Episode
06 August 2024 Official episode · Official transcript
black hat cybercrime
The episode describes unauthorized access, credential reuse, shared-link persistence, and exfiltration of unreleased music and confidential business data from artists, managers, labels, and cloud-storage accounts.
Topics: Exposed cloud-storage links, Password reuse and credential stuffing, Password hash cracking, Weak MD5 password protection, Shared-link and collaborator-invite persistence, Ghost logins through delegated applications and alternate identity providers, API-key persistence, Security through obscurity, Cloud-storage permission auditing, Two-factor authentication, Least-privilege access control, Unauthorized file exfiltration, Sensitive personal data exposure, URL scanning and unintended URL disclosure, Account compromise through breached databases
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Bitly account-history flaw AFFECTS Bitly
Professor Dubstep describes a Bitly flaw that exposed all links shortened by an account when a plus sign was appended to a shortened URL.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“they had a glaring flaw in their system where if you add a ‘+’ to the end of any shortened link”
Professor Dubstep EXPLOITS Bitly account-history flaw
Professor Dubstep says they used the Bitly account-history flaw to inspect management accounts and download internally shared links.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we’d be able to just see those and download them”
Professor Dubstep USES Google dorking
Jack says Google dorking can be used to find music files and sometimes content that should not be public.
Explicit Confidence 91% · Jack Rhysider EP 148 Details
“Maybe Google dorking can help. I know I’ve found quite a bit of music this way.”
Database breaches of Dropbox, Last.fm, and MySpace INVOLVES Dropbox
Professor Dubstep attributes the 2016 database-breach activity to a stolen Dropbox database.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“Dropbox had their database stolen.”
Database breaches of Dropbox, Last.fm, and MySpace INVOLVES MediaFire
The episode describes leaked databases from Dropbox, Last.fm, and MySpace; MediaFire was later used as a target with recovered credentials.
Derived Confidence 84% · Professor Dubstep EP 148 Details
“Dropbox had their database stolen. Last.fm had their database stolen. MySpace had their database stolen as well”
Professor Dubstep USES LeakedSource
Professor Dubstep says the stolen databases were uploaded to LeakedSource, where users could pay to view database results and password hashes.
Explicit Confidence 98% · Professor Dubstep EP 148 Details
“they’re all just uploaded to this thing called — I think it was LeakedSource”
Professor Dubstep USES Password hash cracking
Professor Dubstep says they recovered password hashes from leaked databases and decrypted or cracked them to obtain usable passwords.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“you could take the hash and just decrypt it yourself”
Professor Dubstep USES MD5
Professor Dubstep says the breached passwords were protected with standard MD5 and that much of the MD5 table had already been cracked.
Explicit Confidence 98% · Professor Dubstep EP 148 Details
“just standard MD5, which almost the whole MD5 table had been cracked by that point”
Professor Dubstep USES password reuse
Professor Dubstep says the recovered passwords were tested on other services on the assumption that artists reused passwords.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“just hope that their security was not so great and that they kept reusing this password all the time”
Professor Dubstep USES Credential stuffing
Professor Dubstep describes taking credentials from breached databases and trying them against many services used by musicians.
Derived Confidence 95% · Jack Rhysider EP 148 Details
“We’ve got Skrillex’s password. It works on an old Skype account”
Professor Dubstep COMPROMISES Skype
Professor Dubstep says a recovered old Skrillex password successfully logged into Skrillex’s inactive Skype account.
Explicit Confidence 99% · Jack Rhysider EP 148 Details
“It logs straight in. To Skrillex’s Skype account.”
Professor Dubstep COMPROMISES MediaFire
Professor Dubstep says they used a manager’s recovered password on a MediaFire page and gained access to unreleased tracks and Photoshop documents.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we tried it on a MediaFire page, which worked. It logged us in.”
Professor Dubstep COMPROMISES Box.com
Professor Dubstep says they reused Skrillex’s manager’s password to log into Box.com and access the record label’s production files and upcoming releases.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we try it on the box.com account, and it logs us straight in”
Professor Dubstep USES Shared-link persistence
Professor Dubstep says they created share links so they could continue viewing folders after the compromised account’s password was changed.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we copied the share link for each folder that was in there and we set the permission on that so that anyone with that share link could still view the folder”
Professor Dubstep USES Ghost login
Jack explains that connecting a new Zapier account or alternate login can preserve access to a cloud account even after its password is changed, calling this a ghost login.
Explicit Confidence 83% · Jack Rhysider EP 148 Details
“This is what I mean by a ghost login, someone who’s in your account who doesn’t even need a username or password to stay in.”
Professor Dubstep USES exfiltration
Jack characterizes the group’s downloading of files that were not intended for public consumption as exfiltration rather than conventional theft.
Attributed Confidence 98% · Jack Rhysider EP 148 Details
“They exfiltrated files that were not meant for public consumption but weren’t very well protected.”
Professor Dubstep says that during Leakmas hundreds of items were leaked onto xTrill and Reddit.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“Christmas 2015, there was an event called Leakmas where hundreds of things got leaked onto xTrill, onto Reddit.”
Professor Dubstep USES Splice
Professor Dubstep says they accessed a Splice account using credentials found in a management contact sheet and downloaded DJ-set preparation files.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“One of them was the password for their Splice account. Splice was a service that offered project file storage”
Professor Dubstep COMPROMISES Dropbox
Professor Dubstep says the group used a breached database to obtain access to a Major Lazer production team’s Dropbox and find the Terrorize project file.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we did manage it. We were talking back and forth with each other, me and Arnie and Shane in group chat”
“So, we logged into this account, and the first thing we searched for was ‘Terrorize project file’ and it was there”
Professor Dubstep ASSOCIATED_WITH Shane
Professor Dubstep says they began working with Shane and Arnie Kurtz to prevent Spintire from continuing to leak compromised material.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we started working together from that point on on these things, me and Shane and another friend called Arnie Kurtz”
Professor Dubstep ASSOCIATED_WITH Arnie Kurtz
Professor Dubstep says they worked with Arnie Kurtz and Shane to lock down shared links and accounts compromised by Spintire.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we started working together from that point on on these things, me and Shane and another friend called Arnie Kurtz”
Spintire USES Password hash cracking
Professor Dubstep says Spintire searched leaked databases for credentials and used them to attempt access to other accounts.
Explicit Confidence 96% · Professor Dubstep EP 148 Details
“They were talking with each other about trying to hack into accounts using these databases”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:26:17.211512+00:00