Episode 154 [START OF RECORDING]
JACK: I just heard about this thing called K&R insurance. I didn’t even know this was possible.
K&R stands for ‘kidnapping and ransom’. If you think you're a likely target for kidnapping and
people are gonna hold you until you pay a ransom, then this might be worth buying. Why do I know
this? I just ran across an article that said a guy was kidnapped in Toronto and held for
ransom. They wanted him to pay a million dollars, and then they’ll let him go. I think he paid it,
and then they dumped him off in a park and they sped off. Why did they kidnap him? Because they
knew he had cryptocurrency, a lot of it. He was the founder of a crypto-based startup, and if he
didn’t have the money, surely his company did. Well, at least that’s what the thieves thought,
and they were right. Scary stuff. (INTRO): [INTRO MUSIC] These are true stories
from the dark side of the internet. I’m Jack Rhysider. This is Darknet
Diaries. [INTRO MUSIC ENDS] JACK:
Let’s see, what are you using for a mic here? CONOR: SteelSeries headset. Is it bad?
JACK: It sounds good. CONOR: Yeah? Perfect.
JACK: So, are you ready to tell us about the worst time of your life?
CONOR: Yeah. I’m ready. JACK: It always seems so weird
to me to be digging into stories like this because it is — it’s probably a hard
thing to talk about, isn't it? CONOR: Yeah, it is, especially when
it just happened. But I mean, it’s been four or five years now, so, I’ve kind of
overcome it at this point. JACK: How old are you now?
CONOR: Twenty-five. JACK: Okay. So, I bet all this started
in a video game somewhere, didn’t it? CONOR: Yeah, yeah, it did.
JACK: What game was that? CONOR: Completely right. [Crosstalk]
Minecraft. JACK: Oh, okay,
I was gonna guess Minecraft or Roblox. CONOR: Yeah. There’s actually — they're both
involved at certain points throughout the story, so, that was a fantastic guess. [Music] Yeah,
so, it was really Minecraft where I got into everything. Ever since I was younger, I’ve always
had an obsession with computers and technology, and I was always kinda reserved when I was a
kid. So, a lot of the time I spent online and on computers and on video games. In my younger years,
that was Minecraft specifically. So, yeah, I used to play Minecraft multiplayer servers.
One day I just got bored and I decided to just join a server and start messing with people, which
I cruelly took enjoyment in at the time. JACK: So, messing with — is that
like griefing? CONOR: Just — yeah,
griefing, that’s the term. Exactly. JACK: Yeah. So, is that using in-game
mechanics to just screw with them or were you doing more than that?
CONOR: In-game mechanics, yeah, just to mess with them, or just trolling them in the chat
like a little kid. But yeah, I was doing that for a while. I had eventually joined one server,
and I had seen this other player on the server teleport into blocks. So, Minecraft’s obviously
made of blocks. This guy teleported a couple of blocks downwards, and I was impressed. I didn’t
know what he was doing. So, I think he kinda knew that I was messing around with the server.
He was doing the same thing. So, I had messaged him, private-messaged him, in the server and we
ended up talking on Skype. That was the beginning of everything, really. This is back when I was
probably eleven or twelve years old. JACK: So, this is where you start learning
glitches and hacks of some kind. CONOR: Yeah. So, this guy was a programmer.
He was a Java programmer, but he had his own custom code, a client, on Minecraft that he
used to carry out various exploits or little glitches. We had eventually — I had eventually
befriended him, and we would go on these servers together and mess with people just for fun
because we enjoyed it. But alongside programming and Java, he was also partaking in social
engineering. At that time I had no idea what it was until he introduced me to it. So,
we would join servers, we’d mess with the admin of the servers, so, the owner, and there was
one — at one point — the first time it happened, we had joined this server. He was talking to the
admin kind of in a friendly way, and then eventually a couple hours later, he logged
into the admin’s account on Minecraft on the server and took it over and deleted everything.
I had no idea what was going on at this time. JACK: Let me give you a little bit more context.
