Beau Friedlander:
What the … I don’t know what the hack, honestly. Why are all these hackers coming after me this week? I could swear I’ve gotten at least four. And it was sort of a slow week, so I decided to call one of the numbers. And so, I did. It was a guy in another part of the world. I’m guessing he may have been in Queens. He was not a native English speaker.
Beau Friedlander:
And I said, “I got an email from you. This is Microsoft, isn’t it?” And he said, “Yes.” And then, I said, “Great. Well, I got an email saying that I ordered a new year subscription for my Microsoft, but my Microsoft subscription isn’t up. And I got charged $265.37. I’m just wondering if we could talk about that?”
Beau Friedlander:
And he said, “Oh, I’m so sorry. We’ve gotten a lot of these. Can you tell me the order number?” And I said, “I can. I got the order number right here. So I told him the order number.” He said, “Oh, one second.” He clicked and he moved some dishes around. And then, he came back and he said, “Ah, yes. I see the error here so I can fix this.”
Beau Friedlander:
I said, “Great. What have we got to do?” He said, “Well, I need you to download something. I’m going to send you to a website.” I said, “Great, what’s the website?” He said, “Okay, you ready?” And I was like, “Yeah. I’m totally ready.” So I type it in. He tells me the thing, I’m typing it in, and he finishes telling me what it is.
Beau Friedlander:
And it’s very clearly a remote access site where if I had done this, he would have full access to my computer in a takeover mode. He finishes telling me the web address and I … There’s thunder outside. I said, “Sir, this is the FBI. I’m going to need you to go on hold for a second.” He immediately hung up on me. Click.
Adam Levin:
That is disturbing and that’s why there was thunder in the background.
Beau Friedlander:
Yeah. This horrible, this… this bandit was going to get into my computer and wreak some havoc. The only thing that stopped him was me knowing that he was who he was. I do have an idea though, for what we can do to make this more fun next time.
Adam Levin:
Well, I think one of the things is that if they don’t answer the phone, “Microsoft,” that could be kind of a problem.
Beau Friedlander:
Oh no, he did. He did. But I still think that there’s… My thing is, Adam, you know it’s fun to just keep them on the phone for a bit.
Adam Levin:
Definitely.
Beau Friedlander:
You can say something like, “Well, I do have that number, but … Oh my gosh, there’s a cute bunny outside. Do you like rabbits? I like rabbits, and rabbits are cool. Do you ever notice that some rabbits have long ears and some don’t really have long ears? Some have these weird tails, and some have like crazy tails that look like they were done for a French couture show.” They get really frustrated with you if you do that. But it’s super fun.
Adam Levin:
Well, you could say, “Tell me that number again?”
Beau Friedlander:
Oh yeah, that’s a good one. Or I …
Adam Levin:
What’s that URL? I have trouble hearing. Tell me again.
Beau Friedlander:
Well, one more thing I wanted to say was if you… One thing I wanted to do that I didn’t do was I just wanted to read a random number to him. Because I know no matter what I say to him, he’s going to say, “Yes. Oh my God. You have this problem.” And it could be fun to just do that over and over and over again.
Adam Levin:
Or what you could have done is pretended that you were in the United States Senate and simply start a filibuster, and see how long you could filibuster him on the phone.
Beau Friedlander:
That’s what I was doing with the rabbit story.
Adam Levin:
Hi, I’m Adam Levin, former director of the New Jersey Division of Consumer Affairs, founder of CyberScout, and author of the book Swiped: How to Protect Yourself in a World Full of Scammers, Phishers and Identity Thieves.
Beau Friedlander:
I’m Beau Friedlander, a person who really needs that book, because hackers seem to love me.
Travis Taylor:
I’m Travis Taylor, resident tech guy and guy that’s commonly trying to hack Beau.
Adam Levin:
We’re all here, and this is What the Hack.
Beau Friedlander:
What’s going on today?
Adam Levin:
Today, we have a very interesting conversation with a young guy who got gamed while he was gaming.
Beau Friedlander:
Oh, God. I hate when that happens.
