Speaker 1: Welcome to tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tex Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with I Heart Radio
Speaker 1: and I love all things tech and this is the
Speaker 1: tech news for Tuesday, auguste. Yesterday, telecrrier T Mobile confirmed
Speaker 1: reports that the company had been hacked. The site Motherboard
Speaker 1: reported that hackers were offering up for sale private data
Speaker 1: of T mobile customers, including social security numbers and driver's
Speaker 1: license numbers, which prompted the company to conduct an internal investigation.
Speaker 1: While T Mobile did say that the investigation showed someone
Speaker 1: had gained unauthorized access to T Mobile's system, the company
Speaker 1: has not yet determined that any personal data was compromised,
Speaker 1: and that the company quote cannot confirm the reported number
Speaker 1: of records affected or the validity of statements made by
Speaker 1: others end quote. According to Motherboard, the person who tipped
Speaker 1: them off to the fact that this breach happened. A
Speaker 1: seller of this data, said that their group compromised information
Speaker 1: relating to one hundred million people. Motherboard confirmed that the
Speaker 1: samples of data that they saw did in fact reflect
Speaker 1: accurate information about T Mobile customers, and the sellers are
Speaker 1: peddling the info on the dark web, asking for bitcoin
Speaker 1: and exchange from millions of records of personal data. Motherboard
Speaker 1: also reported that the sellers had lost access to the
Speaker 1: back door entry to T Mobile servers, but they had
Speaker 1: already downloaded all the data, so you know, that's not great.
Speaker 1: The damage was already done. This is why businesses that
Speaker 1: monitor stuff like the dark web and your information that
Speaker 1: may or may not beyond it are getting more popular
Speaker 1: because it's a way for you to find out if
Speaker 1: you have had your private data compromised. I may need
Speaker 1: to do a full episode about that kind of stuff
Speaker 1: to talk about. You know, what tools are out there,
Speaker 1: how useful are they? What you should do if you
Speaker 1: find out that your information has been included in one
Speaker 1: of those breaches, because it certainly can be really overwhelming
Speaker 1: when it happens. Alright, so hackers stole data from T Mobile.
Speaker 1: But our next story is about how the Dallas, Texas
Speaker 1: Police Department lost an enormous amount of data all by themselves.
Speaker 1: And by enormous, I'm talking about twenty two terra bytes
Speaker 1: of information. And this relates to a data migration, which
Speaker 1: is a process where I mean it's what sounds like,
Speaker 1: you're moving information from you know, one storage receptacle to another,
Speaker 1: and it's always a huge pain in the protocus to
Speaker 1: do this kind of thing, particularly as amount of information
Speaker 1: gets larger. Just think of every time that you've bought
Speaker 1: a new phone and just the process of setting everything
Speaker 1: up on there and transferring all your information from your
Speaker 1: old phone to your new phone. Now that has slowly
Speaker 1: become easier to do, but still kind of a hassle.
Speaker 1: You know, it's time consuming and you just want to
Speaker 1: be able to use your new thing. Well, multiply that
Speaker 1: times I don't know, a bajillion, and you get the
Speaker 1: idea of what it's like to move the data of
Speaker 1: an entire organization from one resource to another, like if
Speaker 1: you're going from one cloud based service to a different
Speaker 1: one or something like that. And in this case, during
Speaker 1: that process, the Dallas Police Department managed to delete that
Speaker 1: mountain of information. And of course we're talking about the police,
Speaker 1: so this can, and in this case did include some
Speaker 1: incredibly important, crucial and private information, including case files related
Speaker 1: to a murder trial. So obviously that's beyond disastrous. And
Speaker 1: the actual data deletion happened way back in April of
Speaker 1: twenty one, but the police Department did not report on
Speaker 1: it until this month, and I suppose part of that
Speaker 1: reason was that the department was going into emergency data
Speaker 1: recovery mode, and to their credit, they were able to
Speaker 1: restore around fourteen terabytes of data, but that still leaves
Speaker 1: eight terabytes of information that have been lost forever, and
Speaker 1: that includes some criminal case files that were created before July,
Speaker 1: though the police department says they don't actually know the
Speaker 1: precise number of case files that have been lost. And honestly,
Speaker 1: I am shocked that there wasn't a more comprehensive data
Speaker 1: backup strategy in place for this, because redundancy is a
Speaker 1: key feature in data management and it's absolutely critical when
Speaker 1: stuff like this happens. That's why you have backup systems.
