Transcription performed by LeahTranscribesJACK: Have you ever tried installing an app on your computer but then ended up with something else? Like, you downloaded something you actually wanted like a app to retrieve a deleted file or to get some video to play properly, [Music] you get it on your machine the way everyone does, you downloaded it, run the installer, click through the screens, next, next, next, agree, and then it’s installed, but then something strange happens. You might not notice right away, but there’s something new on your computer, a new app or toolbar in your browser, or maybe your homepage changed to something like a search engine you never heard of, and your computer seems to be doing something every now and then that just doesn’t make sense. Like, it’s a tad slower or the fans are suddenly louder, but you’re just not exactly sure why. Most of the time it’s relatively harmless. It’s some kind of junkware.
Some company paid a few cents to bundle their stuff into your download, hoping that you wouldn’t remove the software and you would start using their software. It’s annoying but it’s easy to delete and forget about it. But stop and think what just happened; you went to try to install one thing and something else came along with it, something you didn’t choose to download and didn’t even know you were installing it at the time. You didn’t even know what it was. It latched onto something else that you trusted and came into your PC and got installed. I hate this kind of software, software that you didn’t install. It just came along for the ride, software that you don’t want on your machine. It has a hidden agenda, and who knows what that thing is doing there. This is a story about a piece of software that snuck onto our machines like that. It’s called Blackshades.
Intro: [Intro music] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries.
JACK: Let me start at beginning. Alex Yucel and Michael Hogue created a program called Blackshades, and in 2010 they started selling it online. Blackshades, or more specifically, the Blackshades RAT, is a piece of software that allows an attacker to gain complete control remotely of a victim’s machine. They can view their files, record their keystrokes, lock their data, and hijack their webcam. [Music] They marketed Blackshades like a regular software product. They had a website with an About Us page and an Order Now button. The page said ‘Blackshades is mainly an IT surveillance and security-based company directed at making your PC experiences easier. Our main goal is to offer affordable software solutions comparable to bigger names out there.’ Then they listed the benefits of using the product; to spy on your children or spouse, to find out if your partner is cheating on you, or to see if someone was using your computer in unwanted ways.
They even had a legal notice saying that it’s legal to install monitoring software on your own computer according to the Spy Act of 2004. The price? Forty bucks. The site wasn’t hidden on the dark web. It was right there in the open with normal-sounding marketing language, and at first glance it doesn’t look nefarious. But as you think about it, you’re like, wait, hold on a minute. The software is used to spy on people? Which makes me wonder, is Blackshades legal? Well, there’s actually two questions here. Is making and selling Blackshades legal, and is using Blackshades legal? The website says that this is a surveillance and security tool used to monitor the activity of your child’s computer. Well, that in itself isn’t illegal even if it can be abused, kinda like a knife isn’t illegal. We need it to make food with. Someone waving it around on the street is suddenly a big threat. In fact, many businesses today use software just like that to monitor what their employees are doing.
It’ll take screenshots, record what apps are opened and in focus, and track the locations of devices. But when a company spies on its own computers, it typically makes it very clear; there is a monitoring system on your computer, or they make the employees sign a document which says ‘You may be monitored while you’re here at work’, which is what makes it legal. That person being spied on knows and consents to it. So, on the surface, both making and using software like this can be perfectly legal. But Blackshades wasn’t marketing this to businesses. They were marketing it on hacker forums. [Music] They specifically were building a tool that they knew people would use for malicious purposes. They weren’t in the business of selling kitchen knives. They were specifically marketing their product to people they knew would abuse it. So, their whole website, which was saying this is used to track your kids, that was really a lie, a ruse to make it look legal and look perfectly fine.
