening over the last few months is that i will go and unlock my mac the screen will come on type in my password or use biometrics or whatever the the mac will then open to the desktop the podcast app will have opened by itself and it will be displaying some random ass spirituality app education app um religion as well and i didn't know what to make of it as i said at first but there were a couple of different scenarios where yes i would unlock the device and then it would be automatically opened sometimes i would be using my mac and it would just happen in front of me and i'd be like whoa okay i guess the podcast app is open now and then in other cases the app would already be open but it would just seem seemingly random and i'm gonna guess it's not random but obviously for to an observer it looks random in that oh okay It's just opened this podcast now.

4:37So really confusing and eyebrow raising and just making me wonder, well, what the hell is going on here? Is this something bad or is this something just weird? Yeah. I mean, it's definitely never good when apps and software just starts opening on your computer without you initiating that. Well, it could be anything. It could be anything. It could be something bad. it could be something really bad it could just be i mean my macbook i'm primarily a pc user and my macbook is constantly opening what i think of as like trash like junkware which i would include a lot of the apple services in that and it just opens stuff by itself but what you were saying was like specifically certain kinds of podcasts like you said like the spirituality and religion which is not your usual fare um well also and and it's a specific and it's specifically specifically the native, quote unquote, legitimate piece of Apple software.

5:37Right. Like, again, as you say, you're on Windows and you're unfortunately used to there just being crap on Windows all the time. Either that from Windows itself or I don't know. I installed myself. Yeah, you installed yourself or I remember back in the day, I mean, I feel like it's less of a problem now, but like malvertising was just you go to the wrong website on a Windows machine and you're not blocking ads, you might be surreptitiously downloading software. It just sounds scary. So yeah, for sure. Yes, this was strange because it was the real Apple piece of software. Right. Yeah. And it was opening like this very specific, like what it was opening was weird.

6:16I don't know if you can even like tell me the names of these podcasts on them have actual names on them are like basically wingdings. But what were the podcasts themselves? Like what were they titled? I just tried to open one and it's not loading so maybe it got removed but I have this email in front of me I'm not going to read the whole one because I think people will realize that it's clearly a script or some sort of command but one of the podcasts is titled 5.dot slash xewe2 single quote, double quote, double quote ampersand hash x22 to and then it gets to on click alert and it goes through and it is clearly a command and you know i think we'll talk about that in a minute but another of the podcasts was uh it was actually in arabic and i can't remember off the top of my head it was something like uh life advice or something like that and there's a gmail address included in the title as well weirdly there was one called from somebody called lionel pimenta and then it had a specific url for a google play store app all in the podcast title and then probably the last one i think there were a couple more but i only documented um just most of them another one was called free will free will and then that had a direct link to some sermon website as well.

7:44So a whole, I would say, mix, very weird podcast, but not the usual stuff I listen to. I'm usually listening to video game news or Hollywood news. I'm not listening to religious sermons through Apple Podcasts typically. Yeah, Free Will, Free Will. That's a great one. I like that podcast a lot. I'm a big fan. I'm a top listener of Free Will, Free Will. and do they are there like did you try to listen to any of them do they actually have audio in them well free will free will does yeah i i played it and i know some people will be like oh you you were clicking around and stuff and it was because again looked into a bit and i felt well i do need to probe this whatever and i think it would be very crazy if you got directly hacked just by playing some audio you know and i don't think that's what's going on here as we'll see but that one did have some audio of someone just giving a sermon but then that that first one i mentioned as far as i could tell it was just silence there was there was nothing going on and these podcasts i should say they're like several years old some date from 2018 2019 uh 2021 so they're they're not 2025 2024 necessarily but they've clearly been co-opted in some way or some shenanigans are going on where these podcasts are all of a sudden being surfaced and basically thrust in my face i'm like the the simpsons smithers uh gif we're surrounded by women but it's that but with like podcasts basically you know it's horrible like weird spirituality nonsense podcast, spam podcast.

