JACK: Using a computer to gain unauthorized access to data, otherwise known as a hack;
some people do it for greed. Some do it for knowledge. Some do it because they’re just
plain bored and they can. Then there are those people who do it because they’re pissed off,
really pissed off and they want things to change.
EIJAH: Sometimes it falls on us to just decide we’re going to change the world,
or just decide that we’re going to take a stand, just decide that we’re fed up.
JACK: Sometimes those fed up people do something so daring it propels them into a whole new world.
EIJAH: I was approached by a secret group of hackers. I know this sounds like,
Hollywood-crazy, I know this sounds like Mr. Robot but it’s true.
JACK: But this isn’t Hollywood. This is real life where happy endings don’t come easy,
especially deep in the heart of the web.
EIJAH: [INTRO MUSIC] My hacker name is Eijah.
Welcome to a true story from the dark side of the internet.
JACK (INTRO): My name is Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: Eijah is a smart guy. In fact, his whole family is smart.
EIJAH: My father’s an electrical engineer. My entire family has at minimum, Masters Degrees.
My mother, my sister, and her husband have PhDs, I have a Masters. For some reason my
entire family loves universities. I don’t know why, but we all have multiple degrees.
JACK: Eijah got his Master’s Degree and worked his way up. He was on a
good path. By 2007 he was sitting pretty in a sweet job at a Fortune 500 company.
EIJAH: My job at that time which was a pretty big job, I was in charge of American Express’
security portfolio. I did all the strategy and all the internal documentation for application
security vulnerability analysis, prevention of hacks, stuff like that,
but even more importantly building out their internet and intranet security systems.
We’re talking identity management, access management and control, things like that.
JACK: For someone like Eijah this job wasn’t that fulfilling. Tasks
were mundane, dry, and not very exciting.
EIJAH: When I came home at night – you can imagine I hated my job because it was boring as hell.
Nothing against American Express; they treated me like any numbered employee, fine. It was boring,
it was really boring. I stayed up late and I was trying to find something to do. [MUSIC]
JACK: At night Eijah would tinker with various electronics and do different coding projects.
EIJAH: I had an Xbox 360 which, by the way, was a great gaming console. Somebody told me
about this little-known peripheral called the Xbox HD DVD Drive. I got curious and
decided to buy one. I spent $300 and I plugged it in and I could watch my video on – through
my Xbox 360. I think it came with King Kong which was a terrible movie but nonetheless,
it worked. [KING KONG GROWLING] Then I was reading on FlashDot and some of the forums
that Toshiba drivers were available for Windows. You could plug your HD DVD drive for your 360 into
your computer ‘cause it had a USB interface and you could watch videos on your computer.
I thought this was great because who wouldn’t want to watch high-def videos while you’re working at
home on your computer, especially as a geek? That just sounds really cool. I plugged it in,
downloaded the free drivers [00:05:00] from Toshiba, plugged in a disc, started
an HD DVD media player, and proceeded to play my legally purchased content,
HD DVD movies, and guess what happened. All of a sudden the software decided that I was
a bad person and it punished me. [MUSIC] It downresed from 1080p down to 480p.
Because my monitor was too old to support the newest HDCP handshake between the computer and
the monitor itself, it assumed I was a pirate and it downresed me even though I’d spent $300 on the
drive and spent twenty, thirty bucks per movie it punished me and treated me as a criminal.
At that moment I looked and I said this isn’t fair. I’ve done everything right. I’ve bought
the drive, I’ve bought the movies. I have a licensed copy of Windows. Everything is legit
and yet I am being treated like a criminal and at that moment – here’s what happens with me;
I started to rage a bit. [KING KONG ROARS] The paranoia of groups like Toshiba and Microsoft
and the AACS LA and these groups that try to enforce DRM upon the masses, they do all this
out of fear. They’re so afraid they’re going to lose money and what they don’t realize is there’s
a greater fear that they should have and that is pissing off smart people. To piss off a small
group of minority, very intelligent hackers, is the worst thing you can do as a company.
