60: dawgyg

JACK: [MUSIC] A quick warning right here at the beginning; this episode does contain some
swear words and some bad language.
If that’s an issue for you, well, maybe skip this one.
Hey, it’s Jack, host of the show.
One of the reasons I like making this show is to smash the stereotype of what a hacker
looks like and today’s guest definitely does that.
I don’t know, I’m trying to understand – get a picture of your vibe, here.
You almost look like Eminem a little.
Not quite, but you know.
TOMMY: Yeah, I get told that a lot.
JACK: What would you characterize yourself?
TOMMY: Well, I actually used to take a lot of pride in the fact that I don’t look like
the average hacker.
I guess what most people would say I was, was do you remember the term whigger?
W-H-I-G-G-E-R?
White guys that dressed like black guys, listened to rap music, and stuff like that?
My first time in prison and up until that point, I guess that’s technically what most
people would see me as.
Like, I wore baggy clothes, sagging pants, backwards hat, and everything like that.
I got tattooed Pain is Love from a Ja Rule song on the back of my head.
I got the Laugh Now and Cry Later faces.
JACK: These are tattoos he got while in prison.
TOMMY: On my right bicep, I put a little tribal-looking face that was smiling, and it said Laugh Now.
Then on my left side, I had a face that was crying and it said Cry Later.
JACK: Federal prison.
TOMMY: In federal prison we all have prison numbers and the last three digits of your
number show where you were arrested.
My number was 38141-083.
083 is the Eastern District of Virginia.
JACK: This is dawgyg and his story perplexes me because of stuff he says, like…
TOMMY: October 18th of 2018, I was paid $160,000 in that one day.
JACK: So, what did he do to make $160,000 in one day?
Well, he’s a hacker.
JACK (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet.
I’m Jack Rhysider.
This is Darknet Diaries.
[INTRO MUSIC ENDS]
JACK: So, dawgyg’s real name is Tommy DeVoss and like many hackers, his story starts out
when he was a young boy in a chatroom.
TOMMY: I actually joined the wrong chatroom by mistake; it was just like, somebody else’s
private room.
It was run by a guy that used the alias Dznutz, D-Z-N-U-T-Z, but I just did the /join#dz by
mistake.
JACK: This brought him to a chatroom full of hackers.
TOMMY: I kind of just hung out in there.
I would just keep joining that same room every day after school for a couple of weeks.
I started asking them questions.
They were like, who the hell is this kid?
Blah, blah, blah.
I got banned like, several times.
JACK: There’s something magical about being in a chatroom as a teenager.
They’re fun and addicting and even though he was banned, he figured out ways to get
back in.
TOMMY: I would just disconnect, reconnect, and then go back in again.
After going in there and spending, I don’t know, several months of just keep going back
in there repeatedly and asking – just pretty much begging the guy to teach me [00:05:00]
stuff.
JACK: Because Tommy saw this chatroom was full of hackers, people breaking into computers
and networks that they weren’t supposed to, and Tommy thought this was cool.
He wanted to get in on the action too, and he wanted to learn what these hackers were
doing.
Even though they kept banning him, he just kept finding a way back into the channel and
was asking them to teach him how to hack.
Eventually they gave in and threw him a bone.
TOMMY: [MUSIC] The first thing that he told me was go to Yahoo AltaVista.
He was like, read everything that you can find about hacking.
I want to say this would have been happening in about ‘94ish.
JACK: Actually, in 1994, Tommy would have only been twelve years old, a pre-teen still.
Well, after bouncing in and out of all these chatrooms, he finally landed on a name.
Dawgyg is what he would be known as online, and that’s dawgy spelled D-A-W-G-Y.
So, he starts learning some basic hacking techniques by reading up on it.
At that time, Phrack was a free online hacking magazine so he probably dove into that and
started reading it from like, the first issue and slowly going through it, reading every
issue.
He learned a few things here and there but hey, he’s just twelve so he was just starting
out and wasn’t very good.
But he eventually joined an IRC hacker crew called TDK.