9:29I mean, these are like funny and dumb and like obviously so far pretty innocuous, but there was one that was less innocuous and a little more malicious than the others. Can you tell us about that one? Yeah, it was the first one I mentioned with that 5.dot slash XE one. Because it was like a command almost. Yeah, that's a command in itself. Yeah, but you would have to click on that or you'd have to run it. What was more interesting was that the same command was if you scrolled down on the podcast page and it has the little section in the Apple Podcasts app that says show website. So obviously for us, I presume it says 404media.co.

10:13I haven't checked in a while, but it probably says that. This one, it had a link to go to that command and maybe some listeners and I think readers of the article may have already figured this out but that was it appeared to be a cross-site scripting attack a xss attack now I remember again it sounds like we're reminiscing about hacking or something I guess we are because malvertising years ago was a big thing on windows I remember xss attacks being all over the place when I first started cybersecurity journalism in around 2013, 2014, where, oh my God, hackers used cross-site scripting to steal this data or to deface this website or something like that.

10:59And it was a really low-hanging fruit attack. It was basically what script kiddies were doing, which are very technically unsophisticated hackers, but they found a vulnerability in a pretty big website and how they're going to do it and get some notoriety. Or as our former colleague Lorenzo covered at Motherboard way back when where we used to work, XSS was the underlying vulnerability used in the MySpace worm. Do you remember that? Yeah. It was before my time. Yeah, I remember that. I did like my community college computers 102 project was about viruses and worms. and that was one of them. Can you tell people, I'm not expecting you to remember the specifics.

11:51I mean, I don't really remember the specifics. Do you remember? It was like... I think it was basically... Oh, it was named Sammy, right? Are you talking about Sammy? Yes, Sammy, who... Pretty famous hacker by this point who does lots of stuff. I think he was making himself everybody's top friend and would propagate through MySpace knocking the infamous Tom off the top spot and making Sammy your best friend on MySpace. And because of the way it works, it would just keep going, keep going, keep going. It was really sick. So, I mean, this Apple podcast thing, it's not there, as far as I can tell.

12:30But the link in the podcast kind of show notes, I guess, or page or whatever, goes to this page. And when you click it, It does say test XSS from this domain, which I think has the top-level domain of Ukraine, if I'm remembering correctly. It doesn't look like a fun website. I'll say that. And yeah, because there's two things. There's the random opening of the podcast and directing to weird-ass podcasts. There's then one of these is apparently being used to deliver or direct people potentially to a potentially malicious website. And that's sort of the more concerning part. Yeah. Yeah. I mean, it's just it feels kind of, it does feel a little bit old school in that way.

13:26But it's just interesting how a lot of these systems have become I don't know, they're more closed than they used to be but at the same time, it's like you can still get away with this kind of widespread. um and obviously i mean do you think it's like one person doing this or is it like it's like a known like kind of attack right i mean well i guess we should talk about the expert who talked about it because he kind of answered a lot of these questions for you or for us that um were a little bit worrisome you talked to patrick wardle um he's a mac os security expert and what was his diagnosis of the situation yeah so when i couldn't figure out what was going on And, you know, I can do a little bit of tech stuff, but I'm not going to be able to figure out what attack is going on or anything like that.

14:13So I thought of Patrick, who is a really, really, really good Mac OS researcher. He runs Objective-C, which is, I was going to say nonprofit, but I'm not sure if that's technically accurate. I'll just say organization. and he develops all of these mac os security tools so you can download one of the tools and it will tell you if any of your apps or any piece of software you've downloaded is trying to connect to the internet and you can block that forever so i do that all the time where i'll download like a text editor i need because it can handle like files of five or ten gigabytes or something we You often need that for stolen data.

14:57But I don't want that communicating with the internet in case it is sketchy. So I just block all connections from that piece of software, that sort of thing. And Patrick makes those and he makes them freely available for anyone to download. And he's covered malware a lot of the time. And I think more importantly, he just understands the Apple ecosystem a lot as he's fully focused on it. So I message Patrick, honestly thinking this is very much below his pay grade. He's like looking into serious stuff most of the time. And he very kindly got back to me and was actually pretty interested. And he said that, quote, the most concerning behavior is that the app can be launched automatically with a podcast of an attacker's choosing.

