Mandatory Update: A Short Story
Guess what? Lately I've been nerding out on creative writing. I even joined a local fiction writers group where we meet up at coffee shops. Like, in person!
Anyway, I submitted a short story to the DEF CON 34 Creative Writing Short Story Contest. My story is called Mandatory Update. The rules of the contest were pretty simple: It has to be about hacking. It has to mention the DEF CON hacking convention in some way. It has to relate to this year's DEF CON theme, agency (self-determination, making your own choices).
Unfortunately, my story didn't win. But I'm still quite proud of it. This is the first short story I've ever written. Let me know if you like it. I might post more works of fiction here in the future too, so make sure to subscribe.
Without further ado, here is Mandatory Update:
My name is Nyx-Ø Linwood, and I hate it.
Not "Nyx." That part's fine. It's the Ø, the pretentious little circle with a line through it that my father insisted on because he thinks he's a fucking visionary. Good luck pronouncing it. Good luck getting government databases to accept it.
I'm sitting at our kitchen table in our cramped San Francisco apartment. Logs spill across the terminal window on my laptop as I wait for my CPU to churn through the way-too-small keyspace. Any minute now, my Python script will break this homebrewed cipher and reveal the flag.
But I'm only half-focused on the challenge in front of me – it's from some random CTF I found on ctftime. Mom is pacing behind me on the phone, getting increasingly stressed out. "He filed another motion? And the judge is taking him seriously?" she says into the phone, sounding both panicked and exhausted.
My mom, Lyra Linwood, is fighting the same fight she has been since I was born. She was Jared Vane's 19-year-old employee when the then-billionaire (now-trillionaire) who was twice her age got her pregnant (gag). He lost custody after a years-long legal fight, thank fucking god, but it left her dealing with an army of Jared stans trolling her.
Even today, 22 years later, after she's completely sworn off social media, the harassment won't stop. Thanks to SlopstreamAI (Jared's newest company), it's much worse. Her trolls use Slopstream to generate noncon deepfake nudes of her, sharing them widely across the internet just to humiliate her. So she's suing Slopstream and Jared, again. But it's not going well.
"Okay. Okay, bye," Mom hangs up the phone. She looks like she's about to cry.
"He's filed another motion in the case, and apparently he has some other fancy law firm on retainer now," Mom says.
My script finishes, exiting without finding the flag. It didn't work. Everything sucks.
I close my laptop. "I'm so sorry, Mom. I wish there was something I could do."
"Oh no, you don't worry about it. This isn't your fight," she says. "He's got infinite money, so I never really expected to win. You just focus on that big conference you're going to."
I open the HackerTracker app on my phone, scrolling through the DEF CON schedule. I've never been to DEF CON before. I don't know anyone who will be there, and as a woman in a male-dominated field, I probably don't even belong, anyway. I'm just a DevOps engineer. I deploy software and monitor it for downtime. I'm not like, a real hacker or anything. I only started doing this CTF stuff lately for fun.
"Yeah," I tell her. "It should be fun. Maybe it can help me take my mind off things."
Thursday morning. Already 100 degrees out, and that's just the low for the day. Inside the air-conditioned Las Vegas Convention Center, DEF CON is lit.
I wait in the registration line with hundreds of people for about two hours. Colorful beach balls bounce between the crowd. Everyone is loud and boisterous. The WiFi spectrum is flush with obviously malicious open hotspots named things like Legit Open WiFi, Please Connect! and FBI Surveillance Van. People have spiky hair, tattoos, massive beards, LEDs sewn into clothing. There's a contingent of furries in full cosplay!
When I finally get to the front of the line, they hand me a custom circuit board with a battery and an SD card with the device's firmware. This is my conference badge, and apparently it's also some sort of hacker puzzle, and you get a prize if you're the first to solve it?!
Without really knowing where to go, and without any main stage talks starting until tomorrow, I wander the massive halls. It's late morning, but the enormous village room is dark. Electronic music permeates the space.
"Wall of Sheep" is projected onto a wall in the Packet Sniffing Village area. Apparently this shows usernames and passwords of anyone foolish enough to send plaintext network traffic over the DefCon-Open WiFi network. Holy shit, someone already logged into their email over SMTP, without any encryption!
The Crypto & Privacy Village has a neon sign that says "Crypto Means Cryptography." Ha! Hell yeah. Cryptocurrency is a scam.
