In the waning years of the 20th century, amid growing anxieties about the turn of the millennium, one man, Robert Bemer, observed the unfolding drama from his remote home on King Possum Lake. A revered figure in computing, Bemer had early on flagged a significant, looming issue known as the Y2K bug, which threatened to disrupt global systems as calendars rolled over to the year 2000. This episode delves into Bemer's life during this critical period, exploring his predictions, the ensuing global frenzy to avert disaster, and the disparate views on whether the billions spent in prevention were justified or merely a response to a misunderstood threat.

In the 1950s and 60s - even leading into the 1990s - the cost of storage was so high, that using a 2-digit field for dates in a software instead of 4-digits could save an organization between $1.2-$2 Million dollars per GB of data. From this perspective, programming computers in the 1950s to record four-digit years would?ve been outright malpractice. But 40 years later, this shortcut became a ticking time bomb which one man, computer scientist Bob Bemer, was trying to diffuse before it was too late.

The 2008 Russo-Georgian War marked a turning point: the first time cyberattacks were used alongside traditional warfare. But what happens when the attackers aren't soldiers, but ordinary citizens? This episode delves into the ethical and legal implications of civilian participation in cyberwarfare, examining real-world examples from Ukraine and beyond.

In 1991, Kevin Mitnick was bouncing back from what was probably the lowest point of his life. He began to rebuild his life: he started working out and lost a hundred pounds, and most importantly - he was finally on the path towards ditching his self-destructive obsession of hacking. 

But just as he was in the process of turning his life around, his brother introduced him to a hacker named Eric Heinz, who told him about a mysterious piece of equipment he came across while breaking into Pacific Bell: SAS, a testing system that allowed its user to listen in on all the calls going through the telephone network. SAS proved to be too great of a temptation for Mitnick, who desperately wanted to wield the power that the testing system could afford him.

For Kevin Mitnick - perhaps the greatest social engineer who ever lived - hacking was an obsession: even though it ruined his marriage, landed him in scary correction facilities and almost cost him his sanity in solitary confinement, Mitnick wasn't able to shake the disease that compelled him to keep breaking into more and more communication systems. 

Right now, hundreds of thousands of people in the southern African country of Namibia are faced with a choice. At the end of next month, their phone service is going to be shut off permanently: to prevent that from happening, they?ll have to give up their data privacy. As a result, nearly two million Namibian citizens are facing a data privacy problem which may haunt them for years to come - and hundreds of thousands more are set to join them, or else they?ll lose their phone service for good. All of which raises the question: was making everybody register their SIM cards a good idea in the first place?

In 2008, The 12 million PCs strong Mariposa Botnet infected almost half of Furture 100 companey - but the three men who ran it were basiclly script kiddies who didn't even knew how to code.

Valdimir Levin is often presented as "the first online bank robber," and appeares on many lists of the "Top 10 Greatest Hackers." But a few veteran Russian hackers cliam that Levin's infamous hack had been mangled by the journlists who wrote about it. What's the truth behind the 1994 $10.7 million Citibank hack?...

About a year ago, six academics from Ruhr University Bochum and the CISPA  Helmholtz Center for Information Security set out to survey engineers and developers on the subject of satellite cybersecurity. But most of these engineers were very reluctant to share any details about their satellites and their security aspects. Why were satellite engineers so reticent to talk about cybersecurity? What was so secretive, so wrong with it, that they didn?t feel they could answer even general questions, anonymously? Because let?s be clear: if there?s something wrong with the security of satellites, that?d be a serious problem.

When investigators discovered in 1996 that US military networks were being extensively hacked, they didn't realize they were witnessing the birth of what would become Russia's formidable Turla APT espionage group. We uncover the 20-year metamorphosis of this original group of hackers into one of the most sophisticated and dangerous state-sponsored threats that's still active today.

In August 2021, a port in Houston, Texas, was attacked. Over the following months, a series of attacks occurred in various locations, reminiscent of a serial killer's pattern. Targets included telecommunications companies, government agencies, power plants, and water treatment facilities. How did Volt Typhoon manage to evade authorities and analysts for such an extended period?

By the time Forbidden Stories published its ?Pegasus Project? in 2021, NSO was already knee deep in what was probably the worst PR disaster ever suffered by a cybersecurity company - and then, in November 2021, came the fateful blow: the US Dept. of Commerce added NSO to its ?Entity List.? Is NSO to blame for its troubles? Could the company have acted differently to prevent its downfall? 

