WEBVTT - A Hacker Saved The Internet 0:00:00.280 --> 0:00:04.720 From UFOs to psychic powers and government conspiracies. History is 0:00:04.840 --> 0:00:09.119 riddled with unexplained events. You can turn back now or 0:00:09.240 --> 0:00:12.160 learn this stuff they don't want you to know. A 0:00:12.280 --> 0:00:13.920 production of iHeartRadio. 0:00:24.320 --> 0:00:26.920 Hello, and welcome back to the show. My name is 0:00:27.080 --> 0:00:31.920 nol Our, buddy Matt is on adventure as Ben. You're Ben, and. 0:00:32.000 --> 0:00:35.200 Matt will be returning soon. They do call me Ben. 0:00:35.360 --> 0:00:39.400 We're joined as always with our super producer Paul, Mission 0:00:39.479 --> 0:00:43.360 Control decand most importantly, you are you. You are here, 0:00:43.400 --> 0:00:46.680 and that makes this the stuff they don't want you 0:00:46.760 --> 0:00:51.400 to know. Noel hacking, hacking? 0:00:52.680 --> 0:00:54.880 Can you hack it? Can you hack it? 0:00:56.120 --> 0:00:59.360 What's the uh what's the first thing you think of 0:00:59.760 --> 0:01:01.080 when you think of hacking. 0:01:01.480 --> 0:01:04.520 I guess the term has become dare I say, a 0:01:04.520 --> 0:01:08.360 bit hackneyed over time, just because it's like, yeah, it 0:01:08.440 --> 0:01:12.720 conjures images of like bad nineties movie depictions of the Internet, 0:01:12.920 --> 0:01:16.840 of someone with like a weird, like overly bespoke cased 0:01:16.920 --> 0:01:21.920 laptop having a screen flashing access granted, you know, people 0:01:21.959 --> 0:01:27.280 flying through vectors of like weird transparent buildings like pre matrix. 0:01:27.760 --> 0:01:30.640 Maybe I'm mainly thinking of the movie Hackers, but it 0:01:30.680 --> 0:01:32.640 was a trope for a while, right, Ben, does that? 0:01:32.680 --> 0:01:34.240 Does that? Come? Does that? Though? Some of those things 0:01:34.319 --> 0:01:36.320 come to mind for you too, You're right. 0:01:36.200 --> 0:01:39.920 No, I always love it in the nineteen nineties films 0:01:40.120 --> 0:01:46.280 when someone reroutes the encryptions right right, the big that's 0:01:46.360 --> 0:01:50.960 the big move. And and it's true that hacking is 0:01:51.000 --> 0:01:55.720 a misrepresented concept in the world of film, Like, weird 0:01:55.840 --> 0:01:59.760 not hackers, to be completely honest with everyone, right, Like, 0:02:00.360 --> 0:02:03.920 we know a little bit of coding, we have phones, 0:02:04.200 --> 0:02:08.639 we get it. But we're also aware that some hacks 0:02:08.720 --> 0:02:13.000 like stucksnet can alter the course of history, and others 0:02:13.560 --> 0:02:18.240 like WannaCry can sweep across the globe at a moment's notice. 0:02:18.960 --> 0:02:23.520 The world of hackings pretty pretty invisible to most people. 0:02:23.680 --> 0:02:26.680 But it's a dangerous world, and it's a very real 0:02:26.720 --> 0:02:32.000 one with genuine potential for harm. And so tonight we 0:02:32.120 --> 0:02:37.359 decided to explore the story of one hacker, in particular, 0:02:37.880 --> 0:02:45.079 a guy named Marcus Hutchins, who accidentally, per his own account, 0:02:45.400 --> 0:02:50.639 stopped a global conspiracy and saved the world. Here are 0:02:50.680 --> 0:02:52.560 the facts. Who is this guy? 0:02:53.080 --> 0:02:55.280 Dang? Yeah? I mean, well, first of all, when we 0:02:55.320 --> 0:02:57.760 think of hackers, we usually think of like some like 0:02:58.000 --> 0:03:01.240 aim screen name type handle right, It's like, well, they 0:03:01.320 --> 0:03:03.800 don't often even get elevated to the point where we 0:03:03.880 --> 0:03:06.560 even like know their names. That's by design, because a 0:03:06.600 --> 0:03:08.680 lot of these folks want to stay anonymous. But we 0:03:08.760 --> 0:03:11.400 do know a thing or two about Marcus. He was 0:03:11.440 --> 0:03:15.560 born in the nineties. Damn you child, nineteen ninety four 0:03:16.200 --> 0:03:18.960 in the