Adam Levin:
Today, we’re welcoming Cristian Capestani to our show. He’s got a very interesting story. But first, let’s find out the interesting story that is Christian. Where are you from?
Cristian C.:
Well, I’m from right here. Olympia, Washington.
Adam Levin:
Washington. All right. All right. Travis is actually from Oregon, so he’s like your neighbor.
Travis Taylor:
A little bit. Yep.
Adam Levin:
I’m in Arizona, which I’m not your neighbor. Beau is in Arizona right now, but he’s generally in New York, and that means he’s really not your neighbor.
Beau Friedlander:
I think of your house as being really a lot closer to Japan actually than to me.
Cristian C.:
That’s a nice way of thinking about it.
Adam Levin:
That’s very true. Okay. We know now that you live in Washington. What do you do?
Cristian C.:
I’ve done a lot of things, but right now I work at a QFC. It’s like a local grocery store as a cashier.
Adam Levin:
Right. But now I understand you have an interesting advocation. You’re also a musician, right?
Cristian C.:
Yeah. I’ve made just music on the side for fun, but I’ve also played cello for roughly 15 years. I don’t know if I’m going to count 2020, because I didn’t play in an orchestra at all. But we’ll see what 2021 holds.
Beau Friedlander:
Do you play orchestral music and solo cello?
Cristian C.:
No, I am too nervous to play solo cello.
Beau Friedlander:
But be honest, you can play the First Cello Suite?
Cristian C.:
Yeah. A bit.
Beau Friedlander:
Awesome. It’s one of my favorite pieces.
Adam Levin:
Solo cello actually sounds like an Italian drink. Have some solo cello.
Travis Taylor:
Have you been hacked? We’d love to hear your story. Give us a call at 623-252-1828 or email stories@whatthehackpod.com.
Adam Levin:
Cristian, you’re also a gamer. Right?
Cristian C.:
Yeah.
Adam Levin:
What’s your favorite games to play?
Cristian C.:
I like strategy games, mainly. So the Civilization series is one of my favorite of all time.
Travis Taylor:
What do you think of the add-ons to Civilization VI?
Cristian C.:
I was adverse at first, and then it grew on me. The more I went back to play Civ V, the more I was like, “Oh, I kind of want to do that.” And I do think the most recent one is …
Beau Friedlander:
But wait… Do they have like a COVID add on for this? Like Civilization seems like … Does it include that or no?
Cristian C.:
No.
Beau Friedlander:
That would be End of Civilization.
Cristian C.:
There is a black plague scenario mode, but there is no COVID-specific …
Travis Taylor:
Yeah. It’s funny. They keep on adding new nations to Civilization, which can be pretty cool. But the last add-on had like vampires and you could play as Beowulf. It was weird.
Cristian C.:
Yeah. They added a zombie mode.
Beau Friedlander:
Basically, they could do the COVID thing and have the anti-vaxxers, the vaxxers.
Travis Taylor:
Right.
Beau Friedlander:
Awesome.
Cristian C.:
And there’s a zombie mode.
Beau Friedlander:
I managed to make it political. Sorry guys.
Travis Taylor:
No worries.
Adam Levin:
Now, my son is nine. He loves Fortnite and Madden, because he beaten me like 48 times so far.
Beau Friedlander:
Cristian, I could kick your butt at the one game that I’m really good at. But I bet you’ve never played it. It’s called Pong.
Cristian C.:
You’d be surprised. Actually, my first console, I grew up playing my dad’s old Atari.
Beau Friedlander:
No, that’s so sad to me, because it’s my only claim to fame is I can play the old Atari games.
Cristian C.:
I haven’t played it in years though, so you’ve probably got it on me.
Beau Friedlander:
All right. Then, you’re on. You’re on.
Adam Levin:
I was kind of like a Pong caveman. I always somehow ended up on the floor playing Pong and it never worked out. I was always ponged. But anyway, there is an interesting story in connection with your gaming career, which brings you to us. Why don’t you tell us what happened?
