Intel Update - July 26 - How the Turntables

Hello again everyone and welcome back to the underground. This is the intel update for July 20th through the 26th of 2025. Continuing the trend of the past few years. It has been once again a very busy week. But unfortunately this week a lot of these issues I would much rather ignore have to do with national security. So I kind of have to pay attention to it. And as much as I really hesitate to do so, I would encourage everyone to pay a little bit more attention to this stuff this week because the potential for this to get out of hand is rather high. Of course, I am referring to mostly the data breach regarding the T app here in the United States, which we'll unfortunately have to get into in a moment. Also, the Epstein scandal in Washington DC continues to develop, so we'll have to cover that a little bit as well. Our friends across the pond have had a similar rough go of it this week with the online safety act causing a ruckus and mostly because the great British firewall is now online. And of course, we have another war to follow in Southeast Asia, this time between Cambodia and Thailand. And that war is heating up. So without further ado, let's go ahead and start digging into t n Southeast Asia, this time between Cambodia and Thailand. And that war is heating up. So without further ado, let's go ahead and start digging into the rather unfortunate story this week, which is the T app data breach. Occasionally, I'll stumble across some information that I really, really wish that I did not learn or know or figure out. And this is most certainly one of those cases. So, what is the T app and what is this data breach all about? Well, this app was created solely for the purpose of allowing women to register for an account, mostly with just the goal of talking about men that they know andor were trying to date. This was mostly created and built and advertised as a dating app, but it was most certainly not. So, the name of the app itself kind of gives it away. Unfortunately, I've learned that the term T is a modern-day slang synonym for the word gossip. So, that should tell you basically what this this app was designed to do from the ground up. So, the general user experience for this app was for women to create an account and only women. I should note that very clearly right up front because that's important. Only women were allowed to have accounts on this app. A count and only women. I should note that very clearly right up front because that's important. Only women were allowed to have accounts on this app. And what they could do is create profiles like MySpace pages back in the day for men that they knew, all without the men knowing about it. So dudes could have a whole baseball card about themselves on this website and uh all the women in their life that they knew sharing information about them, personal details, rumors, uh unsubstantiated slander, all kinds of stuff. and they would have no way of knowing that that they had an entire targeting profile built about them on this app. That's why this situation is so unfortunate because it's just horrific to imagine that such an app would ever actually exist. But it did and it got around 2 million users uh within the United States to register for this app uh since its launch I think a couple of weeks ago. So, this rapidly became the number one downloaded app in the United States uh for a brief period of time there before the leak. Fast forward to a couple of days ago where a random user on 4chan discovered that this app was mostly written by AI and it was written very poorly at that. And mos to a couple of days ago where a random user on 4chan discovered that this app was mostly written by AI and it was written very poorly at that. And most importantly, every single bit of data, every single line of code for this entire app and ecosystem was stored on a storage bucket that was publicly accessible by anyone on the internet. that all you had to do was have the URL and you could have accessed the entire website and the entire app. And that's exactly what someone did because uh quite a few people rapidly ripped all of the content from this website and found just how big of a privacy nightmare this situation was. So what data was leaked from this app? Well, most of the interesting data that was leaked or not even really leaked, it was just online just there for people to see. Most of the interesting data was user registration data. And this is where things rapidly go downhill. You see, remember how I said that only women were allowed to have accounts? Well, how did the app verify that someone was a woman and not uh, you know, creating an account as a dude? Well, they had users choose one of two options. They could take a selfie of their face and upload it to their servers, creating an account as a dude? Well, they had users choose one of two options. They could take a selfie of their face and upload it to their servers, or they could scan a copy of their driver's license and upload it to the company's servers. So, all of that data was leaked. And as if that was not bad enough, in 2025, it turns out that many people still do not understand that when they take a photo with their smartphone with their location data turned on, their smartphone will embed in the metadata of that photo their GPS location. And it turns out it's pretty precise most of the time. people have gotten a little bit too comfortable with uh places like social media like Twitter, Instagram, Facebook, whatever, whatever everyone's using nowadays because most social media websites will strip the XIF data from a photo that you upload. So if you wanted to post a photograph to Instagram, that user's phone is still reporting your GPS location to Instagram. It's just that Instagram is taking the extra step to remove that private data from your photo on your behalf before they post it to your account. Most people for some reason seem to not understand that this goes on. But when you're using photo on your behalf before they post it to your account. Most people for some reason seem to not understand that this goes on. But when you're using a rather poorly coded app that was probably either written in Tel Aviv or Mumbai, they did not strip any of this data. So the raw photos that these people took to register an account to prove that they