Prison for ex-eBay staff who aggressively cyberstalked company’s critics with Craigslist sex party ads and funeral wreaths

Are these guys 12? Are they 12 years old? You don't have the balls to talk to me. Stop hiding behind your computer screen, you fing. Your fat fing husband needs to be put in line.

I think we've got it. I think we've got it.

You've got the... Yeah. Thank you. Smashing Security, episode 292. Trust Her Flux and eBay stalking with Carole Theriault and Graham Cluley. Hello, hello and welcome to Smashing Security episode 292. My name is Graham Cluley.

And I'm Carole Theriault. And Carole, this week in the hot seat, who have we got joining us?

Oh, a very lucky person, Mr. Nobody.

Mr. Nobody. And there's a good reason why we don't have a guest this week, isn't there?

Well, things have got complicated, yeah.

Complicated? Yeah, go on then, tell them.

No, no, you go on, you go on, you tell them.

Well, first of all, we are speaking at NISC, which is a security conference happening up in the north of England or Midlands this week. And so we have to dash off for that, which means a little bit less.

Well, it's not just that we were speaking there. We were actually going to do a live smashing security.

That's right. We're going to perform live smashing security on the stage for the lucky attendees there. And so that was the plan. But then something else happened.

Yep, we got it all ready. We got it all ready. Dotted the I's, crossed the T's. And yesterday, my husband came down with COVID. So he is locked in the bedroom, feeling pretty poorly. And I'm nursemaid.

And quarantined. So you don't have COVID yet, as far as we know.

As far as we know, I'm okay. Yeah.

But there's always a chance you could be carrying. So you're not going to be going to NISC. I'll go to NISC. Yes. And maybe you can join us virtually. That's what the plan is. We'll see if we pull it off. We'll see if we manage that.

But that doesn't mean that we can't do this fantastic show, right?

Correct. So let's kick off by thanking this week's sponsors, Bitwarden, Collide and Akamai.

I'm going to be talking about company loyalty.

And I am going to be talking about whether or not it's cool to have Liz Truss on speed dial. All this and much more on this episode of Smashing Security.

Now, chum chum, I've got a question for you. Have you ever been part of a group that really means something?

It's their support that helps us give you this show for free. Now, coming up on today's show, Graham, what do you got?

Have you felt really loyal to it? Have you had a sense of belonging, a sense of purpose?

What, a company, you mean?

It could be a company. It could be a scout group or a cult or a swimming group or, you know, whatever.

Yeah, no, maybe. Yeah, yeah. I was a big athlete, right? So when I was a kid, yeah, probably as a swimmer in my swim team, I would definitely say I was very identified with that.

Would you do anything to defend your fellow members, you know, make sure that the group wasn't damaged or harmed in some way?

I was 12. So, yes. Yeah. So I imagine raging hormones. You don't need to talk about my fing raging hormones.

Thanks, though. Well, I want to tell you today about a group that had loyal members and, you know, they had a sense of belonging. But one day they realized that they had enemies. People they didn't like, people who weren't fans of their particular group. People who needed to be silenced. And word came down from the top of this group that the leaders of the group were displeased.

Sorry, sorry. When you say silence, do you mean go swim with the fishies?

Well, yeah, that kind of message. So the message which came down from on high was, I want to see ashes as long as it takes, whatever it takes. I can manage any fallout. If the plan goes south, it doesn't matter. But we need to stop them. So word has come down that somebody has to be stopped. If someone texted me that, I would be WTF?

Well, maybe you would, Carole. Maybe you would, but maybe you're just disloyal. Maybe you don't feel a proper member of the team. What's going on? Someone has to be silenced is the message which has come down from the top of this group, right? And maybe the person who you are targeting is on Twitter. And so maybe you'll do what this particular group did, which is it created a phony Twitter handle. And it started posting threats, telling the people they were targeting to stop reporting about their organisation.

Creating a phony Twitter handle is, yeah, I don't know if I would say that's above board.