Speaker 1: It's why you should have a backup system just in
Speaker 1: case something goes wrong with your data, so that you
Speaker 1: still have access to it if the worst should happen,
Speaker 1: whether that's a service now goes offline because it goes
Speaker 1: out of business, or you have a hard drive that fails.
Speaker 1: Moving on, a security researcher named Vola Demir Bob Diachinko,
Speaker 1: and I'm certain I've butchered the pronunciation of his name,
Speaker 1: and I apologize anyway. He uncovered an online list that
Speaker 1: most certainly should not have been uncoverable. It should have
Speaker 1: been hidden, and it was a terrorist watch list. Apparently
Speaker 1: the Terrorists Screening Center created the files and stored them
Speaker 1: online without turning off the index feature. So search engines
Speaker 1: have these things called spiders, and these are little bits
Speaker 1: of code just crawl the web and return results back
Speaker 1: to search engines so that the search engines can continuously
Speaker 1: update their indices. That way, when you search for a
Speaker 1: particular topic, you have a chance of getting really recent
Speaker 1: results if those happen to be the best match to
Speaker 1: whatever your query is. But you might not want your
Speaker 1: website to enter a search engines index. Let's say that
Speaker 1: you've got a website and you just want a certain
Speaker 1: number of people to have access to it. You don't
Speaker 1: need it to be accessible to the world at large.
Speaker 1: So you can actually go into HTML and create a
Speaker 1: little tag so that web spiders just pass over your
Speaker 1: your website, they don't index it, so it won't show
Speaker 1: up in search that You can do other things too,
Speaker 1: like obviously, you could password protect the site as well.
Speaker 1: But that's one thing you can do is just not
Speaker 1: have it show up in search. Well, apparently someone neglected
Speaker 1: to take that step while uploading these files to a server,
Speaker 1: and search engines thus indexed these files, and Diachinko was
Speaker 1: able to read the information in the files through the
Speaker 1: search engines like it wasn't hidden or password protected, and
Speaker 1: it included tons of personal information, you know, all the
Speaker 1: stuff you would expect, like the name of the person,
Speaker 1: their date of birth, their citizenship status. But it also
Speaker 1: included some other stuff that you don't typically see on
Speaker 1: these kinds of lists, like whether or not that person
Speaker 1: is also on a no fly list. And Diachinko said,
Speaker 1: to make matters worse, the files had no password protection,
Speaker 1: so anyone could access them, and Diachinko reported his findings
Speaker 1: to the Department of Homeland Security. Now, according to the Verge,
Speaker 1: the files were first indexed on July nine of this year,
Speaker 1: and they were still up and available for search three
Speaker 1: weeks later before the DHS finally removed them. So here
Speaker 1: we have another example of human error leading to a
Speaker 1: mass of security breach and privacy breach with two million
Speaker 1: records affected. Pretty awful stuff. And when I say pretty
Speaker 1: awful stuff. I mean, these are people who are on
Speaker 1: a terrorist watch list. Some of those people are innocent,
Speaker 1: like not all of those people are guilty of being
Speaker 1: associated with or being involved in terrorist activities, And so
Speaker 1: you realize that this creates are a true devastating breach
Speaker 1: of their privacy. Although I guess it could also alert
Speaker 1: them that they were, you know, on a watch list.
Speaker 1: But yeah, terrible stuff. Moving on, Here's something I'm sure
Speaker 1: a lot of you already knew, but because I have
Speaker 1: very old, only learned about it today. There is an
Speaker 1: online vigilante group that tends to focus on TikTok accounts
Speaker 1: that's been pretty busy lately. The group is called the
Speaker 1: Great Londini l in D I and I, and in
Speaker 1: many ways it reminds me of the anarchic activist group Anonymous.
Speaker 1: Just like that famous collective, the Great Landini relies on
Speaker 1: a masked visage to serve as its symbol and spokesperson,
Speaker 1: so Anonymous. The symbol of choice is a guy Fox mask,
Speaker 1: which is referencing one of the conspirators who plotted to
Speaker 1: ignite barrels of gunpowder hidden underneath Parliament hundreds of years ago.