15:45He was very much focused on that. He did help me confirm, yes, it directs this weird ass site with cross-site scripting or whatever. But he was focused on that. And he actually, I don't think I even mentioned this in the piece or I did in passing, but he did a proof of concept where he sent me a link to a website that he controlled and it automatically opened the 404 Media podcast on my device without a pop-up. You know, like when you download Zoom or rather you click a link and it's like, hey, just confirming you'd like to open Zoom, it doesn't have that. It just automatically opens straight on the podcast, which he found pretty interesting.

16:29And I guess, this is me speculating, but I guess it's a usability thing where Apple is like, well, we don't want people to do two clicks to get to a podcast. We just want people to click once and listen to it, but that can be abused. The other main thing that Patrick said was that, you know slow down this this isn't going to be the biggest thing in the world he said quote of course very much worth stressing on its own this is not an attack but it does create a very effective delivery mechanism if and yes big if a vulnerability exists in the podcasts app so i think that's already interesting it doesn't mean as he says that oh my god there's this massive issue with Apple Podcasts, but there's something going on here.

17:19Yeah. So we're not panicking. We're not being actively hacked, is the good news. We're definitely not panicking. I should say that when I was going through it first, I was looking on Reddit for like, has anybody else reported this? And I couldn't find anything. And then Patrick looked on Twitter slash X as well, and he didn't find anything. But kind of what pushed me over the edge to actually finally get around to writing it up, because again, this has been happening for months, was that someone left a review on that really sketchy podcast with like one star saying, this is clearly a scam. How is Apple allowing this on their platform?

17:59And that signaled to me, oh, so it's not just me saying this weird stuff. That also made me a lot more confident in that this isn't some highly sophisticated targeted attack against journalists. And not that I thought it was that but not a pleasant thing to be happening when you were trying to figure out has someone really really trying to fuck with me uh or not but i saw that and then wrote it up but yeah i don't i don't think panic what came to mind for me was maybe last year or the year before there was a huge wave of google calendar spam do you remember that yeah i got a ton of it and i I still get a ton of Google Calendar spam.

18:42But yeah, it was a big uptick in it last year. Yeah. And it sucks. And it usually is, oh, random guy has put an event on your calendar and it includes links to their website or whatever. And Google... I can't remember how they fixed it. Probably a change in permissions or something. The ability for who can add something to your calendar. But they had to shut that down. That... For me, this podcast stuff is similar to that vibe where somebody is clearly fucking around and playing with the podcast app and sort of doing stuff to people, but it's not super alarming. That said, you know, if you could deliver, as Patrick said, if you could deliver malware to somebody on an iPhone or a Mac device through a native, pre-installed, probably always installed, nearly always installed official Apple app, that's pretty bad.

19:41Yeah. You talked to Apple about this, right? I assume you contacted Apple. Have they responded? They didn't respond for your story, I don't think. Did they? Well, I spoke at them. Not really to them. The first email, 26th of October, and then 27th when I got more, 5th of November, 10th of November, then I sent another email directly to a press contact I have at Apple and he never replied. yeah so Apple has not responded to any of this this is a great like because we always put like such and such company didn't respond or did respond or you know if they did respond we put it but yours it says Apple did not acknowledge or respond to five emails requesting comment the company did respond to other emails for different articles I was working on across that time which is like they didn't just not comment you know like the usual they ignored you for this Yeah, yeah.

20:42And I know that some editors would take that out. And I feel like I've done that before. And Jason or you or Emmanuel have taken it out because sometimes I can get a bit petty. But here, I think it's pretty important that, dude, there is this weird thing going on Apple Podcasts. Like, why can you not even say we're looking into it? Why can't you even acknowledge that? But I mean, Apple is Apple. They can be very difficult sometimes on PR stuff. Yeah, I don't know. A few people after it published, we published this on Thanksgiving. We were all pretty obviously offline during that. But some people emailed and they said, I think it's related to this vulnerability I found in 2024, blah, blah, blah.