I decided in that moment that this was basically bullshit, that I was not going to downres my 1080p
video to 480p and not going to sit there and take it. I was going to do something about it.
JACK: You might think this sounds dramatic but pretty much all of
us have felt frustrated with the stuff we’ve bought before and we’ve all been
wronged by a corporation and felt powerless. Eijah bought an HD DVD player but it would
only play at normal DVD resolution. There’s nothing HD about it. The product wasn’t doing
what it promised it could do and all because of some anti-theft protection?
Or consider this, sometimes when you buy a DVD and try to watch it, you have to sit through
five minutes of commercials. This infuriates some people so badly that they just pirate the
movie instead because the pirated copy doesn’t have ads. People want to be treated with respect
and they want the stuff they bought to work. When companies put protections in place that
get in our way and keeps us from being able to use the things we bought, it makes us mad.
EIJAH: That’s why I’m against Digital Rights Management because at the end of
the day it doesn’t protect illegal use of the content by hackers or malicious
or nefarious individuals. All it does is upset law-abiding,
good consumers like me that just want to watch it and just paid for the content to watch it.
JACK: The frustration Eijah had sat heavy with him. He felt wronged by these companies and felt
powerless but in an instant he realized he wasn’t powerless. He was a smart guy and thought maybe,
just maybe, he could circumvent all the security checks and find a way to play the
movie at full resolution anyways. But there were a few challenges. He had to figure out
how an HD DVD worked. The problem is DVD and Blu-ray movies encrypt the movies that
are on there so if you were to copy the movies off the disc onto your computer,
you wouldn’t be able to read it because the whole thing is encrypted.
This is put in place to keep people from making copies of the movies and pirating it. The company
that created the encryption is the Advanced Access Control System Licensing Administrator
which we’ll just call the AACS LA from now on. The AACS LA has figured out a way to encrypt the movie
on the HD DVD in a unique way and any company that wants to make a player to play HD DVDs has
to purchase a license from the AACS LA so they can get the decryption key to play the movie.
EIJAH: With this key you could decrypt the Blu-ray,
the entire Blu-ray and you could watch the video without any sort of digital
rights management which includes the code that would downres the video.
JACK: Eijah started looking for ways to find this encryption key. [00:10:00]
EIJAH: [MUSIC ] When I decided that I was going to break Blu-ray encryption to the extent that
I could at the moment, the first thing I did is I said okay, I’m gonna do it. The second thing is I
said okay, how am I gonna do it? I know nothing about this. I have to somehow become a quote,
unquote “expert” or at least a fake expert in this entire space where I have zero experience
with it. How do I learn what I don’t even know? You do research and you find out okay,
here’s the site. Here’s the legal entity and then you’ve got to find out which one
of these PDFs do I need to read? What’s the technical specification of the protocol?
So you find that PDF out and then you start going through it. It’s boring. It’s boring. If
you’ve ever read through an academic journal, this was far worse because this was written
by – it sounded like it was written by lawyers. That’s just how boring and dry it was. Each of
these pieces of software, pieces of hardware have these built-in virtual machines because AACS uses
an internal virtual machine to try to protect the memory and try to disguise the transaction
of the decryption routine. You have to figure out how the virtual machine works and then you
have to actually figure out the encryption exchange ‘cause there’s a lot of hashing and
encryption that goes on in order to arrive at the key. Keep in mind there are no device keys
released at this time so there’s no way to verify that my decryption code works right.
At this whole time you have no test data that’s real. Everything is an assumption based on a
whitepaper. All I had was this whitepaper and it was funny because when I was at work
designing architectures for American Express, I was thinking about this. I’d be sitting there at
lunch and I’d thinking about different ways that I could exploit the software, different ways that
I could hook in. I was a Java programmer at that time but I actually ran out of memory with Java.