NSO Group, creator of the infamous Pegasus spyware, is widely regarded as a vile, immoral company: a sort of 21st century soldier of fortune, a mercenary in the service of corrupt and evil regimes. Yet among its many clients are many liberal democracies, including the US, Germany, the Netherlands and Spain, to name but a few. So, is NSO really as evil as many think it is?

The FBI explicitly advises companies against paying ransomware attackers - but itself payed 4.4 million dollars worth of Bitcoin after the Colonial Pipeline attack. So, should you listen to what the experts say, or follow what they occasionally do? It?s complicated, but we can model this problem.

In the vast landscape of STEM, women constitute a mere 28% of the workforce. Yet, when we zoom into the realm of cybersecurity, the number dwindles even further to a startling 20 to 24 percent. What are the underlying reasons behind this disparity?

In 1981, during the G7 Summit in Quebec, French president Francois Mitterand handen President Raegan a top secret collection of documents, called "Farewell Dossier." The information found in the dossier allowed the US to devise a cunning plan - the very first supply chain attack, if you will - to bring a firey end to one of largest industrial espionage campaigns in history. 

Much of the cybersecurity software in use today utilizes AI, especially things like spam filters and network traffic monitors. But will all those tools be enough to stop the proliferation of malware that will come from generative AI-driven cyber attacks? The potential of AI to disrupt cyberspace is far greater than any solutions we?ve come up with thus far, which is why some researchers are looking beyond the traditional answers, towards more aggressive measures.

Every so often, the entire landscape of cybersecurity shifts, all at once: The latest seismic shift in the field occurred just last year. So in this episode of Malicious Life we?re going to take a look into the future of cybersecurity: at how generative AI like ChatGPT will change cyberspace, through the eyes of five research teams breaking ground in the field. We?ll start off simple, and gradually build to increasingly more complex, more futuristic examples of how this technology might well turn against us, forcing us to solve problems we?d never considered before.

On the face of it, there's an obvious economic incentive for both vendors and security researchers to collaborate on disclosing vulnerabilities safely and privately. Yet bug bounty programs have gained prominence only in the past decade or so, and even today only a relatively small portion of vendors have such programs at place. Why is that? 

The constant battle between those who wish to encrypt data and those who wish to break these ciphers has made modern encryption schemes extremely powerful. Subsequently, the tools and methods to break them became equivalently sophisticated. Yet, could it be that someone in the 15th century created a cipher that even today?s most brilliant codebreakers and most sophisticated and advanced tools - cannot break?...

In 2019, Roman Seleznev, a 34 years-old Russian national, was sentenced to 27 years in prison: A sentence that?d make any criminal quiver. Seleznev's deeds had a horrendous effect on the 2.9 million individuals whose credit cards he stole and sold to cyber criminals for identity theft and financial crimes. On one hand, it?s hard to imagine any nonviolent computer crime worth 27 years in prison. But then what is an appropriate sentence for such a man as Seleznev?

"We made a mistake and Sony paid a terrible price.? A terrible price indeed: an arrogant and ill-advised decision to include a rootkit in its music CDs cost Sony BMG a lot of money - and painted it as a self-centered, self-serving company that cares more about its bottom line than its customers. Why did Sony BMG make such a poor decision?

In the last episode of our show, we heard the story of Methbot: an army of hundreds of thousands of bots, programmatically viewing thousands of advertisements on thousands of made-up websites in order to siphon away millions of dollars worth of ad revenue. But even the giant Methbot scam was just a drop in the ocean that is ad fraud. Putting Zhukov in jail made hardly any difference at all, because of how many other people just like him are still out there today.

What makes ad fraud so successful, and so prevalent, and why can?t we stop it? The answer isn?t technical at all. It?s not hard to understand. But it?s a harsh reality that many people are simply not willing to face.

Right now, a man named Aleksandr Zhukov is sitting in jail for one of the most financially ruinous schemes ever invented for the internet. Zhukov is guilty. He was caught and convicted under a mountain of evidence against him.

Except the deeper you look into it, the deeper the well goes. In this episode, we?ll learn how Aleksandr Zhukov defrauded some of the biggest American corporations for millions of dollars. And we?ll ask the question that hardly anyone else is willing to acknowledge: Was this clever, successful, guilty cybercriminal merely a fall guy for everybody else playing his twisted game?

The numbers can?t be any clearer: a DDoS attack costs less than a hundred dollars, while the price tag for mitigating it might reach tens if not hundreds of thousands of dollars. A single well crafted phishing email can easily circumvent cyber defenses which cost millions of dollars to set up. How can we change the extreame cost asymmetry between attackers and defenders in cyberspace?