Speaker 1: That plan did not go well. Remember remember the Great
Speaker 1: Landini's mask of choice has a joker like smile and
Speaker 1: creepy hollow eyes, though the profile on YouTube for the
Speaker 1: Great Landini includes other people who are actually wearing guy
Speaker 1: Fox masks as well, so they also appropriate that imagery. Well.
Speaker 1: They claim they are dedicated to quote exposing racist bullies,
Speaker 1: scammers and trolls end quote h the racist singular is
Speaker 1: in there, so I'm sure they meant racists. So the
Speaker 1: group targets people that they identify as being bullies and racists, etcetera,
Speaker 1: and then they publish those people's identities online, kind of
Speaker 1: like dock sing. This includes informing people like the parents
Speaker 1: of kids who are being trolls and displaying these kinds
Speaker 1: of behaviors online, or employers in the case of you
Speaker 1: know adults. They claim to consist of a collective of
Speaker 1: people with cybersecurity and military experience, which I suspect is
Speaker 1: at best and exaggeration. The website insider dot com reported
Speaker 1: that the group says they can get to the real
Speaker 1: identity of someone posting you know online on like TikTok
Speaker 1: in eight or nine clicks, and it implies that they're
Speaker 1: using some clever ways to figure out who is behind
Speaker 1: any given account, and you know, digging down and finding
Speaker 1: that information out. I suspect that there are some much
Speaker 1: more simple methods that are being employed in many of
Speaker 1: these cases. For example, the targets, the bullies or whatever,
Speaker 1: they could be posting stuff that just contains identifiable information
Speaker 1: in it. So they could be posting TikTok videos where
Speaker 1: you're like, oh, I can totally tell who this person is,
Speaker 1: or they might include links to their other social profiles
Speaker 1: and that makes it really easy. You just cross reference
Speaker 1: and you get all the information you need about who
Speaker 1: that person is, Like if it's a Facebook account, it
Speaker 1: might include their location and everything, and their employer and
Speaker 1: you know, spouse, all that kind of stuff. So, in
Speaker 1: other words, I'm not entirely convinced that this is a
Speaker 1: case where people are using any sort of sophisticated approach
Speaker 1: to get the information. And I'd frankly be surprised if
Speaker 1: they really did have extensive cybersecurity or military experience, because
Speaker 1: they don't need it to do what they're doing. TikTok
Speaker 1: has banned accounts that are associated with this group multiple times,
Speaker 1: and the group consistently keeps making new accounts. As for
Speaker 1: what I think about all this, well, I think vigilante
Speaker 1: justice is not great, but I also acknowledge that there's
Speaker 1: not really a good system in place to hold trolls
Speaker 1: accountable for their actions. I mean, typically it comes down
Speaker 1: to the individual platforms, and as a rule, platforms are
Speaker 1: not super responsive to this kind of stuff, usually because
Speaker 1: it's just operating on such a scale that it becomes
Speaker 1: impractical to react to these things, which just allows the
Speaker 1: problems to fester. And that's really an issue because the
Speaker 1: actions these bullies make, like the things they do, the
Speaker 1: way they can harass people, those can sometimes lead to tragedy.
Speaker 1: I mean there are cases where bullied people have gone
Speaker 1: down a very self destructive pathway. So I understand the
Speaker 1: motivation of the group to see justice done and to
Speaker 1: convince bullies to stop being bullies, but I would rather
Speaker 1: much see a much more concerted effort to create a
Speaker 1: system of justice, like an an official approach, as opposed
Speaker 1: to a self appointed vigilante group. But I also realized
Speaker 1: that a lot of people have serious doubts that you
Speaker 1: could ever really make a just system and have it work.
Speaker 1: We have a couple more news stories But before we
Speaker 1: get to that, let's take a quick break. We're back.