When I get to the Bug Bounty Village, a woman is telling war stories about hunting for vulnerabilities in software from big tech companies, and getting paid for it. Her hair is bright and colorful, and she's wearing a jacket full of patches.
Damn, she made $10,000 from Airbnb after finding a vuln in their mobile app? I need to look into this bug bounty thing.
"Hey, that was really interesting," I tell her after she finishes presenting. "Um, my name is Nyx."
"Hey Nyx, I'm Jade (she/her). Nice to meet you," she says.
"That Airbnb vulnerability is crazy. Man, I wish I could be a bug bounty hunter. But I could never do that. I'm not even a real hacker. I just do DevOps."
"You just do DevOps?" she says, incredulous. "You mean, you just orchestrate thousands of computers, bending them to your will, with a single command? The prod environment lives or dies based on the quality of your Ansible playbooks? Girl, you have a superpower. So many bros act like they know their shit, but you actually do. You absolutely belong here."
I never thought of DevOps like that. Issuing a command on my laptop to bend an army of servers to my will. Slay.
My father thinks he's some brilliant tech genius, but I know for a fact that he's full of shit. He couldn't write a shell script if you put a gun to his head.
Jade added me to a Signal group with some of her friends called Bug Bounty Besties – all badass hacker women. I made my first friend at DEF CON!
It's not until I wander into the Car Hacking Village, and almost walk into the enormous 10-foot-tall banner with a Volta logo, that I'm snapped back into my shitty reality. Next to the banner is an actual Volta Model Z.
Volta, the biggest and most profitable EV company in the country, and the biggest source of my father's obscene wealth, is taking up half the space of the village. Of course they are. This company's continued popularity – no matter how shit their products are, or how much of a sexist bigot Jared keeps proving himself to be – is why he's a trillionaire. That, and the shockingly corrupt government contracts his companies always seem to get awarded.
Volta is hosting a CTF. They also have info on their bug bounty program. Cautiously, I step up to the Volta table.
"Hey there little lady!" a man behind the table says. "You looking for something? Is your boyfriend playing CTF? CTF stands for 'Capture the Flag,' and it's a hacking contest. But I should mention, it's really technical. It's fine if it's not your thing." He grins.
What an asshole.
"I've played CTF before," I tell him. I'm probably better at it than you. "But no, I'm just looking."
"Sick. Grab a sticker, they're free," he says, looking me up and down, pausing at my breasts. "And hey, if you want me to show you around DEF CON, just let me know," and he hands me a business card. Then he goes back to his laptop.
Ew.
I look down at the card. This is Julian Cross, the Vice President of Engineering Infrastructure at Volta.
"Have you figured out the WiFi yet?" Julian asks another Volta bro behind the table.
"No man, it's annoying. I just connected to DefCon-Open," the other guy says. "It's fine, just use your VPN."
"Bet," Julian says. And a moment later, "Okay sweet, I'm connected."
So far, the Car Hacking Village is by far my least favorite part about DEF CON. And Julian Cross is an asshole. He's a VP? I wouldn't be surprised if he knows my father personally, or if he's just as full of shit about his tech skills as my father is. Hmm...
On a whim, I walk away like I'm leaving the Car Hacking Village, but I angle myself so I can look at Julian's laptop screen. He's got an Alex Jones video on Rumble open in a Chrome tab.
I find an open table a few feet away and pull out my laptop. I switch my WiFi device to monitor mode and open WireShark, capturing traffic on DefCon-Open. I filter the traffic by DNS so I can see the domain names that people are loading. A few DNS queries for subdomains of rumble.com scroll bar. Got you, asshole. I note his local IP address.
But I should mention, it's really technical. I repeat his words in my head as I connect to the open network myself and then run an nmap scan against his laptop.
Two hours later, I capture the biggest flag of my entire fucking life! I popped a shell on his laptop, and now I can browse his filesystem, download his data, and run whatever programs I want. Slay!
The nmap scan showed me that Mister VP of Engineering Infrastructure is running Windows, and he sure has a lot of ports open on his laptop – he must have disabled his Windows Firewall. It turns out, he's running software called XAMPP, which sets up an Apache, PHP and MySQL environment for developers.
I searched up XAMPP, and even installed XAMPP in my own Windows VM to practice exploiting it locally. I found that this software ships a MySQL database server without a root password. Once I realized I could connect to his MySQL database as root, I researched MySQL privilege escalation. This is when I learned I could use SELECT INTO OUTFILE to save files to his filesystem, including files that end in .php. At that point, it was game over. I put a PHP shell in his webroot, connected to his IP address in a browser, and boom: remote code execution.