UKs. Sorry, whenever I see someone born in 0:03:18.960 --> 0:03:21.960 the nineteen nineties, God forbid even the two thousands, I'm like, 0:03:22.360 --> 0:03:26.120 I'm such an old But yes, I know they exist 0:03:26.200 --> 0:03:28.600 there everywhere. Man, They're crawling out the woodwork, and they're 0:03:28.639 --> 0:03:32.440 doing big stuff, no doubt. In the United Kingdom in 0:03:32.520 --> 0:03:37.160 nineteen ninety four, Marcus already was when he came of age, 0:03:37.200 --> 0:03:38.520 or at least to the point where he could, you know, 0:03:38.880 --> 0:03:41.600 click clock on a computer, was already showing great promise 0:03:41.840 --> 0:03:46.040 with computers and early kinds of programming. There's a story 0:03:46.080 --> 0:03:49.480 apocryphal or no, that talks about how he was able 0:03:49.520 --> 0:03:53.440 to bypass the computers at his school reroute the encryptions. 0:03:53.680 --> 0:03:57.920 Dare we say bypass the school's computer. I guess let's 0:03:57.920 --> 0:04:02.080 say locks, you know, protection systems, maybe something that would 0:04:02.120 --> 0:04:04.960 not allow people to install outside software so that he 0:04:05.000 --> 0:04:08.560 could install game software. You know some kids, what do 0:04:08.600 --> 0:04:12.000 you think it was plaining? I guess in the nineties 0:04:12.400 --> 0:04:14.839 it would have been what what? What was a PC game? 0:04:14.880 --> 0:04:18.799 This is waypost Doom and like the ID software stuff. 0:04:18.800 --> 0:04:20.120 What would maybe Minecraft? 0:04:21.320 --> 0:04:24.320 Maybe you're right, we came up on Oregon Trail. Let's 0:04:24.360 --> 0:04:25.680 be honest, that's true. 0:04:25.760 --> 0:04:28.200 Yeah, And then I just remember, you know, with all 0:04:28.240 --> 0:04:30.320 the ID software games, those were the ones where they 0:04:30.320 --> 0:04:32.599 would send you the freeware discs in the mail, and 0:04:32.640 --> 0:04:34.680 so that was something that everyone would have installed. But 0:04:34.880 --> 0:04:37.200 in the I guess he would have been coming of age, 0:04:37.240 --> 0:04:40.120 like in the early two thousands, so that might have 0:04:40.200 --> 0:04:41.960 been Minecraft. That's my theory. 0:04:42.320 --> 0:04:46.479 Hmm, that's a solid one. I agree with you. We 0:04:46.480 --> 0:04:50.000 we're getting a lot of his initial career and origin 0:04:50.160 --> 0:04:55.000 story somewhat apocryphal, as you as you said from this 0:04:55.240 --> 0:05:02.280 article by Andy Greenberg over Wired, and Marcus teaches himself 0:05:02.360 --> 0:05:07.200 the ins and outs of coding. He starts hanging out 0:05:07.560 --> 0:05:15.800 online right in these forums, in these Prereddit areas, or 0:05:16.080 --> 0:05:19.880 Reddit was already around, or things like Reddit, things like 0:05:19.960 --> 0:05:22.360 the chans, So it. 0:05:22.279 --> 0:05:25.240 Would have been more for these smaller communities. Definitely wouldn't 0:05:25.240 --> 0:05:27.120 have been quite in the mainstream as much as it 0:05:27.200 --> 0:05:27.680 is today. 0:05:28.720 --> 0:05:34.560 Yeah, he was specifically hanging out with the bad kids 0:05:34.600 --> 0:05:41.120 of the Internet who wanted to flex on malware. Malware 0:05:41.279 --> 0:05:43.560 is like software. 0:05:44.000 --> 0:05:44.480 It is. 0:05:46.040 --> 0:05:51.240 A genre definition of things, programs that are meant to 0:05:51.680 --> 0:05:58.440 compromise other machines in some way. He's dare I say, 0:05:58.520 --> 0:06:02.920 hacking at an early age, and he's very young at 0:06:02.920 --> 0:06:05.039 this point still, yeah. 0:06:04.839 --> 0:06:07.719 I think he at around fourteen years old he comes 0:06:07.800 --> 0:06:11.000 up with his first kind of little hack. I guess, uh, 0:06:11.240 --> 0:06:12.920 it is funny that how hack has sort of become 0:06:12.920 --> 0:06:15.120 more appropriated by the normies, like the idea of like 0:06:15.160 --> 0:06:17.880 life hacks