Orange is the new hack
April 29, 2017 8:14 AM   Subscribe

 
So, that's a teenager, right? And not a smart one. Literally no one is going to cancel or rethink a Netflix subscription because now they can get 10 episodes of OITNB on the pirate bay. The economic threat here is pretty much zero.

So...an idiot.
posted by schadenfrau at 8:19 AM on April 29, 2017 [17 favorites]


>So, that's a teenager, right?

Not necessarily... a guy who'd call himself "The Dark Overlord" could easily be in the ten-to-twelve range.
posted by Sing Or Swim at 8:21 AM on April 29, 2017 [59 favorites]


It would be a kick in the head if the hacker was a woman who got caught and sentenced to time at an all women's prison in upstate New York.
posted by signal at 8:22 AM on April 29, 2017 [89 favorites]


I agree that there is limited potential for damage to Netflix here....no one's going to cancel their subscription bc of this leak. But the possible damage to Fox, ABC, IFC and others who rely on advertising and week-to-week release models is worse.
posted by nevercalm at 8:26 AM on April 29, 2017 [4 favorites]


A nice long prison sentence is just the ticket.
posted by freecellwizard at 8:40 AM on April 29, 2017


On a case-by-case basis, these stories are ridiculous.

Taken as a collective whole, though, they're terrifying. We only know of hacked data when the party doesn't succumb to the thought of blackmail. What happens when they do?
posted by steady-state strawberry at 8:45 AM on April 29, 2017


The irony here is deep.

Netflix didn't pay the hacker because they are well aware that some episodes posted on The Pirate Bay will cost them literally nothing, as in $0.00. Not a single person is going to cancel their Netflix account over that.

But I can't download Netflix (or Hulu, or CBS, or or or) shows to my PC1 because they are worried I might copy them and post them on The Pirate Bay.

1Yes, I realize I can download stuff to my phone/iPad. But that's because Netflix et al use DRM to make copying those downloads more difficult
posted by Frayed Knot at 8:54 AM on April 29, 2017 [1 favorite]


Taken as a collective whole, though, they're terrifying. We only know of hacked data when the party doesn't succumb to the thought of blackmail. What happens when they do?

We don't hear about it, and cyber security experts spread awful, awful rumors based on the conversations they've had about making the decision.
posted by Going To Maine at 9:07 AM on April 29, 2017


Are there betting sites for long-shot plot points in OITNB? If yes, that seems like a better move.
posted by Going To Maine at 9:10 AM on April 29, 2017 [1 favorite]


“We’re quite ashamed to breathe the same air as you..."

Wow, I can't help but seeing this cry-bulling, blame-the-victim tone as a sign of the times.
posted by rpfields at 9:21 AM on April 29, 2017 [3 favorites]


Releasing TV shows? Not really very dark. Shouldn't this kid be killing the goddamn Batman, or something?
posted by thelonius at 9:35 AM on April 29, 2017 [1 favorite]


Wow, the tone of this reminds of the warez message boards o frequented in the mid nineties. When I was 12.
posted by midmarch snowman at 9:40 AM on April 29, 2017 [4 favorites]


I'm impressed Netflix refused to pay him off. There's a brisk trade in on-line extortion, seldom reported on because the victim companies don't want to go public. It's popular with DDOS attacks but we only hear about it when a company refuses to pay. I have no data but my assumption is most companies pay the blackmail.
posted by Nelson at 9:41 AM on April 29, 2017 [2 favorites]


Torrentfreak has a pretty good writeup and mentions other hacks from this group.
posted by Catblack at 10:08 AM on April 29, 2017 [1 favorite]


People who subscribe to Netflix and watch OITNB aren't going to download something from Pirate Bay kid, lol. 90% of them will have never heard of it and the 10% who might will think hmmm, this was uploaded by a hacker with a lot of fanfare in an effort to get people to download it- nope.
posted by fshgrl at 10:34 AM on April 29, 2017 [7 favorites]


Given the range of targets mentioned in the TF article from Catblack, I expect they look for exploitable networks at major companies, steal information and blackmail the companies. Modern bank robbers indeed.
posted by filthy light thief at 10:35 AM on April 29, 2017


This hits close to home. My firm is working on a very sensitive piece of content, and the nature of the work requires all of it to be held on in-house servers. The NDAs the firm and its employees and contractors signed have liquidated damage clauses in seven figures. Realistically, though, if any of it leaked, the producers would take an nine-figure loss, the producer/distributor would have a round of firings on both coasts, and lots of people at every level—creative, technical, executive—would never get the opportunity to do this kind of work again.

So the servers with the content are on a physically isolated network, access to the network is monitored by a team of IT specialists during work, the servers have their power supplies taken off-site during downtime, and our runners are burly men instead of standard-issue L.A. post-house women. Defense in-depth. If any content is leaked, it won't be from us.

