>> Today's episode is brought to you by Squarespace.
>> Head on over to Squarespace.com/Rogue,
that's R-O-G-U-E, sign up for our free trial,
and when you do sign up for the service,
make sure to use promo code 'rogue,'
get 10% off, you'll be awesome.
Murphy, what's your favorite cybercrime?
>> Oh, man, when someone has their arm
replaced with like a machete,
but it's like a pneumatic machete,
where it can like take people's heads off.
And they can control it with their brain and--
>> That's cyberpunk, that's a genre of fiction.
>> Oh, cybercrime! >> Crime.
>> I thought you said cyborg crime.
>> No. [laughs] >> Oh, that's what this is?
-- CC BY REV -- ** MODIFIED BY BIZARRE MAGIC ** ♪ [warbling guitar]
>> ROBOTIC VOICE: Five cybering crimes.
>> All right Murphy, we are talking about
the five hugest, insane cybercrimes.
This comes from an article at "themodernrogue.com"
where there are new articles every single day
this one was written by Mark Hill.
Where do we begin?
>> I want to just talk about how staggering
the numbers that are involved in these crimes.
>> Yeah man, when I think of cybercrime, I think of,
you know, denial of services attacks or
which I'm sure has a monetary value,
in terms of the opportunity cost,
like they weren't able to do business from this time to this time,
but we're talking about legit-ass millions of dollars.
460 million dollars a year
in cybercrime theft?
>> Yeah, you get taken by a Nigerian e-mail scam
and someone wipes out your life savings?
On a scale...
>> That's a quarter of a percent of what happens.
>> If that, because some of these are like
80 million dollars, a billion dollars,
being taken from these massive organizations.
>> Okay, who is this group FACC?
[typing]
>> ROBOTIC VOICE: The Fake President Scam
>> Okay, FACC is an aerospace parts manufacturer,
they fell for the fake president scam.
Basically, someone pretended to be someone in their company,
so it's a lot like phishing, right?
>> Oh, got it, so it's basically like,
wandering into the breakroom like
[affecting an upper management voice] "Everything going well boys?
Here I am, just another employee, hanging out."
>> Exactly.
[also affecting the voice] "Oh, hey, can you do something for me?
Like transfer 56 million dollars to this account, Mr. CEO?"
Now the details on this one are scant,
because obviously FACC doesn't want to say
"Hey, here's exactly how we were ripped off."
>> "This is how dumb we actually were."
>> Yeah.
>> So, pretty much all they've admitted is
some money was lost, [laughs]
and that CEO is no longer with us.
>> After 17 years they fired their CEO.
Now, if you connect the dots, it really seems like
someone sent the CEO a message from some department,
within this large company,
and they said, "Hey, CEO,
"sign off on this 56 million dollar transfer
for this project."
>> 56 million dollars, and I'm sure by applying things
like social pressure
and taking advantage of those psychological back doors
somebody would think, "well, I don't want to be embarrassed
and admit I don't know what project this is."
>> Yeah.
>> But he's mentioning things that tells me that
I probably approved this at a previous date.
Here, let's just knock that out so I can go golfing.
>> Exactly, and half of social engineering,
is really just getting people to do what you need them to do.
Aside from the hacking part,
>> Oh yeah. >> -you've got to gain their confidence.
You have to act like this is totally normal
and a great opportunity, and all of the hallmarks of a con.
>> So, what do you do after that money is sent?
I know in this case it sounds like
about 20 percent of the money was recovered,
everything else was just... [aspirates]
>> Yeah, yeah, they were able to get about a fifth
of it back so it was like 48 million is still just gone
and they don't know who did it.
>> Wow!
>> And the CEO?
>> 'Eah, [stammers]
he killed himself?
>> Dark. No! >> [laughs] So oh, no, no.
>> He was fired.
>> Fired, fired.
>> I don't know what happened after he was fired.
>> Oh no.
All right, so what grade do you give this phisher man?
This "phisherman."
>> Phisherman! >> Phisher of men.
He got away with it.
>> Based on the level of success...
>> And the lucrativeness, and-and the fact that, I mean,
we don't know how he did it, that's the only reason
I can't automatically give it an A+,
but this is an A. I mean, the guy,
the guy did it and got away.
>>> BOTH: A. Yeah.
>> Success is a big bump in the grade curve.
>> Yep.
[typing]
>> ROBOTIC VOICE: Phishing for 30 thousand victims.
