WEBVTT NOTE This file was generated by Descript 00:00:00.435 --> 00:00:01.600 JACK: Have you ever tried installing 00:00:01.601 --> 00:00:03.534 an app on your computer but then 00:00:03.537 --> 00:00:04.615 ended up with something else? 00:00:04.616 --> 00:00:06.139 Like, you downloaded something you 00:00:06.139 --> 00:00:08.207 actually wanted like a app to retrieve 00:00:08.208 --> 00:00:10.285 a deleted file or to get some video 00:00:10.286 --> 00:00:11.666 to play properly, [Music] you get it 00:00:11.667 --> 00:00:13.151 on your machine the way everyone does, 00:00:13.151 --> 00:00:14.662 you downloaded it, run the installer, 00:00:14.665 --> 00:00:16.257 click through the screens, next, next, 00:00:16.258 --> 00:00:18.779 next, agree, and then it’s installed, 00:00:18.779 --> 00:00:20.986 but then something strange happens. 00:00:21.142 --> 00:00:22.457 You might not notice right away, but 00:00:22.457 --> 00:00:24.601 there’s something new on your computer, 00:00:24.840 --> 00:00:27.255 a new app or toolbar in your browser, 00:00:27.256 --> 00:00:28.974 or maybe your homepage changed to 00:00:28.974 --> 00:00:30.647 something like a search engine you 00:00:30.649 --> 00:00:32.522 never heard of, and your computer 00:00:32.522 --> 00:00:33.779 seems to be doing something every now 00:00:33.780 --> 00:00:35.947 and then that just doesn't make sense. 00:00:36.508 --> 00:00:38.549 Like, it’s a tad slower or the 00:00:38.549 --> 00:00:40.722 fans are suddenly louder, but 00:00:40.723 --> 00:00:42.238 you're just not exactly sure why. 00:00:42.705 --> 00:00:44.483 Most of the time it’s relatively harmless. 00:00:44.494 --> 00:00:45.921 It’s some kind of junkware. 00:00:46.229 --> 00:00:48.190 Some company paid a few cents to bundle 00:00:48.193 --> 00:00:49.989 their stuff into your download, hoping 00:00:49.989 --> 00:00:51.357 that you wouldn't remove the software 00:00:51.357 --> 00:00:53.232 and you would start using their software. 00:00:53.394 --> 00:00:54.513 It’s annoying but it’s easy 00:00:54.513 --> 00:00:55.783 to delete and forget about it. 00:00:56.244 --> 00:00:57.715 But stop and think what just happened; 00:00:57.741 --> 00:01:00.068 you went to try to install one thing 00:01:00.313 --> 00:01:01.804 and something else came along with 00:01:01.804 --> 00:01:03.042 it, something you didn't choose to 00:01:03.042 --> 00:01:04.354 download and didn't even know you 00:01:04.354 --> 00:01:05.672 were installing it at the time. 00:01:06.128 --> 00:01:07.610 You didn't even know what it was. 00:01:07.727 --> 00:01:09.257 It latched onto something else 00:01:09.259 --> 00:01:10.981 that you trusted and came into 00:01:10.981 --> 00:01:12.445 your PC and got installed. 00:01:13.003 --> 00:01:14.618 I hate this kind of software, 00:01:14.621 --> 00:01:16.195 software that you didn't install. 00:01:16.196 --> 00:01:18.228 It just came along for the ride, software 00:01:18.231 --> 00:01:19.611 that you don't want on your machine. 00:01:19.980 --> 00:01:21.745 It has a hidden agenda, and who 00:01:21.746 --> 00:01:23.188 knows what that thing is doing there. 00:01:23.740 --> 00:01:26.175 This is a story about a piece of software 00:01:26.175 --> 00:01:28.342 that snuck onto our machines like that. 00:01:28.892 --> 00:01:30.772 It’s called Blackshades. 00:01:34.993 --> 00:01:35.645 Intro: [Intro music] These 00:01:35.645 --> 00:01:36.791 are true stories from the 00:01:36.792 --> 00:01:38.251 dark side of the internet. 00:01:42.086 --> 00:01:43.328 I’m Jack Rhysider. 00:01:44.665 --> 00:01:45.575 This is Darknet Diaries. 00:01:45.575 --> 00:01:45.983 JACK: Let me start at 00:02:03.182 --> 00:02:03.603 beginning. 00:02:03.829 --> 00:02:06.235 Alex Yucel and Michael Hogue created 00:02:06.235 --> 00:02:08.210 a program called Blackshades, and in 00:02:08.211 --> 00:02:10.484 2010 they started selling it online. 00:02:11.019 --> 00:02:12.225 Blackshades, or more 00:02:12.226 --> 00:02:12.396 specifically, the Blackshades RAT, 00:02:14.505 --> 00:02:15.990 is a piece of software that allows 00:02:15.990 --> 00:02:17.903 an attacker to gain complete control 00:02:17.915 --> 00:02:19.877 remotely of a victim’s machine. 00:02:20.063 --> 00:02:21.926 They can view their files, record 00:02:21.926 --> 00:02:22.953 their keystrokes, lock their 00:02:22.953 --> 00:02:24.432 data, and hijack their webcam. 00:02:24.445 --> 00:02:25.923 [Music] They marketed Blackshades 00:02:25.937 --> 00:02:27.380 like a regular software product. 00:02:27.384 --> 00:02:29.004 They had a website with an About 00:02:29.004 --> 00:02:30.713 Us page and an Order Now button. 00:02:31.144 --> 00:02:33.424 The page said ‘Blackshades is 00:02:33.425 --> 00:02:35.184 mainly an IT surveillance and 00:02:35.184 --> 00:02:37.431 security-based company directed at 00:02:37.431 --> 00:02:39.787 making your PC experiences easier. 00:02:40.167 --> 00:02:42.304 Our main goal is to offer affordable 00:02:42.304 --> 00:02:44.350 software solutions comparable to bigger 00:02:44.352 --> 00:02:46.818 names out there.’ Then they listed 00:02:46.818 --> 00:02:48.414 the benefits of using the product; 00:02:48.935 --> 00:02:52.016 to spy on your children or spouse, to 00:02:52.016 --> 00:02:53.641 find out if your partner is cheating 00:02:53.641 --> 00:02:55.611 on you, or to see if someone was 00:02:55.611 --> 00:02:58.170 using your computer in unwanted ways. 00:02:58.796 --> 00:03:00.585 They even had a legal notice saying 00:03:00.899 --> 00:03:02.899 that it’s legal to install monitoring 00:03:02.899 --> 00:03:04.464 software on your own computer 00:03:04.698 --> 00:03:06.822 according to the Spy Act of 2004. 00:03:07.483 --> 00:03:08.058 The price? 00:03:08.366 --> 00:03:09.117 Forty bucks. 00:03:09.939 --> 00:03:12.130 The site wasn't hidden on the dark web. 00:03:12.140 --> 00:03:13.293 It was right there in the open with 00:03:13.311 --> 00:03:15.271 normal-sounding marketing language, and 00:03:15.271 --> 00:03:17.653 at first glance it doesn't look nefarious. 00:03:17.935 --> 00:03:19.857 But as you think about it, you're 00:03:19.858 --> 00:03:21.148 like, wait, hold on a minute. 00:03:21.628 --> 00:03:24.267 The software is used to spy on people? 00:03:25.373 --> 00:03:26.247 Which makes me wonder, 00:03:26.756 --> 00:03:28.995 is Blackshades legal? 00:03:29.787 --> 00:03:31.210 Well, there’s actually two questions here. 00:03:31.230 --> 00:03:32.999 Is making and selling Blackshades 00:03:33.011 --> 00:03:35.724 legal, and is using Blackshades legal? 00:03:36.245 --> 00:03:37.590 The website says that this is a 00:03:37.590 --> 00:03:39.065 surveillance and security tool 00:03:39.303 --> 00:03:40.822 used to monitor the activity 00:03:40.846 --> 00:03:41.956 of your child’s computer. 00:03:42.521 --> 00:03:44.348 Well, that in itself isn't illegal 00:03:44.348 --> 00:03:46.260 even if it can be abused, kinda 00:03:46.260 --> 00:03:47.519 like a knife isn't illegal. 00:03:47.519 --> 00:03:48.686 We need it to make food with. 00:03:49.296 --> 00:03:50.772 Someone waving it around on the 00:03:50.773 --> 00:03:52.377 street is suddenly a big threat. 00:03:53.088 --> 00:03:54.664 In fact, many businesses today use 00:03:54.664 --> 00:03:56.329 software just like that to monitor 00:03:56.330 --> 00:03:57.377 what their employees are doing. 00:03:57.600 --> 00:03:59.069 It’ll take screenshots, record what 00:03:59.085 --> 00:04:00.951 apps are opened and in focus, and 00:04:00.951 --> 00:04:02.516 track the locations of devices. 00:04:03.274 --> 00:04:04.974 But when a company spies on its own 00:04:04.975 --> 00:04:06.793 computers, it typically makes it very 00:04:06.797 --> 00:04:09.167 clear; there is a monitoring system 00:04:09.183 --> 00:04:11.263 on your computer, or they make the 00:04:11.266 --> 00:04:12.873 employees sign a document which says 00:04:12.873 --> 00:04:14.442 ‘You may be monitored while you're here 00:04:14.442 --> 00:04:16.728 at work’, which is what makes it legal. 00:04:16.752 --> 00:04:18.043 That person being spied on 00:04:18.055 --> 00:04:19.873 knows and consents to it. 00:04:20.468 --> 00:04:23.222 So, on the surface, both making and using 00:04:23.222 --> 00:04:26.379 software like this can be perfectly legal. 00:04:27.272 --> 00:04:28.638 But Blackshades wasn't 00:04:28.659 --> 00:04:30.695 marketing this to businesses. 00:04:31.253 --> 00:04:33.808 They were marketing it on hacker forums. 00:04:35.487 --> 00:04:36.451 [Music] They specifically were 00:04:36.455 --> 00:04:38.101 building a tool that they knew people 00:04:38.102 --> 00:04:40.491 would use for malicious purposes. 00:04:40.756 --> 00:04:41.830 They weren't in the business 00:04:41.831 --> 00:04:43.455 of selling kitchen knives. 00:04:43.805 --> 00:04:45.303 They were specifically marketing 00:04:45.305 --> 00:04:46.223 their product to people 00:04:46.225 --> 00:04:48.136 they knew would abuse it. 00:04:48.519 --> 00:04:49.686 So, their whole website, which was 00:04:49.687 --> 00:04:51.123 saying this is used to track your kids, 00:04:51.211 --> 00:04:53.363 that was really a lie, a ruse to make 00:04:53.364 --> 00:04:55.867 it look legal and look perfectly fine. 00:04:56.439 --> 00:04:58.133 To the courts, who look at things through 00:04:58.133 --> 00:05:01.654 the lens of the law, intent matters a lot. 00:05:02.181 --> 00:05:03.976 If you know you're selling to people 00:05:03.979 --> 00:05:05.967 who will use it to commit crimes with, 00:05:06.604 --> 00:05:08.364 then yeah, it’s illegal to sell that. 00:05:09.096 --> 00:05:11.513 When it comes to the customers, if 00:05:11.513 --> 00:05:12.537 they were putting it on people’s 00:05:12.544 --> 00:05:14.234 computers without their consent 00:05:14.244 --> 00:05:15.729 and spying on someone without them 00:05:15.729 --> 00:05:17.818 knowing, then that’s illegal, too. 00:05:18.421 --> 00:05:19.921 That’s unauthorized access to 00:05:19.924 --> 00:05:21.561 a computer, privacy violations, 00:05:21.572 --> 00:05:22.813 identity theft, intercepting 00:05:22.815 --> 00:05:24.316 communications, and extortion. 