But a breakage in the chain will taint every link in the chain, including me, who's not directly involved at this point in time, so please pardon me if I'm on edge for the next several months.
posted by infinitewindow at 10:35 AM on April 29, 2017 [36 favorites]


>So, that's a teenager, right? And not a smart one.

I would not fall into the trope of claiming that a hacker is a teenager. Perhaps it will come out later in the year that they were, but seriously, have you met any teenagers, ever? They are a lot smarter than you give them credit for. It does appear to me, just going off the torrentfreak article, that they've pulled off several of these extortion schemes before. I doubt that they are doing this to have spending money at the mall.
posted by Catblack at 10:38 AM on April 29, 2017 [1 favorite]


Emotional adolescent, then.

Those notes don't betray a whole lot of um...maturity.
posted by schadenfrau at 10:47 AM on April 29, 2017 [2 favorites]


I have zero qualifications to even remotely guess who infinitewindow is working with, but I know people that have had contract work with LucasFilm that sounds nearly identical.
posted by JoeZydeco at 10:58 AM on April 29, 2017 [1 favorite]


Two thoughts. One is that posing as a generic angsty teen scriptkiddy when you're actually a professional criminal ring might potentially be good (or at least boilerplate) attempt at cover. And second, releasing the least harmful (and therefore least useful) bit of leverage first is a good way to muscle the networks that have ad dollars at stake into compliance (as per nevercalm's link).

The diversity of companies targetted makes me wonder if the common thread might not be a secondary production house. I know that title sequences, for example, often get shopped out to third parties. If that third party had a bunch of shows on an improperly secured server or drive, and then fell prey to spearphishing, it might be a good way to snatch up a bunch of content all at once.

Anyway, I'll say it for the hundreth time over the last two years, but the cyberpunk book that our reality now resembles is not very good, and could use an editor.
posted by codacorolla at 11:11 AM on April 29, 2017 [6 favorites]


I know we should never read comments, but what's up with the right-wing slant to 80% of the comments on Variety. That's where they live now, the comment section of VARIETY? WTF?
posted by kuanes at 11:16 AM on April 29, 2017 [2 favorites]


So, that's a teenager, right?

Smart money's on 54 year old Republican railroad commissioner, actually.
posted by byanyothername at 11:20 AM on April 29, 2017 [8 favorites]


It would be a kick in the head if the hacker was a woman who got caught and sentenced to time at an all women's prison in upstate New York.
posted by signal at 11:22 AM on April 29


Now that's some dedicated viral marketing.
posted by McCoy Pauley at 11:49 AM on April 29, 2017 [9 favorites]


>So, that's a teenager, right?

Not necessarily... a guy who'd call himself "The Dark Overlord" could easily be in the ten-to-twelve range.


Or anyone who's ever been a fan of the movie Howard The Duck.

Seriously, MeFis, you disappoint me. Here I thought was a safe space for dorky esoteric bad film enthusiasts.

(And, yes, I can still do a near pitch-perfect vocal impression of Jeffrey Jones as said Dark Overlord.)
posted by Samizdata at 11:50 AM on April 29, 2017 [13 favorites]


Also, this is why we can't have nice digital things.
posted by Samizdata at 11:56 AM on April 29, 2017 [1 favorite]


Reducing viewership for a normal show costs the broadcaster money because fewer eyeballs watching the ads.

But how does Netflix make money off of original content anyway? This is a serious question, I've wondered about this for a while. I assume it thinks "must see shows" on Netflix will make people want to pay for Netflix over, say, Hulu. And it's cheaper than paying for good movies. Also maybe syndication money eventually?

But once something is actually made, they're paying bandwidth and maybe royalties everytime someone watches, right? So as long as this doesn't happen all the time--and make the brand Netflix synonymous with "charging for free stuff on the internet" they're probably actually saving money off this, right?
posted by mark k at 12:05 PM on April 29, 2017 [2 favorites]


So, I can download and watch the first 10 episodes right now and then I have to wait until June to watch the last three or I can just wait a month and a half and not have to mess around with downloading crap?

It's not a cost thing, it's just easier to me to just be patient.
posted by VTX at 12:16 PM on April 29, 2017 [2 favorites]


Someone try this with HBO... demand they stop fucking around and air a final regular length Game of Thrones season already.
posted by Liquidwolf at 12:55 PM on April 29, 2017 [1 favorite]


A friend works for your Average Online Retailer and they get DDOS extortion threats every week. Usually they're hit with a DDOS for a short period of time, then a note arrives demanding a certain amount of money to keep it from happening again. They don't pay, though of course they spend an equivalent amount of money or more to neutralize the threat.
posted by maxwelton at 1:13 PM on April 29, 2017


People who subscribe to Netflix and watch OITNB aren't going to download something from Pirate Bay kid, lol. 90% of them will have never heard of it and the 10% who might will think hmmm, this was uploaded by a hacker with a lot of fanfare in an effort to get people to download it- nope.