Minecraft is a game where players can create their own servers with unique content and stuff, and
sometimes you even need to pay to play on some of these player-made servers. Somehow, this guy was
able to find the person who’s the administrator to this Minecraft server, access their account,
and delete the whole server. What? CONOR: I eventually had figured out he
socially-engineered the admin of this server into giving him the two answers to his secret questions
on his Minecraft account, reset his password, logged in, and destroyed the server.
JACK: Oof, the admin got pwned. No more Minecraft server. Now, at the time, to take control of
someone’s Minecraft account, you had to log into Mojang’s website, the creator of Minecraft,
and what you needed to do is have the username and password. But if you didn’t have the password,
you could reset the password if you knew the answers to the two secret questions. Like, what
was your first car and who was your sixth-grade teacher? Since he watched his friend do this,
he wanted to learn how to do it, too. CONOR: [Music] So, for example, let’s say the
admin’s secret question was ‘What’s your first pet’s name?’ Second question was ‘What’s your
hometown?’ or ‘What school did you go to?’ The second one’s no problem. You can easily
find that out; a simple Google search. The first question is the tough one. So, what we used to do
is — say we’d join a server, we’d find the admin, we’d target him, and we’d know his first question
was ‘What was your first pet’s name?’ So, we’d say — or I would say in the chat, oh, my little kitten
died today, Buttons. Have you ever had any pets before? We’d try and get talking to the admin.
I’d try and get him to divulge the answer to that question. So, I’d say, what was your first pet’s
name? Unbeknownst to him, here I am typing it out, putting it into his Mojang account,
getting ready to reset it. That was the first experience of socially engineering someone.
JACK: This is Conor Freeman, by the way. I should have probably introduced you to him earlier,
but I forgot. He liked the sense of power that these little hacks gave him. When you get control
of a server like that, you become unstoppable. You have full control of the server now,
and you can delete it all if you wanted. There’s something alluring about that, that sense of
power. [Music] But to me, it’s quite a funny power dynamic. A TV show I really like — I think it’s
hilarious — is called Trailer Park Boys, and it’s about life in a trailer park. But the thing that
intrigues me about the show is the immense power struggle that’s going on in this trailer park.
There’s a huge clash between the park supervisor and a couple guys who are always scheming to
make money off of other people in the park. Then there are some drug dealers that live at home
with their mom. I mean, there’s a power struggle right there. Then there’s a guy who doesn't even
live in the trailer park who comes by to try to assert his dominance over the park. It’s this
incredible battle for power. All for what, though? To get the respect of the people in the trailer
park? It just seems so meaningless on the grand scheme of things, but they take this tiny trailer
park so seriously, as if it’s their whole world. I like it maybe because I grew up in different
trailers myself, so I can relate. But it just makes me think that there’s this huge battle going
on over a Minecraft server that a few hundred people play, and it’s all taken so seriously,
too. Anyway, after a while, Minecraft hacking got old to Conor, and he was wondering what
else is out there to mess around with, and he found some hacking forums which explained
all kinds of new stuff he could do. CONOR: Yeah, a lot of socially — social
engineering things. Like, back in the day, people used to do refund scams. So,
say you’d order something on Amazon. You’d get onto Amazon after it’s said ‘delivered’ on
Amazon and say it hasn’t arrived. Someone might have stolen it off my porch or something like
that. You’d get a refund and get your money back. That was a huge thing back then. It still is now,
but it’s a lot less prevalent because Amazon have kinda caught on. There was other kind of scams
and schemes. People would do return programs, did scam-return programs. So, SteelSeries was targeted
a lot back then. You could basically create a support ticket to say that you’ve bought a pair
of SteelSeries headphones. They're not working; can I get a return? They would send you out a
free headset and they wouldn't ask for anything in return. The only thing you had to do was send them
a picture of the headset or a serial number, which you could source from eBay or some kind of online
marketplace where people are reselling them. JACK: Hold on, Conor. You're using
a SteelSeries headset right now. CONOR: Yeah, no, I paid for this one.