00:05:24.839 --> 00:05:26.392 So yeah, this can be illegal 00:05:26.393 --> 00:05:28.411 to use as well, both illegal 00:05:28.412 --> 00:05:30.022 to make and illegal to use. 00:05:30.479 --> 00:05:31.907 But again, it all comes down 00:05:31.909 --> 00:05:34.030 to intent of whether or not 00:05:34.030 --> 00:05:35.914 this is legal versus illegal. 00:05:36.491 --> 00:05:38.503 If these people who use it and make 00:05:38.503 --> 00:05:40.303 it are going to get in trouble over 00:05:40.304 --> 00:05:41.809 this, then the courts are gonna have 00:05:41.810 --> 00:05:43.798 to prove that intent was there to 00:05:43.812 --> 00:05:45.838 sell it to criminals or to spy on 00:05:45.840 --> 00:05:46.931 people without their permission. 00:05:47.751 --> 00:05:49.633 Blackshades is better known as 00:05:49.633 --> 00:05:52.119 the Blackshades RAT, and RAT 00:05:52.242 --> 00:05:54.565 stands for Remote Access Trojan. 00:05:54.991 --> 00:05:56.389 Remote access is like when you 00:05:56.396 --> 00:05:58.889 need computer help and IT support 00:05:58.907 --> 00:06:00.300 takes over your computer to fix 00:06:00.300 --> 00:06:01.918 something, or when you log into your 00:06:01.923 --> 00:06:03.385 home computer from a coffee shop. 00:06:04.018 --> 00:06:05.435 A RAT is the exact same thing, 00:06:05.563 --> 00:06:07.730 except it’s malicious in nature. 00:06:08.138 --> 00:06:10.207 Someone you don't know takes 00:06:10.207 --> 00:06:12.173 over your computer without your 00:06:12.173 --> 00:06:13.634 knowledge or consent, and they 00:06:13.634 --> 00:06:15.298 can see everything you're doing. 00:06:15.828 --> 00:06:17.644 The scariest bit is you have no 00:06:17.644 --> 00:06:19.309 idea it’s happening, since it’s 00:06:19.323 --> 00:06:21.037 completely running silently. 00:06:22.669 --> 00:06:23.895 Once Blackshades was on your 00:06:23.896 --> 00:06:25.381 machine, the attacker has an 00:06:25.382 --> 00:06:27.151 astonishing level of access. 00:06:27.394 --> 00:06:28.729 They could read every file and view 00:06:28.731 --> 00:06:30.626 every photo and video on your computer. 00:06:30.901 --> 00:06:31.512 They could see every 00:06:31.513 --> 00:06:32.620 single key you pressed. 00:06:32.640 --> 00:06:34.046 Every password, every credit card 00:06:34.048 --> 00:06:35.289 number, every private message 00:06:35.292 --> 00:06:36.645 went straight to the attacker. 00:06:36.995 --> 00:06:38.807 They could steal the log-ins to your bank, 00:06:38.846 --> 00:06:40.741 your e-mail, your social media accounts. 00:06:41.131 --> 00:06:42.469 They could turn your webcam and 00:06:42.469 --> 00:06:44.265 microphone on, and from there they 00:06:44.267 --> 00:06:46.314 can commit a litany of crimes; theft, 00:06:46.325 --> 00:06:48.922 extortion, blackmail, for example, but 00:06:48.923 --> 00:06:50.855 also wire fraud and identity theft. 00:06:51.373 --> 00:06:52.150 And it gets worse. 00:06:52.386 --> 00:06:53.659 Blackshades had a feature 00:06:53.699 --> 00:06:55.048 called the Spreader. 00:06:55.420 --> 00:06:56.699 Once it was on your computer, the 00:06:56.701 --> 00:06:58.743 attacker could use your social media 00:06:58.743 --> 00:07:00.607 accounts and chat apps to try to spread 00:07:00.608 --> 00:07:02.178 it to your friends’ computers, too. 00:07:02.749 --> 00:07:03.994 They could even use Blackshades 00:07:04.010 --> 00:07:06.286 for ransomware, locking up their 00:07:06.286 --> 00:07:07.895 targets’ files and demanding 00:07:07.895 --> 00:07:09.427 payments to unscramble them. 00:07:09.427 --> 00:07:11.971 [Music] I can't imagine this feature 00:07:12.036 --> 00:07:14.356 being used for any legitimate purpose. 00:07:14.804 --> 00:07:16.686 So, the fact that this had a ransomware 00:07:16.695 --> 00:07:18.335 feature squarely puts it in the 00:07:18.335 --> 00:07:20.013 malicious software territory, if you're 00:07:20.013 --> 00:07:22.539 asking me, making it clearly illegal. 00:07:23.094 --> 00:07:24.996 But Blackshades would make their users 00:07:24.998 --> 00:07:26.630 click on a button stating that the 00:07:26.631 --> 00:07:28.856 user is responsible for whatever the 00:07:28.861 --> 00:07:31.349 action resulted in, and warning them 00:07:31.395 --> 00:07:33.131 to be careful when using this feature. 00:07:33.519 --> 00:07:35.704 It also said this was made 00:07:35.946 --> 00:07:38.084 for educational purposes only. 00:07:38.899 --> 00:07:40.956 Yeah, okay, sure. 00:07:41.831 --> 00:07:42.957 But there was one problem 00:07:43.179 --> 00:07:44.169 for Blackshades users. 00:07:44.405 --> 00:07:46.304 You couldn't just wave a wand at 00:07:46.304 --> 00:07:48.099 someone and infect their computer 00:07:48.099 --> 00:07:49.674 with Blackshades, and no one in 00:07:49.674 --> 00:07:50.925 their right mind would install 00:07:50.925 --> 00:07:52.587 this to give some random attacker 00:07:52.597 --> 00:07:53.847 full access to their computer. 00:07:54.288 --> 00:07:56.613 So, to get Blackshades on a victim’s 00:07:56.621 --> 00:07:58.714 machine, they had to trick the victim 00:07:58.870 --> 00:08:01.252 into installing it themselves, to make 00:08:01.253 --> 00:08:03.045 them think they're installing something 00:08:03.046 --> 00:08:05.442 else, and that’s tricky because you 00:08:05.443 --> 00:08:07.898 basically have to exploit another human 00:08:08.229 --> 00:08:09.771 to get it installed, which brings us 00:08:09.772 --> 00:08:11.288 into the world of social engineering, 00:08:11.288 --> 00:08:13.221 the art of tricking people into doing 00:08:13.221 --> 00:08:15.082 things they don't actually want to do. 00:08:15.807 --> 00:08:17.800 There are a 1001 ways that we can 00:08:17.813 --> 00:08:19.937 all be tricked into installing 00:08:19.945 --> 00:08:21.277 things that we don't actually want. 00:08:21.551 --> 00:08:23.081 Humans are a weak link when 00:08:23.084 --> 00:08:24.416 it comes to computer security. 00:08:24.908 --> 00:08:26.070 You might have seen some of them, 00:08:26.137 --> 00:08:27.381 obvious links; click here for 00:08:27.381 --> 00:08:28.514 a free iPhone, and you're like, 00:08:28.515 --> 00:08:30.022 yeah, nah, I’m not doing that. 00:08:30.441 --> 00:08:32.592 But sometimes it’s not so obvious. 00:08:32.847 --> 00:08:34.427 Since Blackshades can spread from 00:08:34.427 --> 00:08:36.345 a friend’s computer to yours using 00:08:36.345 --> 00:08:37.792 malicious links, it can look like 00:08:37.793 --> 00:08:39.438 it’s coming from someone you trust. 00:08:40.215 --> 00:08:42.104 They can also hide malware inside 00:08:42.368 --> 00:08:44.841 pirated software, games, or movies 00:08:45.069 --> 00:08:46.630 on peer-to-peer file-sharing sites. 00:08:46.940 --> 00:08:48.513 So, if you downloaded a cracked version 00:08:48.514 --> 00:08:50.054 of a video game that you didn't want 00:08:50.057 --> 00:08:51.723 to buy, Blackshades might come along 00:08:51.725 --> 00:08:53.604 for the ride and get installed with it. 00:08:54.252 --> 00:08:55.001 I should know, too. 00:08:55.001 --> 00:08:56.463 When I was a teenager I downloaded a 00:08:56.463 --> 00:08:58.928 lot of shady apps and games from shady 00:08:58.929 --> 00:09:00.317 parts of the internet, and I would 00:09:00.317 --> 00:09:02.045 constantly be dealing with infections. 00:09:02.529 --> 00:09:03.762 I didn't care because I really wanted 00:09:03.762 --> 00:09:04.858 to play the game, but eventually 00:09:04.858 --> 00:09:06.435 the infection would get so bad that 00:09:06.436 --> 00:09:08.088 I couldn't use my computer at all. 00:09:08.372 --> 00:09:09.185 Pop-ups would just 00:09:09.223 --> 00:09:10.353 constantly be showing up. 00:09:10.569 --> 00:09:12.431 The CPU would crawl to a standstill. 00:09:12.660 --> 00:09:13.925 I must have been hit with malware 00:09:13.926 --> 00:09:15.859 hundreds of times when I was a teenager. 00:09:16.486 --> 00:09:18.040 But that’s what got me good at fixing 00:09:18.040 --> 00:09:20.138 computers, learning how to find malware 00:09:20.171 --> 00:09:21.971 and remove it and cleaning up my computer. 00:09:22.315 --> 00:09:23.598 After a while I took pride in 00:09:23.598 --> 00:09:24.692 knowing there is no problem 00:09:24.692 --> 00:09:26.029 that I can't fix on my computer. 00:09:26.344 --> 00:09:27.314 Worst case is I could just 00:09:27.360 --> 00:09:28.731 reinstall the operating system 00:09:28.732 --> 00:09:31.203 if I had to, which I did a lot. 00:09:31.371 --> 00:09:32.444 I mean, a lot, a lot. 00:09:33.212 --> 00:09:35.735 Anyway, sometimes devices you buy in the 00:09:35.736 --> 00:09:37.258 store actually come with malware on them. 00:09:37.260 --> 00:09:38.449 There was a story I read once 00:09:38.449 --> 00:09:39.947 where a Chinese laptop maker 00:09:39.948 --> 00:09:41.013 was selling their laptops on 00:09:41.013 --> 00:09:43.049 Amazon that came with Windows 11. 