We?ve all experienced the creepiness of modern data trafficking, but that kind of daily annoyance is the surface of a much bigger issue: Big Tech companies such as Amazon & Microsoft are lobbying policymakers to veto laws that harm their business, and often hide their lobbying behind industry coalitions or organizations with names that are vague and seemingly harmless. Will current and future privacy laws actually protect your information, or will they protect the companies collecting your information?

Disruptions to the world?s internet cables happen more often than you think: Whether it be ship anchors or animals or saboteurs, cut a few wires in the right places and at nearly the speed of light you can disrupt or shut off the internet for broad populations of people at a time. It is an immense power that runs through these lines -- a power that can be sabotaged or, in the right hands, weaponized.

In the midst of 35,000 exhilarated spectators eagerly chanting the time-honored countdown to kick off the 2018 Pyeongchang Winter Olympics, a sinister malware crept through the games' network, threatening to disrupt the highly-anticipated event. The obvious question in everyone?s minds was - who was responsible for the attack? Who was vile enough to launch such a potentially destructive attack against an event which, more than anything, symbolizes peace and global cooperation?

O? May 23rd, 1989, Karl Koch - a 23 years old West German hacker who worked for the KGB -  took a drive, from which he would never return: Nine days later his charred remains were found by the police in a remote forest. Was Koch assasinated by the US or the Sovient Union, or is there another, more 'mystical' explanation for his death?

Four decades ago, three quarters would?ve gone a lot further than they do today. With that kind of loose change you could?ve picked up some milk from the grocery store, or over half a gallon of gas, or a bus ticket. But that doesn?t explain why, on one fateful day in 1986, a systems administrator at the Lawrence Berkeley National Laboratory in California made such an issue over 75 missing cents.

You may have heard of the cyber operations performed by Russia. You definitely heard about the missiles being fired by Russia at Ukraine - but how about the propaganda being distributed through the different media platforms?

In this B-Side episode, our Senior Producer Nate Nelson interviewed Dr. Bilyana Lilly - CISSP, a leader in cybersecurity and information warfare with over fifteen years of managerial, technical, and research experience, and author of "Russian Information Warfare" - about the Russian use of instant messaging and social media platforms such as Telegram and Twitter in their war efforts. Dr. Lilly discusses who they are targeting and the real-world impact their propaganda has on various populations.

In the early 1970's, US intelligance pointed at the possibility that the Russians have laid an underwater communication cable between two important naval bases in the Far East. The dangerous mission of installing a listening device on that cable was given to the navy most secretive and unusual submarine.

What happens when an NFT marketplace goes under, and disappears? You would imagine that the users? NFTs are perfectly safe: after all, the blockchain itself is still there, right? But that?s not how things work in the real world. 

Jason Bailey is the co-founder and CEO of ClubNFT, a company  building the next generation of tools to discover, protect, and share NFTs. Jason is an early collector and proponent of CryptoArt, and he spoke with Nate Nelson, our Sr. producer, about the risks facing sellers and buyers who are unfamiliar with this new technology.

Physical artworks in museums are usually well-guarded - but digital artworks are something else entirely: in 2021 alone, scammers successfully stole 100 million dollars worth of non-fungible tokens, or NFTs. Yet blockchain technology, where most NFTs live - is one of the most secure technologies in history. Why, then, are NFT collectors keep getting hacked? 

SIM Swapping Follow Up [ML B-Side]

 You Should Be Afraid of SIM Swaps

FBI vs. REvil [ML BSide]

Cyberbunker, Part 2

Cyberbunker, Part 1

How Netflix Learned Cloud Security

Fred Cohen: The Godfather of Computer Viruses [ML B-Side]

Thamar Gindin is an Israeli scholar whose research focuses on the Persian language. For the past seven years (at least) Thamar has been a target for an endless stream of spear-phishing attempts by the Iranian regime, trying to take over her email account and lure her away from her country's borders. Her family, friends, and colleagues have also suffered numerous attacks. So, how does it feel to live for years with a virtual target mark on your back??

The Problem With Kernel-Mode Anti-Cheat Software

Norse Corp.: How To NOT build a cybersecurity startup

Jailbreaking Tractors [ML BSide]

The Russian Business Network

What can Chess grandmasters teach us about Cyber? [ML BSide]

LabMD Vs. The FTC

What Would Happen if CBS Got Hacked? [ML BSide]

Hacking Stock Markets, Part 2