JACK: Okay. CONOR: Yeah, it’s not
from back then. This is a long time ago. JACK: [Music] So, refund scams were becoming
a thing back in 2018 or so. There were instructions on how to do it,
but some people did not feel comfortable calling up somewhere and lying to someone
to try to convince them that you want a refund. So, there were actually people
you could hire to do it for you. CONOR: Exactly. So, that was the makeup
of it. Essentially you’d order — that was — Apple products were huge. So, essentially you’d order
something, you’d have — you’d order something, you’d go to — a ‘refunder’ they were called on
the forums, and you would say, hey, I ordered a Macbook for $1,200. Can you refund it for me
and I’ll give you twenty percent? So, the refunder would log into your account or they’d call Amazon
and pretend to be you, and they’d execute this kind of scam on Amazon. They’d socially-engineer
the rep into believing that the item was never delivered. They’d get a refund for their customer,
and then they get twenty percent of the total order value. That was a huge thing on that
forum. There were so many people doing it. JACK: So, you would pay a scammer $200, $400,
and then that’s how you’d get your Macbook. CONOR: Yeah, exactly.
JACK: Instead of paying full price for it. CONOR: Mm-hm.
JACK: Okay, what other ways to make money? How were kids doing it?
CONOR: There was a lot of cracking services which are still around now, but again, cyber hygiene has
gotten better, and — as well as that service’s security has gotten better, thankfully. But back
then you could crack most online accounts like — what’s an example? Hilton hotel was
a massive one. People that had Hilton accounts, that stayed a lot in Hilton hotels, you’d build
up these points and you could spend the points on free rooms in Hilton branches worldwide. So,
what people would do is crack these accounts. They’d load up a massive list of usernames
and passwords and try them against the Hilton log-in page, try and land a few accounts that
had points on them, and they’d then resell them on these forums to people looking to use…
JACK: This one always surprised me, because if I go on there and I buy a Hilton account with a
ton of points and I actually go to the hotel and I stay there with these stolen points,
I’m in the room now. CONOR: Yeah.
JACK: If they want to say, hold on, this is some stolen points…
CONOR: Yeah, looking back on it now, it’s insane. But I, myself, would never do that because — just
the stupidity of it. If that person who owned that account was to call up Hilton and say,
look, I didn’t book this room, you're one phone call away from somebody knocking on the door and
saying, hey, this isn't your account and you’ve stolen this room. But people got pretty brave.
People didn’t care. Pizza Hut was another big one. So, you’d order pizzas and you’d build up points,
and people would then try and crack your Pizza Hut account, and you could use these points to
get pizzas on other people’s accounts. You’d just walk into the store, use their points,
and walk out with a free pizza. JACK: It reminds me of pizza plugs as well.
CONOR: Yeah. But pizza plugs is slightly different. They're mostly carders, so,
they're credit card fraudsters. So, they’d use stolen cards and order
the pizza for collection or delivery. JACK: A pizza plug is where you find someone
who will give you really cheap pizzas. Like, for five bucks, they’ll send you three large
pizzas or something. What they're doing is they're using a stolen credit card to order
the pizzas to be sent to you, and then you just pay them like, five bucks for it.
CONOR: But again, that’s insane because you're associating stolen card details with your own
address. If you — say you get it delivered with a stolen card — not the brightest.
JACK: Cook groups, is this a thing? CONOR: Cook groups
in terms of clothes online? JACK: Yeah.