Cristian C.:
So I should start with what the game was. It was called Happy Wheels. And if you know anything about Happy Wheels, you know that it was very popular like nine years ago. Like Fortnite levels of popular, at least among middle schoolers like me at the time. I had always played the trial version of it, which was only like five levels and you could only choose one character.
Cristian C.:
It was basically a 2D platform, but you were a guy on a bike going across challenges and obstacles. The full version was always being played by YouTubers. You could see like, “Oh, they made their own courses and they’re playing. It’s like the dude on a lawnmower and it’s weird.” So I went, “Okay, I want to play this.” Didn’t do any research into it and I went to download it. It’s a Flash game.
Adam Levin:
Uh-oh.
Cristian C.:
So I kind of set myself up for failure there. I downloaded three things, and all three were viruses. The first two were just adware. They popped up and they showed the name of the program. They were easy to remove. I found the names of them, by the way. I didn’t remember it last time, but it’s Amson and Siltware. Those are easy to get rid of. They just slowed it down.
Cristian C.:
But then the third one was called Strong Vault Online Backup. I don’t even know what this thing was supposed to do, because every time I would right-click anywhere, it would start loading something frantically. It would say, “Strong Vault is loading.” And I had to smash the cancel button to get through to the right click and like open something.
Beau Friedlander:
It’s like digital bubble gum on your shoe.
Cristian C.:
Pretty much. It was like, oh, I stepped in that again. Oh, it’s on my shoe.
Travis Taylor:
It’s weird. Strong Vault has been around since at least 2013.
Cristian C.:
Oh, really?
Travis Taylor:
That is a just infamous adware strain.
Adam Levin:
When I heard Strong Vault, I immediately thought of Braveheart.
William Wallace:
They may take our lives, but they’ll never take our freedom.
Adam Levin:
But that’s a movie.
Beau Friedlander:
Let’s hear more. What happened when you noticed that you had gum on your shoe?
Cristian C.:
My instinct was, of course, with the first two, I was like, “Oh, let me go find Strong Vault.” You know what I mean? Because it says Strong Vault. Everything else was saying that it was … I couldn’t find it, couldn’t find anything related to it.
Cristian C.:
I did the whole … At the time, my knowledge of computers was very small compared to what it is now, even though I’m pretty sure I still can’t remove it. But I looked for it in Control Panel. I also did a whole search overnight through just the C Drive on my computer of the word Strong Vault.
Cristian C.:
I just let that happen, and I couldn’t find anything like it. It just slowed down my computer. The longer it was on there, the more slowed down it was. This was an old Dell that had to have a graphics card just to run Windows XP.
Beau Friedlander:
So then what happened?
Cristian C.:
I just left it on there. I was able to … I still have the computer and everything, but it was the family computer. That was around the time I was getting into Minecraft. And so, I was able to somehow host and play on a Minecraft server while Strong Vault was eating away at my CPU.
Beau Friedlander:
So that computer basically became the family station wagon that everyone drives and gets beat up. But it’s no longer really useful.
Cristian C.:
Exactly. Exactly.
Beau Friedlander:
All because of this stupid thing that you clicked on.
Cristian C.:
Yeah.
Beau Friedlander:
Oh, man. Adam, do you … I’m sure, Adam, you can tell him exactly how to remove it right now.
Adam Levin:
Oh, yeah. I’m your guy. Actually, this is the right moment for us to bring the Voice of God, Travis.
Travis Taylor:
Hello?
Adam Levin:
Hi, Voice of God. How are you?
Travis Taylor:
Doing okay. Strong Vault’s been around for quite a while. It makes sense that would pop up alongside a Flash program. Just because they were both at their most viral, roughly around the same time. You can find instructions about how to get rid of Strong Vault, but it was infamously aggressive. The nice thing about it is it doesn’t, or at least it didn’t, exfiltrate any of your data.
