The Teen Behind Scattered Spider - and How Windows Caught Him | 2 Minute Drill with Drex DeFord

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

The Teen Behind Scattered Spider - and How Windows Caught Him | 2 Minute Drill with Drex DeFord

[00:00:01] Hey everyone, I'm Drex and this is the two-minute drill. Special thanks to Sidaris for sponsoring this episode. It's great to see you today. Here's some stuff you might want to know about.
[00:00:11] Today I'm going to start with a photo. It's of a teenage hacker in New York's Upper West Side. He's holding up a fan of $100 bills for the camera, showing off. In another shot, he's wearing a diamond necklace that spells out hack the planet. It's a line lifted from an old '9s movie. The kid is Peter Stokes.
[00:00:31] Online he went by Bouquet. He was a dual US and Estonian citizen living in Tan. And when these photos went up, he was still a teenager. And he was really, really good at one part of his job, which was aliases and VPNs and proxies and all the stuff that's supposed to keep your name off the internet, keep you invisible on the internet. But he
[00:00:56] was terrible at the other part. He could not stop showing off. In January 2023, he posted a photo to his social media account under his hacker name Bouquet.
[00:01:07] And sitting on the desk in the frame of the photo was his school homework. At the top corner of the worksheet in plain view was a name, Peter William Stokes.
[00:01:21] The kid had wrapped himself in layers and layers of anonymity. But in this one shot, he was basically holding up his ID for the camera. But even if he kept his mouth shut, he was findable anyway. And here's why. Microsoft has something called global device identifier. Think of it as a fingerprint stamped on every Windows machine. You can hide your IP address. You can route through a VPN in
[00:01:47] another country, but the machine underneath is still the same machine, and it leaves the same fingerprint every place that it logs in. Investigators use that fingerprint ultimately to tie the bouquet persona to the real kid across Snapchat and Facebook and all the other networks of all of his other victims.
[00:02:09] The VPN he was using ultimately didn't matter. So, let's talk about the victims of Peter Stokes crimes because this was not a small cyber criminal organization that he was a part of. Stokes was part of Scattered Spider, a crew inside of a loose hacker collective called the Comm.
[00:02:28] The group tore through some of the biggest names on the planet. MGM Resorts, Visa, Twillow, uh Dior, Louis Vuitton, lots of others. Stoke started all of this at 16 years old. sim swaps first, then bigger and bigger crimes.
[00:02:44] This past April, Peter Stokes was arrested at an airport in Finland right before he hopped a flight to Japan, and he's been extradited to the US. One more thing, a researcher named Allison Nixon had this whole crew mapped years before this arrest and I did a full episode on her work and I'll drop a link in the show notes because if you want to understand the
[00:03:07] comm and if you understand this want to understand this world, she's the person to listen to. It's one of my favorite two-minute drill episodes. By the way, scattered spider is not a hypothetical for health care. These are the people who call your help desk and sound like a stressed out employee that's locked out of their accounts and they try to talk your real human at the service desk into resetting a password. They've done it to
[00:03:32] hospitals. Their whole game runs on your people and the devices that you trust. I know most of you have done a lot of work on this help desk social engineering problem, but it's never a lock. So, here's today's question. If a teenager can walk into MGM through one phone call, what happens when that call lands at your service desk tonight or on a holiday weekend? Would your team know to
[00:03:58] slow down and take a breath and verify even with a raging physician on the other end of the phone? And here's another thing I'm kind of interested in.
[00:04:08] Did you know about global device identifiers? Did you realize that every device touching your network and theirs is leaving a fingerprint that somebody can follow?
[00:04:19] That's it for today's two-minute drill. Thanks again to Cidereas for sponsoring today's show. Drop me a note. Let me know what you're working on. I'm always happy to hear from you. I'm Drex at 229pro.com.
[00:04:31] Thanks for being here and stay a little paranoid. I'll see you around campus.