Person
person:professor_dubstep
Guest who describes participating in the discovery, unauthorized access, and exfiltration of unreleased music and cloud-stored files.
Guest who describes participating in the discovery, unauthorized access, and exfiltration of unreleased music and cloud-stored files.
“could you use — the name for me, could you use Professor Dubstep?”
“A big thank you to Professor Dubstep for sharing this story with us.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | EXPLOITS | Bitly account-history flaw | Explicit | 148 |
| outgoing | USES | Google dorking | Explicit | 148 |
| outgoing | USES | LeakedSource | Explicit | 148 |
| outgoing | USES | Password hash cracking | Explicit | 148 |
| outgoing | USES | MD5 | Explicit | 148 |
| outgoing | USES | password reuse | Explicit | 148 |
| outgoing | USES | Credential stuffing | Derived | 148 |
| outgoing | COMPROMISES | Skype | Explicit | 148 |
| outgoing | COMPROMISES | MediaFire | Explicit | 148 |
| outgoing | COMPROMISES | Box.com | Explicit | 148 |
| outgoing | USES | Shared-link persistence | Explicit | 148 |
| outgoing | USES | Ghost login | Explicit | 148 |
| outgoing | USES | exfiltration | Attributed | 148 |
| outgoing | USES | Splice | Explicit | 148 |
| outgoing | COMPROMISES | Dropbox | Explicit | 148 |
| outgoing | ASSOCIATED_WITH | Shane | Explicit | 148 |
| outgoing | ASSOCIATED_WITH | Arnie Kurtz | Explicit | 148 |
Professor Dubstep EXPLOITS Bitly account-history flaw
Professor Dubstep says they used the Bitly account-history flaw to inspect management accounts and download internally shared links.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we’d be able to just see those and download them”
Professor Dubstep USES Google dorking
Jack says Google dorking can be used to find music files and sometimes content that should not be public.
Explicit Confidence 91% · Jack Rhysider EP 148 Details
“Maybe Google dorking can help. I know I’ve found quite a bit of music this way.”
Professor Dubstep USES LeakedSource
Professor Dubstep says the stolen databases were uploaded to LeakedSource, where users could pay to view database results and password hashes.
Explicit Confidence 98% · Professor Dubstep EP 148 Details
“they’re all just uploaded to this thing called — I think it was LeakedSource”
Professor Dubstep USES Password hash cracking
Professor Dubstep says they recovered password hashes from leaked databases and decrypted or cracked them to obtain usable passwords.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“you could take the hash and just decrypt it yourself”
Professor Dubstep USES MD5
Professor Dubstep says the breached passwords were protected with standard MD5 and that much of the MD5 table had already been cracked.
Explicit Confidence 98% · Professor Dubstep EP 148 Details
“just standard MD5, which almost the whole MD5 table had been cracked by that point”
Professor Dubstep USES password reuse
Professor Dubstep says the recovered passwords were tested on other services on the assumption that artists reused passwords.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“just hope that their security was not so great and that they kept reusing this password all the time”
Professor Dubstep USES Credential stuffing
Professor Dubstep describes taking credentials from breached databases and trying them against many services used by musicians.
Derived Confidence 95% · Jack Rhysider EP 148 Details
“We’ve got Skrillex’s password. It works on an old Skype account”
Professor Dubstep COMPROMISES Skype
Professor Dubstep says a recovered old Skrillex password successfully logged into Skrillex’s inactive Skype account.
Explicit Confidence 99% · Jack Rhysider EP 148 Details
“It logs straight in. To Skrillex’s Skype account.”
Professor Dubstep COMPROMISES MediaFire
Professor Dubstep says they used a manager’s recovered password on a MediaFire page and gained access to unreleased tracks and Photoshop documents.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we tried it on a MediaFire page, which worked. It logged us in.”
Professor Dubstep COMPROMISES Box.com
Professor Dubstep says they reused Skrillex’s manager’s password to log into Box.com and access the record label’s production files and upcoming releases.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we try it on the box.com account, and it logs us straight in”
Professor Dubstep USES Shared-link persistence
Professor Dubstep says they created share links so they could continue viewing folders after the compromised account’s password was changed.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we copied the share link for each folder that was in there and we set the permission on that so that anyone with that share link could still view the folder”
Professor Dubstep USES Ghost login
Jack explains that connecting a new Zapier account or alternate login can preserve access to a cloud account even after its password is changed, calling this a ghost login.
Explicit Confidence 83% · Jack Rhysider EP 148 Details
“This is what I mean by a ghost login, someone who’s in your account who doesn’t even need a username or password to stay in.”
Professor Dubstep USES exfiltration
Jack characterizes the group’s downloading of files that were not intended for public consumption as exfiltration rather than conventional theft.
Attributed Confidence 98% · Jack Rhysider EP 148 Details
“They exfiltrated files that were not meant for public consumption but weren’t very well protected.”
Professor Dubstep USES Splice
Professor Dubstep says they accessed a Splice account using credentials found in a management contact sheet and downloaded DJ-set preparation files.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“One of them was the password for their Splice account. Splice was a service that offered project file storage”
Professor Dubstep COMPROMISES Dropbox
Professor Dubstep says the group used a breached database to obtain access to a Major Lazer production team’s Dropbox and find the Terrorize project file.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we did manage it. We were talking back and forth with each other, me and Arnie and Shane in group chat”
“So, we logged into this account, and the first thing we searched for was ‘Terrorize project file’ and it was there”
Professor Dubstep ASSOCIATED_WITH Shane
Professor Dubstep says they began working with Shane and Arnie Kurtz to prevent Spintire from continuing to leak compromised material.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we started working together from that point on on these things, me and Shane and another friend called Arnie Kurtz”
Professor Dubstep ASSOCIATED_WITH Arnie Kurtz
Professor Dubstep says they worked with Arnie Kurtz and Shane to lock down shared links and accounts compromised by Spintire.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we started working together from that point on on these things, me and Shane and another friend called Arnie Kurtz”