It's slightly cowardly, isn't it? I can understand why some people might want to remain anonymous, but in this particular instance, it sounds like you're using it for nefarious purposes. I mean, that's the sort of lead-in, isn't it? If you're making threats. Yeah, it doesn't sound cool. What also doesn't sound cool would be to do other things. Now, this is a list of things which this group may have done to the people they were targeting. And you have to say which one of these you think they did and which ones they didn't. So I just read out a few of them. What if I would send you some live spiders and fly larvae? What if I would send you cockroaches?

Whoa, okay. Couldn't you just feed the larvae and the cockroaches to the spiders?

A book entitled Grief Diaries, Surviving the Loss of a Spouse. Maybe you received that through your door.

Jeez. Do they send me a horse's

head? Well, no. But what they did send, maybe, is a preserved fetid pig's head, which costs $59.99 plus $15 post and packing. So which of those do you think I've made up?

Cockroaches.

No, they did do the cockroaches. Guess again.

They've done them all. That's what I'm going to guess. They did them all, didn't they?

Correct. Oh, my God. They did all of them. Yes, they did all of them.

They're obviously not saying loves and kisses from this organisation.

No, they didn't say that, no. These were being sent anonymously to these people who they had a beef against. And they also sent simultaneous Twitter messages from their phony account. Messages like, do I have your attention now? I guess I'm going to have to get your attention another way, bh.

Are these guys 12? Are they 12 years old?

You don't have the balls to talk to me. Stop hiding behind your computer screen, you fer. Your fat ping husband needs to be put in line.

I think we've got it.

You've got this? Yeah. Thank you. When you hurt our business, you hurt our families. People will do anything to protect family. That kind of thing. So not very pleasant, those messages, I think. Not very pleasant for you to edit, I imagine, either, with all those beeps. And they also signed up, these people, for newsletters about pornography, bondage, animal sex.

So they're basically the highest order of troll.

Well, yes. I mean, it's worse than just online troll. They're doing things in real life. Like sending things in the post? Pretty scary. Oh, and they're not just sending things to the people they're targeting. They're also sending parcels to their neighbours, but addressed to their intended victims. Do you see what I mean? So the neighbours received pornography or hustler, barely legal magazines and jazz mags. So not good.

Yeah.

Okay. Now, the people who were launching this campaign decided it hadn't really gone far enough. They thought we have to amp things up a little bit. So after several days of the initial campaign, what they did was they travelled 3,000 miles from California all the way across the United States to Massachusetts so they could stalk their intended victims up close.

Oh, great. This is fantastic.

So they got themselves a blacked-out van, rental vehicle. They repeatedly circled the block. They tracked their victims every move. They tried to break into their victim's garage to plant a GPS tracking device.

You better know who these people are by the end of this. This is crazy.

Is this a movie? They changed their Twitter avatar to be a skull and began publicly posting the home address of their victims along with the death threats.

This is ridiculous. And illegal, presumably.

I imagine so, yeah, right?

So isn't the organisation targeted if they reported this? Are they just sitting there taking this and quaking in their boots?

Oh, no, no, no, no. They are petrified. They've installed CCTV cameras. They're even sleeping in separate bedrooms. So if one of them is attacked in the middle of the night, the other one can hopefully escape and go get help.

Are they lovers or is this just business partners?

It's a husband.

Okay, so who is the organisation? What's going on?

Yeah, exactly. You're wondering, what have the victims done to upset the stalkers? And have you got any theories?

So maybe not that unusual for them to sleep in different bedrooms. But the stalkers have got a police scanner. They're listening in to what the police are saying on their walkie-talkies. And so they know their victims are petrified and call the cops every 10 minutes. And meanwhile, the stalkers have posted the victim's address on Craigslist and other websites, inviting strangers to the home for sex parties.

No, I have no theories.

You mentioned a cult. A cult is possible because that would be sort of feverish loyalty, wouldn't it? Or if you were a member of a demonized political party.

Demonized? Like what?

No, there are political factions out there who some people think, you're a little bit too fervent. But they're not members of a political party. They're not members of cult. What they are are eBay employees.