It’s not like ransomware or anything like that. It’s just deeply, deeply, deeply annoying in terms of … From what you were from what you were talking about. It tries to sell you an ad for absolutely everything that you do. And that’s one of the reasons for its general notorious reputation. Because it’s telling you it’ll back your files up online, but really it’s just giving you the equivalent of a commercial break once every like two seconds.
Beau Friedlander:
My understanding is that it is an app, not a virus per se.
Travis Taylor:
Right.
Beau Friedlander:
I know that… I did a little poking around, and I know that it does break some rules out there. Specifically, around PHI. Adam, I’m never as precise as you. Tell them what PHI is.
Adam Levin:
It’s protected health information.
Beau Friedlander:
So, there’s a HIPAA violation there?
Adam Levin:
Yeah, it’s a HIPAA violation, which is the federal data protection law for the healthcare sector. With PHI, think of it as it’s all of your sensitive, personal information as well as medical information. Whenever your personal health information, your medical information, gets mixed in with your sensitive personal information, that’s considered PHI.
Beau Friedlander:
I know that this does affect PHI. There is a HIPAA problem with this particular app, it exposes it in some way, but I wasn’t really paying attention because it didn’t seem germane. But how is this legal?
Travis Taylor:
It certainly skirts the edges of legality. One of the main ways that things like this end up getting installed is they will very surreptitiously add a little download approved link. So if you’re say, looking to download a game, there’ll be something saying … The larger message will say, “Download this here,” and that’ll be what downloads Strong Vault.
Travis Taylor:
And then, there’ll be a tiny little checkbox underneath that that’ll be the thing that’ll let you download the game. A whole bunch of different software packages online that really just take over your computer with ads, a lot of them are attached to free software downloads. The way that a lot of the websites make their income is by giving you these unwanted passengers along with whatever it is that you’re trying to download.
Beau Friedlander:
At the risk of making someone have a snitty fit, I would like to suggest that that is not the most cool practice. But it is just to make money, right? It’s like a get rich at a mediocre pace scheme.
Travis Taylor:
Yeah. And that’s one of the reasons why Microsoft and Apple have both really moved toward trying pretty aggressively to encourage people to get their software downloads through their approved stores.
Travis Taylor:
That obviously makes extra money for Apple, for instance. It gives them a little bit more control over what it is that you’re downloading, but it also means that they’re able to vet the software that you’re putting on your computer.
Beau Friedlander:
Now, Cristian, are you a person who has ventured onto a site like, for instance, the Pirate Bay?
Cristian C.:
Hypothetically, I know quite a bit about pirating.
Speaker 7:
Aye, captain.
Beau Friedlander:
Hypothetically.
Cristian C.:
Hypothetically.
Beau Friedlander:
As do we all. But I would say … Darknet Diaries had a song on recently that was the Pirate Bay Song and it’s hilarious. About bit torrenting. But the question I have for you is, you were looking for a way to customize the game?
Cristian C.:
When I originally downloaded the viruses?
Beau Friedlander:
Yeah.
Cristian C.:
No, I was looking to download the game itself …
Beau Friedlander:
Oh, the actual game.
Cristian C.:
… Which I didn’t realize I couldn’t.
Beau Friedlander:
I see. And there was no other way, no other place to get it?
Cristian C.:
Oh no. I could just have gone onto the website. This is like a huge mess up on my part.
Beau Friedlander:
Awesome.
Cristian C.:
I could have just looked up, “Happy Wheels full version.” Probably would have gone through.
Adam Levin:
The dreaded shortcut. So, Beau … But first, if we’re going to mention Pirate Bay, we have to explain what Pirate Bay is.
Beau Friedlander:
Well, Pirate Bay was a site that morphed into a political party, which morphed into a religion, actually, called the Downloadists or whatever they’re called. But they are a group of people who made a platform where you can easily get pirated IP. Travis, did I do that right?
Travis Taylor:
You did. Good job.
Speaker 7:
Shiver me timbers.
Beau Friedlander:
Wow.
Adam Levin:
And this has nothing to do with Johnny Depp?
Johnny Depp:
Look what I’ve got. I’ve got a jar of dirt. I’ve got a jar of dirt, and guess what’s inside it?