To the courts, who look at things through the lens of the law, intent matters a lot. If you know you’re selling to people who will use it to commit crimes with, then yeah, it’s illegal to sell that. When it comes to the customers, if they were putting it on people’s computers without their consent and spying on someone without them knowing, then that’s illegal, too. That’s unauthorized access to a computer, privacy violations, identity theft, intercepting communications, and extortion. So yeah, this can be illegal to use as well, both illegal to make and illegal to use. But again, it all comes down to intent of whether or not this is legal versus illegal. If these people who use it and make it are going to get in trouble over this, then the courts are gonna have to prove that intent was there to sell it to criminals or to spy on people without their permission. Blackshades is better known as the Blackshades RAT, and RAT stands for Remote Access Trojan.
Remote access is like when you need computer help and IT support takes over your computer to fix something, or when you log into your home computer from a coffee shop. A RAT is the exact same thing, except it’s malicious in nature. Someone you don’t know takes over your computer without your knowledge or consent, and they can see everything you’re doing. The scariest bit is you have no idea it’s happening, since it’s completely running silently. Once Blackshades was on your machine, the attacker has an astonishing level of access. They could read every file and view every photo and video on your computer. They could see every single key you pressed. Every password, every credit card number, every private message went straight to the attacker. They could steal the log-ins to your bank, your e-mail, your social media accounts. They could turn your webcam and microphone on, and from there they can commit a litany of crimes; theft, extortion, blackmail, for example, but also wire fraud and identity theft.
And it gets worse. Blackshades had a feature called the Spreader. Once it was on your computer, the attacker could use your social media accounts and chat apps to try to spread it to your friends’ computers, too. They could even use Blackshades for ransomware, locking up their targets’ files and demanding payments to unscramble them. [Music] I can’t imagine this feature being used for any legitimate purpose. So, the fact that this had a ransomware feature squarely puts it in the malicious software territory, if you’re asking me, making it clearly illegal. But Blackshades would make their users click on a button stating that the user is responsible for whatever the action resulted in, and warning them to be careful when using this feature. It also said this was made for educational purposes only. Yeah, okay, sure. But there was one problem for Blackshades users.
You couldn’t just wave a wand at someone and infect their computer with Blackshades, and no one in their right mind would install this to give some random attacker full access to their computer. So, to get Blackshades on a victim’s machine, they had to trick the victim into installing it themselves, to make them think they’re installing something else, and that’s tricky because you basically have to exploit another human to get it installed, which brings us into the world of social engineering, the art of tricking people into doing things they don’t actually want to do. There are a 1001 ways that we can all be tricked into installing things that we don’t actually want. Humans are a weak link when it comes to computer security. You might have seen some of them, obvious links; click here for a free iPhone, and you’re like, yeah, nah, I’m not doing that. But sometimes it’s not so obvious. Since Blackshades can spread from a friend’s computer to yours using malicious links, it can look like it’s coming from someone you trust.
They can also hide malware inside pirated software, games, or movies on peer-to-peer file-sharing sites. So, if you downloaded a cracked version of a video game that you didn’t want to buy, Blackshades might come along for the ride and get installed with it. I should know, too. When I was a teenager I downloaded a lot of shady apps and games from shady parts of the internet, and I would constantly be dealing with infections. I didn’t care because I really wanted to play the game, but eventually the infection would get so bad that I couldn’t use my computer at all. Pop-ups would just constantly be showing up. The CPU would crawl to a standstill. I must have been hit with malware hundreds of times when I was a teenager. But that’s what got me good at fixing computers, learning how to find malware and remove it and cleaning up my computer. After a while I took pride in knowing there is no problem that I can’t fix on my computer.
Worst case is I could just reinstall the operating system if I had to, which I did a lot. I mean, a lot, a lot. Anyway, sometimes devices you buy in the store actually come with malware on them. There was a story I read once where a Chinese laptop maker was selling their laptops on Amazon that came with Windows 11. Well, the thing was the Chinese seller was trying to cut costs and didn’t want to pay for Windows 11 license keys for every computer, so they found a pirated version of Windows, installed that, and shipped it with their laptops. Little did they know, the pirated version contained malware and was draining people’s crypto wallets and robbing their Steam accounts. So, you need to be really careful with what apps you install and where you get them from, because having one bad app on your computer can ruin you. But even apps you vet thoroughly can turn rogue. I’ve seen some popular browser extensions get purchased by someone who had malicious intent, and then they put spyware on people’s browsers without them knowing.