You really buried the lead here.

Okay, carry on. So the people who launched this campaign against this couple were working in fairly senior positions inside eBay. So eBay has been a frequent topic of reporting by a fairly small newsletter and website called eCommerce Bytes run by a husband and wife team in Massachusetts.

Okay, so this is a site where they talk about e-commerce dramas. But there's lots of eBay discussion on it because obviously eBay is the big one. Right? But they talk about other things. And in the early days, relations between eBay and the website eCommerce Bytes is fairly cordial. Again, it depends how many people are reading this article, right? If this was on BBC News, that's a big difference from being on, say, a site with a thousand readers. People can pass around these sort of things, can't they? Well, yes, articles can be shared. Were they getting bonuses if they managed to come back with their heads?

Well, you know, if the boss wants something done, if he wants a problem gone away, he may not ask for the details. He just wants it to be fixed. He doesn't need to worry about the details. He's got enough problems. This doesn't make sense to me. eBay is one of the top 10 websites in the world. And they are obsessed with a mom and pop media outlet. Right. And so some of eBay staff began to conspire.

So you're saying these employees had a meeting made a plan to terrorize these people because they didn't like what they were writing and then actually instigated it and did these things and they got caught? I just want to know how this when the

Police began to investigate this because obviously these two people who are being harassed and had their garage broke into. I said, who might your enemies be? It was like, well, some people really upset with us who appear to be, don't want us to report on eBay any longer.

What, said, hey, eBay's after us, do something. So all kinds of craziness was going on at eBay. They played clips from Meet the Fockers, telling people about the circle of trust, encouraging people not to remember anything if the police came asking questions. What? What does this have to do?

Well, this is all about keeping the group together, Carole. It's like, we are all in this together. It's like, you know, it's like...

When you say all employees, do you mean all employees at eBay?

No,

No, no, no, no, no, of course not. It's all employees in this little group. So there are about six of them. And as a result of all this, James Bohr, who was eBay's Senior Director of Safety and Security, he has now been sent to prison for 57 months. His co-conspirator David Harville, the company's Director of Global Resiliency, he's been jailed for two years and also been asked to pay a twenty thousand dollar fine.

Oh, no. Or maybe they're just a band of crazy employees that got together. This is insane. When this story first came out, the CEO did leave very promptly afterwards, the one who'd initially said he wanted something to be done to silence these people, because of disagreements with the rest of the board. He, as far as I know, has not been charged with anything in connection with this. And if your boss sends you an email saying, I want anything to shut these people up, just kind of go, whoa, whoa, calm down.

I want to know if they gave eBay feedback on that fetid pig's head. Lovely quality. Would order again. A plus. Top seller.

What have you got for us this week? It's bad news, I'm afraid. UK as a nation is not a shiny beacon of how a state should be run at the moment, I think. We're in a bit of a pickle. We're in a bit of a sticky pickle.

It's what I call a trust-a-fluck, I think is the phrase.

Interesting, because we're talking about Liz Truss coming up.

Our glorious new leader, yes. But before we get to her, let's just set the scene. So we have the price of electricity going through the roof, yet petroleum companies are boasting about huge bonuses. We have hospitals with too few beds. We don't have enough teachers, doctors, nurses, or mental health professionals. Inflation is looming and food prices are soaring. No, I didn't know that, no. 60,000 people have applied for Iceland's microloans in a two-week period. And credit providers say if the loans could total 3 million if approved. Yes, yeah, yeah, that hasn't gone. It's still, it's still, yeah, it's still headline news. So meanwhile, so this is a huge kind of cluster of garbage. And meanwhile, we have Boris Johnson leaving for lying, basically finally gets the boot in the behind. My dad, apparently. My dad.

Oh, well, there you go. Well, you can thank him.

My dad was one of them.

Thank you very much. He was. Yeah, high five to Graham's dad for that.

He's a member of that particular club. So we should have a different word for a Prime Minister if they're elected versus selected, don't you think?