were indeed female and not male. All of that private data was still attached to the image. And it's even worse for people who took a photo of their driver's license because if they took a photo of their driver's license, that image itself would have a GPS location and their driver's license would have their mailing address. So then you could cross reference the address that was on the driver's license with the GPS coordinate and see if they matched. Right? So now we're starting to see why this may have been a a pretty big deal here. But we'll get back to that in a minute because the GPS stuff is pretty interesting. However, uh that was not the only thing that was leaked. As if it could not get any worse. It got worse because people noticed that not only were these uh photos of registrations online, but more or less the code for the app t get any worse. It got worse because people noticed that not only were these uh photos of registrations online, but more or less the code for the app itself was online, which means that every single thing, every single user posted is now on the internet uh public. So if someone said a rumor about someone or tried to make some kind of unsubstantiated claim about a man that they knew, that information is now all over the internet. private messages, comments, posts, pretty much everything on this website is now just freely available on the internet. And my personal guess is that in a few days, if it doesn't exist already, is probably a database of all of the dudes that were slandered on this website is probably going to come out along with all of the people and their driver's licenses who uh slandered them. So, again, from a civil like social aspect, this is pretty bad. Uh, however, it could probably get quite worse because of what I'm about to mention in just a moment. But remember, all content on the app was leaked, including possibly potentially passwords. So, we all know how people tend to reuse passwords for things, including websites and uh apps they probably should not be usin potentially passwords. So, we all know how people tend to reuse passwords for things, including websites and uh apps they probably should not be using. So, this has a potential to get pretty bad, especially considering that the immediate fallout is for the company to basically just ghost everyone. Uh the T app itself uh has issued no warning or any kind of notification to any of the users that their data has their whole uh existence on the app has been breached. There has not been any acknowledgement from the company at all that any of this data was leaked. They're just carrying on and they're continuing to register new users. So I don't really know what's going on with this, but it does not appear to be that this scandal is over just yet because it's there's been no real effort to change anything. I don't even know if the owners of this app are are still around. they may have just dropped it and left. Uh to be honest, so so it's hard to say exactly what's going on. It looks like the company just kind of walked away. The the developers of this just kind of left it as we can imagine. That's probably a fairly high likelihood considering the very large lawsuits that are going to resu rs of this just kind of left it as we can imagine. That's probably a fairly high likelihood considering the very large lawsuits that are going to result from this. But that's still all a social thing. So, you know, this is it's interesting. It's kind of fascinating, but it's not really like why is it worth talking about? Well, I think it's worth talking about because the national security concerns. A lot of people uh signed up for this app from inside their offices on military bases, legislative buildings, uh government facilities, uh all around the United States. So, very sensitive sites in some cases. People were signing up for this app because they were bored and on their phone at work. And when people are bored and on their phone at work, they submit selfies and boom, there you go. Now you're geo tagged. I haven't seen how many, but a few people, I don't know how many, but at least a few people signed up for this app using a photograph of their military ID, which in case you didn't know, is a huge no no. Uh, that's not a something that's acceptable. But once again, this kind of still stays within the realm of just a really bad data leak, right? So, what I'm trying to get at her that's acceptable. But once again, this kind of still stays within the realm of just a really bad data leak, right? So, what I'm trying to get at here rather awkwardly is what makes this any different than any kind of unflattering data breach in the past, right? If we recall a few years ago, I'm not sure how many people remember this, but a few years ago, there was a scandal with the Ashley Madison company, which was, I guess, a company that was set up to be like a social media for people to have an affair online, and they would uh facilitate the infrastructure for doing that. So, of course, it was a very illicit app. A lot of people got very very upset that their credit card data got leaked. But if we recall that that data breach many years ago, what was leaked during that scandal? If if memory serves me correctly, it was things like credit card information, email addresses, and you know, uh, names and, you know, billing addresses and things like that. Not exactly selfies or GPS coordinates. And when that scandal occurred a few years ago, there wasn't really like a centralized like database for people to go in and search to see if anyone they knew had an account with that website s ago, there wasn't really like a centralized like database for people to go in and search to see if anyone they knew had an account with that website. So, it was really hard to for people to kind of figure out who was, you know, implicated in this rather unflattering data breach, right? Eventually, a lot of people did kind of get implicated in this, but it was it stayed mostly on the dark web for a long time. It didn't immediately appear on Google Maps like this one did. And also I would posit that this particular data breach is worse for national security because of the nature of the app itself. The app itself was designed to share gossip, not necessarily to just have an illicit affair. Having an having your illicit affair being documented