CONOR: Yeah. JACK: Funny; it was about clothes,
but it’s called cooking groups. CONOR: Cook groups. Yeah, it’s funny
you mention that because I used to be hugely into fashion. I still am now, but not as much
a back then. So, cook groups essentially would be groups that — they would employ bots. So,
someone would create a macro. So, I don't know if you're aware of what Supreme— I’m sure you are;
Supreme or, say, Palace, they're world-widely popular streetwear brands. They have weekly
releases or bi-weekly or whatever way they do it. So, they release a very limited amount of stock
on a certain day at a certain time, so it’s very hard to guess, especially items — certain items
like Box Logo hoodies or something like that. So, people would create these macros or scripts
that would automatically log them into the Supreme website. They’d buy these clothes instantly before
anyone else could, and then resell them. That’s a part of the cook groups. Or they
would — people would put their names on an item and someone would — bought it for them and resell
it to them at a marked-up price. JACK: Yeah, it’s kinda like scalping
concert tickets. CONOR: Yeah, exactly.
JACK: So, is this — is there anything illegal about cook groups?
CONOR: No, not from what I’m aware of. I’m sure it’s against the terms of service, but…
JACK: Yeah, I didn’t notice that, either. CONOR: …in terms of legality, no.
JACK: But it is kind of an underground culture there, right? You gotta find a group,
and sometimes it’s the wrong group you're in, and those guys are just there to rip you off. So, you
gotta find a trustworthy group that actually has these orders or whatever you're looking for.
CONOR: Yeah, and that’s the hard thing, 'cause a lot of these people aren't trustworthy because
what they're doing isn't trustworthy in itself. So, it’s hard to find someone
that’s actually gonna pull through. JACK: Yeah, it’s amazing to me how big the
hidden parts of the internet are and all these things going on at once, and we never see it as
just a common internet user. You'll never see any of this. How are you discovering all these
different places on the internet? CONOR: Through this forum. The forum
was massive. I don't really want to say the name of it, but it was probably one of — so,
Hack Forums was one of the forums that was around a long time. I think it’s been going for fifteen
years, maybe a little less than that. That would be the oldest kind of clearnet hacker forum that
I’m aware of. This forum that I was a member of kind of branched off of Hack Forums because
the admin of Hack Forums was — he was kind of a well-known fed. People didn’t really like
him and he was really stringent on the rules on that website. So, this forum that I was on kinda
branched off of Hack Forums and allowed for more black-hat or gray-hat or unethical methods. So,
all of the scumbags that weren't allowed to advertise their services on Hack Forums kind of
moved over to this forum that I was a part of. So, I mean, it was a huge range of services offered
'cause there were so many people on it. JACK: But you call them scumbags.
You were one of the users. CONOR: I was one of them, yeah.
JACK: What do you get dabbling in? What’s kind of the first money you're
making in this kind of world? CONOR: [Music] Thinking back — so,
Xbox ran a promo a long time ago, or Microsoft ran it. They ran a promo; I think it was a collab with
Skittles or something like that. So, they still do it now with Mountain Dew and Doritos. Like,
you buy a bag of Doritos and they’ll have a code on the back of it. You get double XP or something
for Call of Duty. But way back when, there was a promo that was ran with — I think it was Skittles,
where you’d buy a pack of Skittles, input the code on the back of the pack of Skittles, and you’d
get a free seven-day membership or fourteen-day membership on Microsoft Live. But there was people
that had scripts or macros that were brute-forcing this code. So, you’d just set up the script and
brute-force the code, throw hundreds of thousands of it against it, and you would eventually just
keep racking up free membership codes, 'cause there was no rate limit or anything on the
website. So, you could just get fifty to a hundred to even more, thousands of these fourteen-day Xbox
codes. But I eventually got my hands on that script. So, that was probably the first money
I made, when I had that script. I had it running and then I was reselling these membership codes
for like, probably $5 or $10 apiece to people on the forum and eBay and online marketplaces.
JACK: When I was young, I discovered a way to get free Audible books.
CONOR: [Laughs] JACK: So, so far I’m
with you, right? I was hanging out in shady chatrooms, griefing people in video games,
too, and getting free stuff. But I think this is where our paths are about to diverge. Alright,
so, this was making a few bucks for you, but not very much because you were just learning.