There's about six other employees at eBay who've also pleaded guilty for their part in the cyber stalking plot, one of whom has already been sentenced as well to 18 months in prison. So they're getting prison time for this. But what are they putting into their Kool-Aid to make employees at eBay so incredibly loyal? And where can we get some?

I'm not very impressed by Liz Truss, no. She's a bit weird. Yeah, she is a bit weird. The things that are controversial that I've seen in the press is that she doesn't like the idea of taxing the rich to help those in need with social benefits. And she has vowed a red tape bonfire on EU regulations. This is the title in The Express. And weirdly, about 20 odd years ago, when she used to be a Liberal Democrat, when she was a member of a different political party, she really wanted to do away with the monarchy. And of course, she did have a meeting with the Queen just two days before. Anyway. So why am I talking about our newest unelected Prime Minister of the United Kingdom, Liz Truss? Well, according to the Mail on Sunday, the Prime Minister's mobile phone number was found to be available online for the big old price of £6.49. So about two cents in the US dollars at the moment. To be fair, Carole, though, I know what Liz Truss's address is. I don't have to look it up on the Internet.

So the data also included stolen info on 25 other cabinet ministers. Now, you read a lot about politics, don't you?

A little bit.

So you're going to show off right now. We're going to put you on the spot. Who, what is the name of the Chancellor?

Oh, Kwasi Kwarteng. Yes.

Kwarteng, yeah. Okay, Defence Secretary.

Oh, no, it was Ben Wallace. I don't know who they... Yes, Ben Wallace, okay. Oh, is it still Ben Wallace? I thought they'd got rid of him. Yeah. Foreign Secretary? They didn't give it to Suella Braverman, did they? No, she's Home Secretary.

Foreign Secretary is James Cleverly.

Oh, yes, James Cleverly, yes. Yeah, they've only had the job about a week, haven't they? I mean, it's hard to... They keep on turning them around so quickly. And of course, we have the opposition leader. Yes, Keir Starmer. There we go. Very good. It's still her working phone, this is my...

Big point, so apparently Mrs Truss has used the same number since 2011.

Oh my goodness, no, what's going on at MI5? You can't be allowing this if someone's become prime minister, change their bloody phone number. Even though they probably won't want it because otherwise you get rubbish. Yes, sending through some dodgy zero day to infect her phone when they get inside her WhatsApp. You just would think that you would do a review, right? A government security group would do a review to make sure your digital stance is secure or maybe look at how it could be improved. But you know what? This is actually the problem, is that there's no one in charge of these people. So people can make recommendations. People can come along and say, I think you want to be a bit more careful. I've known a number of CEOs pull this prank as well. So just saying, just saying, it's not only politicians. Yeah, there's a lot of political hobnobbing which goes on via things like WhatsApp, which also has a problem of these messages not necessarily being stored, whereas you might have rules in place to archive communications which are going on via email or telephone and the rest of it. But you can have disappearing messages on messaging systems. Well, exactly. So the thing is, is you have all this kind of stuff, right? And I mean, we all remember Pegasus. Oh, that's a good line. Someone else should use that. And they say that ministers receive regular security briefings and advice, including advice on protecting their personal data and mitigating cyber threats. Yeah. Yeah, yeah. Certainly there should be some sort of onboarding process, shouldn't there, for leading politicians? You know, maybe put them through some kind of device to say you will now change your phone.

Didn't Trump have his own device, though?

Was he really ever president or did I just dream that? I was wondering if I had a nightmare for a few years. Oh, my God, it was true. If you're considering a third-party audit like SOC 2 or ISO 27001, then you should be prepared to answer some tough questions about endpoint security. Auditors want to know that you have a system in place to monitor and maintain compliance across your fleet, which means showing that your staff are using things like disk encryption, screen locks, password managers. If you're not quite sure how you'd go about proving all that, then you need Collide. Collide's an endpoint security tool for Mac, Windows and Linux devices that gives you the visibility you need to meet your third-party and internal compliance goals. Best of all, Collide doesn't resort to spying on workers or locking down devices. Instead, it works with end users to resolve issues and relies on their cooperation and informed consent. You can meet your security goals and pass your audit without compromising on privacy. Visit collide.com slash smashing to find out how. If you follow that link, they'll also give you a goodie bag just for activating a free trial. That's K-O-L-I-D-E dot com slash smashing.