and stuff, But back in this day, it 0:06:17.920 --> 0:06:20.479 was it was kind of literally figuring out a weakness, 0:06:20.600 --> 0:06:22.479 you know, some sort of vulnerability and a piece of 0:06:22.520 --> 0:06:25.280 software and then exploiting that. This would probably be one 0:06:25.320 --> 0:06:27.560 of the more basic types of hacks. And he did 0:06:27.560 --> 0:06:31.159 that with Internet Explorer, figuring out of that whole what 0:06:31.320 --> 0:06:34.280 is it like autofill stuff where it like saves your info? 0:06:34.480 --> 0:06:37.240 And I think back in those days it wasn't as 0:06:37.360 --> 0:06:40.240 like authentication heavy as it is now, like even to 0:06:40.320 --> 0:06:42.839 get access to certain autofill type things you have to 0:06:42.960 --> 0:06:45.360 enter a password and use your name and maybe even 0:06:45.400 --> 0:06:47.279 a fingerprints, you know, if you're using one of those 0:06:47.760 --> 0:06:48.920 newer Mac laptops. 0:06:48.960 --> 0:06:50.960 But here's the text on your phone. 0:06:51.200 --> 0:06:53.520 That's right exactly, because a lot of times this stuff 0:06:53.560 --> 0:06:56.120 will include credit card information. It couldn't even include you know, 0:06:56.120 --> 0:06:57.760 that would not be the brightest thing in the world 0:06:57.800 --> 0:07:01.839 to always have that stuff, you know, available for autofill 0:07:01.960 --> 0:07:04.400 but it certainly is out there now and a little 0:07:04.440 --> 0:07:07.000 more protective. But back then it would be for stuff 0:07:07.040 --> 0:07:09.280 like addresses, you know, for shipping or whatever it might be. 0:07:09.440 --> 0:07:11.640 And he used it to I guess, send a direct 0:07:11.680 --> 0:07:15.680 line back to him, you know, from the computer with 0:07:15.960 --> 0:07:21.280 the malware installed, to give people's passwords, and. 0:07:21.800 --> 0:07:26.240 He never used it to commit a crime. The forums 0:07:26.280 --> 0:07:29.880 he was hanging out on were all about flexing. It's 0:07:29.960 --> 0:07:33.840 like his version of a skate park, you know, where 0:07:33.880 --> 0:07:38.280 people are doing their halfpipe tricks, right, And he gets 0:07:38.320 --> 0:07:42.600 acceptance and approval online, and he hangs out more and 0:07:42.680 --> 0:07:46.920 more often on these forums, and his teachers and his 0:07:47.200 --> 0:07:52.080 parents notice that he's not doing so great at his 0:07:53.440 --> 0:07:55.880 homework in school, yeah. 0:07:56.080 --> 0:07:58.360 The regular stuff now, because he's spending all his time 0:07:58.400 --> 0:08:02.840 on those computer labs, and much like what happens when 0:08:03.680 --> 0:08:06.800 hackers are convicted, you know, and sent away that a 0:08:06.840 --> 0:08:09.480 lot of times one of the conditions of their release 0:08:09.600 --> 0:08:12.559 are you can never go near a computer ever again, 0:08:12.600 --> 0:08:16.080 which always seems so heartbreaking. But yeah, he was banned 0:08:16.120 --> 0:08:19.880 from using any of the school's computers because the faculty 0:08:19.960 --> 0:08:23.320 thought that he had hacked the entire school network, which 0:08:23.320 --> 0:08:27.000 he did deny again and got some apocryphal tales in here, 0:08:28.240 --> 0:08:30.360 which is always kind of the way it goes with 0:08:30.400 --> 0:08:34.520 figures like this, But in the end, it was just 0:08:34.520 --> 0:08:36.800 just the push over the cliff he needed to even 0:08:36.880 --> 0:08:40.040 more reject kind of the stuff they were trying to 0:08:40.480 --> 0:08:43.559 hopefully get him to do, to go deeper into in 0:08:43.640 --> 0:08:46.319 terms of like normal homework and a career and all 0:08:46.320 --> 0:08:49.760 of that stuff. So he stopped, basically stopped going to school. 