00:09:43.425 --> 00:09:44.651 Well, the thing was the Chinese seller 00:09:44.651 --> 00:09:46.189 was trying to cut costs and didn't want 00:09:46.189 --> 00:09:48.175 to pay for Windows 11 license keys for 00:09:48.175 --> 00:09:50.245 every computer, so they found a pirated 00:09:50.246 --> 00:09:51.780 version of Windows, installed that, 00:09:51.781 --> 00:09:53.344 and shipped it with their laptops. 00:09:53.731 --> 00:09:55.175 Little did they know, the pirated 00:09:55.178 --> 00:09:57.429 version contained malware and was 00:09:57.430 --> 00:09:59.200 draining people’s crypto wallets 00:09:59.214 --> 00:10:01.116 and robbing their Steam accounts. 00:10:01.613 --> 00:10:03.214 So, you need to be really careful with 00:10:03.214 --> 00:10:04.857 what apps you install and where you 00:10:04.857 --> 00:10:06.425 get them from, because having one bad 00:10:06.430 --> 00:10:08.334 app on your computer can ruin you. 00:10:09.178 --> 00:10:10.251 But even apps you vet 00:10:10.255 --> 00:10:11.507 thoroughly can turn rogue. 00:10:11.562 --> 00:10:13.472 I’ve seen some popular browser extensions 00:10:13.485 --> 00:10:15.808 get purchased by someone who had malicious 00:10:15.809 --> 00:10:17.475 intent, and then they put spyware on 00:10:17.477 --> 00:10:18.887 people’s browsers without them knowing. 00:10:19.326 --> 00:10:21.117 Or maybe someone makes a simple mobile 00:10:21.117 --> 00:10:23.545 app that’s clean and fine and free, even. 00:10:23.944 --> 00:10:26.337 But as it grows in popularity, there’s 00:10:26.346 --> 00:10:28.391 always someone that asks them, hey, 00:10:28.771 --> 00:10:30.297 I’ll give you a few thousand dollars 00:10:30.297 --> 00:10:32.050 if you can put this widget in your app. 00:10:32.117 --> 00:10:32.908 Don't worry, it’s just 00:10:32.908 --> 00:10:34.150 an advertising pixel. 00:10:34.843 --> 00:10:36.401 If someone’s making free software 00:10:36.402 --> 00:10:37.614 and suddenly get offered a few 00:10:37.615 --> 00:10:38.952 thousand dollars to add a simple 00:10:38.952 --> 00:10:41.753 advertising pixel, they might say yes. 00:10:42.504 --> 00:10:45.211 Now suddenly that app, which was clean and 00:10:45.211 --> 00:10:48.478 good, now has some malicious code in it 00:10:48.981 --> 00:10:50.784 tracking what you're doing on your phone. 00:10:51.358 --> 00:10:53.475 Stuff can sneak into our devices 00:10:53.477 --> 00:10:55.281 from all kinds of directions. 00:10:55.724 --> 00:10:56.993 It’s a war out there. 00:10:56.993 --> 00:10:58.858 [Music] Then there’s USB sticks. 00:10:58.858 --> 00:11:00.736 If you put a USB stick into a computer, 00:11:01.126 --> 00:11:02.455 Windows will look at it and see if there’s 00:11:02.457 --> 00:11:05.258 a file called autorun.inf, and if so, 00:11:05.258 --> 00:11:07.008 it’ll run the commands in that file. 00:11:07.259 --> 00:11:08.575 So, if someone swings by your 00:11:08.575 --> 00:11:10.201 computer, pops a USB stick in the 00:11:10.202 --> 00:11:12.812 slot, it may auto-infect that machine. 00:11:13.643 --> 00:11:14.928 Then you could pull the USB stick 00:11:14.929 --> 00:11:16.364 out, and nobody knows what happened. 00:11:16.943 --> 00:11:18.812 Back in the days of Windows XP and Vista, 00:11:18.831 --> 00:11:21.500 this feature was on by default in Windows. 00:11:21.865 --> 00:11:23.852 Nowadays the Autorun feature is not 00:11:23.867 --> 00:11:25.837 on by default, thank goodness, but 00:11:25.837 --> 00:11:27.194 this was a popular way people would 00:11:27.194 --> 00:11:28.816 infect computers with Blackshades, 00:11:28.822 --> 00:11:30.482 since it was just dead simple to do. 00:11:30.485 --> 00:11:32.386 Just stick the USB stick in for a few 00:11:32.387 --> 00:11:33.699 seconds and pull it out, and you're done. 00:11:34.559 --> 00:11:36.007 I think the most popular way people 00:11:36.007 --> 00:11:37.939 were getting victims to install 00:11:37.939 --> 00:11:39.903 this is to send them a message 00:11:39.903 --> 00:11:41.764 saying, ‘Oh my god, is this you? 00:11:41.864 --> 00:11:43.640 How embarrassing!’ with a 00:11:43.646 --> 00:11:45.372 link to a photo or a video. 00:11:46.213 --> 00:11:48.217 Except it wasn't a photo or video. 00:11:48.233 --> 00:11:49.544 It’d look like it, but when you tried 00:11:49.545 --> 00:11:51.260 to open it, it was really a program 00:11:51.571 --> 00:11:53.266 that would install Blackshades. 00:11:53.973 --> 00:11:55.223 Another one, which I’ve actually 00:11:55.223 --> 00:11:56.465 seen in my own inbox, was something 00:11:56.467 --> 00:11:57.929 like, ‘We’ve tried to deliver a 00:11:57.929 --> 00:11:59.454 package to you three times now. 00:11:59.613 --> 00:12:00.660 We were unsuccessful. 00:12:00.866 --> 00:12:02.240 We're gonna send it back to the shipper 00:12:02.240 --> 00:12:04.881 unless you click here.’ I always have 00:12:04.881 --> 00:12:06.585 this knee-jerk reaction like, oh man, 00:12:06.587 --> 00:12:07.803 I don't want my package returned. 00:12:08.504 --> 00:12:10.693 Then I realize it’s to an e-mail I’ve 00:12:10.707 --> 00:12:12.732 never used for ordering things before. 00:12:12.776 --> 00:12:15.586 I’m like, oh, that’s a scam. 00:12:15.768 --> 00:12:16.901 They're trying to trick me. 00:12:17.469 --> 00:12:18.756 So, no matter how vigilant 00:12:18.756 --> 00:12:20.030 you are, I think we're all 00:12:20.031 --> 00:12:21.811 susceptible to phishing e-mails. 00:12:22.451 --> 00:12:23.515 It just has to be clever 00:12:23.515 --> 00:12:24.620 enough to make you click. 00:12:25.488 --> 00:12:27.418 Once Blackshades got installed 00:12:27.418 --> 00:12:29.098 on a victim’s computer, the 00:12:29.112 --> 00:12:31.376 operator needed no skill at all. 00:12:31.559 --> 00:12:32.926 You didn't even have to open a terminal. 00:12:32.945 --> 00:12:34.180 It came with a slick, little 00:12:34.180 --> 00:12:36.211 dashboard to show you every computer 00:12:36.213 --> 00:12:38.392 that you've infected, with icons 00:12:38.393 --> 00:12:39.800 telling you if there is a camera 00:12:39.827 --> 00:12:41.640 available on that computer or not. 00:12:42.288 --> 00:12:43.559 If you were the operator, you could 00:12:43.559 --> 00:12:45.167 simply point and click on the computer 00:12:45.167 --> 00:12:47.401 you wanted to see, and now you could see 00:12:47.403 --> 00:12:50.590 their desktop, files, and yeah, camera. 00:12:51.076 --> 00:12:52.395 I mean, you could see it all; 00:12:52.396 --> 00:12:53.900 people’s private messages, social 00:12:53.901 --> 00:12:55.266 media accounts, Google searches. 00:12:55.477 --> 00:12:56.377 It was spooky. 00:12:56.556 --> 00:12:58.379 [Music] There was this guy named 00:12:58.389 --> 00:13:00.876 Stefan Rigo from Leeds in the UK 00:13:01.034 --> 00:13:02.319 who saw what Blackshades could 00:13:02.330 --> 00:13:03.762 do, and he became interested. 00:13:03.778 --> 00:13:04.974 He was thirty-four years old. 00:13:05.177 --> 00:13:06.541 He bought it for forty bucks 00:13:06.637 --> 00:13:08.671 using his ex-girlfriend’s credit 00:13:08.672 --> 00:13:11.457 card, and then he infected his 00:13:11.457 --> 00:13:13.255 ex-girlfriend with this malware. 00:13:13.905 --> 00:13:15.737 Maybe he sent her a phishing chat 00:13:15.737 --> 00:13:18.192 message or plugged in a USB stick 00:13:18.199 --> 00:13:20.055 when he visited her house one day 00:13:20.056 --> 00:13:21.198 and she left the room or something. 00:13:21.567 --> 00:13:23.330 But when he was at his computer, he 00:13:23.330 --> 00:13:25.815 could see when her computer was online. 00:13:26.420 --> 00:13:28.901 Her computer had a camera on it, 00:13:29.209 --> 00:13:30.820 and from the dark comfort of his 00:13:30.820 --> 00:13:33.266 own house, he turned on her camera 00:13:33.599 --> 00:13:35.261 and watched her in her bedroom. 00:13:36.045 --> 00:13:38.260 He found it incredibly addicting. 00:13:38.603 --> 00:13:41.021 She had no idea he was watching her. 00:13:41.661 --> 00:13:43.308 Usually there’s a little light that 00:13:43.309 --> 00:13:44.949 comes on when your camera is on, right? 00:13:45.424 --> 00:13:46.612 Well, Blackshades made sure 00:13:46.613 --> 00:13:47.916 that light didn't come on. 00:13:48.505 --> 00:13:49.301 Watching her in her 00:13:49.303 --> 00:13:51.500 bedroom gave him a rush. 00:13:51.745 --> 00:13:52.496 He liked it. 00:13:52.641 --> 00:13:54.097 He had some other lady friends and 00:13:54.097 --> 00:13:56.019 wondered what they were doing, too. 00:13:56.568 --> 00:13:58.372 So, he started infecting more and more 00:13:58.375 --> 00:14:00.752 women that he knew with Blackshades. 00:14:01.189 --> 00:14:02.640 He could hear conversations 00:14:02.659 --> 00:14:03.400 people were having. 00:14:03.719 --> 00:14:05.010 He watched them get undressed. 00:14:05.435 --> 00:14:06.997 Of course, he’s taking screenshots of 00:14:06.997 --> 00:14:08.791 them changing and saving the recordings. 00:14:08.947 --> 00:14:10.776 He liked that kind of stuff the most. 00:14:11.106 --> 00:14:12.963 Stefan got seriously addicted 00:14:12.964 --> 00:14:14.603 to watching what women do in 00:14:14.604 --> 00:14:16.267 the privacy of their own homes. 00:14:16.810 --> 00:14:18.192 Every day he would open up his 00:14:18.193 --> 00:14:20.061 Blackshades dashboard and look to see 00:14:20.061 --> 00:14:22.120 what computers he infected were online, 00:14:22.664 --> 00:14:24.625 and then he’d double-click on one and 00:14:24.627 --> 00:14:26.642 sit there, watching what they were doing. 