Or maybe someone makes a simple mobile app that’s clean and fine and free, even. But as it grows in popularity, there’s always someone that asks them, hey, I’ll give you a few thousand dollars if you can put this widget in your app. Don’t worry, it’s just an advertising pixel. If someone’s making free software and suddenly get offered a few thousand dollars to add a simple advertising pixel, they might say yes. Now suddenly that app, which was clean and good, now has some malicious code in it tracking what you’re doing on your phone. Stuff can sneak into our devices from all kinds of directions. It’s a war out there. [Music] Then there’s USB sticks. If you put a USB stick into a computer, Windows will look at it and see if there’s a file called autorun.inf, and if so, it’ll run the commands in that file. So, if someone swings by your computer, pops a USB stick in the slot, it may auto-infect that machine. Then you could pull the USB stick out, and nobody knows what happened.
Back in the days of Windows XP and Vista, this feature was on by default in Windows. Nowadays the Autorun feature is not on by default, thank goodness, but this was a popular way people would infect computers with Blackshades, since it was just dead simple to do. Just stick the USB stick in for a few seconds and pull it out, and you’re done. I think the most popular way people were getting victims to install this is to send them a message saying, ‘Oh my god, is this you? How embarrassing!’ with a link to a photo or a video. Except it wasn’t a photo or video. It’d look like it, but when you tried to open it, it was really a program that would install Blackshades. Another one, which I’ve actually seen in my own inbox, was something like, ‘We’ve tried to deliver a package to you three times now. We were unsuccessful. We’re gonna send it back to the shipper unless you click here.’ I always have this knee-jerk reaction like, oh man, I don’t want my package returned.
Then I realize it’s to an e-mail I’ve never used for ordering things before. I’m like, oh, that’s a scam. They’re trying to trick me. So, no matter how vigilant you are, I think we’re all susceptible to phishing e-mails. It just has to be clever enough to make you click. Once Blackshades got installed on a victim’s computer, the operator needed no skill at all. You didn’t even have to open a terminal. It came with a slick, little dashboard to show you every computer that you’ve infected, with icons telling you if there is a camera available on that computer or not. If you were the operator, you could simply point and click on the computer you wanted to see, and now you could see their desktop, files, and yeah, camera. I mean, you could see it all; people’s private messages, social media accounts, Google searches. It was spooky. [Music] There was this guy named Stefan Rigo from Leeds in the UK who saw what Blackshades could do, and he became interested.
He was thirty-four years old. He bought it for forty bucks using his ex-girlfriend’s credit card, and then he infected his ex-girlfriend with this malware. Maybe he sent her a phishing chat message or plugged in a USB stick when he visited her house one day and she left the room or something. But when he was at his computer, he could see when her computer was online. Her computer had a camera on it, and from the dark comfort of his own house, he turned on her camera and watched her in her bedroom. He found it incredibly addicting. She had no idea he was watching her. Usually there’s a little light that comes on when your camera is on, right? Well, Blackshades made sure that light didn’t come on. Watching her in her bedroom gave him a rush. He liked it. He had some other lady friends and wondered what they were doing, too. So, he started infecting more and more women that he knew with Blackshades. He could hear conversations people were having. He watched them get undressed.
Of course, he’s taking screenshots of them changing and saving the recordings. He liked that kind of stuff the most. Stefan got seriously addicted to watching what women do in the privacy of their own homes. Every day he would open up his Blackshades dashboard and look to see what computers he infected were online, and then he’d double-click on one and sit there, watching what they were doing. Not only was he watching through the cameras, but when they’d use their computers, he’d watch what they were doing on it, too. He could see their passwords, their private messages with people, their photos, what they bought online, their online banking activity, everything they did on that computer. The thing that made it addicting to him was that he never knew when something interesting would happen or what would happen. To him it was like a wave of excitement when he actually saw someone changing in front of a camera. That would make it all worth the time to him.