Speaker 1: Only Fans, the website best known for hosting content creators
Speaker 1: who specialize in not safe for work types of content,
Speaker 1: is trying to get some broader acceptance in the app
Speaker 1: store world. See, because Only Fans is mostly associated with
Speaker 1: nudity and sexual content, the company has not been able
Speaker 1: to secure permission from Apple and Google's respective app stores
Speaker 1: to launch an app for users. So now Only Fans
Speaker 1: is promoting a new ish app called o f TV,
Speaker 1: which will allow Only Fans creators to make content specifically
Speaker 1: for this app, as long as that content is in
Speaker 1: the safe for work category. So there's a strict policy
Speaker 1: against stuff like nudity and sexual content, So if creators
Speaker 1: want to make stuff for o f TV, they have
Speaker 1: to follow those rules that allows Only Fans to have
Speaker 1: an app in the app stores without violating those app
Speaker 1: stores policies. Now, I did say it's a new ish
Speaker 1: app because it's actually been available since January of this year,
Speaker 1: but Only Fans is only just recently started to, you know,
Speaker 1: tell people that this app even exists. Now, maybe that
Speaker 1: was an effort to allow interested content creators to make
Speaker 1: stuff that could live on this app, so that the
Speaker 1: app would have some content available as soon as folks
Speaker 1: downloaded it, rather than having a content app with no
Speaker 1: content on it, which isn't very interesting. I'm sure the
Speaker 1: Only Fans reached out to some of their top creators
Speaker 1: and invited them to participate in this. Not Only Fans
Speaker 1: is really trying to branch out of the adult content
Speaker 1: niche and become more of a broad content creator platform
Speaker 1: that allows people to monetize their work, similar to platforms
Speaker 1: like Patreon. That being said, the app seems more like
Speaker 1: an outreach effort, like a marketing effort, rather than a
Speaker 1: money maker. Tim Stokely, the CEO of Only Fans, told
Speaker 1: Bloomberg that the content on O f TV is quote
Speaker 1: not being monetized and there's no direct impact on creators
Speaker 1: earnings end quote. Which if that's the case, then I
Speaker 1: question why content creators already on Only Fans, those who
Speaker 1: are you know, firmly established as creating adult content, in particular,
Speaker 1: why they would ever bother to make stuff for O
Speaker 1: f TV if they aren't allowed to create the kind
Speaker 1: of content that actually brings them revenue, and if there's
Speaker 1: no revenue to be made by creating content for o
Speaker 1: f TV, at least not directly. Then that seems like
Speaker 1: a pretty big investment of time and effort for little
Speaker 1: to no payoff, unless your goal is to lure people
Speaker 1: to go to the Only Fans dot com site and
Speaker 1: then become a supporter there. So, in other words, to
Speaker 1: hint at the sort of content you would be able
Speaker 1: to get on the Only Fans site, but you couldn't
Speaker 1: actually show it on o F TV. And it's possible
Speaker 1: also the Only Fans commissioned content from creators, and like, yeah,
Speaker 1: there's no monetization directly through the app, but only Fans
Speaker 1: may have paid creators to create stuff to live on
Speaker 1: o f t V. I wouldn't be surprised to learn that.
Speaker 1: I do not know for the record whether that happened
Speaker 1: or not, but it wouldn't shock me to learn that
Speaker 1: that's what was going on. Now. Some people might just
Speaker 1: want to make fun stuff for free, and there's nothing
Speaker 1: wrong with that, you know, if you want to do that,
Speaker 1: you should totally do that. But as a content creator myself, no, certainly,
Speaker 1: not only fans creator, no one, No one wants that.
Speaker 1: But I have to really be into something in order
Speaker 1: to do it for free because my job has me
Speaker 1: creating content every ding dang day, and if there's no
Speaker 1: return on that, it feels like I might be taking
Speaker 1: away time that I could use to do other stuff. Anyway,
Speaker 1: it will be interesting to see how o f TV
Speaker 1: plays into the overall strategy, both for only fans the
Speaker 1: company and for the content creators making content for that site. Next.
Speaker 1: Tesla is once again under the microscope for its autopilot feature.
Speaker 1: This time, the National Highway Traffic and Safety Administration or
Speaker 1: in ht s A, is looking into the company due
Speaker 1: to a series of accidents in which Tesla vehicles that
Speaker 1: were in autopilot mode collided with parked emergency vehicles. According
Speaker 1: to the nht s A, since two thousand eighteen, there
Speaker 1: have been eleven incidents in which Tesla vehicles in the
Speaker 1: driver assist mode, whether that was autopilot or the other
Speaker 1: style of driver as system modes, collided with vehicles at
Speaker 1: a first responder emergency scene, and those crashes resulted in
Speaker 1: seventeen people being injured and in one case, one person died.
Speaker 1: And we're starting to see an increasing amount of pressure
Speaker 1: on companies that are creating autonomous vehicle systems like government pressure. Now,
Speaker 1: in an ideal implementation, autonomous vehicles would drastically reduce the
Speaker 1: number of accidents and thus injuries and deaths on the road.