>> So that was a case where you had a small team
and they were targeting one high value target,
but of course, as we learned in the phishing episode,
casts a very, very wide net.
Here's the amazing part, there are three guys in the UK
that all went to jail, just three guys,
had a massive phishing operation,
that 2,600 fake websites,
all designed to support their narrative.
>> Yeah, they targeted 30,000 people,
in fourteen different countries,
and walked away with 81 million dollars.
>> At least 81 million dollars,
because that's just the part that they know,
that's the part that they were able to confirm.
>> Exactly, like with the other scam,
that one is much more targeted,
so there's a single point of failure,
so if it fails you're out, and then you've got to start over,
somewhere within in the company,
or even another company.
>> Sure.
>> This method is more like the shotgun effect.
They're casting a really wide net.
They just send out so much spam,
that even if a small percentage is successful...
>> That's good enough!
>> It's going to add up. >> 81 million dollars is a lot of money.
>> And they had like 70 million new email addresses,
so they were about to expand it
in a big way when they were caught.
>> Wow, here's the part that I couldn't believe.
81 million dollars,
the guys got caught.
How much time do you think they're doing?
>> They probably went away for what, 20 years or something like that?
>> Five to eight years each.
>> Did they have to give the money back?
>> I'm sure whatever money was known,
they were able to get back,
but I'm sure they've got hidden accounts somewhere.
>> I don't want to steal from anyone,
but if someone were to say "Here's 81 million dollars,
you have to do three to five years."
>> Oh man, I'd be, I'd be in there [snaps fingers]
Yeah-- [laughs]
>> Do I go now?
Do I get to say bye to my family?
If not, it's okay.
>> So these dudes, they got caught,
but they created this massive operation.
What kind of grade do you give them?
>> I think they probably got a little too greedy,
it seemed like it was a successful scam,
and they won, clearly, 81 million,
they should have just stopped.
>> Yeah, but instead they looked to expand
to two Canadas worth of e-mails.
>> Yes, uh, I'm going to say, you should have quit
while you were ahead.
>> I give them a B minus.
>> That's what I was thinking, yeah, B minus.
>> I mean, I mean, if they still had the money, though...
>> JASON: They might.
>> They might, they might!
[typing]
>> ROBOTIC VOICE:: Bank heisting from North Korea, maybe.
>> This next one is a straight up bank robbery
by North-freaking-Korea.
>> Yeah, I mean, and if you can't trust a dictatorial regime
with your money, who can you trust?
>> Okay, but this is the weird part.
Is they didn't rob an actual bank,
they instead penetrated the SWIFT Network
which is I guess the way all
of the banks internationally talk to each other.
Now, actually hacking the SWIFT Network
would be very, very hard.
In the article he describes it as
"a Fort Knox inside a bigger Fort Knox"
but they had a stolen password for somebody,
so they were able to waltz right in
and have full access to the system.
>> Yeah, why would you get access to a single bank
when you could get access,
to the network >> To all of them.
>> that has access to all of them.
So, they stole it from the Bangladesh Bank,
but what's interesting to me here,
the vulnerability
was very, very small.
It was one employee and they just took his password.
They didn't really hack into anything.
>> Right.
>> They just got some poor bastard's password
and looted 81 million dollars.
>> But the funny part is they weren't even subtle about it.
They came marching in the moment the had access,
they tried to withdraw a billion dollars, a billion dollars!
>> That sets off some red flags.
>> Yes, a few flags.
But even then, they did manage to get 81 million dollars,
and again they can't confirm,
so it is assumed that it was North Korea.
>> Yeah, we don't want to cast aspersions, that's uh...
>> [laughs] But it sounds like they got away with it,
what do you think?
I give them a solid A, minus.
>> Yeah, they don't even know that it was North Korea.
They think that they laundered it through Filipino casinos.
>> Yep. >> And it's just gone.
So, 81 million, successful--
>> Got to give them an A.
>> Ah, yeah, I'm going to go with A plus.
>> A plus would be if they got the billion.
That was dumb for them to try to set up all those flags,
by going for a billion.
>> Okay. >> They should have played the long game.
>> Good argument, I'll give them an A.
They made a lot of money,
but honestly 81 million's not a lot for a regime to steal.
>> No.
[typing]
>> ROBOTIC VOICE:: The scam with 40 thousand ATM transactions.
>> So, here's one.
Two Middle Eastern banks got taken
for 45 million dollars,
in a total of 12 hours.