TOMMY: TDK stood for Those Damn Kids.
The main focus of TDK was IRC EFnet wars.
We would build botnets to go and check every single op in our target room and find a server
that didn’t have anybody from that server on it that was an operator.
Then we would DDoS that server to split it off in the network and then they’d just
basically take over the channel.
JACK: Damn you, you’re the one who did that?
That pissed me off so much back in the day.
TOMMY: So, there was – do you remember?
JACK: Yeah, I remember that.
I remember that because I was also hanging out in IRC channels in 1994 on EFnet, the
exact place where dawgyg was trying to do server splits and take over the channels.
I remember channels getting taken over by young kids but at the time, I thought it was
kind of funny and didn’t really take these chatrooms too seriously.
When Tommy started calling himself dawgyg, trying to take over these chatrooms, I think
this is where he starts trying on his black hat.
That is, he’s trying to conduct hacks that are causing destruction and grief.
Maybe taking over a chatroom isn’t illegal but this would be the beginning of his lifelong
hacking career.
What led you up to getting suspended at high school?
TOMMY: I used to get bored a lot while I was taking a computer class for – it was QBasic
in school.
A lot of times I’d get bored and wouldn’t have anything to do ‘cause I would write
my program for the class really fast.
I would actually DDoS my school’s IP address to take our internet down because then we
couldn’t do class and we’d get to go outside and play.
JACK: Yeah, he crashed the school’s internet because he would rather go outside and play.
TOMMY: I actually got in trouble for doing that.
They suspended me the first time three days for that.
JACK: That was his first suspension from high school but it wasn’t his only one.
Soon after that, he got suspended again.
TOMMY: I got expelled from school because I broke into a military base in Korea and
used their computer systems.
I hijacked the AOL account that the general of the base was using and I sent an e-mail
from his e-mail address, from his AOL account to the superintendent of Hanover County, that
one of the high schools in his county was gonna blow up at 10:30 in the morning.
JACK: A convoluted scheme but it was done for the same reasons as the first one; he
just didn’t want to be in school.
He wanted to…
TOMMY: Be able to skip school, go to the river, smoke weed, and just have fun for the day.
JACK: It worked, sort of.
School was cancelled but he didn’t get away with it.
TOMMY: I went to school the next day.
There was a guy in a suit on each side of the door and they were like, you need to come
with us.
[MUSIC] I got expelled.
JACK: So, how did he get caught?
Did that military base in Korea do some forensic investigation and trace this back to a teenager
in West Virginia? No.
Did the police track his online connections?
No again.
What happened is that he told someone that he’s the one who got school cancelled that
day and that person went and told someone at the school that Tommy is who sent in this
bomb threat.
TOMMY: Because I had used [00:10:00] the internet to do it, the FBI ended up raiding my house
about two weeks after it happened to take my computers.
That was the first time that I was charged with computer crimes.
I was actually charged with violating The Computer Fraud and Abuse Act.
JACK: Being a minor, a sophomore, one of those damn kids in the eyes of the law, this could
get bad pretty quick.
The feds took his computers but let him go free as they investigated the case.
Well, this gave him more time, more time to hack more stuff.
He got a new computer and slipped on his black hat again.
But forget about TDK at this point; he was onto more ambitious adventures.
TOMMY: [MUSIC] I started talking to a bunch of other hacking groups and I got in contact
with a guy named RaFa who was a member of World of Hell and he was telling me about
they had rules for their group where you’re only allowed to hack UNIX systems.
You weren’t allowed to target Windows because Windows was too easy.
They like to only attack government, military, and Fortune 500 companies.
JACK: This was great.
Dawgyg liked everything about this; the rules, the people, the stuff he was learning, so
he started hacking with World of Hell.
TOMMY: Then in June of 2001, I defaced my first website as part of World of Hell.
It was actually the Virginia – I broke into The Virginia Department of Informational Technology
and defaced www.state.ba.us which was our main state website.
Just from that point on, I just was defacing stuff with World of Hell nonstop for about
six to nine months.