Speaker 1: The vast majority of accidents on the road are due
Speaker 1: to human error. So you take human error out and
Speaker 1: you will eliminate a ton of accidents, assuming you have
Speaker 1: an idea real implementation of autonomous driving technology. But we
Speaker 1: are a far way away from having that ideal implementation.
Speaker 1: No one has created a system that we could call
Speaker 1: truly autonomous. Tesla maintains that autopilot is a driver assist feature.
Speaker 1: It is not a true autonomous mode, but it also
Speaker 1: promotes its vehicles as having quote all the hardware needed
Speaker 1: in the future for full self driving in almost all
Speaker 1: circumstances end quote. So essentially it's saying, yeah, this isn't
Speaker 1: an autonomous vehicle, but it's got everything that can make
Speaker 1: it an autonomous vehicle. So it's really just you know,
Speaker 1: when we throw the switch is that's kind of the messaging.
Speaker 1: That's what sounds like. I'm not saying that's specifically what
Speaker 1: they're saying. That's how a lot of people interpret it,
Speaker 1: which kind of comes across as a bit of a
Speaker 1: mixed message, and I think ultimately we have to hold
Speaker 1: Tesla owners accountable for their choices, such as using a
Speaker 1: feature like autopilot beyond its intended function, but still a
Speaker 1: good deal of responsibility also has to fall on the
Speaker 1: company itself. The US investigation into Tesla covers all models
Speaker 1: from two thousand and fourteen to present day and could
Speaker 1: potentially lead to new rules about when features like autopilot
Speaker 1: are allowed to be used and when they are not.
Speaker 1: Back in March, a Chinese military satellite called Yunhai one
Speaker 1: Dash zero two broke apart in orbit, and at the
Speaker 1: time no one was really sure what caused it to happen,
Speaker 1: so there was one hypothesis that perhaps the satellite's propulsion
Speaker 1: system had a critical failure that led to an explosion,
Speaker 1: something that the Chinese company behind Yunhai said was not likely.
Speaker 1: An astrophysicist named Jonathan McDowell has now determined that the
Speaker 1: true cause of yun Hi's demise was a high speed
Speaker 1: space collision. He determined that a piece of debris measuring
Speaker 1: between four and twenty inches wide collided with un high
Speaker 1: and on further analysis, determined that this debris came from
Speaker 1: a Senate to rocket that was used by Russia to
Speaker 1: launch a spy satellite in orbit all the way back in.
Speaker 1: This piece that was flying around in orbit is one
Speaker 1: of eight known pieces from that rocket that satellite trackers
Speaker 1: have kept tabs on over the years, saying here's some
Speaker 1: more space debris that we have to be on the
Speaker 1: lookout for. The collision with un High generated even more
Speaker 1: space debris, which of course means now there's even more
Speaker 1: stuff whizzing around in orbit that could potentially create hazards
Speaker 1: for various types of spacecraft, whether that has people aborted
Speaker 1: or not. Now, I will remind you space is big,
Speaker 1: or as Douglas Adams put it, space is big, really big.
Speaker 1: But the orbits where we tend to put stuff are
Speaker 1: starting to get a little crowded, and that means that
Speaker 1: with each passing year there are more opportunities for collisions
Speaker 1: to happen, and depending upon what collides with what we
Speaker 1: could see consequences here on Earth as various services get disrupted. Now, granted,
Speaker 1: not every satellite is inhabiting the same morbid. We have
Speaker 1: some satellites that are in really far out orbits around Earth,
Speaker 1: so it's not like everything is crowded into the same space,
Speaker 1: but it is getting a little more you know, rough
Speaker 1: out there. Also, the increase in space junk means it's
Speaker 1: harder for astronomers to see celestial bodies here on Earth's surface,
Speaker 1: Like there are more things blocking our view beyond our
Speaker 1: own orbit. And that's not great either. Not that I
Speaker 1: think that this is necessarily going to get better anytime soon,
Speaker 1: but the problem is becoming increasingly evident. I have a
Speaker 1: couple more stories to get to. But before we jump
Speaker 1: on that, let's take another quick break. Yak and e yak.