The tools that I was writing in Java – I needed to manipulate memory directly which Java doesn’t do
very well, so I actually switched to a C and C++ utility pipeline just to be able to have
raw access to the memory to pull this content from the Blu-ray player. That was a lot of fun.
These utilities I wrote, they would stop and resume the process. Another one would scan memory,
look for pattern. Another one would output the history. Another one would merge different
files. Another one would try to inject content and perform key derivation. If you’re curious
what it’s like to hack, it’s kind of like going into a dark building without any sort
of light and assuming you’re walking in the right direction but not even sure that you’re
in the right room let alone the right city block, let alone the right state. You go down a path as
a hacker and you make a lot of assumptions and most of the times those assumptions are wrong.
All it takes is one wrong assumption to steer you in a totally different direction but you have to
have faith in your analysis and you have to have faith in what you believe you’re going to find,
even if all the evidence is against you. Even then, there’s zero guarantee that you’re ever
going to find what you think’s there or you’re ever going to be rewarded. Sometimes you go down
a path and you don’t know where you need to stop. You don’t know if it’s an infinite path
going in the wrong direction or you don’t know if you’re two steps away from finding the keys.
JACK: Eijah spent long hours deep into the night trying to crack the encryption keys on
the HD DVD. The programs he wrote were furiously running through the data looking for the keys. His
computer screen was scrolling with tons of text as his programs tried to decipher the encryption.
EIJAH: I’m sitting there, multiple console windows are up. I think it’s early Friday or Saturday
morning and all this data is going through the screens. It looks like something out of The Matrix
or something out of an episode of Mr. Robot. Way too many screens up. I’m drinking coffee. I’m
probably sitting there in my underwear ‘cause I didn’t even take the time to go get dressed
yet. All these things happen and then bang; no more scrolling output. Everything freezes
and there’s this key on the screen. I look at it and I’m like okay, I must have screwed up. Okay,
clearly I’ve screwed up the code. It output a key and so something’s wrong with my code.
This is after ten days of planning and [00:15:00] reading whitepapers and figuring out how I’m going
to attack programs and do I need to hook into the kernel? And all this work to get
up to this one point and I’m a hundred percent confident that I screwed up something in the
code. At that point I’m like well, crap. Okay, well let me restart the process. So I restart
the process. Bang. Same execution abort at the same line outputting the same key. I’m
thinking well, I really screwed something up. Maybe it was the code I added last night. Then
after the third time that the same value was printed to the screen I finally thought well,
maybe that’s the key. Could that actually be the key? I thought wait, did I just find it? [MUSIC]
JACK: Eijah stared at the key that was displayed on the screen.
COMPUTER: AA856A1B8A…
JACK: This was the key that would allow someone to decrypt a Blu-ray movie and make a copy of it.
COMPUTER: …6AEFBE1C04.
JACK: Eijah didn’t have a good way to test if this key was what he was
looking for. This made it hard to know whether this was it or not.
EIJAH: There’s no guarantee that the keys that I found were correct,
except cryptographically they said they were correct. According to my algorithm I was able
to derive a key from a series of routines and mathematically it was unlikely that
that derivation would have happened from random data. You stick to the math, you stick to the
crypto. Mathematically this was correct. The end result was correct. Then the panic set in.
For anybody who hasn’t really been in that moment where you’re angry,
you’ve spent two weeks deciding you’re going to literally fuck over Sony and fuck over AACS,
and you’re just enraged and you’ve got this mission. Everything you’re doing, it’s obsessive
at that point. Then you suddenly think oh, wait. I’ve done it. I’ve actually done it.
I have something in front of me that nobody else in the world has. What do you do with it? That is
when the panic hits. The heart starts beating and you start assuming that at any moment the
feds are gonna bust in the door because for some reason the feds care about Blu-ray encryption.
[MUSIC] I don’t know why, but in that moment it all sounds logical. You start to sweat,
you start to panic, and you’re like holy shit, what have I done? You’re like oh my god,
I’m in trouble. They’re going to sue me. They’re going to come after me. Then after about an hour
of pacing frantically throughout the house thinking about what you’re going to do,
you then calm down enough and you realize there’s really only two things you can
do. You can either do nothing or you can release it to the world.