00:14:27.236 --> 00:14:28.385 Not only was he watching through 00:14:28.385 --> 00:14:29.211 the cameras, but when they'd 00:14:29.211 --> 00:14:30.394 use their computers, he’d watch 00:14:30.395 --> 00:14:31.643 what they were doing on it, too. 00:14:31.846 --> 00:14:33.545 He could see their passwords, their 00:14:33.547 --> 00:14:35.384 private messages with people, their 00:14:35.393 --> 00:14:37.743 photos, what they bought online, 00:14:37.859 --> 00:14:39.359 their online banking activity, 00:14:39.865 --> 00:14:41.776 everything they did on that computer. 00:14:42.771 --> 00:14:44.138 The thing that made it addicting 00:14:44.138 --> 00:14:45.803 to him was that he never knew 00:14:45.803 --> 00:14:46.885 when something interesting would 00:14:46.893 --> 00:14:48.496 happen or what would happen. 00:14:49.070 --> 00:14:50.707 To him it was like a wave of 00:14:50.709 --> 00:14:52.581 excitement when he actually saw 00:14:52.586 --> 00:14:54.273 someone changing in front of a camera. 00:14:54.722 --> 00:14:55.710 That would make it all 00:14:55.718 --> 00:14:56.857 worth the time to him. 00:14:57.712 --> 00:14:59.129 He started out by putting it on the 00:14:59.129 --> 00:15:01.875 computers of women he knew, but then 00:15:01.888 --> 00:15:03.296 he learned how to spread it from 00:15:03.305 --> 00:15:05.416 those computers to their friends’ 00:15:05.416 --> 00:15:07.869 computers, and now he was infecting 00:15:07.875 --> 00:15:08.967 other women that he didn't even 00:15:08.968 --> 00:15:10.628 know, and he didn't stop there. 00:15:10.629 --> 00:15:11.668 He was trying to infect other 00:15:11.669 --> 00:15:13.270 women, too, like people working 00:15:13.270 --> 00:15:15.302 in coffee shops or at a library. 00:15:15.589 --> 00:15:16.923 It was real easy for him just 00:15:16.924 --> 00:15:18.310 to put in a USB drive and try 00:15:18.312 --> 00:15:19.487 to infect someone’s laptop. 00:15:20.467 --> 00:15:22.142 He was seriously addicted to this, 00:15:22.142 --> 00:15:24.079 and over time he got over a dozen 00:15:24.105 --> 00:15:26.232 people infected with Blackshades. 00:15:27.432 --> 00:15:29.042 With that, there was always 00:15:29.051 --> 00:15:30.599 someone online doing something 00:15:30.601 --> 00:15:32.178 interesting that he liked watching. 00:15:34.620 --> 00:15:36.306 There’s a whole voyeurism fetish 00:15:36.312 --> 00:15:37.133 out there on the internet. 00:15:37.145 --> 00:15:39.561 People will secretly film women getting 00:15:39.562 --> 00:15:41.337 undressed and posting it online. 00:15:41.735 --> 00:15:42.907 Or maybe they’ll hold a camera 00:15:42.908 --> 00:15:44.207 under some lady’s skirt and take 00:15:44.207 --> 00:15:45.438 a photo of that and share it. 00:15:46.056 --> 00:15:48.185 Well, this voyeurism community was 00:15:48.193 --> 00:15:50.015 hearing about what you could do with 00:15:50.040 --> 00:15:52.701 Blackshades, and they were into it. 00:15:53.046 --> 00:15:54.967 The Blackshades RAT had incredible 00:15:54.969 --> 00:15:57.065 potential for secretly getting videos 00:15:57.065 --> 00:15:59.333 of women undressing or having sex. 00:15:59.805 --> 00:16:01.679 Soon the biggest user base of Blackshades 00:16:01.696 --> 00:16:03.910 were guys spying on girls to see them 00:16:03.911 --> 00:16:06.310 naked, and in most cases the guys were 00:16:06.310 --> 00:16:08.228 spying on the girls they knew, keeping 00:16:08.230 --> 00:16:10.310 tabs on exes, getting dirt on someone 00:16:10.310 --> 00:16:12.302 they're jealous of, or just spying on 00:16:12.302 --> 00:16:13.876 women because they found it fascinating. 00:16:14.530 --> 00:16:17.068 Over time, thousands of Blackshades users 00:16:17.117 --> 00:16:19.826 were using this tool to spy on women. 00:16:20.309 --> 00:16:21.601 It really helped Blackshades 00:16:21.621 --> 00:16:22.741 grow in popularity. 00:16:23.395 --> 00:16:24.371 But they weren't the only people 00:16:24.371 --> 00:16:25.329 interested in Blackshades. 00:16:25.608 --> 00:16:27.564 It was also used to target activists. 00:16:27.743 --> 00:16:29.242 In 2012, Syria was in the 00:16:29.242 --> 00:16:30.313 middle of a civil war. 00:16:30.584 --> 00:16:31.814 People were really upset with 00:16:31.814 --> 00:16:33.236 the president of Syria, Bashar 00:16:33.248 --> 00:16:35.161 al-Assad, for using chemical 00:16:35.163 --> 00:16:36.684 weapons on his own civilians. 00:16:36.887 --> 00:16:38.626 The country ignited in large-scale 00:16:38.630 --> 00:16:40.534 protest and pro-democracy rallies 00:16:40.536 --> 00:16:41.827 as part of the Arab Spring. 00:16:42.247 --> 00:16:43.834 In the midst of this, researchers at 00:16:43.834 --> 00:16:45.512 the Electronic Frontier Foundation and 00:16:45.512 --> 00:16:47.264 the Citizen Lab noticed that Syrian 00:16:47.297 --> 00:16:49.464 activists were getting hit with malware. 00:16:50.001 --> 00:16:52.084 They would get a link from a Skype account 00:16:52.352 --> 00:16:54.538 from someone they knew and trusted without 00:16:54.538 --> 00:16:56.954 realizing that account was compromised. 00:16:57.328 --> 00:16:59.597 One message read, ‘There’s a person who 00:16:59.597 --> 00:17:01.251 hates you, and he keeps talking about you. 00:17:01.424 --> 00:17:03.125 Here's a screenshot of the conversation.’ 00:17:03.473 --> 00:17:05.651 There was a link to the malicious file, 00:17:06.197 --> 00:17:08.256 and when they’d click it, Blackshades 00:17:08.270 --> 00:17:10.030 would install itself on their device. 00:17:10.482 --> 00:17:12.399 [Music] The Syrian government used 00:17:12.411 --> 00:17:14.529 Blackshades to spy on opposition 00:17:14.593 --> 00:17:16.699 activists and tried to suppress them by 00:17:16.709 --> 00:17:18.631 having total control of their computers. 00:17:19.154 --> 00:17:20.129 They could do things like get 00:17:20.141 --> 00:17:21.681 information on the next rally or 00:17:21.681 --> 00:17:23.318 delete social media accounts or 00:17:23.318 --> 00:17:24.825 look through photos and documents. 00:17:25.465 --> 00:17:26.478 Before Blackshades there was 00:17:26.479 --> 00:17:27.997 another tool called DarkComet. 00:17:28.355 --> 00:17:29.991 It was developed back in 2008 by a 00:17:29.992 --> 00:17:31.801 French programmer named Jean-Pierre 00:17:31.809 --> 00:17:34.596 Lesueur, also known as DarkCoderSc. 00:17:34.629 --> 00:17:36.106 He discontinued the program 00:17:36.108 --> 00:17:37.640 partially due to its use in the 00:17:37.650 --> 00:17:39.718 Syrian civil war and possibly due 00:17:39.719 --> 00:17:41.996 to the fear of him being arrested. 00:17:42.324 --> 00:17:44.197 Like Blackshades, DarkComet was used to 00:17:44.198 --> 00:17:46.068 spy on victims through key-logging, screen 00:17:46.071 --> 00:17:48.028 captures, and by stealing their passwords. 00:17:48.621 --> 00:17:50.207 To me, this is really fascinating because 00:17:50.436 --> 00:17:52.301 at the time, a lot of activists within 00:17:52.592 --> 00:17:54.655 the hacker group Anonymous were very 00:17:54.659 --> 00:17:56.456 active in the Arab Spring trying to help 00:17:56.459 --> 00:17:58.446 the protesters from afar by knocking the 00:17:58.446 --> 00:17:59.870 government offline and doing stuff like 00:17:59.870 --> 00:18:01.966 that, and it’s wild that the very people 00:18:02.187 --> 00:18:04.407 who wanted to assist the protesters 00:18:04.731 --> 00:18:06.443 are also the ones who are accidentally 00:18:06.449 --> 00:18:08.169 assisting the government to suppress the 00:18:08.170 --> 00:18:10.791 protesters, because tools are typically 00:18:10.792 --> 00:18:12.712 neutral and can be used by either side. 00:18:13.013 --> 00:18:14.788 When you make something so effective, 00:18:15.055 --> 00:18:16.484 people will notice it on both sides 00:18:16.484 --> 00:18:17.929 and use it for their own agenda. 00:18:18.389 --> 00:18:19.892 I don't have any knowledge of whether the 00:18:19.893 --> 00:18:21.662 creators of DarkComet or Blackshades were 00:18:21.662 --> 00:18:23.527 members of Anonymous, and it wouldn't 00:18:23.527 --> 00:18:24.805 surprise me if they were, because, 00:18:25.073 --> 00:18:27.312 well, at least the maker of DarkComet 00:18:27.341 --> 00:18:29.013 said some stuff online that looked a 00:18:29.014 --> 00:18:30.821 lot like what the Anonymous activists 00:18:30.826 --> 00:18:32.250 were saying about Syria at the time. 00:18:32.887 --> 00:18:34.571 So, this was yet another thing 00:18:34.614 --> 00:18:36.176 this malware was being used for. 00:18:36.384 --> 00:18:38.665 A $40 piece of software marketed to 00:18:38.665 --> 00:18:41.049 suspicious spouses and parents was being 00:18:41.049 --> 00:18:43.127 used to find dissidents during a war. 00:18:43.631 --> 00:18:45.131 Which, by the way, government intelligence 00:18:45.131 --> 00:18:47.288 units love using off-the-shelf tools 00:18:47.288 --> 00:18:49.041 to conduct their spying, since they 00:18:49.042 --> 00:18:50.154 don't have to burn any of their 00:18:50.155 --> 00:18:51.853 trade craft to conduct their tasks. 00:18:52.151 --> 00:18:54.104 A $40 off-the-shelf tool is way 00:18:54.104 --> 00:18:55.232 cheaper than spending a lot of 00:18:55.235 --> 00:18:56.529 time and energy developing their 00:18:56.530 --> 00:18:57.951 own tool to do the same thing. 00:18:58.618 --> 00:19:00.195 By this time Blackshades was becoming 00:19:00.485 --> 00:19:02.193 well known in the hacker communities. 