But 100% of them are going to open up tomorrow's paper and read the headline "NETFLIX HACKED BY EVIL HACKERS" and, since 90% of them don't know The Pirate Bay from Jack Sparrow, will wonder if their credit cards, personal data (or viewing habits) are now compromised. How can Netflix possibly prove to them that it wasn't?

If even a small fraction of them are perturbed enough to cancel, that's lost money.
posted by The Pluto Gangsta at 1:21 PM on April 29, 2017 [1 favorite]


But how does Netflix make money off of original content anyway? This is a serious question, I've wondered about this for a while. I assume it thinks "must see shows" on Netflix will make people want to pay for Netflix over, say, Hulu. And it's cheaper than paying for good movies. Also maybe syndication money eventually?

Yes, I think all of that is true (though syndication is at-best a tertiary concern). Netflix banks off subscriptions, so they're basically interested in whatever lures more people to sign up. Which means "must-see" content -- what are the major cultural phenomena being generated? Stranger Things, the Marvel shows, OITNB, the OA, etc. It's quite similar to HBO in that respect, and I think they've taken a page out of HBO's playbook with respect to paying for original content and not interfering too much with the creators thereof.
posted by axiom at 1:30 PM on April 29, 2017 [3 favorites]


The original programming is most of what I watch on Netflix.
posted by VTX at 2:01 PM on April 29, 2017 [1 favorite]


Someone try this with HBO...
...yeah, release episodes of Bill Maher's show three months before they're scheduled to air (when he really tapes them).
posted by oneswellfoop at 3:05 PM on April 29, 2017


Netflix didn't pay the hacker because they are well aware that some episodes posted on The Pirate Bay will cost them literally nothing, as in $0.00. Not a single person is going to cancel their Netflix account over that.

It's probably true that Netflix isn't necessarily that worried about it, but I imagine that it is of concern to the producers of OItNB, because the watch numbers on Netflix's servers probably do affect what they're paid to produce future seasons.

This came up just a few weeks ago with the kickstarted MST3K revival on Netflix (of which I was a backer): As promised during the Kickstarter campaign, backers were granted early DRMless streaming/download access to the premiere episode and the rest of the season soon afterwards, a few days in advance of the "real" release on Netflix. Creator Joel Hodgson sent a deeply sincere letter to all backers politely requesting that nobody upload the new season to file sharing networks (If you will recall, MST3K's creators used to encourage "circulating the tapes" back in the '80s and '90s before digital file-sharing exploded in the '00s) and to preferably watch the episodes on Netflix instead of offline. All of this was to help keep the show's numbers high on its "home" platform, to ensure that Netflix continues to view the series as a moneymaker for its original programming division. From what I can tell, Joel and the rest don't need to worry too much (no announcement for next season, but the show is trending!) but I can see the whole situation being quite worrisome to content creators more than the networks that host them.
posted by Strange Interlude at 3:10 PM on April 29, 2017 [2 favorites]


They're doing Netflix a service, I'll save Netflix the bandwidth and watch the first 10 episodes via torrent, then watch the last 3 episodes on Netflix. They can measure this by seeing the number of people who've only watched the last 3 episodes. As a Netflix subscriber, me watching these in advance doesn't hurt them at all.
posted by furtive at 3:23 PM on April 29, 2017


"and our runners are burly men instead of standard-issue L.A. post-house women."

Post-house women?
posted by aerotive at 3:29 PM on April 29, 2017 [1 favorite]


You know, the women who think house is passé and are into deep house, micro house, tribal house, acid house...
posted by The Pluto Gangsta at 3:47 PM on April 29, 2017 [23 favorites]


The networks would have to be idiots to risk word getting out that they are willing to pay hackers lots of money not to release stolen shows. Therefore the hackers are idiots for thinking they can get the networks to pay up, especially now that they've gone public.
posted by straight at 4:41 PM on April 29, 2017 [1 favorite]


Netflix makes more than HBO because Netflix offers a lot more for a lot less. I pay for a Netflix subscription even if I don't have time that month to actually watch it, because it's not so expensive that I even think of cutting that when I have to tighten my budget. HBO's cost is much higher when I consider that I would need a cable subscription, which I no longer have. If I could get HBO for the same cost as Netflix I'd do it in a heartbeat. It does make me wonder how much money HBO could make if they became a streaming only service like Netflix.
posted by Hazelsmrf at 6:19 PM on April 29, 2017 [2 favorites]


Therefore the hackers are idiots for thinking they can get the networks to pay up