In two different instances, one two-hour block,
and one ten-hour block,
and the way they did it was brilliant.
>> Rather than hacking into the banks themselves,
they hacked into the credit card processing companies,
and raised the limit on pre-paid debit cards.
>> So, in other words, if a pre-paid debit card says
it was for 50 dollars, then theoretically,
there's just a line that says, "Okay,
stop paying out money for it."
>> Exactly.
>> But if you raise that to 500, suddenly,
you're able to just pop it in and make all the money. Right?
>> Yeah, but what good is that
if they don't have the cards themselves?
>> Right, so they got one of those magnetic stripe printers
basically, that we found on Amazon,
and then they had hundreds of people,
in 27 different countries, they did a test run,
they said, "Two hours, everybody go to an ATM,
"withdraw everything you can,
"you can keep some percentage of it.
Send us the rest."
>> And then, wire the rest back to the masters, so to speak.
>> 5 million dollars in two hours,
so they had a success, right?
>> So they said, "Okay, this works! Let's do it a lot!"
>> So then they go for the big leagues,
and in ten hours, they have 36 thousand transactions,
totalling 40 million dollars, [snaps] boom, just like that.
>> And they had confederates all over the place,
just making these transactions. >> Hundreds of people, yeah.
That's ultimately who got arrested.
The masterminds, the guys behind the guys,
were probably Russian affiliated, Russian gangs,
never got caught.
>> New champion, the fact that-that they had a clever angle,
to go for it, the fact that they were successful,
and the fact that the big bigs got away--
>> Yeah. >> That's some mustache twirling, uh, shenanigans.
>> Yeah, all of the people really committing the crimes,
the most obvious ones, they got all scooped up,
whereas the guys at the head of the organization?
>> Keyser Söze. >> Yeah, what do you give it?
>> Oh, A plus-plus.
>> A plus-plus, you like it? >> This is the best one, yeah.
>> I think it's pretty good.
Not for the guys who thought, "Oh, we're part of this scam."
They were all expendable. >> Oh no, they're chumps.
>> Yeah.
>> You got to break some eggs, right?
>> But if you take it to the top...
>> And they probably don't even have any information to report,
they're like, "Oh I had this phone number,
that the guy used to call me from" and then that's it.
>> Yeah, "I was sent a card, I used some money,
"I sent the rest to somebody else,
now I'm going to jail?"
>> [laughs] Whoops.
[typing]
>> ROBOTIC VOICE: The virtual inside job.
>> Guess who perpetrated this one?
>> Uh, the Russians?
>> Of course it was the Russians.
>> But man, oh man, is it a big one.
This is the single biggest financial disaster
in cybercrime history.
900 million dollars,
stolen from a bunch of different banks,
because they were patient.
They penetrated the network, they got access
to the banks' information.
>> Rather than trying to steal a billion dollars
in one fell swoop.
>> Instead, what they did is they just quietly watched
business as usual for two months.
>> They blended in.
>> They learned idiosyncrasies, they learned the way people
use language, they learned every single way
to dot their i's and cross their t's,
so that all of their fraudulent transactions
would look absolutely perfect.
>> Let's say you're trying to infiltrate an auto-mechanic,
the first time you drop a phrase "Samophlange"
>> Sure.
>> Everyone's going to know, "Wait a minute,
I don't think Jerry's really a mechanic."
So these guys just blended in
and so when they started doing things,
everything looked like it was on the level.
>> They were also super patient.
They made sure to do smaller transactions,
that were very humdrum, no big deal,
they didn't try to pull a North Korea
and take a billion dollars all at once.
They eventually got their 900 million dollars.
>> Yeah, they would take an account,
inflate its value by a ton of money,
and then extract that.
>> So you were left with the exact same number,
>> Yeah. >> -and anyone just looking was like
"Yeah, that's how much should be in there."
>> Yeah, which really reinforces the idea
that money is just a shared hallucination that we all have.
>> Yeah man.
>> It's just numbers.
>> Well the crazy part is they would've gotten away
with all of this, they could still be doing this,
except for, I don't know if it was out of boredom
or curiosity, they rigged an ATM to randomly spit out money
and that was such an obvious like, "Well, this isn't right,"
that it sparked an investigation.
They're like "Who authorized this?
"Who did that?
"Wait, who is this guy?
What's this employee?"
And then they unfolded
that 900 million dollars had been stolen.
>> You know it was just, some Fredo
who was trying to get into,
"You know what I'm going to do?