by a credit card data breach that reveals that you are on a website that you're not supposed to be on. That's bad enough, but what's worse than that in in my opinion at least? Well, the potential for blackmail in this case. So, let's get right down into the weeds of what I mean by this. Uh, mostly because I'm already down here in the weeds and I'm dragging you guys down here with me because it's uh pretty rough. So, the type of data on this web because I'm already down here in the weeds and I'm dragging you guys down here with me because it's uh pretty rough. So, the type of data on this website that was leaked is very interesting because well, for one, immediately everyone could very easily georreerence all of the selfies and the data that was on these websites and plot it on a map. And when you plot things on maps, things get pretty interesting, right? So, what you can do is you can take the GPS coordinates of all of the people that were implicated in this uh scandal and you can cross reference it with their mailing address and or their voting records. So, now you can verify as to whether or not a person was actually at the mailing address that they were supposed to be at. Remember the nature of this app? The nature of this app is to rate men like Yelp or like some kind of social credit system for men that they may be dating or affiliated with. So, if you will unfortunately follow along with me for just a moment, a woman has an affair outside of marriage and decides that she does not like the individual that she was having the affair with anymore and she decides to hop on this app, create an account, and share a lot of she does not like the individual that she was having the affair with anymore and she decides to hop on this app, create an account, and share a lot of private details. This guy's a cheater, blah blah blah, so on and so forth, or any other kind of really bad, damaging information about this this person that they were having the affair with. Well, if they took their selfie photo from that guy's apartment because they got upset one time, well, you can see how that data is now on the internet for people to cross reference with their actual mailing address uh if they were so kind as to provide a scan of their driver's license. So, that's bad enough as is, but let me tell you something, ladies and gentlemen. It gets a whole lot worse if this entire scandal took place located within the base housing of a military base. And it gets even worse than that. If these pens started popping up in the places where general officers are known to live, as in the more affluent parts of military bases around the country, if you know what I mean. And it can get worse, not in just the context of the military threats, but uh powerful people being potentially implicated in things like this. Because what you get worse, not in just the context of the military threats, but uh powerful people being potentially implicated in things like this. Because what you can do is take the GPS data from this data breach and overlay it on a map and overlay that with US census data for income for instance to find out just how many people living in very affluent areas are not very happy with the people around them. So as interesting as that is uh for potentially very uh wealthy and very powerful people having a lot of pins fall on their personal residences. Remember, again, I'm trying to look at things from a more practical national security angle. And I can tell you that if we're looking at a counter espionage effort, I am sure I am sure that a lot of people would be very very interested in this app's data. I can guarantee you that every single intelligence agency in the world is just having a field day with this already because you can look at the data and see the obvious espionage angle. users who are married to someone, but they had an account on this app uh secretly so their spouse couldn't see it. And because they took uh georreerenced photographs, uh you can now know that they worked on or near a app uh secretly so their spouse couldn't see it. And because they took uh georreerenced photographs, uh you can now know that they worked on or near a military base. So you can narrow it down, you know, to even more specific uh threat vectors and things like that. These people are ripe targets for blackmail, espionage, leverage from an international spiring, you know, anything and everything. Uh, of course the the the vulnerabilities here are absolutely limitless. I am just only focusing on the the part of the spectrum that lies within the espionage realm because, you know, the the other stuff is is interesting, but I don't want to waste you guys' time by going into the social aspects of this. So, yeah, this is a pretty big scandal. I don't think anyone has realized how severe this is just yet because everyone's focusing on this from the social angle, right? You're talking about, all right, these women created an account on a on an app solely for the purposes of doxing and sharing the the PII of dudes that they know without their knowledge. Oh, look at that. Their own PII gets breached, right? So, the the comeuppance angle of this, you know, and the the tables being turned angle of ledge. Oh, look at that. Their own PII gets breached, right? So, the the comeuppance angle of this, you know, and the the tables being turned angle of all of this is what people are focusing on right now. I'm trying to not really get involved in all of that, right? I'm trying to look at things from like, okay, how bad is this? because this app was about gossip and about the social angle of things and you know all this gossipy stuff right people are less likely to take it seriously so for instance I don't even know if like say the army's C is looking into this to identify any general officers wives who were implicated in this uh to find out hey look now you're at risk for espionage so you know be on the lookout kind of thing I don't know if they're doing that I think that you know the internet is you know of course faster than any kind of you counter espionage agency can work of course but I don't know they may just ignore this because well they think that it's about gossip and they think that it's about this you know useless social thing and they don't they don't understand that this man this has some pretty serious national