The hackers are sort of idiots, true, but I think that the situation seems atypical. According to the TorrentFreak article, their other targets have been corporate data. That's material that people would gladly keep quiet. A leak of movie or a network TV series would be catastrophic. It's only in this one instance of a streaming show that releases all at once and is both inexpensive and a small part of a larger brand that this tactic is dumb.
posted by Going To Maine at 7:10 PM on April 29, 2017 [1 favorite]


I would have assumed a Dark Overlord would have a better grasp of just how lazy I am.
posted by srboisvert at 8:23 PM on April 29, 2017


The torrentfreak link makes for interesting reading. The Dark Overlord wrote up essentially a little extortion contract which they claim the production company signed and returned, though there's no evidence of that. The ransom they demanded was 50 bitcoins, which works out to around $67,000 at the current exchange rate. Their claim is that after the agreement was signed, the ransom wasn't paid by the deadline of December 31st, at which time they levied a "late fee," and when the production company didn't pay that they leaked first episode 1 and then the remaining 9.

The torrent itself seems to consist of 10 .mov files weighing in around 1GB each. Comments on TPB so far deem them "very watchable" at 720p. Personally I'd find it unwise to add my IP address into that swarm, and you can't exactly binge on 10 episodes out of 13 anyways.
posted by whir at 10:53 PM on April 29, 2017 [1 favorite]


A leak of movie or a network TV series would be catastrophic.

But not nearly as catastrophic as putting a sign on their back saying, "Hey hackers, we will pay you lots of money if you steal our stuff and threaten to leak it."
posted by straight at 12:59 AM on April 30, 2017


A leak of movie or a network TV series would be catastrophic.

But not nearly as catastrophic as putting a sign on their back saying, “Hey hackers, we will pay you lots of money if you steal our stuff and threaten to leak it.”

It seems like the public threat of leaking occurred after the execs welched on the deal, though? (Or so the hackers claim, which means maybe take it with a grain of salt.) And given infinite window’s comment about the amount of money that can be on the line, the right blackmail price would be far preferable to a leak. That is, it seems like this kind of blackmail occurs already and the signs are already on the backs.
posted by Going To Maine at 1:10 AM on April 30, 2017 [1 favorite]


FYI, HBO Now started up about a year or so ago and is only $4 more per month than Netflix.

Unless something changes it does not seem to be available in Canada, so as far as I can tell the only way is still through cable.
posted by Hazelsmrf at 1:31 AM on April 30, 2017 [1 favorite]


Not sure if this matters much, but I distinctly remember that when THE WIRE! was still airing on HBO, somebody leaked the entire final season sans series finale with seemingly no fanfare whatsoever.

In fact, I remember not believing that the random video site I found that had the episodes listed as DVD_Screener rips was real, but sure enough...it was. At the time I saw zero press about the leak, and to this day am the only person I know of who watched the leaked screeners.

That said, the agonizing wait of almost 3 months for the single, final episode to air was brutal...I'd watched the whole season around the time Episode 1 or 2 aired, and I can say with 100% certainty that it was a negative experience.

So this Dark Overlord, releasing all but 3 episodes of seems to still be a popular show might have done Netflix a favor. If tons of people watch the leaks and are 3 episodes away from the end with a month or so to go, the buzz and discussion that comes from that might be way more significant than it otherwise would have been.

Even Googling now, I can't find much about the leaks of Wire S5, other than some discussions on a message board where people were trying to collect em' all. Seems like I found them after 9/10 had been widely spread, and despite being morally conflicted about watching them I didn't tell a soul where I was watching them.

On a side note - really? $67k to prevent one of the biggest shows you make from leaking and neither company paid? Even if you expect to pay and still have them leak, I can't imagine $67k would be enough for either company to stop and pick it up off the ground, should it happen to be sitting there.
posted by GreyboxHero at 3:45 PM on May 1, 2017


Brian Fung at The Washington Post: "Why the ‘Orange Is the New Black’ leak really won’t hurt Netflix"
posted by Going To Maine at 12:25 PM on May 2, 2017


Fools! The Dark Overlord is the coolest hacker in the world, and you are just jelous. Once my mom let's me on the computer tonight you wil pay!1

:maniacal Butters laugh recedes into the distance:
posted by Rei Toei at 5:17 AM on May 3, 2017


On a side note - really? $67k to prevent one of the biggest shows you make from leaking and neither company paid?
I'd bet it's about precedent: if they pay, suddenly a lot more people are going to try to repeat it and the next one will probably charge more. Netflix knows that their DRM, like all such systems, is breakable and doesn't want to create a cottage industry building tools which will cost them far more when content owners either stop licensing or charge more for the perceived risk.
posted by adamsc at 4:09 PM on May 3, 2017


« Older Whole Foods = Whole Paycheck   |   Nice racks. (And modules and patches.) Newer »


This thread has been archived and is closed to new comments