JACK: Eijah was faced with a difficult decision. He knew that if he posted the keys online it would
likely damage movie distributors like Sony, which is what he wanted, but he knew this also meant
they might come after him and try to arrest him. But his fear was overcome with anger. He
was still angry at that anti-theft DRM that kept him from being able to watch his movie at full
resolution. He decided to post the encryption key he found on a popular hacker forum called Doom9.
EIJAH: But then there’s this other moment of panic that sets in that all the hackers have
and that is what if I’m wrong? [00:20:00] Because when you release it online you’ve
gotta be absolutely certain. There’s no room for error. When you release it it’s gotta be right,
it’s gotta be solid because you’re going to be having hundreds of people looking
at this. You’ve gotta be certain because if you release something and it’s not right,
your credibility is screwed. That’s the way it works in our world. You craft a message,
a paragraph or two, you explain what you found, you create a new forum post and you release it.
You see what happens. [MUSIC] The post right after mine is can somebody else confirm it,
please? Once it was released a variety of people tested almost instantly.
JACK: The community tested Eijah’s key and confirmed it worked. This would be the very
first decryption key ever made public for the HD DVD and Blu-ray discs. Other keys
had been posted for regular DVDs but not the decryption keys for the HD DVDs. This
was a bit of ground-breaking information for the hacker community to take and use.
EIJAH: Right around this time, I don’t know if this is coincidence or not,
but literally I think it was two days after I released the key, I got a knock on my door one
morning. I don’t answer knocks on doors just for so many reasons. I’m not a paranoid person but if
somebody wants to get in touch with me and they’re legitimate, they know ways to do it. Knocking on
my front door is not one. There’s a knock on my door. I didn’t answer it. After the person left,
some time went by and I was going out to go grocery shopping or whatever. I looked;
there was a sticky note left on my front door. It was from the police and it was the weirdest note.
It said please call us, we think your identity was stolen. I kid you not. This was within 48,
72 hours of me releasing the keys. At that time I was living in Arizona so this would have been
probably somebody from Peoria Police Department which is a suburb of Phoenix. At this time I was
in a hyper-state of paranoia because of the hack and the release of the information. Why
would an officer put that specific message on a little note on your front door? I didn’t get a
call on my phone. I didn’t get a piece of mail delivered from the police. Instead the officer
made an in-person visit within 72 hours of my hack specifying he thinks my identity was stolen,
please call him. This whole thing had got me on edge to the point where I
was looking over my shoulder a little bit more. [MUSIC] Here’s where it gets exciting.
The moment I released this key I was approached by a secret, I don’t know what to call it,
a secret group of hackers, a secret group of DRM code breakers and invited into this secret
society. I know this sounds like Hollywood-crazy, I know this sounds like Mr. Robot but it’s true.
I was approached – by breaking this encryption and by releasing this key I was somehow entitled
to an invitation. I had won my invitation into this dark, secret hackers group. They reached
out to me in a very secret way a few days after I released the key and invited me into
their private group. We spent the next few weeks furthering our hacks and working together which
was flattering because I never set out to be a DRM hacker. I was just pissed at Sony, that’s all.
I didn’t really care initially about the movement, or I didn’t really care initially
about DRM but the deeper I got into this the more I realized that DRM is crap. It’s draconian;
it’s a form of enslavement. It’s not fair and it’s not consumer-friendly. The deeper I got into this
the more I realized that I was on the right path and that even though my motivations to start this
journey was selfish and was based out of anger and rage, I transitioned to a much more mature
and a better state and [00:25:00] motivation in that this was bad for consumerism and this was
bad for privacy and this was bad for everybody in the world who didn’t have the skills to do
something about it. Sony and the AACS and Toshiba and all those companies that treat us like numbers
and value us only to the extent that our dollars are handed over to them, need to pay and will pay.