00:19:02.193 --> 00:19:03.547 Hundreds of people were buying it 00:19:03.757 --> 00:19:05.362 and infecting thousands of machines 00:19:05.362 --> 00:19:07.455 with it, which also meant the victims 00:19:07.456 --> 00:19:09.231 were waking up to the nightmare 00:19:09.234 --> 00:19:10.683 happening to their computers. 00:19:10.912 --> 00:19:13.312 Victims would often get extortion e-mails 00:19:13.313 --> 00:19:15.042 where they would receive an embarrassing 00:19:15.042 --> 00:19:17.590 photo of them with some kind of demand. 00:19:18.170 --> 00:19:19.367 The obvious demand is to pay 00:19:19.367 --> 00:19:21.039 some Bitcoin and we’ll delete 00:19:21.040 --> 00:19:23.332 it, but some were downright evil. 00:19:23.640 --> 00:19:25.123 Like, people would send a half-naked 00:19:25.126 --> 00:19:27.429 photo to their victim and say, ‘Send 00:19:27.431 --> 00:19:29.869 me a fully-nude photo or I’m posting 00:19:29.871 --> 00:19:31.918 this on your own social media account. 00:19:32.305 --> 00:19:33.394 Let me show you that I have 00:19:33.395 --> 00:19:34.978 access to it.’ Then they would 00:19:34.978 --> 00:19:36.751 post a test message to prove it. 00:19:37.390 --> 00:19:40.629 It would rattle a lot of these women, and 00:19:40.630 --> 00:19:42.029 they would sometimes send the pictures 00:19:42.033 --> 00:19:44.230 that were demanded simply out of fear. 00:19:45.210 --> 00:19:46.369 [Music] Sometimes the attacker would 00:19:46.369 --> 00:19:47.761 catch a picture of their victim 00:19:47.886 --> 00:19:49.944 having sex and send them a picture 00:19:49.945 --> 00:19:52.358 of that and demand a video call over 00:19:52.358 --> 00:19:54.341 Skype, and they'd ask the women to 00:19:54.341 --> 00:19:56.949 do a five-minute sex show for them on 00:19:56.950 --> 00:19:59.695 camera as part of the ransom demand. 00:20:00.312 --> 00:20:01.556 If they didn't do it, the attacker 00:20:01.559 --> 00:20:02.934 had access to all their social media 00:20:02.935 --> 00:20:04.995 accounts and said they'd post something 00:20:04.995 --> 00:20:06.594 really terrible if they didn't to it. 00:20:07.272 --> 00:20:09.436 Blackshades was a growing problem, 00:20:09.710 --> 00:20:11.045 and victims were being almost 00:20:11.056 --> 00:20:13.156 entirely silent about the matter due 00:20:13.158 --> 00:20:14.864 to all the embarrassment and fear. 00:20:15.342 --> 00:20:17.141 I hate to say it, but it’s 00:20:17.206 --> 00:20:19.046 possible that some women died 00:20:19.054 --> 00:20:20.703 by suicide because of this. 00:20:21.276 --> 00:20:22.746 I didn't see any specific stories 00:20:22.750 --> 00:20:24.181 about that happening with Blackshades, 00:20:24.556 --> 00:20:27.330 but I’ve seen countless stories where 00:20:27.346 --> 00:20:29.966 online bullying and abuse and harassment 00:20:29.983 --> 00:20:32.299 has led to women feeling so desperate 00:20:32.299 --> 00:20:34.855 that they'd rather die than face the 00:20:34.855 --> 00:20:36.781 embarrassment or harassment anymore. 00:20:36.796 --> 00:20:38.293 It’s really tragic. 00:20:39.445 --> 00:20:40.925 We're gonna take a quick ad break, 00:20:40.926 --> 00:20:43.299 but stay with us because this is 00:20:43.299 --> 00:20:45.304 where the FBI starts to get involved. 00:20:49.760 --> 00:20:51.176 The FBI started rooting around in 00:20:51.176 --> 00:20:54.073 some hacker forums looking for crime, 00:20:54.520 --> 00:20:56.042 but they weren't focused on this. 00:20:56.173 --> 00:20:57.296 Not yet, at least. 00:20:57.379 --> 00:20:59.655 They were focused on stuff like 00:20:59.745 --> 00:21:01.941 credit card fraud and online fraud. 00:21:02.443 --> 00:21:04.573 In 2010 the FBI decided to go 00:21:04.573 --> 00:21:06.416 on the dark web and build their 00:21:06.456 --> 00:21:08.767 own stolen credit card exchange. 00:21:09.283 --> 00:21:10.335 They were hoping thieves would 00:21:10.335 --> 00:21:11.932 come and sell stolen cards and 00:21:11.932 --> 00:21:13.571 people would buy them, and then the 00:21:13.573 --> 00:21:15.129 FBI would catch them in the act. 00:21:15.423 --> 00:21:17.360 It’s wild to me that the FBI built 00:21:17.425 --> 00:21:19.303 their own carders market on the 00:21:19.305 --> 00:21:21.956 dark web, a honeypot to trap people. 00:21:22.495 --> 00:21:24.378 Not only could you buy and sell stolen 00:21:24.378 --> 00:21:26.138 credit cards there, but they sold 00:21:26.167 --> 00:21:28.508 tools for stealing credit cards, too. 00:21:29.097 --> 00:21:31.177 However, dark web forums like this only 00:21:31.178 --> 00:21:33.557 work when there’s trust, so the FBI, 00:21:33.636 --> 00:21:36.241 which was acting like dark web operators, 00:21:36.712 --> 00:21:38.767 said they’ll verify every tool before 00:21:38.767 --> 00:21:40.399 it’s allowed to be sold on the site. 00:21:40.903 --> 00:21:42.254 So, for instance, if you wanted to sell 00:21:42.254 --> 00:21:44.715 a credit card scraper, the FBI would 00:21:44.802 --> 00:21:46.841 have to vet you as a seller first. 00:21:46.980 --> 00:21:48.399 Send us one and we’ll test it, and if 00:21:48.399 --> 00:21:49.985 it’s good, we’ll approve you as a vendor. 00:21:50.706 --> 00:21:52.444 The administrators were either 00:21:52.461 --> 00:21:54.062 undercover agents or confidential 00:21:54.062 --> 00:21:55.535 sources in the investigation. 00:21:55.926 --> 00:21:57.312 They were reviewing these products 00:21:57.318 --> 00:21:59.108 to get evidence of criminal activity 00:21:59.351 --> 00:22:00.686 and to investigate the hardware, 00:22:00.764 --> 00:22:02.329 software, and methods used. 00:22:02.648 --> 00:22:04.713 The FBI was looking for credit card 00:22:04.714 --> 00:22:07.993 fraud, but then the co-creator of 00:22:07.998 --> 00:22:10.716 Blackshades, Michael Hogue, wanted 00:22:10.716 --> 00:22:13.032 to become a vendor on this forum. 00:22:13.032 --> 00:22:15.343 [Music] So, he submitted his tool, 00:22:15.447 --> 00:22:17.581 Blackshades, to show them that 00:22:17.582 --> 00:22:19.515 he has a real tool that can be 00:22:19.516 --> 00:22:21.488 used to scrape credit card data. 00:22:22.081 --> 00:22:25.906 He had no idea he was pitching the FBI. 00:22:26.860 --> 00:22:28.206 It’s kind of ironic that the 00:22:28.207 --> 00:22:29.818 co-creator of Blackshades fell for 00:22:29.818 --> 00:22:31.538 a social engineering trap himself. 00:22:31.973 --> 00:22:32.269 See? 00:22:32.275 --> 00:22:33.780 Even he’s susceptible to that. 00:22:34.426 --> 00:22:35.915 The FBI couldn't believe 00:22:35.974 --> 00:22:37.618 Michael sent them his malware. 00:22:37.963 --> 00:22:40.341 This was clear evidence of his intent, 00:22:40.573 --> 00:22:42.670 to sell Blackshades to criminals. 00:22:43.210 --> 00:22:44.912 All that language that this was 00:22:44.912 --> 00:22:46.538 only for educational purposes 00:22:46.539 --> 00:22:48.137 or for a parent to monitor their 00:22:48.137 --> 00:22:49.978 kid wasn't gonna fly anymore. 00:22:50.205 --> 00:22:51.782 When you're selling it to criminals on 00:22:51.782 --> 00:22:53.598 a dark web forum to steal credit card 00:22:53.604 --> 00:22:55.885 data with, then that’s clear intent. 00:22:56.622 --> 00:22:59.185 In 2012, the trap snapped shut. 00:22:59.445 --> 00:23:01.240 The FBI ran a sting operation 00:23:01.242 --> 00:23:02.995 called Operation Card Shop. 00:23:03.276 --> 00:23:04.808 It led to twenty-four 00:23:04.827 --> 00:23:06.245 arrests in eight countries. 00:23:06.447 --> 00:23:07.805 Almost all of these arrests 00:23:07.805 --> 00:23:09.520 were for credit card fraud, 00:23:09.980 --> 00:23:11.158 but there was one exception. 00:23:11.369 --> 00:23:13.504 One of the people arrested was Michael 00:23:13.513 --> 00:23:15.603 Hogue, the maker of Blackshades. 00:23:15.880 --> 00:23:17.397 He was charged under the Computer 00:23:17.399 --> 00:23:19.068 Fraud and Abuse Act for conspiracy 00:23:19.068 --> 00:23:20.492 to commit computer hacking 00:23:20.743 --> 00:23:22.150 and transmission of malware. 00:23:22.578 --> 00:23:24.487 Writing and selling software isn't 00:23:24.532 --> 00:23:26.136 illegal, but writing and selling 00:23:26.136 --> 00:23:27.751 software with the intent of logging 00:23:27.758 --> 00:23:29.477 keystrokes, ransomwaring files, 00:23:29.487 --> 00:23:31.115 stealing credit cards, and spying on 00:23:31.121 --> 00:23:34.360 webcams without consent is illegal. 00:23:35.211 --> 00:23:37.541 Hogue cooperated with investigators, 00:23:38.217 --> 00:23:40.825 which meant he avoided prison entirely. 00:23:41.225 --> 00:23:42.541 He was sentenced to five years of 00:23:42.541 --> 00:23:44.353 probation and he was ordered to 00:23:44.353 --> 00:23:47.767 forfeit $40,000, and had to perform 00:23:47.772 --> 00:23:49.877 500 hours of community service. 00:23:50.707 --> 00:23:51.455 So, that’s it, right? 00:23:52.264 --> 00:23:53.851 Co-creator of Blackshades arrested, 00:23:54.116 --> 00:23:56.118 2,000 people in cuffs, game over 00:23:56.154 --> 00:23:57.530 for Blackshades at least, right? 00:23:58.078 --> 00:23:59.015 Except it wasn't. 00:23:59.304 --> 00:24:01.231 The Blackshades website stayed up 00:24:01.309 --> 00:24:03.006 and operational and kept selling 00:24:03.007 --> 00:24:04.437 it to people for forty bucks. 