0:08:50.559 --> 0:08:52.000 He can't blame him, you know. 0:08:52.080 --> 0:08:56.199 Oh yeah, tore a terrible move to really absolutely misguided 0:08:56.240 --> 0:08:58.880 attempt to get someone to not do the thing that 0:08:58.920 --> 0:08:59.360 they love. 0:09:00.679 --> 0:09:05.520 And so he gets pushed away from what we call it, 0:09:05.840 --> 0:09:09.800 we're going to sound very old, his irl society in 0:09:09.880 --> 0:09:15.040 real life society. He gets pushed away, and soon he 0:09:15.559 --> 0:09:19.640 is hanging out full time on these Internet forums. And 0:09:21.000 --> 0:09:24.800 you know these are forbes associated with what we call 0:09:25.080 --> 0:09:28.720 pen testing, if we're being correct, penetration testing. 0:09:28.800 --> 0:09:31.920 Ah yeah, isn't familiar with that one. And it's like 0:09:31.960 --> 0:09:33.640 you said, I mean a lot of it was sort 0:09:33.640 --> 0:09:36.000 of flexes, like here's see what I can do, but 0:09:36.040 --> 0:09:38.880 it wasn't necessarily these folks were colluding, you know, to 0:09:39.360 --> 0:09:43.880 plan large scale Internet heists. But as we know, in 0:09:44.000 --> 0:09:47.280 order to know what the bad guys are doing and 0:09:47.280 --> 0:09:49.640 how to protect against what they're doing, you got to 0:09:49.720 --> 0:09:52.200 kind of have the same bag of tricks. So this 0:09:52.280 --> 0:09:55.160 really is kind of an interesting early, you know, kind 0:09:55.200 --> 0:09:58.320 of entry point into what ultimately led to him being 0:09:58.360 --> 0:09:59.400 as known as he became. 0:10:00.960 --> 0:10:05.440 Just so, and you know, at this point, if you're 0:10:05.559 --> 0:10:09.240 hanging out with those bad kids on that Internet halfpipe, 0:10:09.920 --> 0:10:13.360 the feds are gonna come shut you down. The squares 0:10:13.400 --> 0:10:17.240 are gonna come in, and authorities will clamp down on 0:10:17.240 --> 0:10:20.560 one site. But they're essentially playing whack them hole, which 0:10:20.600 --> 0:10:25.360 means that the users of these forums will transfer to 0:10:25.720 --> 0:10:30.959 another site. So the forum that our young friend Hutchens 0:10:31.000 --> 0:10:34.680 hangs out at gets closed down, gets shut down, so 0:10:34.760 --> 0:10:38.120 he moves to another spot it's cold in a burst 0:10:38.120 --> 0:10:43.600 of creativity hack forums, no one well no, no one 0:10:43.640 --> 0:10:45.280 will ever figure that one out. 0:10:45.840 --> 0:10:48.560 Well, how man, isn't the smarter move instead of like 0:10:48.679 --> 0:10:51.120 cracking down and like tipping your hand just to kind 0:10:51.120 --> 0:10:53.920 of lurk and see what you can see. I guess 0:10:54.200 --> 0:10:56.120 they probably do that for a while and then get 0:10:56.120 --> 0:10:58.400 to a point where they're like, Okay, we've exhausted this one. 0:10:58.440 --> 0:11:00.400 We need to I just wonder it will be the 0:11:00.440 --> 0:11:02.640 impetus for the cops coming in and breaking them up, 0:11:02.720 --> 0:11:05.840 or learning these folks to their presence, or if it's 0:11:05.880 --> 0:11:08.960 more like they overplayed their hand and the kids are like, 0:11:09.000 --> 0:11:12.559 oh no, we've been made. We need to move on right. 0:11:13.040 --> 0:11:17.600 Right right. We've got a great quote from Wired from 0:11:17.760 --> 0:11:22.120 our buddy Andy writing here, and he talks about you 0:11:22.200 --> 0:11:24.679 know what this makes me think of. It makes me 0:11:24.800 --> 0:11:31.720 think of walking into a hotel pool or something like that, 0:11:31.760 --> 0:11:35.440 where you have the steps at first where you dip 0:11:35.520 --> 0:11:39.480 your toes in, and our buddy Hutchins is walking in 0:11:39.600 --> 0:11:46.280 deeper and deeper water. Wired describes hack forums in a 0:11:46.360 --> 0:11:47.560 pretty interesting way. 0:11:48.080 --> 0:11:51.800 Yeah. He describes the members as being a shade more 0:11:51.840 --> 0:11:54.840 advanced in their skills and a shade Murkier in their ethics. 