JACK: Oh, in case you were wondering, deface is just a term used to change what’s written
on a website.
You can swap the photo that’s on the front page to something else, or just change what’s
said there to whatever you want.
In this case he probably had to prove himself that he was the guy who hacked this site so
he probably wrote something on there like Hacked by dawgyg or Hacked by World of Hell,
or something like that.
What were some of the sites that you were hitting or World of Hell was hitting?
TOMMY: Yahoo.com.ph, nokia.com, sony.com, Dotson, Dunhill, Epson, Fuji Film…
JACK: If hacking is a drug…
TOMMY: …Mercedes Benz…
JACK: …dawgyg was getting addicted.
TOMMY: …World Online, the car company, AOL.
JACK: He was loving this hacking and the World of Hell hacker group.
TOMMY: …HP, Reebok…
JACK: But the problem with addictions is that you can overdose.
TOMMY: …United Airlines, Casio, Motorola…
JACK: And you can fall into a world of pain.
TOMMY: …Hyundai, Sony Music, Toshiba, Opal, Volvo, EA Sports…
JACK: After the break, the party ends for dawgyg.
TOMMY: …Rolex, Pfizer, a bunch of Chinese government systems, the US Department of Energy,
the US court systems, Venezuelan military…creative.com, Audi, Kenwood, Acer…
JACK: High schooler dawgyg was still hunched over his monitor wearing a black hat and defacing
website after website.
TOMMY: …Xerox, Packard Bell, Compact, 3Com…
JACK: Doing all he could before he turned eighteen which was an adult in the eyes of
the law.
TOMMY: I turned eighteen in November of 2001.
I actually stopped hacking for a few weeks but then I got bored again so I started [00:15:00]
doing it again.
I hacked consistently until June 12th of 2002.
ANNC: [MUSIC] In the year 2002…
TOMMY: [TRAILER IN BACKGROUND] Oh, and June 11th, that night, Men in Black 2 had just
come out in theatres so that night, before I went to bed, I downloaded Men in Black 2.
The plan was I was gonna go to work the next day and then I was gonna come home from work
early, smoke weed with my sister…
ANNC: Don’t bother calling the CIA.
Forget the FBI.
TOMMY: We were gonna watch that movie.
JACK: He got out of work for the same reasons he wanted to get out of school; so he could
go play.
In this case, to play an illegally-downloaded movie.
He goes home to his apartment with his sister and they watch Men in Black 2, but the real
men in black were knocking on his door.
TOMMY: [MUSIC] I went to push the door open but it was yanked open in front of me and
an M16 was in my face.
There was somewhere between twenty and thirty agents inside of my apartment.
My sister was sitting on my couch crying, my dad was standing in the living room next
to her and just like, when he saw me walk through the door, he just looked at me and
shook his head.
They took everything in the house that was related to computers; all floppy disc, any
CD that was in there, every computer, every computer component, every piece of paper that
had notes handwritten on them.
JACK: Now, what was going – I mean, what was your emotional level at that point?
Were you freaking out about this or how were you feeling?
TOMMY: I was scared shitless at the time because I was an adult at that point and I was on
probation still for the hacking and bomb threat two years before.
JACK: Once again, they took all his electronics and computers and he had two weeks before
his court date.
TOMMY: This is it; I’ve got two weeks of freedom.
They’re going to lock me up in two weeks so I was like screw it, I’m just gonna have
fun and do whatever.
[MUSIC] I spent two weeks racing.
I used to street race a lot so I spent two weeks street racing, going to the beach a
lot, hanging out with as many of my friends as I could, trying to sleep with as many different
girls as I could.
JACK: Now nineteen years old, black hat hacker Tommy DeVoss, dawgyg, stands in front of a
judge two weeks later.
Hats were not allowed in court.
TOMMY: I ended up pleading guilty in October of 2003 to one count of violating the CFAA
for breaking into a computer system that controls interstate commerce.
I had broken into a website called Bank Colo, B-A-N-K-C-O-L-O.com, and defaced the website.
Turns out, it was for the Colorado Bank and Trust Company.