21:26I haven't had time to go through those yet. I'll definitely go through those emails and sort of figure out, is there something else going on here? You know? All right. Should we leave that there? and I'll get Matthew. Yeah, go get him. All right. We'll be right back after this.

21:57I'm a bit of a last minute Christmas shopper. I'm sure you know the feeling. You need something fast. You go into the store, but the shelves are empty and you're all out of ideas. I'm really bad at getting gifts from my mom. I always wait till the last minute and I get her a gift card on Christmas Eve. Not this year. This year, she's getting an AuraFrame. AuraFrame is a digital picture frame you can personalize before you give it. Just preload it with your favorite family holiday moments and upload them when you order it. It even comes in a gift box so you don't have to worry about wrapping it.

22:31And if you make a few new memories during the holidays you want in the frame, just use the Aura Frames phone app to easily share them where they can be enjoyed all year round. You can't wrap togetherness, but you can frame it. For a limited time, visit AuraFrames.com and get$45 off Aura's best-selling Carver Matte Frames. Name number one by Wirecutter by using promo code 404media at checkout. That's A-U-R-A frames.com promo code 404media. This deal is exclusive to listeners and frames sell out fast So order yours now to get in the time for the holidays Support the show by mentioning us at checkout Terms and conditions apply This show is sponsored by BetterHelp The holidays are a time of traditions Whether these are family traditions you've had forever Or whether they're new traditions you've been starting This season is a good time to reflect on what traditions mean to you And to rewrite ones that aren't serving you or start new ones entirely.

23:32Incorporating therapy into your new or existing traditions can help you find joy this time of year or can help you work through what can be an overly hectic or lonely season. Close your year with clarity rather than chaos and form new traditions for yourself with BetterHelp. BetterHelp therapists work according to a strict code of conduct and are fully licensed in the U.S. It's a stressful time of year, so you probably don't have time to go therapist shopping. with BetterHelp you don't have to it does the initial matching for you using a short questionnaire it's 12 years of experience means they typically get it right the first time but if you aren't happy with your match you can switch at any time with more than 30 ,000 therapists you're sure to find one that's right for you.

24:15This December start a new tradition by taking care of you our listeners get 10 % off betterhelp.com 404media that's betterhelp H-E-L-P dot com slash 404 media.

24:39All right, and we are back this time with Matthew. The headline of this one that you wrote is unauthorized edits to Ukraine's frontline maps point to poly markets war better. This is a crazy story. People are really, really outraged in my mentions about it on various social media platforms. Good. Yeah. I think we'll get to it. We'll definitely get to your thoughts on it because it combines scamming, predatory behavior, and warfare all into one story somehow. Let's start with Polymarket. I think a lot of people will be familiar, but maybe some aren't. What is Polymarket for those who don't know?

25:29So Polymarket is what they call a predictive betting market. It's quite simply a place where you can lay money down on something that's got a binary outcome. will President Trump win the 2024 election? Yes or no. Which was a big one, obviously. Which was a big one. And a lot of people made a lot of money. Made so much money that the Wall Street Journal was profiling the people that made millions of dollars. A French guy. A French guy, yeah. It was really fascinating. When his family was like, you're crazy. He's like, I'm going to make a lot of money. And he did. He did. He made a lot of money.

26:05So that's very basic. That's what polymarket is. It basically allows you to gamble on everything, including the outcomes of individual battles in a war zone. We'll get to that. I'm just going to... Well, I was going to say we'll get to that. And I've opened up Polymarket to see what the bets are. The top one is actually a Russia-Ukraine one. As in Russia versus Ukraine ceasefire in 2025, yes or no. Fed decision in December, yes or no. ponderous presidential election. So yeah, you can bet on everything, basically, in current affairs or in the world. Maybe you don't know stuff off the top of your head, but do individual people make these bets or are they made...