0:11:55.280 --> 0:11:58.760 A lord of the flies collection of young hackers seeking 0:11:58.760 --> 0:12:03.360 to impress one another with nihilistic feats of exploitation. They're 0:12:03.400 --> 0:12:06.920 in lies of the flex. We were talking about the minimum 0:12:07.080 --> 0:12:10.880 table stakes to gain respect from the hack forums crowd 0:12:10.920 --> 0:12:14.080 was possession of a botnet, a collection of hundreds of 0:12:14.080 --> 0:12:18.480 thousands of malware infected computers that obey a hacker's commands, 0:12:18.800 --> 0:12:21.880 capable of directing junk traffic at rivals to flood their 0:12:21.880 --> 0:12:24.480 web servers and knock them offline. What's known as a 0:12:24.520 --> 0:12:28.400 distributed denial of service or d DOS attack. Pretty common 0:12:29.280 --> 0:12:31.840 technique we've heard that, you know, make the news plenty, 0:12:31.920 --> 0:12:34.240 Like if I'm not mistaken, we were all just in 0:12:34.320 --> 0:12:37.880 Las Vegas recently, and I think they were a victim 0:12:37.880 --> 0:12:40.960 of a hack that I think involved at least in 0:12:41.120 --> 0:12:44.520 part d DOS attacks. Because all of their servers were overloaded, 0:12:44.760 --> 0:12:47.320 they couldn't talk to each other, the MGM hotels and 0:12:47.600 --> 0:12:49.760 the lights wouldn't work in the room. And when you 0:12:49.800 --> 0:12:53.000 have a system that's so interconnected like that, these things 0:12:53.080 --> 0:12:54.160 can be crippling, right. 0:12:54.720 --> 0:13:00.680 You nailed it, Yeah, absolutely, And it's said that Matt 0:13:00.760 --> 0:13:04.800 is on adventures, because that's one of the things, as 0:13:04.840 --> 0:13:08.400 you will call that he brought up to us before 0:13:08.440 --> 0:13:13.360 you and Paul and I traveled to Las Vegas. Matt 0:13:13.440 --> 0:13:17.040 was I'm not gonna do an impression of Matt because 0:13:17.080 --> 0:13:17.559 we all know. 0:13:18.160 --> 0:13:20.160 It's not possible. He's too singular, that. 0:13:21.200 --> 0:13:25.400 He's such a voice. Yeah, and uh, Matt, just who 0:13:25.440 --> 0:13:29.320 everyone knows. Matt was telling us before we went to 0:13:29.400 --> 0:13:34.080 Vegas about the hack. I think he was the first 0:13:34.080 --> 0:13:37.480 one who clocked it, and he was saying, guys, we 0:13:37.600 --> 0:13:42.240 gotta be careful. He asked us if we would bring 0:13:42.360 --> 0:13:47.840 burner phones, and uh, and be honest with you, I 0:13:47.880 --> 0:13:50.600 did not bring a burner phone. I used my real 0:13:50.679 --> 0:13:53.080 phone in Las Vegas. 0:13:52.840 --> 0:13:58.040 But not your real name. You were assigned one by 0:13:58.080 --> 0:14:02.640 hotel management. Yeah, but it's crazy how effective some of 0:14:02.640 --> 0:14:05.240 these simpler kind of techniques can be. And I guess 0:14:05.240 --> 0:14:07.840 I didn't really understand the idea of this botnet, Like 0:14:07.920 --> 0:14:11.439 it's basically like these are these are these computers who 0:14:11.520 --> 0:14:14.440 don't know they've been had, who don't know they've been infected, 0:14:14.440 --> 0:14:17.400 and are now like under your sway like that you know, 0:14:17.600 --> 0:14:20.440 sorcerer's apprentice in the brooms kind of scenario. Right. 0:14:21.600 --> 0:14:27.320 Yeah, and this kid, Marcus Hutchins is a child at 0:14:27.320 --> 0:14:31.040 this point, he's fifteen years old, he's all in. He 0:14:31.160 --> 0:14:37.080 creates a botnet, and what he does is he suckers 0:14:37.120 --> 0:14:42.760 people via fake files or misleading files uploaded to bit 0:14:42.840 --> 0:14:49.240 torrent sites. For those of us in a certain demographic, 0:14:49.560 --> 0:14:53.000 you might think of LimeWire or things like that. 0:14:53.920 --> 0:14:56.560 Oh dude, but I mean bit torrent. You know, you 0:14:56.560 --> 0:14:58.600 would get it through like the Pirate Bay or whatever, 0:14:58.760 --> 0:15:00.840 or like there were other different ones. And the way 0:15:00.880 --> 0:15:04.240 BitTorrent files work is they're like broken up into all 0:15:04.240 --> 0:15:07.280 these little micro pieces that are then kind of reassembled. 