He started out by putting it on the computers of women he knew, but then he learned how to spread it from those computers to their friends’ computers, and now he was infecting other women that he didn’t even know, and he didn’t stop there. He was trying to infect other women, too, like people working in coffee shops or at a library. It was real easy for him just to put in a USB drive and try to infect someone’s laptop. He was seriously addicted to this, and over time he got over a dozen people infected with Blackshades. With that, there was always someone online doing something interesting that he liked watching. There’s a whole voyeurism fetish out there on the internet. People will secretly film women getting undressed and posting it online. Or maybe they’ll hold a camera under some lady’s skirt and take a photo of that and share it. Well, this voyeurism community was hearing about what you could do with Blackshades, and they were into it.
The Blackshades RAT had incredible potential for secretly getting videos of women undressing or having sex. Soon the biggest user base of Blackshades were guys spying on girls to see them naked, and in most cases the guys were spying on the girls they knew, keeping tabs on exes, getting dirt on someone they’re jealous of, or just spying on women because they found it fascinating. Over time, thousands of Blackshades users were using this tool to spy on women. It really helped Blackshades grow in popularity. But they weren’t the only people interested in Blackshades. It was also used to target activists. In 2012, Syria was in the middle of a civil war. People were really upset with the president of Syria, Bashar al-Assad, for using chemical weapons on his own civilians. The country ignited in large-scale protest and pro-democracy rallies as part of the Arab Spring. In the midst of this, researchers at the Electronic Frontier Foundation and the Citizen Lab noticed that Syrian activists were getting hit with malware.
They would get a link from a Skype account from someone they knew and trusted without realizing that account was compromised. One message read, ‘There’s a person who hates you, and he keeps talking about you. Here’s a screenshot of the conversation.’ There was a link to the malicious file, and when they’d click it, Blackshades would install itself on their device. [Music] The Syrian government used Blackshades to spy on opposition activists and tried to suppress them by having total control of their computers. They could do things like get information on the next rally or delete social media accounts or look through photos and documents. Before Blackshades there was another tool called DarkComet. It was developed back in 2008 by a French programmer named Jean-Pierre Lesueur, also known as DarkCoderSc. He discontinued the program partially due to its use in the Syrian civil war and possibly due to the fear of him being arrested.
Like Blackshades, DarkComet was used to spy on victims through key-logging, screen captures, and by stealing their passwords. To me, this is really fascinating because at the time, a lot of activists within the hacker group Anonymous were very active in the Arab Spring trying to help the protesters from afar by knocking the government offline and doing stuff like that, and it’s wild that the very people who wanted to assist the protesters are also the ones who are accidentally assisting the government to suppress the protesters, because tools are typically neutral and can be used by either side. When you make something so effective, people will notice it on both sides and use it for their own agenda. I don’t have any knowledge of whether the creators of DarkComet or Blackshades were members of Anonymous, and it wouldn’t surprise me if they were, because, well, at least the maker of DarkComet said some stuff online that looked a lot like what the Anonymous activists were saying about Syria at the time.
So, this was yet another thing this malware was being used for. A $40 piece of software marketed to suspicious spouses and parents was being used to find dissidents during a war. Which, by the way, government intelligence units love using off-the-shelf tools to conduct their spying, since they don’t have to burn any of their trade craft to conduct their tasks. A $40 off-the-shelf tool is way cheaper than spending a lot of time and energy developing their own tool to do the same thing. By this time Blackshades was becoming well known in the hacker communities. Hundreds of people were buying it and infecting thousands of machines with it, which also meant the victims were waking up to the nightmare happening to their computers. Victims would often get extortion e-mails where they would receive an embarrassing photo of them with some kind of demand. The obvious demand is to pay some Bitcoin and we’ll delete it, but some were downright evil.