What were you, like fourteen years old then? CONOR: Probably thirteen or fourteen, yeah, which
is insane looking back. After a while of being on this forum, I kinda got bored of it. I kinda — I
had a relationship with the admin. We talked back and forth, and I think he kinda annoyed me one
day. So, I just quit that forum, and luckily for me, or unluckily, looking back, there was a new
forum that opened up called OGUsers, which was an online marketplace where people would buy and
sell OG, original usernames. So, say, @Jack on Instagram or @Jack on Twitter. They’d buy
and sell these different usernames for hundreds of thousands of dollars, and that was my next venture
then, getting into acquiring these usernames. JACK: So, Jack on Twitter is Jack Dorsey,
the original owner of Twitter. Good luck getting that one. But the thing about OGUsers that I
think is worth pointing out is half of them were fine and legit reselling, and then half of them
were social-engineered, stolen accounts. Would you consider that to be true?
CONOR: I’d say it’s a lot more skewed. I’d say it was probably ninety-five,
five — ninety-five percent stolen, five percent, if even that, genuine.
JACK: So, if you're not aware, OGUsers is a place where people are selling usernames.
That is Twitter accounts, Instagram accounts, Snapchat accounts. Why? Because we all hate it
when we go to register at one of these places and someone has already taken our name. So,
some people would pay extra for an account with a cool name. The problem is, the stuff for sale in
this site is often stolen accounts, where people would hack into that account, get control of it,
and then sell it on this site, OGUsers. CONOR: Yeah. So, I had a bit of crypto. I
discovered Bitcoin back when I dabbled in the other things on the other forum, but I had an
understanding of what crypto was. So, I had a bit of Bitcoin. I had bought a username one day on
Twitter. I can't remember the exact handle, but I bought it to resell it. I held it for a couple of
weeks, put it back up for sale, and made a couple of hundred on that. So, that was my first venture
into buying and selling the usernames. I didn’t last long, though, buying them. [Music] That’s
when it turned into me then stealing them or being introduced to people that were stealing them,
and kind of falling into that. JACK: What was your method
for stealing usernames? CONOR: Breached databases were a huge thing back
then. I know they're even bigger now. But a lot of people didn’t know how to use them, utilize them,
or how to find them. So, there were services where — there still is now, I’m sure, but there were
services where you could search someone’s username or e-mail, and they’ll pull their data from a
breached database, like their password, username, full name. So, what I was doing was doxing these
account holders. I would find their e-mail, I’d search the e-mail through the breached databases
and then find their password, and I’d try my luck at logging into the account with that password.
Because not many people were doing this at that point, I had quite some success with that.
JACK: Probably most of these were just crappy usernames, though, and you just didn’t even
care and you just logged back out? CONOR: Yeah, a lot of them were — yeah,
it was more the thrill of being able to find the password and log in. Or, sometimes you’d
get a password that’s incorrect or you might add a exclamation mark or an @ or something at the end,
and that would be the correct one, and you’d get a bit of a thrill out of that. But yeah,
most of them weren't anything amazing. JACK: Yeah, I imagine that’s a big thrill,
to be like, yeah, no, wrong password. Then you're like,
what if I add an exclamation point? Then, bing, you're in. Oh my gosh,
I’m brilliant, I’m a genius, I’m the best hacker in the world. Look at me.
CONOR: Yeah, you feel like a genius. JACK: This allowed you to acquire some — Twitter
and Instagram were your main things? CONOR: Twitter and Instagram, yeah. They're
still the main ones now. They're the most popular social media. So,
that’s what people would go for the most. JACK: Conor was making some scratch from all this,
all in Bitcoin, of course, looking through database breaches, finding passwords that
would work on Twitter, then stealing those usernames and selling them. Okay, so, roughly how
profitable was this for you selling OGUsers? CONOR: I don't know. I couldn't quantify a figure.
Probably $20,000 or $30,000? No, probably a lot less. I didn’t really get into it that deep.
JACK: He built up a reputation for having quite a bit of usernames for sale on OGUsers. It was
going well, but then something else caught his attention, something so much bigger
that eventually made him lose interest in OGUsers altogether. [Music] The thing he
saw some people doing was SIM swapping. CONOR: Yeah, so, it would start with a target.