0:15:07.800 --> 0:15:10.480 So I imagine this is a very smart way of 0:15:10.600 --> 0:15:14.000 using a technology that is a little bit you know, 0:15:14.240 --> 0:15:17.440 more underground internety. But it's also like, you know, we 0:15:17.520 --> 0:15:20.240 knew tons of people that weren't mega hacker, people that 0:15:20.280 --> 0:15:23.760 were like using bittorn all the time. It was super mainstream. 0:15:23.800 --> 0:15:26.320 So it would make sense that he amassed a pretty 0:15:26.360 --> 0:15:31.400 significant bought army by exploiting these BitTorrent sites for sure. 0:15:31.720 --> 0:15:36.240 And we all remember, let's be honest, whether you are 0:15:36.600 --> 0:15:41.840 a street laced NRO person or whether you have a 0:15:41.880 --> 0:15:45.880 little bit of r Maybe in your college days, you 0:15:45.960 --> 0:15:51.080 remember the old say they said, look, you're never gonna 0:15:51.120 --> 0:15:54.720 get caught if you're downloading the files. You're only in 0:15:54.800 --> 0:15:58.720 trouble if you're the one uploading them or sharing them, 0:15:58.840 --> 0:16:01.680 right and yeah, and so it's true. 0:16:01.520 --> 0:16:03.440 For some of them. But like the bit torrent ones, 0:16:03.560 --> 0:16:06.720 just by participating you were sort of part of It 0:16:06.720 --> 0:16:08.760 was harder to track down individuals, I think because it 0:16:08.840 --> 0:16:11.920 was like by downloading the file, you were also participating 0:16:11.920 --> 0:16:14.400 in the upload. But I got a few of those 0:16:14.480 --> 0:16:20.000 Web Sheriff no no infringement notices back in the day. 0:16:20.040 --> 0:16:20.960 I sure did you know what? 0:16:20.960 --> 0:16:21.120 It was? 0:16:21.200 --> 0:16:24.480 Usually about HBO related content. It was usually about like 0:16:24.480 --> 0:16:27.560 Sopranos episodes or episodes of sixty And you'd get this 0:16:27.720 --> 0:16:31.800 like form letter directed at your ISP, and then they 0:16:31.800 --> 0:16:35.280 would come to you and it was like, hey, fly right, buddy, 0:16:35.880 --> 0:16:37.720 or things are going to go poorly for you. You can 0:16:37.760 --> 0:16:40.040 get banned from your ISP. At the very least, that's 0:16:40.040 --> 0:16:40.800 probably what happened. 0:16:41.360 --> 0:16:46.040 Oh geez, well, this doesn't hit our boy, Hutchins, our 0:16:46.120 --> 0:16:49.520 young fifteen year old Hutchins. He has a bought army. 0:16:50.000 --> 0:16:53.680 It's like eight thousand computers and he starts setting up 0:16:53.720 --> 0:17:00.400 his own business. He has one called ghost Hosting. The 0:17:00.520 --> 0:17:05.879 first O is zero, get it because it's leaked to. 0:17:05.920 --> 0:17:11.000 Speak, Yeah, very aim Internetti as well. This is a 0:17:11.080 --> 0:17:14.280 server kind of like web services deal, you know, kind 0:17:14.280 --> 0:17:17.080 of like we know now is like AWS Amazon web 0:17:17.119 --> 0:17:21.800 services for hosting sites, much smaller and much more niche 0:17:22.000 --> 0:17:25.280 This was specifically for hosting sites for hack forum members 0:17:25.440 --> 0:17:30.639 that allowed them to shield their IP addresses from anyone 0:17:30.640 --> 0:17:33.560 who would try to, you know, find where the root 0:17:33.880 --> 0:17:39.280 of such sites might be. But he had some caveats. 0:17:39.280 --> 0:17:41.680 He would allow people to post anything other than child 0:17:41.720 --> 0:17:44.800 sexual abuse material. It's good on him for that, of course, 0:17:44.800 --> 0:17:47.360 because we know a lot of times these masked you know, 0:17:48.000 --> 0:17:50.640 web sites or servers. That's a big part of it. 0:17:50.760 --> 0:17:52.840 But what he was doing essentially was like sort of 0:17:52.880 --> 0:17:56.760 a smaller scale silk Road dark web thing, but I 0:17:56.760 --> 0:18:00.000 don't think you needed like a tour browser to access. 