security implications here and I think that this data bre ing and they don't they don't understand that this man this has some pretty serious national security implications here and I think that this data breach is a lot worse than say if just some sort of illicit or you know embarrassing app leak occurred because of the nature of what was going on on this app this app gained notoriety because of what was happening on it so what was happening on this app. Well, it gained notoriety because it was just a pure vindictive cesspool of rottness. And what I mean by that is a lot of times women would create a profile, like a fake bit of information about a guy that they were trying to date themselves, so that they would basically give him a one-star Yelp rating. This dude's horrible. Stay away from this guy. And then they secretly go try to date that guy. So, they would try to poison the well regarding individual people. And in many cases, the guy had no idea that this was going on. So, say you're in a Fortune 500 company and you really want to date your boss and your boss is dating somebody else. And so, you go on this app and you created a fake report about how all this guy's a horrible person. Here's a bunch of lies about him to ward off poten nd so, you go on this app and you created a fake report about how all this guy's a horrible person. Here's a bunch of lies about him to ward off potential people from this person. If you're at a Fortune 500 company and that data gets leaked, well, there you go. You could have people getting fired because of the false rumors that are being perpetrated about them on this particular app. And again, looking at things from the national security angle, you could have things like security clearances being impacted by this because I don't know if anyone knows this or not, but a couple of years ago, the US government, when it comes to social media, requires you to give over your social media accounts when you apply for a security clearance. Do you see the problem here? The reason for this is because the US government, if they're going to give you a security clearance, would really appreciate knowing if you are engaging in behavior or posting content online that is very likely to get you in a situation where you could be blackmailed. People do not like to hear it, but I'll mention it now. This is also why people who were openly gay or people who were transgender were prevented in the past fr not like to hear it, but I'll mention it now. This is also why people who were openly gay or people who were transgender were prevented in the past from getting security clearances because at the time during the height of the cold war the Soviet Union uh went after these people like a moth to flame because uh at the time it was socially unacceptable for people to be of that persuasion. So you know it would it would be damaging if someone you know came out of the closet or something like that and that was a security risk at the time. Now, you know, one can argue about that in modern society. But you see the the kind of general idea here. The US government from a national security angle, if they're going to give you a security clearance, they want to make sure that you're not engaging in behavior that is easil that's going to get you easily blackmailed by a foreign nation state, right? So, social considerations aside, I know that's a very touchy topic, but when it comes to national security, it's pretty clear. So, now you can start seeing how a man can have a security clearance and a social media profile that is not even his, and he's got a social media presence. Well, now that just ng how a man can have a security clearance and a social media profile that is not even his, and he's got a social media presence. Well, now that just got leaked to China and Russia, this is this is just a gigantic mess. And unfortunately, uh there's really probably going to be absolutely zero accountability for any of this. So, uh it really does highlight, especially when we get to what's going on in the UK, it really does highlight the data security concerns, but also the fact that there were 2 million users on this website. At least that's what they reported. I don't know if it was actually 2 million. When I took a look at some of this data, I only looked at 20,000 people. So, this is what the map looks like with 20,000. Can you imagine what 2 million looks like? You know, that's a lot. That's a pretty big number of people. And I just I just feel that because this is this people are going to look at this and they're going to think, "Ah, this is just about a gossip thing. Some kind of internet weird 4chan thing. Not worth not worth looking at." No, I'm telling you, look at it. Like, look into this, you know, and I don't think the agencies are going to do it. There's a lot of threa ooking at." No, I'm telling you, look at it. Like, look into this, you know, and I don't think the agencies are going to do it. There's a lot of threat vectors out there now. And like I wrote in the wire, in two or three days when this whole thing gets forgotten about and everybody kind of moves on and there's some other new horrific thing in the news cycle, people are going to forget about this. But you know who doesn't forget about this? The national intelligence agencies of pretty much every country on Earth who are going to look to exploit this. So just when this exits the news cycle is my bet is when when a lot of this data is going to be exploited and a lot of uh a lot a lot of espionage potential is increased. So sorry for spending so much time talking about this one today. I didn't want to talk about it at all. But when I started looking at it through the lens of national security, I started realizing, oh dear, this is a very big deal. And most importantly, it's worth spending so much time on because it's not just a data breach. It's a data breach that falls right there in that sweet spot where people are not going to care about it. So that's why I think it's worth uh focus h. It's a data breach that falls right there in that sweet spot where people are not going to care about it. So that's why I think it's worth uh focusing on for a while. And I think it's going to be very interesting to see what information comes from the uh data that was leaked, especially when it comes to what people were saying about uh