You’ve doxed a user. You’d use various different methods of getting all their information. So,
their full name, address, phone number, their SSN. There’s a certain website that you can buy credits
on and input someone’s first and last name and get their SSN. So, you’d have all that information,
and then you’d — back in the day, it was a lot simpler than it was now. So, say if you were on
T-Mobile, I would call up and say, hey, my name’s Jack Rhysider. My last four of my SSN is 1234.
I’ve just lost my phone and my SIM card is inside it. I have a replacement SIM card here. If I give
you the ISE ID, can you swap my SIM over to this card? The agent would happily do it. Once that’s
done, your phone number is now mine. JACK: Your phone number is now mine. I
just think about how scary that sounds. If someone can take your phone number from you,
they can pretty much become you. So much of our identity is tied to our phone number. Yes, they
can text the people you know as you. They might be able to call your bank and pretend to be you.
But perhaps the scariest is that they can often recover some of your accounts. Like, if you have
a Google account and you go there and say, oh, I forgot my password, they might have an option to
text you a code to confirm it’s you. They text you thinking nobody in the world is gonna have access
to your phone except you, right? Which you can use to reset a Google account, and now you have access
to their e-mail, drives, photos, and maybe even their YouTube channel and more. Once they have
control of your main e-mail account, they can just go through and reset your other accounts.
Say you lost your Twitter password. It’ll say, okay, no problem. Let’s e-mail you a new one. So,
now they can get into your Twitter, too. This whole thing hinges on whether or not you can
convince the T-Mobile customer service rep that you really did lose your phone and to
get them to switch SIM cards for you. So, were some carriers easier for you than others?
CONOR: Yeah, T-Mobile by far was the easiest. It was insane. You’d get — sometimes you’d have to
brute-force these calls. So, you’d have to call ten or fifteen times until you’d get an agent who
just doesn't care enough, and he’ll just swap it. T-Mobile was insane. You’d just make one
call and they’d do it willy-nilly, happily just swap the SIM. AT&T was definitely the hardest,
and then Verizon I’d say was in the middle. Sprint as well, although not many people used it. Sprint
was another one, and then I think Cricket is what it’s called. Cricket and Sprint were pretty easy,
too. But as it got harder, people started to look into exploits on the actual websites of
these carriers. So, there’s a couple of well-known exploits in AT&T and T-Mobile that people would
use to either retrieve the pin off someone’s account or remotely swap the SIM themselves
or pull their information or whatever else. JACK: It’s crazy to me how in-depth of knowledge
you have of this, right? You understand wireless carriers of the world and SIM cards and usernames
and passwords and computer skills. You're just going higher and higher. Yet, you have to go to,
I don't know, history class and learn about the war and stuff in the afternoon, and then go
back to this crazy technical stuff. Did it feel like you were living two different worlds?
CONOR: Yeah, definitely. Nobody knew about it in my personal life. So, it — that was the thing;
you kinda have this detached personality where in person you're a completely different guy,
and then when you're online, it’s like your brain is in a different place. [Music] So,
you completely dissociate from your real life. So, it’s like two separate personas that you
have. It was like that the whole time. JACK: Yeah, it’s also interesting to look at
maybe some of the other kids in school who are trying to build up their social media,
right? You see these people are on Instagram, and you're like, alright, so,
you’ve got 300 followers. I can get you an account by this afternoon with a million followers. What’s
the deal here? There’s no game. How did you be like…? Did you ever look at that like that?
CONOR: Yeah…it was actually exactly that. When you're young and impressionable like I was,
I thought I was on top of the world and way smarter than everybody else. So, I would kind
of look at them and be like, oh, you're an idiot. How do you not know what I know or
how are you so impressed, or whatever else. JACK: Well, you had to know that what you were
doing is not exactly the straightforward way to do things. It’s the back way,
wrong way, and it-works way, but it’s not exactly the way you're supposed to.