0:18:00.040 --> 0:18:02.840 Think it wasn't like exactly dark Road silk Web, but 0:18:03.080 --> 0:18:05.080 it was in that vein the idea that you couldn't 0:18:05.119 --> 0:18:08.359 necessarily figure out where it was coming from, and maybe 0:18:08.400 --> 0:18:10.480 there was even a way for users to be encrypted 0:18:10.480 --> 0:18:11.720 so they couldn't be tracked either. 0:18:12.280 --> 0:18:15.639 Yeah, it was all about anonymity, and he had these 0:18:15.840 --> 0:18:21.040 ethical lines. He kept evolving his skills. He learned how 0:18:21.080 --> 0:18:27.560 to analyze and improve other hackers software, especially their rootkits. 0:18:27.880 --> 0:18:31.480 Rootkits are a thing that will change the operating system 0:18:31.680 --> 0:18:35.359 of a computer such that it can hide itself. And 0:18:35.680 --> 0:18:40.400 people were massively impressed on these forums. And by the way, 0:18:40.520 --> 0:18:44.640 at this point, none of these folks on these forums 0:18:45.280 --> 0:18:49.440 know anything about each other. They're very careful with it. 0:18:49.880 --> 0:18:53.920 And this guy, our guy Mark, he starts taking these 0:18:54.000 --> 0:19:00.640 gigs writing what the authorities will call malware, and he's 0:19:00.720 --> 0:19:07.480 picking up little side joints, you know, He's like, hey, 0:19:07.680 --> 0:19:10.120 I know how to turn a piece of code here, 0:19:10.440 --> 0:19:15.360 and that's where he meets someone calling themselves. Theny things 0:19:15.400 --> 0:19:21.800 turn dark. It eventually leads him to something terrible called 0:19:22.160 --> 0:19:22.919 Wanna Cry. 0:19:23.520 --> 0:19:26.720 Yeah, it's interesting to kind of get the trajectory of 0:19:26.800 --> 0:19:30.840 this kid and his sort of like upbringing or like 0:19:30.880 --> 0:19:33.080 his rise in this kind of culture, because at this 0:19:33.200 --> 0:19:36.159 point he's like a teenager, you know, he's basically kind 0:19:36.200 --> 0:19:39.520 of like a snotty teenager who just kind of maybe 0:19:39.560 --> 0:19:42.280 wants to creak a little bit of chaos, you know, 0:19:42.320 --> 0:19:44.960 but he does seem to have a moral code, which 0:19:44.960 --> 0:19:46.960 I think is important. And I think what we're gonna 0:19:46.960 --> 0:19:50.600 see is a turn where he's like, Ooh, with great 0:19:50.640 --> 0:19:53.639 power comes great responsibility kind of vibes, you know. And 0:19:53.680 --> 0:19:56.439 it just took him meeting the super villain kind of 0:19:56.560 --> 0:19:59.840 our story to make that realization. But maybe I'm over 0:20:00.080 --> 0:20:03.720 over stating the case. But it's a really interesting story. 0:20:04.240 --> 0:20:07.680 You're one hundred percent correct, Noal, I propose we pause 0:20:07.920 --> 0:20:11.159 for a word from our sponsor, which will hopefully be 0:20:11.280 --> 0:20:12.600 a VPN company. 0:20:12.840 --> 0:20:14.320 Yeah, no doubt. 0:20:20.440 --> 0:20:27.880 Here's where it gets crazy. So this guy Vinnie contacts Marcus. 0:20:27.920 --> 0:20:33.359 Marcus is about sixteen at this point, and Vinnie is 0:20:33.400 --> 0:20:36.840 a stranger on the Internet. Marcus does not know him 0:20:36.880 --> 0:20:41.560 from a Canna paint. And Vinnie goes to Marcus and says, 0:20:41.600 --> 0:20:46.000 I'll give you a job make a new rootkit for me, kiddo, 0:20:47.000 --> 0:20:52.560 and I'll sell it all over the cool people Internet 0:20:52.640 --> 0:20:56.199 and you will get fifty percent of the profits. 