Smashing security listeners, did you know that Bitwarden is the only open source cross platform password manager that can be used at home on the go or at work? Bitwarden's password manager securely stores credentials spanning across personal and business worlds. And every Bitwarden account begins with the creation of a personal vault, which allows you to store all your personal credentials. These are unique and secure passwords for every single account you access. And it's easy to set up. It's easy to use. I honestly love Bitwarden. I use it at home, use it at work, use it on the go. Get started with a free trial of a Teams or enterprise plan at bitwarden.com forward slash smashing. Or you can even try it for free across devices as an individual user. Check it out at bitwarden.com forward slash smashing. And thanks to Bitwarden for sponsoring the show.

Every day, billions of people around the world connect with their favourite brands online through shopping, gaming, banking, learning and more. Every second, the internet gets more chaotic. More cyber threats. Securing entire ecosystems, clouds, apps, APIs and users, that grows more complex, causing friction that slows innovation and hampers agility. With Akamai, cyber security can become an engine for innovation and growth. Whether you want to achieve unmatched security with Akamai's suite of app and API protection or embrace a zero-trust architecture, Akamai can help. With insights from the world's most distributed computer platform, Akamai delivers unique security research on the latest attacks and trends on everything from ransomware as a service, gangs like Conti, DDoS attacks, phishing attacks, to help you protect your business. Where else can you take advantage of insights from 7 trillion DNS queries per day? To learn more about Akamai and their security research, visit their website akamai.com slash smashing. That's A-K-A-M-A-I dot com slash smashing. And welcome back. Can you join us for our favourite part of the show, the part of the show that we like to call Pick of the Week.

Pick of the Week. Pick of the Week.

Pick of the Week is the part of the show where everyone chooses anything. It could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish. It doesn't have to be security-related necessarily. Better not be. Now, my pick of the week this week is not security related. Excellent. In a surprising pivot, Carole, I'm going to take a leaf out of your book and I am going to recommend a recipe. What? What? I know. It's the sort of thing that you do. Is this one you've made? This is something I have actually made. Now, when I say made.

You mean someone made it for you and you ate it? No.

No, I did it. So I've had requests from my son quite often for a soft-boiled egg with soldiers in the morning. And I've tried this on a number of occasions before taking him to school. And it's been disastrous because either the eggs are too hard or the eggs are all squishy.

I am so, not outraged, surprised. You didn't just call me up and go, Carole, how do I boil an egg? No, I know how to boil. No, no, soft-boiled egg. I know exactly. Anyway, carry on.

Well, I'm going to share my method for soft boiling an egg perfectly every time. I'm going to link to a YouTube video and I'm going to tell you how I'm doing it because so far it has worked perfectly every time. And maybe there are other people like me, ex-programmers, who are struggling with this and would benefit.

And don't have a really good friend who's an amazing cook. Yeah. Okay, crack on.

Get yourself a pot. Put about half an inch of water in it. Only half an inch. It's only a little bit of water in it, right? Boil the water. So it's bubbling. That's what boiling means. Put your eggs in. Put a top on the pot. What's that called? Put a lid on the pot. It's still boiling. You wait six minutes. Don't wait seven minutes. You wait six minutes. Quick, take it off the hob. Put them in cold water. Those, my friend, are soft-boiled eggs, which you can put your toast soldiers and dip them in. And I have a very happy son.

Okay, that's totally not how I do it. Isn't that funny? So

It's the steam which actually boils them. It's not the water. Okay, let's hear your method, which won't be as good as mine. Okay. My method works every time.

Grab eggs. Put them in a pot. I did that. Add about an inch of water. Too much. Put the lid on. Yes. It's cold. Everything's cold right now.