JACK: Hm, yeah, messing with a banking website was probably a bad move.
I mean, they’re federally regulated and insured which means that crimes involving
a bank are probably going to be investigated by federal law enforcement.
TOMMY: The judge asked me to stand up.
He looked at me and he said Mr. DeVoss, I do not believe that you’re sorry for anything
that you’ve done.
I think the only reason that you are showing any remorse whatsoever is because of the fact
that you got caught.
He ended up sentencing me to twenty-seven months in federal prison, [MUSIC] banning
me from computers for ten years, and giving me five years of probation.
I want to say it was $100,000 of restitution that had to be paid.
Then after he pronounced my sentence, he said I now place you in the custody of the US Marshals
to serve your sentence and my knees pretty much gave out on me.
I walked in there expecting to walk back out that day for at least thirty days and now
all of a sudden, I’m getting locked up for almost two and a half years.
JACK: The fun was over; dawgyg’s hacking spree was done.
Back to being Tommy with no hat to wear in prison.
What were some of the tattoos you got?
TOMMY: My first tattoos in prison; I got a tribal on each one of my [00:20:00] biceps,
one on each side.
It was just a small little tribal and one had a T for my initial and the other one had
a C for the girl I was dating at the time.
I got three dots on my right wrist which is a Hispanic gang tattoo puntos locos, ‘crazy
life.’
I had the words ‘crazy life’ put on – I don’t know what it’s called.
It’s not my forearms but it’s the back of my arms between my elbow and my wrist.
‘Crazy’ was put on one side, ‘life’ was put on the other side.
I went in with five or six tattoos and came out with like, twenty-five or thirty total.
JACK: Tommy served his two years in prison and got out.
At this point it’s 2006, he’s twenty-two, but still has to serve probation.
So, your real probation had ten years no computers?
TOMMY: No computers, cell phones, game systems, fax machines, anything that could communicate
with other people aside from an actual phone.
I could make phone calls.
I wasn’t allowed to touch a cell phone or anything like that.
Even when I would go and get a job, a lot of jobs would have you clock in on a computer.
I wasn’t allowed to do that.
I had to have another co-worker clock me in and out.
For the first thirty days or so, when I got out of prison the first time, I didn’t do
any drugs and I didn’t get on a computer or anything.
JACK: For the first thirty days?
This doesn’t sound good.
But let’s not forget Tommy was once addicted to hacking.
It was all he could think about, not to mention being high, so even though he went two years
without doing any of this, how long could he hold out now that he’s sort of free again?
Turns out, thirty days.
TOMMY: [MUSIC] I actually started defacing websites again because of how my bedroom was
set up in the house.
I used to sit at my computer and I was sitting next to a window that I could see out but
you couldn’t see into it.
I just would always sit there and if I saw a car pull in my driveway that I didn’t
recognize, I would jump up and take my desktop computer completely apart, hide different
parts of it in various places of the house so it couldn’t be found, and then go and
answer the door.
JACK: His probation officer would visit sometimes, come by and check on Tommy; talk to him, look
around his room, and make sure he wasn’t using a computer because that wasn’t allowed
on his probation.
One day, when his probation officer did come by, Tommy quickly shut down the machine, took
it all apart, and hid it all over his room.
But he forgot to hide one thing and when the PO came into his room, he saw a keyboard on
Tommy’s bed. Busted.
This was a violation of his probation and he had to go back to prison to do more time.
Eventually he came back home again.
Again, his probation was that he could not use computers but Tommy just couldn’t keep
his fingers off them.
He didn’t want to hack anymore but he was just addicted to computers and would use it
for other things, but the FBI was interested to see if he was gonna go back to being a
hacker.
TOMMY: The FBI actually watched me for six months.
They rented the house across the street from mine, took pictures of every person that came
to my house.
The FBI actually collected our trash to go through it, looking for evidence that I was
on a computer hacking again.
JACK: As Tommy tells the story, his parents wanted to sell the house and a couple of FBI
agents came over posing as potential buyers of the house.