I was invited to this secret hacker group which was really cool. We shared all of
our insights and all of our strategies with one another and I helped other hackers get
better at breaking DRM and they did the same for me. An interesting thing about
the hacking scene is if we think we’re first to do something, we might only be first to release
it. We might not have been first to find it. There’s value in not releasing information
because if companies like Sony and Toshiba and others think that the current version of their
protocol hasn’t been broken yet, they’re under no obligation to change anything.
JACK: When Eijah posted his key on the forum it triggered a chain of events. The key is
first picked up by software developers who create the software that can easily rip or
copy a Blu-ray disc. Then the rippers get ahold of that software and begin making copies of their
Blu-ray movies. Then they post and distribute the movies to torrent sites like The Pirate
Bay and then pirates can download movies and watch them without having to buy them.
Eijah’s key caused a serious ripple effect that rang through the pirating community.
The AACS is the organization that created the encryption on the Blu-ray and they had
a plan in the event that a key like this got leaked. As soon as they became aware the key
was being used by pirates and hackers, they would change the algorithm. Yes,
the key that Eijah found would continue to work to copy Blu-ray movies up until then,
but the AACS made it so that key wouldn’t work on any new Blu-ray movies that were made after
that. The hackers would have to find a new key and break the encryption again.
EIJAH: It’s this cat-and-mouse game that goes on infinitely as long as they know the latest version
has been compromised. There’s a lot of power in breaking a system but keeping that break quiet.
JACK: But the AACS did more than just change the algorithm. They
tried hitting back at websites that posted their keys publically.
EIJAH: When the processing key was released, something funny happened. The AACS LA thought
that they could impose upon the internet their will of take-downs. They had their lawyers send
all these take-down notices to all these different sites who posted the key in articles like Dig,
FlashDot, and others. We look at it and laugh, just completely discarding this idea as utter
crazy. But that’s the world the lawyers live in; somehow they think this makes sense. They
think they are entitled to this because it is right but to them it still makes sense.
What was happening was, keys are hexadecimal values so they’re literally strings of A
through F and 1 through 9, is all they are. It’s text data. It’s something that you can
hide in so many different ways. A lot of people started disguising the numbers of
the processing key in colors and images and reversing it and disguising it in a way that
would make search algorithms impossible to find it. That was where hackers and
technologists and the community abroad just started taking advantage of the stupidity
and the lack of social and internet awareness by these executives and by the AACS LA. You
can’t declare war on an infinite army of smart people who are motivated by a greater cause.
Our cause is social justice and our cause is bigger than any sort of legal army they’re
going to be able to mount. That’s why it doesn’t really matter, at the end of the day, how many
lawyers they send after us. I find it humorous to think that lawyers still think they have any sort
of strength and any sort of influence compared to an army of hackers and an army of passionate and
motivated internet users. [00:30:00] I remember seeing at American Express – and keep in mind,
I was in director level as the security portfolio architect and I reported directly to a VP.
There was this one day while this was going on. This was probably three, four days after
I released the information. I had a one-on-one with my VP, my boss. Very, very nice lady. I
have such a great respect for her. She called me in for our one-on-one and she knew something was
up. I’m sure I was physically showing signs of stress and tension and nervousness but I
remember she was very perceptive and she said what’s wrong? Something going on? You don’t
seem like yourself. I remember that conversation because of course I denied it. I was like no, no,
maybe I just didn’t sleep well. Insert any excuse here to try to jump to the next topic, but I
remember thinking about that for years to come and I said you know what? I’m not like my old self.
I’m different. This has been a – in a lot of ways,
this has been almost an opportunity to be reborn. It was that moment forward that I
decided I’m gonna quit American Express because I just wasn’t enjoying the work. The excitement,
the adrenaline bump that I got from this whole hacker thing was very exciting. I don’t think
I’d want that sort of adrenaline bump every week in my life because I’d probably fall over dead
but it was so exciting and it was so invigorating and empowering to know that I had just, on a whim,
I made a decision to do something totally new and it worked. It’s kind of like that quote from Tron.