00:24:04.972 --> 00:24:06.422 What's hilarious is around that 00:24:06.423 --> 00:24:07.749 time, Blackshades became so 00:24:07.750 --> 00:24:09.746 popular that you could find pirated 00:24:09.747 --> 00:24:11.152 versions of it floating around, too. 00:24:11.393 --> 00:24:12.991 People who didn't want to pay the $40 00:24:12.992 --> 00:24:14.712 could download it and install a pirated 00:24:14.714 --> 00:24:16.689 version and use it, and it’s hilarious 00:24:16.692 --> 00:24:19.745 because almost certainly a pirated 00:24:19.749 --> 00:24:22.720 version of Blackshades is going to come 00:24:22.720 --> 00:24:24.808 with some other malware bundled on it. 00:24:24.808 --> 00:24:26.535 You're gonna get some other spy 00:24:26.535 --> 00:24:28.734 tool installed if you install this. 00:24:29.539 --> 00:24:31.410 People were spying on the spies. 00:24:32.227 --> 00:24:32.986 Over the next year, 00:24:32.994 --> 00:24:34.439 Blackshades did not shrink. 00:24:34.455 --> 00:24:35.235 It grew. 00:24:35.687 --> 00:24:38.952 In 2013 Blackshades made its news again. 00:24:39.346 --> 00:24:42.124 REPORTER: Miss Teen USA 2013, Cassidy 00:24:42.125 --> 00:24:44.300 Wolf, was one of the victims of a hacker 00:24:44.501 --> 00:24:46.360 using the malicious software called 00:24:46.373 --> 00:24:49.045 Blackshades RAT, or remote access tool. 00:24:49.313 --> 00:24:51.490 Authorities say last year a hacker 00:24:51.491 --> 00:24:54.114 used Wolf’s personal computer webcam to 00:24:54.114 --> 00:24:56.253 take nude photos of her and threatened 00:24:56.253 --> 00:24:58.238 to post them online if Wolf didn't 00:24:58.241 --> 00:25:00.088 send him more revealing photos. 00:25:00.333 --> 00:25:02.092 Instead, she went to police. 00:25:02.495 --> 00:25:03.850 JACK: Cassidy Wolf, a high-school 00:25:03.851 --> 00:25:05.553 student from Temecula, California, 00:25:05.640 --> 00:25:07.121 got an anonymous e-mail. 00:25:07.637 --> 00:25:09.751 A stranger said he had photos of 00:25:09.752 --> 00:25:11.680 her, photos taken in her bedroom 00:25:11.977 --> 00:25:13.591 through her webcam, on her own 00:25:13.591 --> 00:25:15.221 computer after he hacked into it. 00:25:15.558 --> 00:25:17.973 He tried to extort her after threatening 00:25:17.975 --> 00:25:20.202 to release intimate photos unless she 00:25:20.202 --> 00:25:23.015 provided him with a special performance. 00:25:23.294 --> 00:25:24.805 Classic sextortion. 00:25:24.805 --> 00:25:27.030 [Music] She had no idea 00:25:27.074 --> 00:25:28.087 she was infected by this. 00:25:28.097 --> 00:25:29.901 She said her camera light never came 00:25:29.903 --> 00:25:31.507 on, and she didn't know anybody had 00:25:31.507 --> 00:25:33.069 been staring at her in her room this 00:25:33.069 --> 00:25:34.876 whole time or watching her computer. 00:25:35.468 --> 00:25:36.963 She didn't send any 00:25:37.108 --> 00:25:38.583 photos to this stranger. 00:25:38.886 --> 00:25:40.693 She went to law enforcement instead. 00:25:41.235 --> 00:25:43.565 The FBI ran the investigation, and when 00:25:43.565 --> 00:25:45.434 they figured out who was behind it, it 00:25:45.435 --> 00:25:47.536 turned out the hacker wasn't some shadowy 00:25:47.536 --> 00:25:49.062 figure on the far side of the world. 00:25:49.565 --> 00:25:51.331 It was a guy she went to high school 00:25:51.331 --> 00:25:53.742 with, a former classmate named Jared 00:25:53.764 --> 00:25:56.418 Abrahams, and she was not the only one. 00:25:56.773 --> 00:25:59.086 Jared used Blackshades to break 00:25:59.101 --> 00:26:00.496 into the computers of at least 00:26:00.529 --> 00:26:02.417 two dozen women and girls. 00:26:02.783 --> 00:26:03.976 Their ages ranged from 00:26:03.976 --> 00:26:05.684 sixteen to the early twenties. 00:26:06.308 --> 00:26:08.546 Jared got arrested by the FBI. 00:26:09.152 --> 00:26:10.964 Two months later he pled guilty 00:26:10.965 --> 00:26:12.663 to extortion and hacking. 00:26:13.257 --> 00:26:14.829 He went to court for sentencing 00:26:15.381 --> 00:26:16.919 and he was sentenced to eighteen 00:26:16.919 --> 00:26:17.977 months in federal prison. 00:26:19.171 --> 00:26:21.066 Four months after this extortion 00:26:21.066 --> 00:26:22.797 attempt, Cassidy Wolf was 00:26:22.802 --> 00:26:25.833 crowed Miss Teen USA 2013. 00:26:26.471 --> 00:26:28.056 Instead of keeping quiet about what 00:26:28.066 --> 00:26:29.937 happened to her, she did the opposite. 00:26:29.956 --> 00:26:31.934 She spent her year using that title to 00:26:31.951 --> 00:26:34.499 go to schools and talk about exactly 00:26:34.501 --> 00:26:38.095 that, webcam hacking and sextortion. 00:26:38.731 --> 00:26:40.514 CASSIDY: Yeah, so, a few years ago 00:26:40.544 --> 00:26:42.789 I was with a friend of mine, and I 00:26:42.790 --> 00:26:44.886 randomly got an e-mail, and in that 00:26:44.916 --> 00:26:46.879 e-mail he had attached photos that 00:26:46.879 --> 00:26:48.596 he had taken of me through my webcam. 00:26:49.176 --> 00:26:50.827 So, it ended up being a 00:26:51.126 --> 00:26:52.404 federal investigation… 00:26:52.405 --> 00:26:52.662 INTERVIEWER: Yeah. 00:26:52.683 --> 00:26:53.628 CASSIDY: …for three months straight. 00:26:54.400 --> 00:26:55.786 The guy that did it ended up going 00:26:55.787 --> 00:26:57.218 to prison for eighteen months. 00:26:57.679 --> 00:26:58.929 JACK: Wow, how brave of her to 00:26:58.930 --> 00:27:00.421 use her newfound popularity to 00:27:00.421 --> 00:27:02.381 fight for justice and to win. 00:27:02.811 --> 00:27:04.639 So, that’s one guy caught for spying 00:27:04.640 --> 00:27:06.809 on girls, but that didn't slow down 00:27:06.809 --> 00:27:08.444 the continual growth of Blackshades’ 00:27:08.460 --> 00:27:10.843 sale and usage, because by May 00:27:10.856 --> 00:27:13.703 2014, Blackshades was booming. 00:27:14.130 --> 00:27:15.870 By then it had infected over 00:27:15.870 --> 00:27:18.041 a million computers worldwide. 00:27:18.705 --> 00:27:20.053 [Music] When the FBI arrested 00:27:20.113 --> 00:27:21.393 Blackshades’ co-creator, Michael 00:27:21.393 --> 00:27:23.706 Hogue, he became a cooperating witness, 00:27:24.124 --> 00:27:26.251 which meant he let them see all the 00:27:26.251 --> 00:27:28.128 inside baseball of his organization. 00:27:28.345 --> 00:27:29.425 He showed the FBI how many 00:27:29.425 --> 00:27:30.957 computers it had infected, who 00:27:30.957 --> 00:27:32.107 the users were, everything. 00:27:32.652 --> 00:27:33.913 Well, actually, I don't know how 00:27:33.913 --> 00:27:35.669 much he actually showed them versus 00:27:35.670 --> 00:27:37.148 how much they saw, because they 00:27:37.149 --> 00:27:38.995 just seized all his servers and took 00:27:38.995 --> 00:27:40.250 all the computers for themselves. 00:27:40.441 --> 00:27:41.943 So, the FBI knew the malware had 00:27:41.944 --> 00:27:43.750 infected over 500,000 computers in 00:27:43.750 --> 00:27:45.595 over a hundred countries and had 00:27:45.598 --> 00:27:48.545 generated over $350,000 in sales. 00:27:49.123 --> 00:27:50.879 They had the names and addresses of more 00:27:50.879 --> 00:27:54.149 than 6,000 customer accounts, basically 00:27:54.149 --> 00:27:55.675 a customer list of all the people 00:27:55.676 --> 00:27:57.557 around the world who bought Blackshades. 00:27:58.151 --> 00:27:59.601 They shared this list with law 00:27:59.616 --> 00:28:01.344 enforcement partners around the world. 00:28:02.017 --> 00:28:04.113 So, what do you do as the FBI when 00:28:04.115 --> 00:28:05.596 you have the billing information for 00:28:05.597 --> 00:28:07.411 thousands of Blackshades customers? 00:28:07.904 --> 00:28:08.702 I know you've heard the term 00:28:08.704 --> 00:28:10.150 before; they can't arrest us all. 00:28:10.468 --> 00:28:11.259 But can they? 00:28:11.606 --> 00:28:12.631 I think they wanted to. 00:28:13.111 --> 00:28:15.381 But the FBI has a 99% conviction rate. 00:28:15.583 --> 00:28:16.860 If they arrest someone, they better 00:28:16.861 --> 00:28:18.204 have bulletproof evidence that 00:28:18.204 --> 00:28:19.679 that person committed a crime. 00:28:20.293 --> 00:28:21.613 I mean, that one user, Stefan, 00:28:21.899 --> 00:28:22.827 bought the thing using his 00:28:22.887 --> 00:28:24.553 ex-girlfriend’s credit card, right? 00:28:24.962 --> 00:28:26.300 So, just in the list of names of 00:28:26.309 --> 00:28:27.936 people who purchased it isn't enough. 00:28:28.305 --> 00:28:30.485 They need to go through each customer 00:28:30.485 --> 00:28:31.747 individually and prove that they 00:28:31.750 --> 00:28:33.060 were actually abusing the tool. 00:28:33.373 --> 00:28:34.509 Because what if someone’s just using 00:28:34.509 --> 00:28:35.871 it to monitor their child’s computer 00:28:35.871 --> 00:28:38.446 activity like the website advertised it? 00:28:38.788 --> 00:28:40.252 They didn't want to make any mistakes. 00:28:40.708 --> 00:28:43.049 So, they spent months and an enormous 00:28:43.051 --> 00:28:45.207 amount of time building cases for 00:28:45.208 --> 00:28:47.426 as many of its users as they could. 00:28:48.273 --> 00:28:49.971 They were able to get enough evidence 00:28:49.971 --> 00:28:51.864 on lots of people who were clearly 00:28:51.881 --> 00:28:54.034 abusing the tool, but those people 00:28:54.034 --> 00:28:56.199 were located all over the world, so 00:28:56.200 --> 00:28:57.561 they reached out to law enforcement in 00:28:57.561 --> 00:28:59.197 eighteen different countries to try to 00:28:59.197 --> 00:29:02.395 do a worldwide coordinated takedown. 