That’s when they saw Tommy on his computer in his room.
This was a direct violation of his probation again which was all the evidence they needed.
The FBI went and got their arrest warrant and came back and knocked on the door.
TOMMY: When I opened it, they bust through the door and it was the FBI DCIS which is
the Defense Criminal Investigative Service.
It’s kind of like the Department of Defense’s version of the FBI, the Secret Service, and
state police for Virginia.
They locked me up for violating probation and failing a drug test.
They gave me fourteen months in prison that time which was the maximum they were allowed
to give me.
They gave me what they call diesel therapy; they put me in solitary confinement for three
weeks in Petersburg and they shipped me from there to USP Atlanta which is a maximum-security
prison in Atlanta, Georgia.
They put me in solitary confinement there for I want to say it was another three weeks.
Then they sent me from there to a medium-high prison in Williamsburg, South Carolina where
they put me in solitary again for a couple of weeks before putting me on the actual compound.
JACK: I think going back to prison again really did change Tommy.
[00:25:00] He didn’t like it there; he didn’t want to ever come back so he spent a long
time weighing which was worth more to him, the high you get from hacking or his freedom.
Each time he went to court, he ended up in front of the same judge every time and that
judge’s name was Judge Payne.
Judge Payne said something to him which had a lasting impact.
TOMMY: The last time I was in court on October 28th of 2009, I had Judge Payne.
For every time I went to federal court, I had the same judge.
He told me that if he ever sees me in his courtroom again for a computer crime, he was
gonna give me life in prison.
Yeah, he made it so I don’t want to hack illegally anymore.
I got a daughter that would be really mad at me if I went to prison for the rest of
my life.
JACK: Tommy gets out of prison and does good on probation; no violations.
In fact, he does all the time he’s supposed to do and on November 3rd, 2010 his probation
is done and he’s a free man once again.
TOMMY: [MUSIC] It was really nice to know that I could get on computers again and not
have to worry that I was gonna go to prison or get caught on them or anything.
I didn’t have to hide them anymore.
I was allowed to get cell phones.
The biggest thing to me was the fact that I was allowed to go to school now.
While I was on probation I wasn’t allowed to go to college because you can’t go through
college without having to use a computer for something, especially when I wanted to go
for computer stuff.
I was allowed to try to find a computer job at that point.
That was the biggest difference for me.
JACK: He could go to college, use computers, but of course, he was not allowed to do any
illegal hacking, no matter how tempting it might be.
Finding a legit job in the tech industry is really hard when you have a federal conviction
on your record, especially for fraud.
TOMMY: I spent three years from 2010 to 2013 trying to find a computer job, period.
I kept working as a cook and doing construction but I couldn’t find any company that would
hire me doing computers because of my background and everything.
They automatically think you were stealing money or identities.
JACK: Tommy would sometimes get that itch to be dawgyg the black hat and hack into something
again.
But he controlled his temptations no matter how strong they were.
The truth was he was really good at hacking and when you’re really good at something,
you like doing it.
But then he heard about something new, something that would change his life and start a new
chapter for him; bug bounties.
[MUSIC] There are two main websites that do this; HackerOne and Bugcrowd.
Companies will go to these websites and say something like hey, if anyone can find a security
issue on our website, we’ll give them a reward.
Tommy came across HackerOne and decided to check it out.
He saw the website Yahoo had a bug bounty program and he was already really familiar
with the way Yahoo worked.
He’d been poking at it and hacking on it throughout his whole teenage life, so he was
kind of flabbergasted now that Yahoo was willing to pay anyone who could find a security problem
in their website.
He starts hacking around on their site and found something.
TOMMY: I reported my first bug on HackerOne to Yahoo in March of 2016 and I found that
a lot of Yahoo’s system admins and developers were using gist to share information and they
were forgetting to make them private or delete them after the fact.
I found a bunch of them that were leaking internal passwords, database credentials,
network maps, and stuff like that.
That was my first bug.
Yahoo reported it to them and they gave me like, three hundred bucks for it.
