Chasing The Most Hated Hacker In History - Joe Tidy

Tidy emphasizes that hackers go for the easiest targets. Using a password manager moves you from the 'easy bucket' to the 'harder bucket,' significantly reducing your risk. He notes that even having a password manager is a step ahead of most people. The host shares that a former FBI most wanted hacker told him the 90/10 solution is just to use a password manager.

Tidy includes multi-factor authentication as part of the basic cybersecurity hygiene that, if widely adopted, would make the cyber world safer. He mentions it alongside password managers and software updates as simple but effective measures.

Tidy explains that despite the CrowdStrike incident, keeping software up to date is still crucial because hackers often exploit old vulnerabilities. He says, 'generally speaking, Crowd Strike aside, keep your software up to date.' He notes that the CrowdStrike problem was an exception where the update itself caused a global outage, affecting millions of computers. He advises that for most people, automatic updates are beneficial, but for critical systems, a delay to test updates might be wise.

Tidy explains that most hacks start with social engineering, such as calling the IT help desk and pretending to be a staff member who forgot their password. He says it sounds stupid but it works. He emphasizes that this has been the main attack vector for 20 years and nothing has changed. He also mentions that even sophisticated attacks like Stuxnet used physical social engineering (USB sticks in a parking lot). Therefore, being skeptical and following verification protocols is the best defense.

Tidy shares that after his Moscow trip to investigate the Evil Corp gang, he felt intimidated and installed a security camera system around his house. He also mentions that a cybersecurity researcher named Fabian Wasa fled Germany due to threats from ransomware gangs. This highlights the real-world dangers of investigating cybercrime.

Joe Tidy explains that groups like Scattered Spider are part of a larger collective called 'the Comm,' a community of thousands of online delinquents, mostly young boys, who coordinate on Discord and Telegram. They are not highly organized but are persistent and cause mayhem, including ransomware attacks on companies like M&S and Harrods. They are motivated by clout and money, and they often don't care about getting caught. Tidy notes that despite their amateurish operational security, they have caused significant disruption, and law enforcement has been slow to take them seriously. He cites the example of Lizard Squad, who took down Xbox Live and PlayStation Network on Christmas 2014, and how the same individuals evolved into more serious cybercriminals.

Tidy argues that two factors drove the shift: Twitter introduced the concept of followers, retweets, and online clout, which attracted hackers seeking fame. Then Bitcoin provided a way to monetize their activities anonymously. He traces the 'conveyor belt' of teenage cybercrime gangs starting with LulzSec in 2011, who loved the attention, to modern groups like Scattered Spider who are after money. He notes that before Twitter, social networks were about being social with your network, but Twitter invented the idea of clout. The combination of fame and money turned what was once 'chaotic good' into 'chaotic evil.'

Tidy explains that the initial entry into systems is usually through social engineering, such as phishing emails or phone calls pretending to be a staff member who forgot their password. He says, 'it sounds so stupid but it works.' Once inside, hackers then use technical methods to spread and deploy ransomware. He also mentions the Stuxnet attack, which used USB sticks dropped in a parking lot to infect Iranian nuclear facilities, proving that even the most sophisticated attacks often rely on low-tech methods. He emphasizes that this has been true for 20 years and nothing has changed.

Tidy argues that without cryptocurrency, cybercrime would be much harder. He explains that crypto allows criminals to receive payments directly to wallets without banks being able to stop them. He contrasts this with the early days of hacking, where a teenage hacker he profiles spent stolen money on PlayStation games and land, which was easily traced by police. With crypto, laundering is more difficult but still possible. He also notes that gift cards are another untraceable method used by less sophisticated criminals. The rise of Bitcoin in 2011-2013 coincided with the shift in hacking culture from fun to profit.

Tidy recounts how CrowdStrike's update bricked systems, affecting airlines, hospitals, and businesses. He notes the irony that those who followed best practices of keeping software up to date were the ones hit. He says the world 'bounced back' but there are ongoing lawsuits. He uses this to illustrate that while keeping software updated is generally good advice, it's not without risks. He also mentions that the incident shows how dependent we are on a few key software providers.

Tidy gives the example of Julius Kivimaki, who accidentally uploaded his entire home directory while trying to extort a psychotherapy company. The police found his IP address and traced him. He also mentions that teenage hackers often don't disguise their voices or faces, and they don't protect themselves well because they don't care about getting caught. He quotes a researcher who says 'everyone thinks that cyber criminals are masterminds when they're carrying out the hacks, but they're not masterminds at covering their tracks.' This leads to their downfall.