Oh, I'm not doing that.

Yes, I'm... Carry on. Can I? Yes, carry on. Put the heat on, bring it to a boil. Once it hits the boil, turn it off completely. There's a lid on as well, right? Turn it off completely. Leave it for three minutes. Remove eggs. Cold water, if you're not going to eat them right away, or slap them in your little egg holder and mummy, mummy, yum, yum, yum, yum, yum. Anyway, listeners, try your favourite. See what works better for you.

All right. Let's have an online poll, maybe. Yes. Carole, what's your pick of the week?

Well, interesting, because I have a pick of the week for you, Graham, because mine is a list of what people say are cool Twitter bots. So I have a list of a few of them, and I wanted to check them out with you to see if you'd say, yes, that would be totally useful or not interested at all. Does that work?

Go ahead.

All right. Number one, Threadreader app.

Oh, I've heard of this, yes.

Yeah? So it's when a tweet has too many threads, you just reply with the Threadreader app, unroll, and the bot will compile it into an easily readable blog-style format.

Yeah, it kind of puts it onto a page, doesn't it, the whole conversation. Yeah, that's cool. I don't use it, but I've heard of it. I've seen it.

Quoted replies. Do you want to know other people who have quoted a particular tweet? This is where quoted replies comes to the rescue. You just have to reply or quote the original tweet with at quoted replies. And then the bot provides you with a link and you can then tap it to view all the quotes that particular tweet where it's shown on Twitter.

Don't see what the point of that is.

No. What about screenshots of old websites? So it's like a Wayback machine, you know, so the... And that uses Twitter somehow. Yeah, so you kind of go at Wayback underscore exe, and it'll generate screenshots of old websites in old browsers and tweet them to you every two hours. That sounds really useful. Earthquake alerts at Earthquake Bot.

Oh, I definitely need that here in Oxfordshire, yes.

Well, maybe some friends live in places where there's a lot of earthquakes, and basically the bot tweets about any earthquake with an intensity of five or greater as they happen worldwide.

How does it get that information?

It uses data from the United States Geological Survey, Graham, and also it adds a Google Map link for each location it tweets about.

Can you say I'm only interested in earthquakes in a particular area rather than hearing about one star? Do you think

I know the answer to that? Oh. It doesn't matter. Last one. Tiny Care. A genuinely helpful Twitter bot that helps you practice self-care. So it sends you an hourly reminder to take a break from a busy work life with gentle advice to take a deep breath or drink water or go listen to music or go out or do things that make you happy.

So what, it fills up your Twitter timeline with... Every hour. Stand up, blow your nose, cut your toenails.

No, it's much nicer. Please remember to take a second to take some deep breaths. Please remember to take a moment to take your meds. I need that. Anyway, so I have a link in the show notes to this list of pretty cute bots. You may know of better ones. So feel free to tweet them over to us. That's my pick of the week.

Marvelous. Well, Carole, I think we have survived without a guest. Next week we'll have a guest and maybe we'll do a post-mortem on how the NISC Smashing Security Live event went. That'd be good.

Yes. Fingers crossed for us people.

Folks, you can follow us on Twitter at Smashing Security. No G. Twitter allows to have a G. And we're also on Reddit. Look for us on the Smashing Security subreddit. And don't forget, to ensure you never miss another episode, follow Smashing Security in your favourite podcast app, such as Apple Podcasts, Spotify and Google Podcasts.

And of course a huge shout out to our episode sponsors Akamai, Bitwarden and Collide and of course to our wonderful Patreon community. It's thanks to them all that this show is free. For episode show notes, sponsorship information, guests list and the entire back catalog of more than 291 episodes, check out smashingsecurity.com.

Until next time, cheerio. Bye bye.

Bye. Eight away from 300. Scary.

Oh yeah. Yeah. Eight more episodes. When do we quit? When do we just call it a day? Do we... No, just keep on going because the public want us to carry on. They love us. The roar of the crowd, the smell of grease paint, the sniff of the microphone.

The end of the episode. Bye everyone.