JACK: As in, Yahoo was thanking Tommy for hacking their site and telling them about
a security problem they had and were so happy, they gave him $300 for this.
TOMMY: I was like oh shit, okay, so maybe this is real.
I made very little money the first couple of months ‘cause it was all really low-level
things that I was finding.
Then in May of 2016, ImageMagick remote code execution vulnerability was public at that
time.
JACK: The ImageMagick bug was a vulnerability where websites let you upload an image but
you could send a malicious image to it and then you can get access to the website just
by uploading a malicious image.
TOMMY: I actually got remote code execution on two of Yahoo’s servers using that and
got – the first one was $1,000 bounty and then the following week I found the same [00:30:00]
RCE on a different server, reported that, and they gave me the full $4,000.
JACK: With that, dawgyg was back.
This time, completely legal.
This time wearing a white hat because all this was legit and paid out by Yahoo, the
company he hacked.
But because they have a bug bounty program, it explicitly allows this kind of hack if
you’re participating in the program.
They’ll pay you for it, so he was basically given the green light to hack once again.
Dawgyg was in somewhat disbelief.
Is this even real?
But it was, so he sat up straight, cracked his knuckles, and began going to town looking
for more bugs that would pay out.
TOMMY: In my first year doing bug bounties, in 2016, I think I only made let’s say somewhere
between $30,000 and $50,000, somewhere.
Almost all of it was on HackerOne and then in 2017 I ended up making – I think I set
the goal to make $100,000 in 2017 from bug bounties, and made somewhere between $115,000/$200,000
for 2017.
JACK: The white hat hacker move was working for him but what looked even better, what
he really wanted, was a green hat.
Green as in money.
TOMMY: 2018, I think I made, combined across all three platforms, somewhere between $600,000
and $700,000.
JACK: For dawgyg money looked best when it was turned into cars.
Men in Black 2 got him in real trouble but Fast and Furious truly inspired him.
TOMMY: The Fast and the Furious movies started coming out, what was it, ’99 or so?
I fell in love with the Skyline GT-Rs.
JACK: Tell me about what happened to you in January, 2018.
TOMMY: In January, 2018 I got $175 bounty on a Friday afternoon, [MUSIC] on a HackerOne
program.
I was kind of mad about the bounty ‘cause it should have been quite a bit more but the
program paid really bad, and I put the $175 on a – I bet on basketball, international
basketball, a lot – put that $175 on there at about 7:00 on that Friday night and by
Monday afternoon, 4:00 or 5:00 in the afternoon, I had turned $175 into $133,000.
I withdrew $50,000 of it and I went and bought my first Skyline.
It was a 1992 R32 GTS-T. That was technically my dream car.
It wasn’t the GT-R model but it was still a Skyline.
I was like, extremely happy.
JACK: In 2018, dawgyg kept finding and submitting bugs on HackerOne.
$200 here, $1,000 here, $5,000 there.
He was racking up one bounty after another, slowly but surely fattening his stack, earning
his green hat, and then he scored the biggest bounty yet.
TOMMY: Okay, so October of 2018 I set the record for the highest amount of bounties
paid in a single day to a single researcher.
I was playing with the Nexus RF and I found a bypass for their blacklist that they had
used and I ended up being able to bypass the blacklist in a total of fifteen or sixteen
different end points for SSRF.
JACK: I know some of you don’t understand what he’s saying.
That’s okay; all you need to know is that he found a vulnerability sixteen times on
a single company’s website.
TOMMY: Ended up getting new bugs for all sixteen of them and each one of them was $10,000.
[MUSIC] It was like, October 18th or something like that of 2018.
I was paid $160,000 worth of bounties in that one day.
JACK: What is that feeling like, to get $160,000 in a day’s work?
TOMMY: Unreal.
It was just, like – it still seems too good to be true.
That’s my single-day highest payout but I’ve had at least five or six single-days
where I’ve made six figures in one day.
DOM: Ask any racer, any real racer.
It don’t matter if you win by an inch or a mile.
[CROWD CHEERS] Winning’s winning.