Like, people would send a half-naked photo to their victim and say, ‘Send me a fully-nude photo or I’m posting this on your own social media account. Let me show you that I have access to it.’ Then they would post a test message to prove it. It would rattle a lot of these women, and they would sometimes send the pictures that were demanded simply out of fear. [Music] Sometimes the attacker would catch a picture of their victim having sex and send them a picture of that and demand a video call over Skype, and they’d ask the women to do a five-minute sex show for them on camera as part of the ransom demand. If they didn’t do it, the attacker had access to all their social media accounts and said they’d post something really terrible if they didn’t to it. Blackshades was a growing problem, and victims were being almost entirely silent about the matter due to all the embarrassment and fear. I hate to say it, but it’s possible that some women died by suicide because of this.
I didn’t see any specific stories about that happening with Blackshades, but I’ve seen countless stories where online bullying and abuse and harassment has led to women feeling so desperate that they’d rather die than face the embarrassment or harassment anymore. It’s really tragic. We’re gonna take a quick ad break, but stay with us because this is where the FBI starts to get involved. The FBI started rooting around in some hacker forums looking for crime, but they weren’t focused on this. Not yet, at least. They were focused on stuff like credit card fraud and online fraud. In 2010 the FBI decided to go on the dark web and build their own stolen credit card exchange. They were hoping thieves would come and sell stolen cards and people would buy them, and then the FBI would catch them in the act. It’s wild to me that the FBI built their own carders market on the dark web, a honeypot to trap people. Not only could you buy and sell stolen credit cards there, but they sold tools for stealing credit cards, too.
However, dark web forums like this only work when there’s trust, so the FBI, which was acting like dark web operators, said they’ll verify every tool before it’s allowed to be sold on the site. So, for instance, if you wanted to sell a credit card scraper, the FBI would have to vet you as a seller first. Send us one and we’ll test it, and if it’s good, we’ll approve you as a vendor. The administrators were either undercover agents or confidential sources in the investigation. They were reviewing these products to get evidence of criminal activity and to investigate the hardware, software, and methods used. The FBI was looking for credit card fraud, but then the co-creator of Blackshades, Michael Hogue, wanted to become a vendor on this forum. [Music] So, he submitted his tool, Blackshades, to show them that he has a real tool that can be used to scrape credit card data. He had no idea he was pitching the FBI. It’s kind of ironic that the co-creator of Blackshades fell for a social engineering trap himself.
See? Even he’s susceptible to that. The FBI couldn’t believe Michael sent them his malware. This was clear evidence of his intent, to sell Blackshades to criminals. All that language that this was only for educational purposes or for a parent to monitor their kid wasn’t gonna fly anymore. When you’re selling it to criminals on a dark web forum to steal credit card data with, then that’s clear intent. In 2012, the trap snapped shut. The FBI ran a sting operation called Operation Card Shop. It led to twenty-four arrests in eight countries. Almost all of these arrests were for credit card fraud, but there was one exception. One of the people arrested was Michael Hogue, the maker of Blackshades. He was charged under the Computer Fraud and Abuse Act for conspiracy to commit computer hacking and transmission of malware. Writing and selling software isn’t illegal, but writing and selling software with the intent of logging keystrokes, ransomwaring files, stealing credit cards, and spying on webcams without consent is illegal.
Hogue cooperated with investigators, which meant he avoided prison entirely. He was sentenced to five years of probation and he was ordered to forfeit $40,000, and had to perform 500 hours of community service. So, that’s it, right? Co-creator of Blackshades arrested, 2,000 people in cuffs, game over for Blackshades at least, right? Except it wasn’t. The Blackshades website stayed up and operational and kept selling it to people for forty bucks. What’s hilarious is around that time, Blackshades became so popular that you could find pirated versions of it floating around, too. People who didn’t want to pay the $40 could download it and install a pirated version and use it, and it’s hilarious because almost certainly a pirated version of Blackshades is going to come with some other malware bundled on it. You’re gonna get some other spy tool installed if you install this. People were spying on the spies. Over the next year, Blackshades did not shrink. It grew. In 2013 Blackshades made its news again.