Beau Friedlander:
No. But funny enough, when Disney was going after Pirate Bay, because they were getting really snitty about their content being available on the Pirate Bay… They did this whole campaign about how pirating is bad. And then, the next ad would be for Pirates of the Caribbean, which was kind of funny.
Travis Taylor:
And the Pirate Bay is still around.
Beau Friedlander:
Now it’s AI, right? It just keeps … It’s got its own life. It’s turned into HAL-2000.
Dave Bowman:
I don’t know what you’re talking about, HAL.
HAL:
I know that you and Frank were planning to disconnect me. And I’m afraid that’s something I cannot allow to happen.
Travis Taylor:
It keeps bouncing around and they keep on getting different country codes and domain names. But it’s still very much out there.
Beau Friedlander:
Well, they also …
Adam Levin:
So …
Beau Friedlander:
Wait, Adam, this is the best part. They tried to buy two pylons in the middle of the sea, so you call it a country.
Travis Taylor:
Sealand.
Beau Friedlander:
Sealand, yeah.
Cristian C.:
They tried to buy Sealand?
Beau Friedlander:
Yeah.
Travis Taylor:
Yeah.
Adam Levin:
I want my own country.
Travis Taylor:
How do you know about Sealand?
Chistian C.:
Okay. I love history. And I love the tiny little parts of history that are just kind of relevant, but also not very. Like Sealand, it’s got some … You can look into it. There’s some important political opposition behind it, but it’s just cool that a dude just set up Sealand.
Beau Friedlander:
And then, he was tired of it, so he put it up for sale. And then, the dudes from Pirate Bay were like, “I would like to have it. That’s what we need. We need a country, because they can’t do anything to a country.”
Cristian C.:
I didn’t know they tried to buy Sealand. That’s hilarious.
Adam Levin:
I think we should create a country called Beaulandia.
Beau Friedlander:
Oh, Beaulandia, where everyone’s called Beau and Beaufina.
Adam Levin:
That’s a pretty bodacious plan, you got there.
Beau Friedlander:
But the bonus structure is great. Anyway … Oh, the dad jokes. We apologize for that. Did you ever get to ride around on a lawn mower on that game?
Cristian C.:
Yes I did, because I found out … I went to school the next week. I was like, “Yeah, I tried to get the full version. I couldn’t download it.” My friend looked at me like, “Download? What are you talking about? Just go to the website.” And I played it for a little bit.
Beau Friedlander:
Super awesome.
Cristian C.:
That was it.
Beau Friedlander:
And it was all over. And then, you just had the old … You had turned the family computer into a jalopy. But other than that, everything was good?
Cristian C.:
Yeah.
Beau Friedlander:
Do they call it the Cristian computer now that it’s been jalopy-fied?
Cristian C.:
We just say, “The old Dell,” and everyone knows. Because it was really just my dad that used it other than me. And so, every once in a while he’ll have me like open it up … I have to use a different power supply from my newer than that, but older computer to actually run it.
Cristian C.:
Because there’s a bunch of files on that hardware that I haven’t gotten around to getting off of it yet. Every once in a while he’ll be like, “Hey, can you grab that picture from like 2004?” It’s like, “Yeah, I guess.”
Beau Friedlander:
My kids just hit me up for every video. They made about 4,000 videos in Photo Booth back when they were … About 10, 12 years ago. They just asked me, “Is that computer still around?” And old dad has to go to storage and pull it out for that one thing.
Beau Friedlander:
But I have a question for Adam and Travis, which is something that I feel like I kind of know … But like I said, I haven’t gamed since a game came in an eight track cassette, basically. What are some of the … We practice something called the three M’s. How do the three M’s apply to this, Adam?
Adam Levin:
Well, again, the whole thing is, how do you reduce your attackable surface? Minimizing your risk of exposure. How do you effectively monitor and how do you manage the damage? One of the ways that you reduce your attackable surface on something like this is read reviews.