people on the app. For instance, I saw I haven't verified it for myself, but I found uh claims that uh one user was identified as being an HR manager at a very large company and was actually posting uh negative uh social credit reviews about all of the men that she had interviewed uh for particular jobs and exactly why she had fired them or uh not fired them but refused to hire them. So, you know, you see how this is a kind of a big deal uh when it comes to everything from national security to the economy to the workplace. And oh man, it is just a nightmare that I really really really wish uh I didn't have to care about so much. But anyway, let's let's get off of that and let's talk about something equally concerning, which is our friends across the pond. Our friends in the United Kingdom have had a rather rough week because the online safety act qually concerning, which is our friends across the pond. Our friends in the United Kingdom have had a rather rough week because the online safety act uh went into effect a couple of days ago and the average British person discovered exactly what that law was all about when they tried to visit any website in the United Kingdom. So the online safety act was a rather controversial uh piece of legislation that was pushed through uh the British government and essentially it was originally advertised as a way of preventing youth from accessing adult content. It turns out that this law uh also applies to pretty much any website that hosts content. And the impact of this law, which is dripping with irony, is that pretty much every website in the United Kingdom is now required to make users submit a selfie and or a photograph of their stateisssued government identification. So maybe we can see where this is a little bit of a problem here. Of course, most websites have just shut down services to the UK. And of course, VPN companies have made probably in the sums of hundreds of millions of dollars overnight uh just from new users from the UK so that British people can get around their own fir obably in the sums of hundreds of millions of dollars overnight uh just from new users from the UK so that British people can get around their own firewall for their own country. So I guess we're just going to have to see what comes of it. A lot of British people have noted on social media that immediately this law was used to censor footage of protests at migrant centers uh and uh to to make sure that people can't know about protests that are occurring in their own country. So yeah, this is about as dystopian as it possibly gets. But again, it's it's Europe, so I don't really know in the context of how bad censorship already was. I don't know how bad it's going to get because of this. It'll get worse, but how worse? I don't know. We We're just gonna have to see, I guess. But anyway, I wish our friends across the pond good luck uh in working through that one. So, that's pretty much all I have for today. Uh before we roll up with the intercepted ghost net reports, I did want to mention that I am aware of the large-scale war that is rapidly getting underway in uh Cambodia and Thailand. I'm going to have to get some more information on that. I've not built a map yet, and I have not st idly getting underway in uh Cambodia and Thailand. I'm going to have to get some more information on that. I've not built a map yet, and I have not started plotting all of the information on it. However, this has uh become a much larger thing than just a border clash. This is a legitimate war between Cambodia and Thailand. Again, something that not a lot of people tend to care about so much. However, the Thai Navy is now involved. So, this is becoming more of a regional thing and not just a border clash. So, please give me some time to do a little bit more research and uh I'll hopefully on Monday have the ability to get a little bit more fidelity on what's going on there because I'm no expert in South uh Southeast Asia. I have a very primitive knowledge of of the region. So, uh I'm going to have to get up to speed over the weekend here and we'll have to see how the how this goes. But, uh more information to come on that on Monday. But, as far as ghost net reports for this week, it was a good net this week. A lot of people exchanging information. A lot of good uh a lot of good details uh were shared. The Starlink outage occurred shortly before the ghost net uh window. So, I had my r nformation. A lot of good uh a lot of good details uh were shared. The Starlink outage occurred shortly before the ghost net uh window. So, I had my radio up and running and a lot of people were sending messages about the Starlink outage, which is fantastic. I think that's you know one of the main reasons for HF radio so that so that users can get you know news from around the country and exchange information around the country when there's like a in in the case of Starlink a global outage. Uh so that was quite handy a very good use for that sort of thing but yeah it's uh coming along very well. Uh it's working fantastically and uh I hope to have some ways of clarifying things and smoothing out the the Ghostn net guide uh here in just a bit but more to come on that later. So, that's pretty much all I have for today. Here are the sources as usual. Thank you guys all for sticking with me through this rather unfortunate uh news week and hopefully next week we can get some more fidelity on exactly what's going on in places like Southeast Asia as well as uh the latest developments for the Epstein scandal, which I uh forgot to make a slide on. But anyway, uh things keep changing by the m Asia as well as uh the latest developments for the Epstein scandal, which I uh forgot to make a slide on. But anyway, uh things keep changing by the minute with regards to the Epstein scandal in Washington DC. And uh I guess we're just going to have to wait for things to settle down a little bit before we figure out exactly what's going on because things are flip-flopping way too quickly uh for anyone to really make any kind of risk assessment based off of that information. So hopefully by Monday we'll have some more uh fidelity on what's going on and we'll just kind of work it then. So uh thank you guys all for sticking with me. Thank you for all of your support and I will see you next time. And as always, fight in the shade.