0:20:56.600 --> 0:21:00.440 Dude, sounds like a deal. I'm sixteen on I'm doing 0:21:00.440 --> 0:21:02.760 this for fun largely anyway, and I'm starting to make 0:21:02.800 --> 0:21:06.639 a little extra money, you know, proving the principle and 0:21:06.760 --> 0:21:09.320 mom and dad wrong, you know, why wouldn't I hop 0:21:09.359 --> 0:21:12.880 on this train? So a little more than halfway through 0:21:12.920 --> 0:21:16.040 twenty twelve, they get this whole deal up and running 0:21:16.119 --> 0:21:18.760 something called a upas kit, which I believe is named 0:21:18.800 --> 0:21:23.080 after a poison tree. So maybe it's pronounced upus upus. 0:21:23.600 --> 0:21:28.680 Yeah. Look, I am also not one hundred percent on 0:21:28.720 --> 0:21:32.399 the pronunciation, but you're right now. It is named after 0:21:32.440 --> 0:21:36.280 a poisonous tree Antiaris toxicaria. 0:21:36.520 --> 0:21:39.959 Yeah that sounds scary mainly just cut has toxic in it, 0:21:40.000 --> 0:21:42.480 but it's part of the mulberry family, which is a 0:21:42.560 --> 0:21:46.160 very pleasant sounding tree. But so, yeah, this is their enterprise. 0:21:46.240 --> 0:21:49.320 They've been working on for a bit now. And at 0:21:49.320 --> 0:21:53.959 this point, Vinnie sends Hutchins like a bunch of drugs 0:21:54.320 --> 0:21:57.000 for his birthday. 0:21:56.200 --> 0:22:04.119 Because he was so Mark was complaining to his internet 0:22:04.160 --> 0:22:09.360 friend Vinnie about how difficult it was to find good 0:22:09.480 --> 0:22:12.440 drugs in the United Kingdom. 0:22:13.119 --> 0:22:17.679 Okay, so this was not completely unsolicited then, like Marcus 0:22:17.840 --> 0:22:20.520 is into these drugs, he wasn't just like because that 0:22:20.600 --> 0:22:22.679 also seems like a flex too, where it's like I 0:22:22.720 --> 0:22:25.000 know where you live and I'm sending you illegal stuff. 0:22:25.000 --> 0:22:28.280 This would have been appreciated by young Marcus. I'm open, 0:22:28.640 --> 0:22:31.399 we're not talking about crank or heroin here. Maybe just 0:22:31.520 --> 0:22:32.040 some weed. 0:22:32.760 --> 0:22:35.520 Yeah, I think it was just saying I can't find 0:22:35.720 --> 0:22:42.040 good weed in the United Kingdom, and Vinny comes through 0:22:42.240 --> 0:22:45.000 with more than just cannabis. 0:22:45.160 --> 0:22:48.560 I see. So there is a little bit of a 0:22:48.600 --> 0:22:50.720 little bit of a flex in there too, I think, 0:22:50.760 --> 0:22:53.879 where it's almost like, you know, yeah, you're in deep 0:22:53.960 --> 0:22:58.119 Because to your point, Ben, he'd always sort of just 0:22:58.480 --> 0:23:01.280 ridden that line between doing stuff that was just a 0:23:01.280 --> 0:23:03.879 little more anarchist and a little more just kind of 0:23:03.880 --> 0:23:07.120 middle finger to the man and like square society, but 0:23:07.240 --> 0:23:11.880 never things that would be considered fully morally reprehensible or 0:23:11.960 --> 0:23:14.880 like felony level illegal, right. 0:23:15.560 --> 0:23:22.119 Right, Just so, the upus Upas sales had allowed Marcus 0:23:22.160 --> 0:23:26.240 the ability to not go to school and to work 0:23:26.480 --> 0:23:30.639 full time. He was supporting himself. He was one of 0:23:30.640 --> 0:23:35.840 those kids who probably looked like, what do you call it, 0:23:36.240 --> 0:23:39.960 hikiko mori, the kids who stay home guys? 0:23:40.040 --> 0:23:42.920 Yeah, in Japan for sure, or like in Spider Man, 0:23:42.960 --> 0:23:44.840 he's like the guy in the chair, you know. 0:23:45.880 --> 0:23:51.719 Right, yeah, And he was increasingly living this double life. 0:23:51.760 --> 0:23:56.280 He was a mild mannered young British man by day. 0:23:56.440 --> 0:23:59.840 He was a master hacker by night. And here we 0:23:59.880 --> 0:24:05.080 go back to Marcus's own admissions. He made a serious error, 0:24:05.400 --> 0:24:08.520 just like you said, Noel, he had always stayed a 0:24:08.680 --> 0:24:14.720 step away from actions he considered illegal or unethical or 0:24:14.800 --> 0:24:19.959 morally reprehensible. And he said he knew of criminals, and 0:24:20.119 --> 0:24:23.640 he knew of crimes they had committed, but he did 0:24:23.680 --> 0:24:28.760 not consider himself a criminal. He always thought he was 0:24:29.240 --> 0:24:34.440 just on the side of the law, exactly. 0:24:34.680 --> 0:24:38.800