Adam Levin:
Make sure you totally understand where you’re going. Always. The old line that I like to give people is, “If you don’t want remorse, go to the source.” Like Christian said, if he just simply went to the website, he would’ve had a much better experience. He wouldn’t have had the human version of the movie Turbo in his life about the snail.
Speaker 10:
A little far from home, aren’t you? Garden snail.
Beau Friedlander:
Wait. To jump in here … Don’t stop with the three M’s, but I just also want to say, Cristian, as a musician who may one day write a huge hit, you know the value of IP.
And so, if you write that song, you want to get paid for it. And the people who made that lawnmower version of the game want to get paid for it too. Come on, go to the sources. A really good piece of advice, Adam.
Adam Levin:
But the three M’s really are, basically, what are the kinds of things that you need to do to make yourself a harder target? How can you find out as quickly as possible that you have a problem? Which is the monitoring part. And the damage control plan, which is, “Now, what?”
It’s really all about, “What do I do now in order to insulate myself from ever doing this again, and to get myself out of this mess in the first place?” It’s always important to think in terms of minimizing, monitoring, and managing. Now, Travis, from a technological viewpoint?
Travis Taylor:
Two of the main things that come to mind are, first of all, not downloading anything to a really important device that has sensitive information. It’s a lot better to crash the family station wagon than it is to crash your dad’s Porsche.
Adam Levin:
True that.
Travis Taylor:
If you were to put adware on something that you relied on for work, for instance, that would be catastrophic rather than merely irritating. And the other one that’s a little more specific is that, right now, a huge vector for adware and malware is video game add-ons.
There are a lot of things, especially from Minecraft on the Android app store, that promise you either additional functionality. Like the equivalent of adding a lawnmower or something like that, that end up actually just completely stealing your data, slowing down your phone, and sometimes even rendering the device completely useless.
Travis Taylor:
To that extent … The fun thing with a lot of these games is the fact that they can be extended and expanded. You can add more things onto them. But as far as that’s concerned, to Adam’s point, make sure you’re keeping a very close eye on where it is that you’re getting that.
If it’s just something that doesn’t have a lot of reviews or isn’t officially supported by the software developer, that is very likely to be something with some ulterior motives.
Beau Friedlander:
To get back to your point, Travis, about the vulnerability of a machine that the whole family’s using. You have this example, which is super obvious. But then, there are things that are not as obvious as gum on the shoe. They’re invisible, but they’re in your computer. And they really can track what the person paying the bills and your family is doing. That can be, if not a catastrophic event, a super annoying event that makes the next two months of your life way more complicated than they need to be.
This is just to say that there are dangers out there and that your attackable surface is what you make of it really. You can make it big or you can make it small. Think about the karate guy. And this is going to be very hard to do in audio, but wrap your one arm around your head and curl up your foot and bend your legs in. You’re a lot harder to hit. And so, you try to shrink your digital surface in the same way. Think like Mr. Miyagi.
Mr. Miyagi:
Walk right side. Safe. Walk left side. Safe. Walk middle, sooner or later, get the squish just like grape.
Adam Levin:
Again, we really appreciate you coming on today. You talk about an issue that frankly impacts a lot of people. A lot of people are gamers and a lot of people game from family-related computers. All sorts of horrible or not horrible things can happen depending upon where you go, what you click, what you’re involved with. Therefore, just be careful. Good luck in your music career in your other careers and in your gaming career as well.
Beau Friedlander:
See you on the high seas, Cristian. We’ll see you in the Pirate Bay.
Cristian C.:
Unofficially. If I were to be there.
Adam Levin:
Hypothetically.
Beau Friedlander:
I might find something on my computer of use to you. Anyway.
Adam Levin:
Maybe.
Beau Friedlander:
Thanks again.
Cristian C.:
Yeah. Thanks for having me.
Beau Friedlander:
What the Hack is a Loud Tree Media production in partnership with Larj Media. That’s L-A-R-J Media. You can find What the Hack, wherever you get your podcasts. Be sure to follow us on social media. You can find more information at adamlevin.com.
Speaker 12:
Loud tree.