26:51Oh, sorry. They launch these campaigns or is it Polymarket that does that? Do you know? I actually don't know off the top of my head. My informed guess is that But somebody launches it, and they launch it with a simple bet on the yes-no proposition. So they put like five cents or whatever on yes, and then other people can take the odds. And then the odds change depending on who's voting yes and who's voting no. Just based on everything else I kind of know about how Polymarket works, I think that's probably something like that. Yeah. And the creator of Polymarket, and I think Wall Street as well, they see it way more than a gambling platform.

27:37They actually see it as a source of information where you can sort of tap into the sentiment of certain populations or the wider public about what is actually going on here. And of course, that goes back to the Trump one, right? Where people say Polymarket called the previous election while all of these other polls were wrong, right? It's extremely fascinating. I think I'm going to half pitch you a story while we're on the podcast, in fact. Because I've been thinking about this a lot. Because yeah, the CEO bills Polymarket as the future of news. That's like one of his big taglines. And the reason that he says it's the future of news is that it's kind of this libertarian game theory mindset that I would say permeates everything on the platform.

28:23That if you put your money where your mouth is, it changes the nature of what you think is going to happen. If you're willing to put like five bucks on the presidential election instead of just your vote, or instead of just your social media clout, it's like, that's pure somehow. It tells you about the heart of a human being. Like, in that Frenchman's heart of hearts, he knew Trump was going to win. Right. And that's why he put all those millions of dollars on there. He was willing to put that money up in the endorsement of that political candidate. Yeah, it is very interesting. I don't know if I fully agree with all of the premises.

29:01Oh, I absolutely do not. So, and then people have been betting specifically on things related to the Russian invasion of Ukraine. as I said, there was one about the ceasefire and that sort of thing. So let's just get to the specific one you wrote about. This map that the article discusses, what is this map and who makes it? So I'm going to apologize first and say that my Slavic is bad. And I cannot pronounce Ukrainian or Russian words. So I'm just going to throw that out there at the beginning. So there's this think tank called the Institute for the Study of War that's been around for a while.

29:41It kind of made its bones tracking the movements of specific conflicts, like the literal frontline movements of specific conflicts in the Middle East. And now has what is kind of like the gold standard map of where troops are and where the front lines are in the war in Ukraine. Typically, they update it once a day around 1.30 p.m. And that map is the map that Polymarket uses to resolve its disputes about who controls what territory in Ukraine. Because it's a very reliable map. Because it's a very reliable map because it takes a bunch of different factors into account. It's kind of all run by experts.

30:26There is another map that's very popular called the Deep State Live Map, but that map also has like, it's kind of supported and tied in with the Ukraine Ministry of Defense. So it's kind of like, how much do you trust the people, like the self-reporting of Ukraine's MOD, right? Just the same as you wouldn't trust a map that's put out and supported by the Russian side, right? So ISW uses a bunch of different factors. They use open source intelligence. They read through all the Telegram channels. They look at what both sides are putting out in their propaganda to kind of suss out where the territorial lines are.

31:06and so like the way these polymarket disputes resolve and specifically the one that we're going to be talking about is around a city called Myrtlerod which is in Donetsk which is one of like the heavily fought over regions in the eastern portion of Ukraine that Russia like annexed and Ukraine has kind of been holding this city for a long time and it's been encircled by Russia and it's kind of people know that it's probably going to fall. And in fact, like a couple hours ago, Russia had put out like its own propaganda video showing Russian soldiers in the town square. But Polymarket had a lot of bets on this specific town.

31:47There's like over a million dollars worth of volume in this specific area, which is pretty unusual for these conflicts. Usually it's just like a couple grand that people are betting. Right. So the way, like every bet on Polymarket has a very specific set of circumstances that resolve the bet in one way or another. And when it's something like territorial control over a war zone, they pick like, they said, this cross section of streets, this part of the town, when it goes over to the Russian side, then this bet will be marked as resolved and the cash will pay out. So we'll Russia control this town by November 15th.