TOMMY: It’s unreal to know that ten years ago right now I was sitting in federal prison,
to [00:35:00] now I’m one of six people on HackerOne that have made a million dollars
just on the HackerOne platform.
I’m pretty sure I’ve made over $800,000 in 2019 just from HackerOne.
JACK: I’ve confirmed all this, by the way; I’ve read through his court cases, I’ve
listened to his mother talk, and HackerOne themselves has announced that Tommy was the
sixth hacker on their site to make one million dollars.
In 2019, he made $910,000 total, just missing his goal of one million dollars in bug bounties
in one year.
What did your parents think when you started using HackerOne to hack again?
TOMMY: At first, they were super leery of it.
My mom finally accepted it after the first year or so when she saw that I was able to
make money and I was making decent money and not getting in trouble.
My dad still doesn’t accept it.
He actually won’t talk to me because he thinks that I’m wasting my life and wants
me to get a normal nine-to-five job and everything.
The last time I actually spoke to him was in February of this year and he was disowning
me and telling me that I needed to stop wasting my life and get a real job before I lose my
life, or something along those lines.
JACK: That’s because he thinks this isn’t legit work?
TOMMY: Yeah.
I’m hoping that he’s seeing it now in the last – in 2019, I’ve bought cars for
my two nieces that are seventeen years old; I bought both of them their first car.
I bought my baby sister who is about to turn eighteen, I bought her her first car.
I’ve got a set of twin sisters a year younger than me.
One of them lives in Florida; I bought her a truck earlier this year.
I bought her twin sister a car and a truck a few months ago.
I bought my mom a Mustang back in October of this year and I bought myself, this year,
I’ve bought myself an Infiniti G37.
I’m planning to buy my dad a brand-new truck.
I’m planning on buying him a truck within the next month or two and then just buying
it, taking it to his house, putting it in his driveway with the keys in the title, and
just leaving it there and letting him come home from work to find a brand-new truck sitting
in his driveway for him.
JACK: Oh, there’s an update here; I recorded this interview months ago but I checked with
Tommy just before airing this and he’s slowly getting on talking terms with his dad again.
When he pitched this idea to him, his dad had another plan.
Remember the car Tommy bought his eighteen-year-old little sister?
Well, she didn’t drive it right and she blew the engine so his dad said instead of
buying me a new truck, why don’t you buy another new car for your little sister?
So, that’s what Tommy’s planning on doing.
Also, at this point, dawgyg has earned so much money that he’s been able to buy two
of his dream cars and both of them are the classic Nissan Skylines from Too Fast, Too
Furious.
What are the license plates on your cars?
TOMMY: On my R32 GTS-T I’ve got an antique tag on it that says H4CK3R, H-4-C-K-3-R. On
my ‘92 R32 GT-R, it says BNTYPLZ and then I have on my Infiniti G37, I have the license
plate TY-H1.
Earlier this year I actually, a couple months ago, I actually was sent to DC by HackerOne
and I spoke at a little cyber-security leaders meetup between the government and military
agencies.
So, going from a black hat being sent to prison for hacking the government to actually being
invited to speak to government leaders about my experience hacking them.
JACK: This is the weird new future we’re living in.
Ten years ago, when dawgyg was hacking, bug bounties didn’t exist and the government
was chasing him.
Now, dawgyg is doing the same kind of hacking but now companies are paying him to do it
and the government is asking him to come teach them, sort of like if you can’t beat ‘em,
join ‘em.
TOMMY: Yeah, exactly.
The good thing, one of the things that I love about the DOD’s program so much is that
it’s their scope.
Tons of companies start up a bug bounty program and they have an extremely limited scope.
It’s like, we only want information about these and everything.
As a former black hat, I know that I don’t give two shits about a scope if I’m a black
hat.
JACK: Yeah, Tommy’s now helping the feds secure their networks.
It’s weird how it all turned out, isn’t it?
[00:40:00] Even though the bug bounties are bringing him a great income, he’s actually
been looking for a day job lately.