REPORTER: Miss Teen USA 2013, Cassidy Wolf, was one of the victims of a hacker using the malicious software called Blackshades RAT, or remote access tool. Authorities say last year a hacker used Wolf’s personal computer webcam to take nude photos of her and threatened to post them online if Wolf didn’t send him more revealing photos. Instead, she went to police.
JACK: Cassidy Wolf, a high-school student from Temecula, California, got an anonymous e-mail. A stranger said he had photos of her, photos taken in her bedroom through her webcam, on her own computer after he hacked into it. He tried to extort her after threatening to release intimate photos unless she provided him with a special performance. Classic sextortion. [Music] She had no idea she was infected by this. She said her camera light never came on, and she didn’t know anybody had been staring at her in her room this whole time or watching her computer. She didn’t send any photos to this stranger. She went to law enforcement instead. The FBI ran the investigation, and when they figured out who was behind it, it turned out the hacker wasn’t some shadowy figure on the far side of the world. It was a guy she went to high school with, a former classmate named Jared Abrahams, and she was not the only one.
Jared used Blackshades to break into the computers of at least two dozen women and girls. Their ages ranged from sixteen to the early twenties. Jared got arrested by the FBI. Two months later he pled guilty to extortion and hacking. He went to court for sentencing and he was sentenced to eighteen months in federal prison. Four months after this extortion attempt, Cassidy Wolf was crowed Miss Teen USA 2013. Instead of keeping quiet about what happened to her, she did the opposite. She spent her year using that title to go to schools and talk about exactly that, webcam hacking and sextortion.
CASSIDY: Yeah, so, a few years ago I was with a friend of mine, and I randomly got an e-mail, and in that e-mail he had attached photos that he had taken of me through my webcam. So, it ended up being a federal investigation…
INTERVIEWER: Yeah.
CASSIDY: …for three months straight. The guy that did it ended up going to prison for eighteen months.
JACK: Wow, how brave of her to use her newfound popularity to fight for justice and to win. So, that’s one guy caught for spying on girls, but that didn’t slow down the continual growth of Blackshades’ sale and usage, because by May 2014, Blackshades was booming. By then it had infected over a million computers worldwide. [Music] When the FBI arrested Blackshades’ co-creator, Michael Hogue, he became a cooperating witness, which meant he let them see all the inside baseball of his organization. He showed the FBI how many computers it had infected, who the users were, everything. Well, actually, I don’t know how much he actually showed them versus how much they saw, because they just seized all his servers and took all the computers for themselves. So, the FBI knew the malware had infected over 500,000 computers in over a hundred countries and had generated over $350,000 in sales. They had the names and addresses of more than 6,000 customer accounts, basically a customer list of all the people around the world who bought Blackshades.
They shared this list with law enforcement partners around the world. So, what do you do as the FBI when you have the billing information for thousands of Blackshades customers? I know you’ve heard the term before; they can’t arrest us all. But can they? I think they wanted to. But the FBI has a 99% conviction rate. If they arrest someone, they better have bulletproof evidence that that person committed a crime. I mean, that one user, Stefan, bought the thing using his ex-girlfriend’s credit card, right? So, just in the list of names of people who purchased it isn’t enough. They need to go through each customer individually and prove that they were actually abusing the tool. Because what if someone’s just using it to monitor their child’s computer activity like the website advertised it? They didn’t want to make any mistakes. So, they spent months and an enormous amount of time building cases for as many of its users as they could.
They were able to get enough evidence on lots of people who were clearly abusing the tool, but those people were located all over the world, so they reached out to law enforcement in eighteen different countries to try to do a worldwide coordinated takedown. On May 19th, 2014, law enforcement officials from around the world raided the homes of Blackshade users, arresting as many people as they could. Here’s Preet Bharara, the US Attorney for the Southern District of New York, in a press conference explaining what they did.