Speaker 1: We're back, as is yik yak. I'm on track. Okay, So,
Speaker 1: for those of you who have never heard of yik yak,
Speaker 1: back in two thousand and fourteen, you could download this
Speaker 1: app called yik yak and you could use it as
Speaker 1: a kind of hyper local social networking platform. So the
Speaker 1: idea was, at least in the original incarnation of yek yak,
Speaker 1: that you could see what people were posting in your
Speaker 1: immediate area. You could also post, and people in your
Speaker 1: area could read what you wrote wrote, but you would
Speaker 1: only see things that have been posted within a five
Speaker 1: mile radius of your current location. And on top of that,
Speaker 1: the whole thing was anonymous, so people would anonymously post
Speaker 1: these things. The idea was for people to share fun
Speaker 1: and from aation that was relevant to the specific location.
Speaker 1: But if you're thinking hum an app that lets you
Speaker 1: post anonymously about, you know, anything within your hyper local region,
Speaker 1: I bet people could use something like that to really
Speaker 1: troll the heck out of other folks, Well, you would
Speaker 1: be right. Bullying, doxing, harassment, and more were rampant on
Speaker 1: yik yak, which got particularly popular around college campuses. It
Speaker 1: got to the point where the company had to geo
Speaker 1: fence the app and cut it off for certain regions,
Speaker 1: like around high schools and stuff, because people were using
Speaker 1: it to do all sorts of things like spread rumors
Speaker 1: about others, and because it's anonymous, you never really knew
Speaker 1: who it was that was saying these things. And it
Speaker 1: got bad enough, and the heat got intense enough that
Speaker 1: ultimately yik yak changed up its policy and it required
Speaker 1: users to establish a hand doll So it kind of
Speaker 1: removed that anonymous feature because now there was a handle
Speaker 1: associated with a message, it wasn't just anonymous yik yak user.
Speaker 1: The company was already kind of spiraling at that point,
Speaker 1: and ultimately it went out of business and now it
Speaker 1: is under new management as a new group came in
Speaker 1: and purchased the intellectual property to yik yak earlier this year,
Speaker 1: and they are launching a new version of the app,
Speaker 1: and anonymity is back. That is a feature that has returned,
Speaker 1: as is the hyper local focus of the app itself. However,
Speaker 1: the new company says it has a zero tolerance policy
Speaker 1: for harassment and bullying. It's got a list of rules
Speaker 1: that users are supposed to follow or else they face
Speaker 1: getting banned from the service. Because while they might be
Speaker 1: anonymous to all the other users, yik yak on the
Speaker 1: server side can see which account posts what. There's also
Speaker 1: a way apparently to up thee or down vote posts
Speaker 1: on yr kik. I say, apparently, because I have not
Speaker 1: downloaded it myself. Uh, And the company says that posts
Speaker 1: that receive a minus five on that scoring system of
Speaker 1: people down vote it, those kinds of messages won't show
Speaker 1: up anymore for other users. So if someone's been talking
Speaker 1: trash and enough people in your area have voted it
Speaker 1: down and you log into yer kik, you won't even
Speaker 1: see it because it will be below that threshold. Now,
Speaker 1: whether all this is going to prevent abuse of the
Speaker 1: platform remains to be seen. I'm somewhat weary of the
Speaker 1: whole thing because I saw how ugly things got the
Speaker 1: first time around when yek yak was a thing. And
Speaker 1: if you ever want to hear about the most uncomfortable
Speaker 1: I've ever been in my job, asked me about the
Speaker 1: time I was told to moderate a south By Southwest
Speaker 1: panel about yik yak, because I still have stressed dreams
Speaker 1: about that day. Finally, sometimes hackers find an exploit in
Speaker 1: a system and then you know, they exploit it, or
Speaker 1: they might sell that knowledge to someone else so that
Speaker 1: that someone else can go and exploit the vulnerability, potentially
Speaker 1: getting caught in the process, while the hacker just pockets
Speaker 1: whatever money was spent in order to get that information.
Speaker 1: But sometimes, and actually this happens more frequently than it
Speaker 1: tends to be reported, hackers will actually reach out to
Speaker 1: a company and alert them of an exploit that they found,
Speaker 1: and then they might get a reward for their good
Speaker 1: deed because the company will say, oh my gosh, thank
Speaker 1: you for telling us about this. They patch up the vulnerability,
Speaker 1: and they reward the hacker That's what happened recently with
Speaker 1: a hacker who reported an issue with valves payment process
Speaker 1: on Steam. Now, in case you're not familiar, Steam is
Speaker 1: an online storefront for computer games, and it also has
Speaker 1: some social networking features. But I think most people just
Speaker 1: view it as a way to purchase and organize a
Speaker 1: computer game library. Maybe that's just my own experience, because
Speaker 1: that's all I use it for. Anyway. This is all
Speaker 1: digital download stuff, right You go on the online store,
Speaker 1: you buy a game, you download it to your computer.