This is going to be awesome."
He's some low-level idiot, he's like--
>> You had an amazing golden goose,
that you had to get fancy with it.
>> Yeah, you know that one of his bosses was like,
"You did--you did what?
There's an ATM that's just spitting out money?"
>> They're like, "Yeah, hilarious, right?"
>> Can you imagine the investigator looking into that
and says "Okay, we got a ATM that's spit--
wait... oh, oh my god."
>> Oh, as you uncover just how big
and deep the whole thing goes?
>> Yeah. It's like there's almost a billion dollars US. >> That's crazy man.
All right, A plus plus, right?
This is the grand champion.
>> Really clever, I've got to commend them for their patience
and for the chameleon-like methodology
of just implanting themselves and blending
in to watch everything, that is admirable.
I mean, never do that.
>> I was about to say.
>> Never do that.
>> You're sort of laying it on a bit thick there.
>> That's terrible, bad behavior.
>> Man we're in the wrong business.
We got to into that cybercrime.
>> Or everybody's got to up their Patreon.
Patreon.com/modernrogue
>> Dude, [mumbles] you need to drop a mixetape
is what needs to happen. [laughs]
>> Jason Murphy, cybercrime freestyle rap,
and go! [snaps fingers]
[deep voice] >> ♪ Oh you son of a [chirp] ♪
♪ I don't even have that itch. ♪
♪ What am I supposed do in rhyming things? ♪
♪ I don't even know what half of these words mean. ♪
♪ I'm going to sit here and drop some rhymes ♪
♪ and like you do this all time ♪
♪ but I'm not good at it. ♪
♪ I can't even fathom it. ♪
♪ I don't even know what word rhymes with fathom it. ♪
[laughs]
>> Man!
That was so much better,
I thought was laying a trap for you.
>> I thought you were too!
[laughing]
You unlocked my secret rhyming ability,
until it crashed and burned at the very end there.
>> No it was amazing, that was amazing.
>> So this is it man, this is one of the last few weekends
before we start massive construction
at Modern Rogue HQ, and you realize what's next on the list?
>> Missile silo?
>> No, I mean. >> Volcano lair?
>> Okay, all of those will happen, here at Modern Rogue HQ,
but I'm talking about our virtual presence online.
>> Oh, that, yes.
>> Look, we built our site on Squarespace.
People watched us build it live, we filled it
with all this amazing content and articles,
now it's time for us to grow again.
We have to have all the new videos,
Scam Nation now putting out stuff more often,
we need a community hub, and we got to find out
what they want us to put in.
>> Yeah, because we can easily implement it with Squarespace.
It just takes a click and drag,
you don't have to know a single line of code.
>> Although, if you do want to hire
one of those voodoo wizards
>> That's how I used to do it. [laughter]
>> Somebody has a shrunken head, shakes a talisman,
does some RSS.
[laughter]
>> Guts a calf over the keyboard.
>> Because I asked the folks at home to send me
modernrogueshow@gmail.com, what do you want
for the community sites?
You want forums?
You want a place to showcase your videos?
Like, how can we make this a site
that is part of your daily rotation?
You know how many people responded?
There was a zero in the number.
>> None‽
>> Nobody responded!
>> Nobody‽
>> Look, you guys got to write us.
Modernrogueshow@gmail.com.
The beauty of Squarespace is that it's easy
to re-tool everything, but we have to know
what the communities, what the rogues, out there
want us to do.
>> And they could be building their own sites using Squarespace.
Go to Squarespace.com/Rogue, get 10% off your first purchase.
>> Yeah and a free trial, so you can try it all out.
Figure out how to be a genius.
You're probably already a genius,
but now you'll know it.
>> You're probably smarter than we are.
>> Thanks to Squarespace.
[metallic chime rings out]
[distorted] >> BRIAN: ♪ All right, Jason Murphy, cybercrime freestyle rap, and go! ♪
[bassy beat] >> ♪ Oh, you son of a -itch, I don't even have that itch, ♪
♪ that i-i-itch. ♪
♪ What am I supposed to do with rhyming things? ♪
♪ I don't even know what half of these words mean. ♪ >> BRIAN: [echoes] ♪ Because I'm a Modern Rogue! ♪
♪ I'm going to sit here and drop some rhymes ♪
♪ and like you do this all the time ♪
♪ but I'm not good at it. I can't even fathom it. ♪
♪ I don't even know what word rhymes with fathom it. ♪
>> [laughs] Man!