PREET: We are announcing another global law enforcement operation that has exposed and crippled a frightening form of cybercrime affecting hundreds of thousands of computer users around the world.
JACK: The operation led to ninety-seven arrests and 359 searches across the world, with people detained in the US, the UK, Germany, France, the Netherlands, Belgium, Austria, Switzerland, Italy, Croatia, Denmark, Estonia, Finland, Moldova, Canada, and Chile. The age of the criminals varied. Some were teenagers; a sixteen-year-old in the UK, a seventeen-year-old in Finland, an eighteen-year-old in the Netherlands. Others were adults, and I’m pretty sure it was all males who got arrested. Ninety-seven people arrested for using the tool. The reasons for using it varied, too. Some used it for voyeurism and extortion. Some used it for financial theft. Some built botnets to launch DDoS attacks. Some locked computers up with ransomware. More than a thousand data-storage devices were also seized, and they took the Blackshades website offline. One case involved an eighteen-year-old man from the Netherlands who allegedly infected 2,000 computers to take photos of women and girls who were using their machines. 2,000 infections from one guy alone. In 2014 prosecutors in the US unsealed charges against five people. Here’s FBI’s Special Agent in charge, Leo Taddeo.
LEO: [Music] We have charged three key members of the Blackshades organization, as well as two cybercriminals in the New York area who purchased the software and used it to victimize hundreds of innocent people. Specifically we announce charges against the two alleged creators of the Blackshades RAT, Alex Yucel and Michael Hogue. Yucel, a Swedish citizen, was arrested in Moldova in November 2013, and he is awaiting extradition to the United States. The indictment against Yucel has been under seal and was made public earlier today. Mr. Hogue was arrested in Arizona in June of 2012, and subsequently pled guilty in January of 2013. Mr. Hogue has been cooperating with the government and its investigation since his arrest. We have also charged and arrested today Brendan Johnston, a former Blackshades employee who helped market and sell the RAT as well as provide technical assistance to its users, and two New York-area purchasers of the RAT who allegedly used it to steal online account information and spy on victims through webcams.
JACK: When the FBI made copies of the customer list, they didn’t stop at the developers. Across more than forty US cities, agents knocked on the doors of regular people who paid forty bucks, and if you were on hacking forums at the time, you would have seen panic unfold in real time. People were posting things like ‘The FBI just raided my house’ or ‘They took my computer’ or ‘What do I do?’ One guy in Canada posted that the police showed up with a warrant because his son had bought it.
FBI: During this past week, FBI agents in over forty cities across the country conducted searches, interviews, and arrests of people who purchased Blackshades and may have used it to commit cybercrimes. We also passed leads to foreign law enforcement agencies around the world. In the last few days our law enforcement partners in nineteen foreign countries carried out their own law enforcement actions. The combined efforts of the FBI and foreign law enforcement marks the Blackshades takedown as one of the largest global cyber operations in history.
JACK: Wow, one of the largest global cyber operations in history. Remember that guy I told you about earlier, Stefan Rigo, who infected over a dozen women with Blackshades? He was arrested in this operation, too, and he pleaded guilty. He received a suspended sentence, 200 hours of community service, and seven years on the sex offender registry.
FBI: Combating cybercrime is a top priority for the FBI. The charges unsealed today should put cybercriminals around the world on notice. If you think you can hide behind your computer screen, think again. Just like in the physical world, the FBI will follow the digital trail to your doorstep. If you think operating in a foreign country puts you out of our reach, think again. We have many law enforcement partners around the world who are with us in this fight. If we can’t reach you, they can.
JACK: Blackshades is old now. Most antivirus software can detect it, and some of the methods it used to spread no longer work. The website is gone. The forums are dead. The people who built it got arrested. But even though Blackshades today is mostly a museum piece, malware doesn’t really die. It evolves. The $40 RAT with the friendly menu got replaced by newer ones with different names. The criminal economy moved into newer, more sophisticated malware that’s harder to detect. What’s still true is malware wants to be sneaky and live quietly. It doesn’t want the victim to know they are infected. There’s an asymmetry of knowledge here which is a huge gap, actually. Most people don’t know enough about computers or how to secure them to protect themselves reliably, and these attackers rely on that lack of knowledge to hide in the wires, under the radar. Listening to shows like this starts to bridge that gap.