Speaker 1: It's just the online version of what we used to
Speaker 1: do by going into old brick and mortar stores. And
Speaker 1: Steam's success has been the Valve really hasn't need needed
Speaker 1: to spend, you know, nearly as much time doing what
Speaker 1: it used to do, which was that it used to
Speaker 1: make a lot of computer games, and now it doesn't. Anyway,
Speaker 1: this hacker found out that if he created an email
Speaker 1: address with the term amount five thousand in the email
Speaker 1: address and then registered that email with Steam, and then
Speaker 1: went through the process of allowing Steam to put a
Speaker 1: one dollar charge to their payment system. This is a
Speaker 1: way for Steam to verify that whatever payment process you
Speaker 1: put in is legit. Then he would receive five thousand
Speaker 1: dollars in his Steam wallet just by going through this approach.
Speaker 1: So the email just had to have that term in
Speaker 1: it and Steam would award that amount of money to
Speaker 1: his wallet. So he could have just kept on making
Speaker 1: accounts like that and using these fake Steam dollars to
Speaker 1: buy tons of games. But instead the hacker let Valve
Speaker 1: know about the exploit, and the company patched the problem
Speaker 1: and then rewarded the hacker with a bug bounty of
Speaker 1: seven thousand, five hundred dollars. And I think that's just
Speaker 1: a nice story all around the idea of someone saying, hey,
Speaker 1: you should know about this, because people, if they found
Speaker 1: out about it, would totally exploit it, and you would
Speaker 1: be out a huge amount of money because you'd have
Speaker 1: all this money you would owe developers. It would be
Speaker 1: just manufactured cash, to be nothing flowing into Valve and
Speaker 1: everything flowing out. So it was a good thing to report. Um, Yeah,
Speaker 1: I like stories like this. Hackers do this. I should
Speaker 1: also add that there are cases, plenty of cases where
Speaker 1: you will learn about hackers who find it a vulnerability.
Speaker 1: They'll report it to whichever entity you know is responsible
Speaker 1: for that software and nothing gets done. That is incredibly
Speaker 1: irresponsible and something that I hate to see. And there's
Speaker 1: so many stories about it where you're like, hacker X
Speaker 1: finds out that company Y has some major vulnerability and
Speaker 1: its software reports it to the company. The company doesn't respond,
Speaker 1: the company doesn't change anything or patch the vulnerability. Then
Speaker 1: the hacker then goes forward with the information going public,
Speaker 1: saying hey, there's this massive vulnerability in the software package,
Speaker 1: and then the company is saying, why are you telling
Speaker 1: everybody this? Well, if the hacker has gone through the
Speaker 1: process of alerting the company, then it's the company's responsibility
Speaker 1: to respond and get that problem fixed. And if that
Speaker 1: doesn't work, you know someone else is going to find
Speaker 1: that exploit and take advantage of it. So I think
Speaker 1: it's the only reasonable thing for a hacker to do
Speaker 1: is to come forward and say, hey, I gave them
Speaker 1: every opportunity to fix this, they didn't do it, so
Speaker 1: maybe now they'll do it now that the whole world
Speaker 1: knows about it. Um kind of brutal approach. But the
Speaker 1: flip side of that is if a company doesn't fix
Speaker 1: that problem, someone else will find it and they might
Speaker 1: not have the moral compass to reach out to the
Speaker 1: company and instead might exploit it and harm either the
Speaker 1: company or the company's customers, or both in the process. Okay,
Speaker 1: that's it for this episode and the news for Tuesday,
Speaker 1: August one. If you have suggestions for topics I should
Speaker 1: cover in future episodes of tech Stuff, reach out to me.
Speaker 1: The best way to do that is over on Twitter.
Speaker 1: The handle we use for the show is text stuff
Speaker 1: HSW and I'll talk to you again really see. Text
Speaker 1: Stuff is an I Heart Radio production. For more podcasts
Speaker 1: from I Heart Radio, visit the i Heart Radio app,
Speaker 1: Apple Podcasts, or wherever you listen to your favorite shows.