00:29:03.315 --> 00:29:06.341 On May 19th, 2014, law enforcement 00:29:06.368 --> 00:29:08.109 officials from around the world 00:29:08.109 --> 00:29:10.426 raided the homes of Blackshade users, 00:29:10.728 --> 00:29:12.966 arresting as many people as they could. 00:29:13.473 --> 00:29:15.523 Here's Preet Bharara, the US Attorney for 00:29:15.523 --> 00:29:16.962 the Southern District of New York, in a 00:29:16.964 --> 00:29:18.918 press conference explaining what they did. 00:29:19.374 --> 00:29:21.259 PREET: We are announcing another global 00:29:21.259 --> 00:29:23.201 law enforcement operation that has 00:29:23.203 --> 00:29:26.508 exposed and crippled a frightening form of 00:29:26.508 --> 00:29:29.588 cybercrime affecting hundreds of thousands 00:29:29.605 --> 00:29:31.810 of computer users around the world. 00:29:32.262 --> 00:29:33.974 JACK: The operation led to ninety-seven 00:29:33.980 --> 00:29:36.464 arrests and 359 searches across the 00:29:36.464 --> 00:29:38.838 world, with people detained in the US, 00:29:38.878 --> 00:29:41.416 the UK, Germany, France, the Netherlands, 00:29:41.426 --> 00:29:42.867 Belgium, Austria, Switzerland, 00:29:42.878 --> 00:29:44.735 Italy, Croatia, Denmark, Estonia, 00:29:44.739 --> 00:29:46.752 Finland, Moldova, Canada, and Chile. 00:29:47.301 --> 00:29:48.623 The age of the criminals varied. 00:29:48.629 --> 00:29:50.867 Some were teenagers; a sixteen-year-old in 00:29:50.869 --> 00:29:52.690 the UK, a seventeen-year-old in Finland, 00:29:52.895 --> 00:29:54.354 an eighteen-year-old in the Netherlands. 00:29:54.591 --> 00:29:56.478 Others were adults, and I’m pretty 00:29:56.479 --> 00:29:58.639 sure it was all males who got arrested. 00:29:58.701 --> 00:30:01.667 Ninety-seven people 00:30:01.995 --> 00:30:03.588 arrested for using the tool. 00:30:04.098 --> 00:30:05.919 The reasons for using it varied, too. 00:30:05.951 --> 00:30:08.303 Some used it for voyeurism and extortion. 00:30:08.529 --> 00:30:10.153 Some used it for financial theft. 00:30:10.375 --> 00:30:12.803 Some built botnets to launch DDoS attacks. 00:30:12.900 --> 00:30:14.673 Some locked computers up with ransomware. 00:30:15.189 --> 00:30:16.997 More than a thousand data-storage 00:30:17.003 --> 00:30:19.020 devices were also seized, and they 00:30:19.020 --> 00:30:21.352 took the Blackshades website offline. 00:30:22.163 --> 00:30:23.829 One case involved an eighteen-year-old 00:30:23.829 --> 00:30:24.935 man from the Netherlands who 00:30:24.961 --> 00:30:27.665 allegedly infected 2,000 computers 00:30:27.668 --> 00:30:29.426 to take photos of women and girls 00:30:29.748 --> 00:30:31.526 who were using their machines. 00:30:31.870 --> 00:30:34.858 2,000 infections from one guy alone. 00:30:35.788 --> 00:30:38.215 In 2014 prosecutors in the US 00:30:38.286 --> 00:30:40.699 unsealed charges against five people. 00:30:40.959 --> 00:30:42.447 Here's FBI’s Special Agent 00:30:42.460 --> 00:30:43.777 in charge, Leo Taddeo. 00:30:44.318 --> 00:30:46.060 LEO: [Music] We have charged three key 00:30:46.060 --> 00:30:48.126 members of the Blackshades organization, 00:30:48.625 --> 00:30:50.188 as well as two cybercriminals in 00:30:50.188 --> 00:30:52.141 the New York area who purchased the 00:30:52.141 --> 00:30:54.012 software and used it to victimize 00:30:54.289 --> 00:30:56.190 hundreds of innocent people. 00:30:56.987 --> 00:30:57.931 Specifically we announce 00:30:57.936 --> 00:30:59.601 charges against the two alleged 00:30:59.617 --> 00:31:01.681 creators of the Blackshades RAT, 00:31:01.921 --> 00:31:04.062 Alex Yucel and Michael Hogue. 00:31:04.785 --> 00:31:07.127 Yucel, a Swedish citizen, was arrested 00:31:07.128 --> 00:31:10.387 in Moldova in November 2013, and he is 00:31:10.387 --> 00:31:12.082 awaiting extradition to the United States. 00:31:12.673 --> 00:31:13.642 The indictment against Yucel 00:31:13.652 --> 00:31:15.234 has been under seal and was 00:31:15.234 --> 00:31:16.563 made public earlier today. 00:31:17.434 --> 00:31:19.808 Mr. Hogue was arrested in Arizona 00:31:19.815 --> 00:31:22.408 in June of 2012, and subsequently 00:31:22.408 --> 00:31:25.148 pled guilty in January of 2013. 00:31:25.705 --> 00:31:27.261 Mr. Hogue has been cooperating 00:31:27.261 --> 00:31:28.463 with the government and its 00:31:28.463 --> 00:31:30.613 investigation since his arrest. 00:31:31.425 --> 00:31:32.920 We have also charged and arrested 00:31:32.921 --> 00:31:35.351 today Brendan Johnston, a former 00:31:35.355 --> 00:31:37.675 Blackshades employee who helped market 00:31:37.688 --> 00:31:40.069 and sell the RAT as well as provide 00:31:40.094 --> 00:31:41.711 technical assistance to its users, 00:31:42.204 --> 00:31:44.380 and two New York-area purchasers 00:31:44.399 --> 00:31:46.423 of the RAT who allegedly used it 00:31:46.423 --> 00:31:48.228 to steal online account information 00:31:48.551 --> 00:31:51.876 and spy on victims through webcams. 00:31:52.392 --> 00:31:53.537 JACK: When the FBI made copies 00:31:53.538 --> 00:31:54.680 of the customer list, they 00:31:54.680 --> 00:31:56.251 didn't stop at the developers. 00:31:56.335 --> 00:31:58.894 Across more than forty US cities, agents 00:31:58.907 --> 00:32:00.653 knocked on the doors of regular people 00:32:00.900 --> 00:32:03.008 who paid forty bucks, and if you were 00:32:03.009 --> 00:32:04.821 on hacking forums at the time, you would 00:32:04.822 --> 00:32:07.304 have seen panic unfold in real time. 00:32:07.657 --> 00:32:09.599 People were posting things like ‘The 00:32:09.600 --> 00:32:11.872 FBI just raided my house’ or ‘They 00:32:11.872 --> 00:32:13.895 took my computer’ or ‘What do I 00:32:13.897 --> 00:32:16.286 do?’ One guy in Canada posted that 00:32:16.287 --> 00:32:17.527 the police showed up with a warrant 00:32:17.531 --> 00:32:18.976 because his son had bought it. 00:32:19.550 --> 00:32:21.452 FBI: During this past week, FBI 00:32:21.456 --> 00:32:23.095 agents in over forty cities across 00:32:23.095 --> 00:32:24.982 the country conducted searches, 00:32:25.194 --> 00:32:27.325 interviews, and arrests of people 00:32:27.326 --> 00:32:29.121 who purchased Blackshades and may 00:32:29.124 --> 00:32:30.975 have used it to commit cybercrimes. 00:32:31.756 --> 00:32:33.478 We also passed leads to foreign law 00:32:33.478 --> 00:32:35.129 enforcement agencies around the world. 00:32:35.661 --> 00:32:37.779 In the last few days our law 00:32:37.781 --> 00:32:39.938 enforcement partners in nineteen 00:32:39.939 --> 00:32:41.482 foreign countries carried out 00:32:41.482 --> 00:32:43.069 their own law enforcement actions. 00:32:43.422 --> 00:32:45.590 The combined efforts of the FBI and 00:32:45.590 --> 00:32:48.101 foreign law enforcement marks the 00:32:48.105 --> 00:32:50.756 Blackshades takedown as one of the largest 00:32:50.801 --> 00:32:52.948 global cyber operations in history. 00:32:53.579 --> 00:32:55.197 JACK: Wow, one of the largest 00:32:55.260 --> 00:32:58.208 global cyber operations in history. 00:32:59.083 --> 00:33:00.104 Remember that guy I told you about 00:33:00.105 --> 00:33:02.169 earlier, Stefan Rigo, who infected 00:33:02.170 --> 00:33:03.707 over a dozen women with Blackshades? 00:33:03.915 --> 00:33:05.503 He was arrested in this operation, 00:33:05.503 --> 00:33:06.804 too, and he pleaded guilty. 00:33:07.140 --> 00:33:09.887 He received a suspended sentence, 200 00:33:09.923 --> 00:33:12.215 hours of community service, and seven 00:33:12.215 --> 00:33:14.163 years on the sex offender registry. 00:33:14.701 --> 00:33:16.130 FBI: Combating cybercrime is 00:33:16.131 --> 00:33:17.693 a top priority for the FBI. 00:33:18.263 --> 00:33:20.275 The charges unsealed today should put 00:33:20.297 --> 00:33:22.810 cybercriminals around the world on notice. 00:33:23.206 --> 00:33:24.781 If you think you can hide behind 00:33:24.782 --> 00:33:27.116 your computer screen, think again. 00:33:28.096 --> 00:33:29.157 Just like in the physical 00:33:29.158 --> 00:33:31.036 world, the FBI will follow the 00:33:31.041 --> 00:33:32.630 digital trail to your doorstep. 00:33:33.168 --> 00:33:34.397 If you think operating in a 00:33:34.397 --> 00:33:36.019 foreign country puts you out 00:33:36.020 --> 00:33:37.655 of our reach, think again. 00:33:38.064 --> 00:33:39.336 We have many law enforcement 00:33:39.339 --> 00:33:41.167 partners around the world who 00:33:41.167 --> 00:33:42.490 are with us in this fight. 00:33:43.212 --> 00:33:45.375 If we can't reach you, they can. 00:33:48.055 --> 00:33:49.658 JACK: Blackshades is old now. 00:33:49.669 --> 00:33:51.755 Most antivirus software can detect 00:33:51.756 --> 00:33:52.910 it, and some of the methods it 00:33:52.910 --> 00:33:54.467 used to spread no longer work. 00:33:54.702 --> 00:33:55.977 The website is gone. 00:33:55.980 --> 00:33:56.956 The forums are dead. 00:33:57.339 --> 00:33:59.202 The people who built it got arrested. 00:33:59.698 --> 00:34:00.785 But even though Blackshades 00:34:00.810 --> 00:34:02.841 today is mostly a museum piece, 00:34:03.262 --> 00:34:04.480 malware doesn't really die. 00:34:04.488 --> 00:34:05.303 It evolves. 00:34:05.488 --> 00:34:07.037 The $40 RAT with the friendly 00:34:07.039 --> 00:34:08.803 menu got replaced by newer 00:34:08.806 --> 00:34:10.029 ones with different names. 00:34:10.114 --> 00:34:11.409 The criminal economy moved 00:34:11.411 --> 00:34:12.734 into newer, more sophisticated 00:34:12.773 --> 00:34:14.766 malware that’s harder to detect. 00:34:15.152 --> 00:34:17.364 What's still true is malware wants 00:34:17.364 --> 00:34:19.282 to be sneaky and live quietly. 