Now you’re aware that tools like this exist in the world, and they’re a big deal. I mean, this one resulted in one of the largest global cyber operations in history. This isn’t just some little thing. This is a huge problem. So, awareness is step number one for your safety. Be aware that messages from friends can contain malware, and it doesn’t always mean that they sent it to you. It’s always good to verify things out-of-band if you’re not sure. Like, if you get a text message from a friend with a suspicious link, call them on the phone and be like, hey, did you just send me this text? [Music] It’s always better to be safe than sorry. Be aware that all of the documents that you have, the photos you took, or anything you’ve saved on the cloud may and probably will get loose at some point and get out in the world. Data breaches are extremely common, and malware like this makes it easy for an attacker to get into your computer to see your stuff.
So treat your sensitive documents and photos with much more care than normal. For me, I store stuff offline on a hard drive that’s encrypted. It’s a pain in the neck to interact with those files on there, but that’s the point. I want to make it really hard for anyone else to access it, too. There are also USB sticks that you can get which encrypt all the data on it, and to decrypt it you have to enter in a PIN code. Storing stuff on an encrypted USB stick is a pretty good idea, especially since things like mobile phones can’t decrypt a hard drive to interact with it. You should treat the internet as a hostile place, because it is. Be very, very cautious when downloading things, clicking links, installing stuff, accepting pop-up options. For me personally, I try to adopt a very minimal approach when it comes to the software and apps I use. The fewer the better, because it reduces the attack surfaces for things that can go wrong. For Pete’s sake, cover your cameras.
I think a lot of us are already in the habit of covering our laptop cameras, which is great. But what about your phone camera? I’m seeing cases these days that have a little slider on the back of the phone so it covers the camera, and I love that. I have one of those myself. But what about the front camera? I haven’t seen any cases that cover that. There are little camera covers that you can stick on it, but in my experience, they just always pop off after a few days. I’ve actually experienced with a ton of different types of tape. Electrical tape is easy to peel off for a photo and it doesn’t leave much residue, but you need to swap the tape out every month or so or else it gets gooey. I just don’t trust cameras to be off when I think they’re off because of stories like this. I also unplug the TV when I go into hotel rooms when I stay there, since a lot of them have cameras and mics in them, too. Of course you should keep your system and apps updated.
Use a different complex password for every service app and website you have an account for. [Music] Actually, I use a different e-mail address for every account that I have as well. This way I immediately know if something doesn’t look right because it’ll be for an e-mail that I only use for one thing, and now I’m getting something else from it. It’s not a bad idea to use an antivirus scan every now and then to check for malware on your devices. I’m not gonna plug any here, though, but do some research and find one that’s trusted and reputable. I’m not sure we can achieve perfect privacy or security, but like I’ve said before, when you’re trying to secure your stuff, it’s kinda like running from a bear in the woods. You don’t need to be faster than the bear; you just need to be faster than your friend who’s also running from the bear in order to stay alive. Your goal is to make it hard for an attacker to get to your stuff so that they just move on to an easier target.
Outro: [Outro music] This show is created by me, Papa Ransom, Jack Rhysider. This one was written by motherboard, Yale Grauer. Our editor is the gigabyter, Tristan Ledger, sound design by the LFO, Garrett Tiedemann, mixing by Proximity Sound, and our intro music is by the mysterious Breakmaster Cylinder. If you haven’t checked it out already, you should go listen to my other podcast called LOW. It’s the craziest story I’ve ever told. It’s the craziest story I’ve ever heard, and it just might change the way you think about life. Go find LOW wherever you listen to podcasts, spelled L-O-W. My computer just went through a messy divorce. She ended up getting a C drive, and he got the D drive. This is Darknet Diaries.