Speaker
Chris Formosa
Appearances over time
1 episodes
Episodes
1
Podcasts
Quotes & moments
When Ben Brundage first connected with Lumen engineer Chris Formosa, they chatted for 8 hours straight passing notes back and forth about IP Idea.
KimWolf exploited a bug in IP Idea's residential proxy code to break into home networks and install DDoS malware on consumer devices. It was like an Airbnb guest deciding to squat in the rental and rummage through all the locked closets.
Bored during COVID lockdowns, teenager Benjamin Brundage started modding Minecraft and quickly fell into Discord servers where cybercrime was openly discussed. He saw a stolen list of 100 Spotify accounts and chose to warn the victims instead of joining the hackers.
As a high school senior, Ben found two major security bugs in Dutch government websites during an open bug-bounty program. His reward: a black t-shirt reading 'Hacked the Dutch government, and all I got was this lousy t-shirt.' It was a dopamine rush anyway.
Residential proxy networks let companies rent out your home IP address to route anonymous internet traffic — sometimes without your consent. Pirated streaming apps and cheap 'too good to be true' TV boxes are common vectors for installing the malware that makes this possible.
Ben Brundage installed IP Idea's software on an old Android phone via a pirated streaming app and monitored all traffic coming in and out. Within a week, a mysterious domain appeared: xd.resi.to — the direct link KimWolf was using to break into devices on the network.
In January, Google obtained a US court order to shut down 13 of IP Idea's business domains and dozens of its servers. Two months later, the DOJ struck against four major DDoS botnets including KimWolf, seizing domains and infrastructure — and thanked Ben's startup Synthient in the press release.
When Ben Brundage wanted to keep a KimWolf-connected hacker talking without spooking them, he sent a cat GIF — a tuxedo-wearing cat meant to signal he wasn't taking things too seriously. It worked, and the hacker started sharing operational details about the botnet.
The lasting lesson of KimWolf isn't just about one botnet — it's that the internet is flooded with garbage devices and apps that have become part of criminal infrastructure. Robert McMillan calls it 'internet pollution,' and nobody has figured out how to clean it up.
A DDoS attack floods a target computer with so much junk traffic — fake requests for webpages — that it grinds to a halt. KimWolf weaponized millions of ordinary home devices to do exactly this at an unprecedented scale.
KimWolf quietly hijacked nearly 2 million Android and consumer devices — TV boxes, cameras, picture frames — and turned them into a single, monstrous cyberweapon. Experts feared it could knock out the internet entirely.
The breakthrough in the KimWolf investigation came when a Big Pipes employee discovered that their own IP address was launching attacks. The culprit: a $50 digital picture frame on their home network, secretly turned into a DDoS weapon.
Big Pipes is an elite cybersecurity working group of engineers from major internet companies who quietly defend the internet's infrastructure. When they recruited Ben Brundage for their weekly calls, they got something the wizards lacked: a Discord-native who could talk to hackers using cat memes.
Analysis
What they talk about
- Technology 100%
Connections
Shows they appear on and people they share episodes with. Drag to explore.