00:34:19.554 --> 00:34:20.592 It doesn't want the victim 00:34:20.592 --> 00:34:22.134 to know they are infected. 00:34:22.477 --> 00:34:24.556 There’s an asymmetry of knowledge 00:34:24.556 --> 00:34:26.585 here which is a huge gap, actually. 00:34:26.600 --> 00:34:28.571 Most people don't know enough about 00:34:28.572 --> 00:34:30.589 computers or how to secure them to 00:34:30.591 --> 00:34:32.966 protect themselves reliably, and these 00:34:32.967 --> 00:34:35.145 attackers rely on that lack of knowledge 00:34:35.147 --> 00:34:37.437 to hide in the wires, under the radar. 00:34:38.315 --> 00:34:39.772 Listening to shows like this 00:34:40.053 --> 00:34:41.516 starts to bridge that gap. 00:34:41.576 --> 00:34:44.197 Now you're aware that tools 00:34:44.199 --> 00:34:45.533 like this exist in the world, 00:34:45.866 --> 00:34:46.891 and they're a big deal. 00:34:47.132 --> 00:34:48.206 I mean, this one resulted 00:34:48.217 --> 00:34:49.712 in one of the largest global 00:34:49.712 --> 00:34:51.330 cyber operations in history. 00:34:51.770 --> 00:34:53.359 This isn't just some little thing. 00:34:53.360 --> 00:34:54.647 This is a huge problem. 00:34:55.062 --> 00:34:56.761 So, awareness is step 00:34:56.761 --> 00:34:58.365 number one for your safety. 00:34:58.979 --> 00:35:00.986 Be aware that messages from friends 00:35:00.988 --> 00:35:03.331 can contain malware, and it doesn't 00:35:03.331 --> 00:35:04.986 always mean that they sent it to you. 00:35:05.462 --> 00:35:06.772 It’s always good to verify things 00:35:07.024 --> 00:35:08.218 out-of-band if you're not sure. 00:35:08.220 --> 00:35:09.430 Like, if you get a text message from 00:35:09.430 --> 00:35:10.808 a friend with a suspicious link, 00:35:11.083 --> 00:35:12.156 call them on the phone and be like, 00:35:12.156 --> 00:35:13.418 hey, did you just send me this text? 00:35:13.728 --> 00:35:14.232 [Music] It’s always better 00:35:14.236 --> 00:35:15.192 to be safe than sorry. 00:35:16.036 --> 00:35:17.671 Be aware that all of the documents 00:35:17.672 --> 00:35:19.060 that you have, the photos you took, 00:35:19.265 --> 00:35:20.817 or anything you've saved on the cloud 00:35:21.351 --> 00:35:24.165 may and probably will get loose at 00:35:24.168 --> 00:35:26.534 some point and get out in the world. 00:35:26.961 --> 00:35:28.830 Data breaches are extremely common, 00:35:28.837 --> 00:35:30.481 and malware like this makes it 00:35:30.491 --> 00:35:32.509 easy for an attacker to get into 00:35:32.509 --> 00:35:33.901 your computer to see your stuff. 00:35:34.390 --> 00:35:37.063 So treat your sensitive documents and 00:35:37.064 --> 00:35:40.589 photos with much more care than normal. 00:35:41.456 --> 00:35:44.015 For me, I store stuff offline on 00:35:44.016 --> 00:35:46.138 a hard drive that’s encrypted. 00:35:46.659 --> 00:35:47.787 It’s a pain in the neck to 00:35:47.789 --> 00:35:49.058 interact with those files on 00:35:49.058 --> 00:35:50.156 there, but that’s the point. 00:35:50.175 --> 00:35:51.559 I want to make it really hard for 00:35:51.560 --> 00:35:52.984 anyone else to access it, too. 00:35:53.686 --> 00:35:55.500 There are also USB sticks that 00:35:55.500 --> 00:35:57.335 you can get which encrypt all 00:35:57.336 --> 00:35:58.865 the data on it, and to decrypt it 00:35:58.865 --> 00:36:00.382 you have to enter in a PIN code. 00:36:01.109 --> 00:36:02.913 Storing stuff on an encrypted USB stick 00:36:02.915 --> 00:36:05.025 is a pretty good idea, especially since 00:36:05.028 --> 00:36:06.610 things like mobile phones can't decrypt 00:36:06.612 --> 00:36:08.111 a hard drive to interact with it. 00:36:08.356 --> 00:36:09.828 You should treat the internet as 00:36:09.830 --> 00:36:11.243 a hostile place, because it is. 00:36:11.506 --> 00:36:13.683 Be very, very cautious when downloading 00:36:13.687 --> 00:36:15.457 things, clicking links, installing 00:36:15.457 --> 00:36:17.669 stuff, accepting pop-up options. 00:36:18.153 --> 00:36:20.105 For me personally, I try to adopt a 00:36:20.105 --> 00:36:21.946 very minimal approach when it comes 00:36:21.946 --> 00:36:23.685 to the software and apps I use. 00:36:23.981 --> 00:36:25.466 The fewer the better, because 00:36:25.466 --> 00:36:27.134 it reduces the attack surfaces 00:36:27.421 --> 00:36:28.566 for things that can go wrong. 00:36:28.962 --> 00:36:30.698 For Pete’s sake, cover your cameras. 00:36:30.700 --> 00:36:31.857 I think a lot of us are already 00:36:31.857 --> 00:36:32.982 in the habit of covering our 00:36:32.982 --> 00:36:34.662 laptop cameras, which is great. 00:36:35.110 --> 00:36:36.484 But what about your phone camera? 00:36:36.706 --> 00:36:38.351 I’m seeing cases these days that have a 00:36:38.352 --> 00:36:40.393 little slider on the back of the phone 00:36:40.393 --> 00:36:42.072 so it covers the camera, and I love that. 00:36:42.073 --> 00:36:43.104 I have one of those myself. 00:36:43.469 --> 00:36:44.881 But what about the front camera? 00:36:44.984 --> 00:36:47.248 I haven't seen any cases that cover that. 00:36:47.676 --> 00:36:49.128 There are little camera covers that you 00:36:49.129 --> 00:36:50.975 can stick on it, but in my experience, 00:36:50.975 --> 00:36:52.839 they just always pop off after a few days. 00:36:53.338 --> 00:36:54.511 I’ve actually experienced with a 00:36:54.511 --> 00:36:56.149 ton of different types of tape. 00:36:56.501 --> 00:36:57.919 Electrical tape is easy to peel off 00:36:57.930 --> 00:36:59.184 for a photo and it doesn't leave much 00:36:59.185 --> 00:37:01.324 residue, but you need to swap the tape out 00:37:01.325 --> 00:37:02.824 every month or so or else it gets gooey. 00:37:03.189 --> 00:37:04.587 I just don't trust cameras to 00:37:04.592 --> 00:37:06.725 be off when I think they're off 00:37:06.742 --> 00:37:08.154 because of stories like this. 00:37:08.490 --> 00:37:10.639 I also unplug the TV when I go into hotel 00:37:10.640 --> 00:37:12.600 rooms when I stay there, since a lot of 00:37:12.600 --> 00:37:14.042 them have cameras and mics in them, too. 00:37:14.616 --> 00:37:15.774 Of course you should keep 00:37:15.776 --> 00:37:17.607 your system and apps updated. 00:37:17.859 --> 00:37:19.527 Use a different complex password 00:37:19.529 --> 00:37:20.915 for every service app and 00:37:20.935 --> 00:37:22.120 website you have an account for. 00:37:22.370 --> 00:37:23.011 [Music] Actually, I use a 00:37:23.011 --> 00:37:24.285 different e-mail address for 00:37:24.287 --> 00:37:26.027 every account that I have as well. 00:37:26.029 --> 00:37:27.607 This way I immediately know if something 00:37:27.607 --> 00:37:29.448 doesn't look right because it’ll be for an 00:37:29.448 --> 00:37:31.395 e-mail that I only use for one thing, and 00:37:31.435 --> 00:37:32.571 now I’m getting something else from it. 00:37:32.839 --> 00:37:34.519 It’s not a bad idea to use an 00:37:34.528 --> 00:37:35.964 antivirus scan every now and then to 00:37:35.966 --> 00:37:37.589 check for malware on your devices. 00:37:37.976 --> 00:37:39.210 I’m not gonna plug any here, though, 00:37:39.210 --> 00:37:40.420 but do some research and find 00:37:40.420 --> 00:37:42.008 one that’s trusted and reputable. 00:37:42.827 --> 00:37:44.427 I’m not sure we can achieve perfect 00:37:44.429 --> 00:37:46.589 privacy or security, but like I’ve 00:37:46.590 --> 00:37:47.914 said before, when you're trying to 00:37:47.914 --> 00:37:49.406 secure your stuff, it’s kinda like 00:37:49.406 --> 00:37:51.212 running from a bear in the woods. 00:37:51.425 --> 00:37:52.665 You don't need to be faster than 00:37:52.666 --> 00:37:54.156 the bear; you just need to be faster 00:37:54.156 --> 00:37:55.555 than your friend who’s also running 00:37:55.557 --> 00:37:57.321 from the bear in order to stay alive. 00:37:57.539 --> 00:38:00.297 Your goal is to make it hard for an 00:38:00.298 --> 00:38:02.624 attacker to get to your stuff so that 00:38:02.624 --> 00:38:04.586 they just move on to an easier target. 00:38:16.332 --> 00:38:18.199 Outro: [Outro music] This show is created 00:38:18.199 --> 00:38:18.259 by me, Papa Ransom, Jack Rhysider. 00:38:18.640 --> 00:38:19.834 This one was written by 00:38:19.906 --> 00:38:21.686 motherboard, Yale Grauer. 00:38:22.096 --> 00:38:23.901 Our editor is the gigabyter, Tristan 00:38:23.901 --> 00:38:25.864 Ledger, sound design by the LFO, 00:38:25.895 --> 00:38:27.817 Garrett Tiedemann, mixing by Proximity 00:38:27.817 --> 00:38:29.174 Sound, and our intro music is by 00:38:29.178 --> 00:38:30.951 the mysterious Breakmaster Cylinder. 00:38:31.417 --> 00:38:32.279 If you haven't checked it out 00:38:32.279 --> 00:38:33.176 already, you should go listen 00:38:33.176 --> 00:38:35.365 to my other podcast called LOW. 00:38:35.589 --> 00:38:37.893 It’s the craziest story I’ve ever told. 00:38:37.995 --> 00:38:39.136 It’s the craziest story I’ve ever 00:38:39.136 --> 00:38:40.806 heard, and it just might change 00:38:40.806 --> 00:38:42.158 the way you think about life. 00:38:42.792 --> 00:38:45.372 Go find LOW wherever you listen 00:38:45.372 --> 00:38:47.837 to podcasts, spelled L-O-W. 00:38:49.513 --> 00:38:51.274 My computer just went 00:38:51.276 --> 00:38:53.598 through a messy divorce. 00:38:54.147 --> 00:38:55.625 She ended up getting a C 00:38:55.627 --> 00:38:57.605 drive, and he got the D drive. 00:38:58.230 --> 00:39:00.317 This is Darknet Diaries.