K FLYNN: I kept dreaming of a world I thought I’d never see. Then, one day…
S FLYNN: You got in.
K FLYNN: That’s right, man. I got in.
EIJAH: I got in. It’s that moment of euphoria, that moment where nothing is the same. You’re
not the same person, you can’t ever go back. You’ve been reborn in a lot of ways. I ended
up quitting American Express not long thereafter. I think it was about ten
months after and I went into game programming which ended up being a seven-year journey for
me where I made games such as Guitar Hero and Max Payne 3 and Grand Theft Auto V. I
was one of the lead programmers for Grand Theft Auto V for five years with Rockstar.
Some of my code is still in Red Dead Redemption 2 which is coming out this
fall. Even though I resigned from Rockstar two-and-a-half years ago,
very amicably, and I miss that studio and I miss the people I worked with,
it was part of my evolution and I resigned so that I could become an entrepreneur and
that I could do things like Demon Saw, and most recently my current company Promether.
As much as I would love to give a really exciting summary and conclusion, the saddest
part of the story is that there really hasn’t been anything that came as a result of this.
It’s almost like there’s been no retribution. There’s been no follow-up. There’s been no running
down the streets. I want to see a scene from Bourne Identity where Matt Damon’s running from
a bunch of KGB agents. There hasn’t been anything exciting like that which is probably a good thing,
right? We don’t need those things in our lives but the AACS never came after me. Sony never came
after me. It makes sense why they didn’t; they wanted this thing to go away. They wanted the
fact that their protocol and their specification was insecure and was a terribly written protocol.
They wanted people to forget that. They just wanted to make money. They wanted Toshiba and
Sony and Philips and Emerson and all these other companies to just keep paying their
licensing fee for the specification, the AACS spec. They just didn’t want the publicity. I
guess it makes sense if you think about it, why they didn’t follow-up, why they aren’t
making a stink about this or making this very political or very out in the open,
because they just want it to go away. They just want to make money. That sums up the
entire reason for the specification. It’s not about [00:35:00] protecting
us. It’s not about even protecting the content. It’s just about making money.
I sure as hell hope that there was a board meeting or at least a bunch of executives and some sort
of dumb-ass executive said why the fuck can’t we stop these hackers? It’s a rhetorical question.
You wouldn’t have us if you treated us fairly. Most of us are honest people. Most of us will
pay a fair price for content. Nobody wants to steal and cheat. We don’t want to be pirates.
The moment companies give us good content at a fair price in a convenient way, piracy is going
to be destroyed. Just treat us with respect and dignity and we will pay for your content.
You, whoever you are out there, you are listening to this right now. You are not powerless. You,
who are listening to this, are far more powerful than I am. It’s just a matter of whether tomorrow
when you wake up, you’re going to do something about the injustice in the world. I heard an
interesting quote. I don’t remember who the athlete was but somebody was interviewing this
Olympic athlete and they asked her, they said how do you do it? How do you achieve
these great feats? She said it’s really easy. Every morning when the alarm clock goes off,
I choose not to hit snooze. Sometimes the secrets to life is just not pressing the snooze button.
JACK: Eijah is currently working on two projects he created himself;
Demon Saw and Promether. Demon Saw is a secure and anonymous file sharing app. Think of it like
a decentralized Dropbox that you can run on your own server. Promether is a way to
transfer files and communicate securely even if you’re operating in an insecure network.
Both projects are free for anyone to use and Demon Saw is available now to use.
JACK (OUTRO): [OUTRO MUSIC] You’ve been listening to Darknet Diaries. To learn more about Eijah,
check out darknetdiaries.com. This show is created by me, Jack Rhysider,
with editing help from Stephanie Jens. Theme music is created by Breakmaster
Cylinder. If you like this show and want to help it out, it would mean a lot to me
if you would tell others about it. Spread the word any way you can. Thanks a lot.