TOMMY: I don’t have anybody to talk to that – when I make a really cool hack or anything
like that, aside from the people online.
I see hacking as kind of an addiction.
I’m just as much addicted to hacking as I ever was addicted to any drug or anything
like that.
I’ll never stop hacking.
Actually, the only reason I’m looking for a full-time job is because I miss working
with a team and just want to have a little bit of structure to my day so that I’m not
just like, I sit around bored out of my mind a lot.
There’s only so much Xbox you can play and online games and stuff you can play before
even they get boring.
JACK: Tommy did, in fact, recently get a job with one of the biggest banks in the US doing
research on the threats they see there.
He applied, interviewed, they liked him, he passed, got the job, and he had a start date
in January.
But when they ran a background check on him, they got worried and so they decided not to
bring him on board.
This was a bummer since another reason he wants a day job is to prove to his dad that
he’s doing good work.
TOMMY: I think he’ll be happier then.
I’ll still be doing my bug bounties and stuff but I’ll have what he sees in his
eye as a real job.
JACK: Okay, so if Tommy’s story is inspiring to you, you can get started earning money
finding bugs, too.
This is what Tommy suggests you do to get started.
TOMMY: Just doing hacker101.com which is kind of like hacker university where it’s capture-the-flags
and stuff to show you some real-world examples of things that bug hunters have found to give
you hands on experience.
Doing pen tester labs; I always suggest when somebody asks me where to start is reading
every blog post you can find from Bug Hunters about what they found and everything so it
gives you an idea.
JACK: Last thing I asked Tommy, a former criminal, is if he has any advice for the next generation
who might be thinking of trying on that black hat.
TOMMY: It’s not worth doing the stuff illegally.
Thanks to Edward Snowden’s leaks back in 2013, we know that everything we do online
is monitored by the US government and anybody that thinks that they can do things illegally
and get away with it is mistaken.
Anybody that has been doing things illegally and has gotten away with it, it’s only because
they haven’t wanted to look at you yet but they can.
You’re not gonna hide yourself completely.
Everybody makes mistakes.
The amount of money that you can make doing this legally far outweighs the money you’re
gonna make illegally ‘cause if you’re good enough to do this as a black hat, you’re
good enough to do this as a white hat and you can make life-changing money doing it.
JACK: Just being airing this episode, Tommy attended the H1-415 hacking event.
This is a nine-hour hackathon put on by HackerOne in San Francisco.
The goal is to see how many bug bounties can be claimed within nine hours.
A bunch of people showed up.
Tommy went and he was finding bug after bug and reporting them.
Within the nine hours given for the event, he earned $101,000 which gave him the coveted
MVH, Most Valuable Hacker.
[APPLAUSE] I get a little jealous listening to this story because I was one of those people
who did everything right; I’ve never been arrested for hacking, I never went to prison,
I went to university and got a computer science degree, and then I spent ten years working
as a security engineer.
I made nothing close to a million dollars yet here’s Tommy breaking all the rules
and getting scarred again and again, failing repeatedly, and still coming out not just
okay but with all the toys.
But I guess it just reminds me of that Fast and Furious quote.
EDWIN: You know, everyone happens to know a few things.
One of the things everyone knows is it’s not how you stand by your car; it’s how
you race your car.
You better learn that.
[REVVING]
JACK (OUTRO): [OUTRO MUSIC] A very big thank you to Tommy DeVoss, AKA dawgyg.
Great story, but stay out of trouble, okay?
Oh, have you listened to the five bonus episodes of Darknet Diaries yet?
They’re out there but they’re only for Patreon supporters.
If this show brings you value, please consider giving to the Darknet Diaries Patreon.
You can also get an ad-free version of the show there, too.
This show is made by me, the Tokyo drifter, Jack Rhysider.
This episode was produced by the turbo-charged Jake Warga, editing help this episode by the
[00:45:00] windblown Damienne, and our theme music is by the electric-powered Breakmaster
Cylinder.
Even though a Mirai botnet is launched somewhere in the world every time I say it, this is
Darknet Diaries.