My heart is pounding. This was exhilarating. I should really close my laptop and get out of here before I get caught.
I glance up at Julian from where I'm sitting and overhear him telling the other Volta bro, "Dude, did you see what Jared posted today? The man is such a troll. Legend." I shake my head in disgust.
Fuck it.
I save a copy of Julian's .ssh folder, his .gnupg folder, and his Chrome browser profile. Then, I delete my PHP web shell, delete the temporary MySQL database I created on his server, and then I get out of here.
I can't believe I hacked that guy. I can't stop thinking about it. The rush!
I bring a whole pizza back to my hotel room at the Wynn and stay there the rest of the day, completely ignoring the DEF CON schedule. I stare at the open document in my text editor. -----BEGIN OPENSSH PRIVATE KEY-----, it begins. What Volta secrets might you unlock, SSH key?
I shouldn't do this. It's illegal. Like, seriously illegal. If I get caught I could go to prison for a long time.
On the other hand, I already hacked Julian Cross and stole his most precious digital keys. I already could go to prison for a long time, and it would be crazy not to at least look at what type of access he has, right?
Also, it's Volta. Fuck them.
I set up a new Linux VM, copy his Chrome profile into place, and open Google Chrome. A copy of his browser, from the point in time I exfiltrated it from his laptop a few hours earlier, appears on my screen. That same Rumble tab with the Alex Jones video is still open.
First, I go to Gmail. Holy shit, that's his inbox. Then I load Github, and I'm logged in as Julian Cross. He's part of Volta's GitHub organization, as expected.
No, wait. He's the owner of Volta's GitHub organization! He has access to every single Volta repository. He has access to everything.
I have access to everything.
I spend the next I-don't-know-how-many-hours deep in exploration. I clone a copy of every single repo – there are hundreds of them – and start exploring the code at random. I know my way around Python and JavaScript, enough to write simple scripts when the need arises, but I wouldn't consider myself a real software developer.
So instead, I focus on the GitHub Actions workflows. This is the automation, how the software gets deployed. This is DevOps: my specialty.
I'm starting to understand it all. These repos are for the mobile apps. Those are for the web apps. These ones are for the vehicles themselves. This is for the infotainment system, this is for the driver assistance, and this one over here is for telemetry, data collection, and... wow, basically just a fuckton of surveillance on everyone who drives a Volta. I'm so glad I don't own a Volta.
I glance at the clock on my laptop screen, laying down more on the hotel bed.
It's 4:07am.
I drift off to sleep, feeling powerful for the first time in my life. My dreams are vivid, exciting, and full of continuous integration pipelines.
I open my eyes, and realize I'm still wearing all my clothes from yesterday, and my laptop is still open on the bed next to me. I drag myself out of bed and pull open the hotel's blackout curtains. Blindingly bright Las Vegas sunlight floods the room.
What time is it? I check my phone. It's almost 11, and there are dozens of new messages in the Bug Bounty Besties group. I flip through the Signal group: coordinating a party last night that I was too deep into code to notice, lots of memes, and links to some interesting talks today.
I'm at DEF CON. There are so many things to do. The talks have already started. There are huge sections of the conference I haven't seen yet. There are like twenty different CTFs to choose from, and tons of other contests too. I could learn how to pick locks, or how to solder circuit boards.
But honestly, there's only one thing I want to do right now. I want to keep hacking Volta.
I want to find some serious vulnerabilities in Volta's infrastructure. Technically, I already did. I'm logged into the VP of Engineering's GitHub account! But I want to find some that I can actually talk about without getting arrested. Maybe I can even submit a bug bounty, and make Jared's fucking company give me some money...
But first, I feel gross.
I brush my teeth and take a shower, and get ready for the first full day of DEF CON. I'm definitely gonna be hacking Volta today, but I'm gonna do it from the conference.
I head down the elevator to the casino level of the Wynn in search of quick breakfast. I find a Starbucks, and go to the back of the line behind about ten other DEF CONers who also just woke up. I skim through HackerTracker to see what's going on today until it's my turn, and I order a breakfast wrap and an iced americano.
By the time I've made it through the sweltering heat from my hotel to the convention center, I've finished eating the breakfast wrap and all the ice in my americano has melted.
I step through the enormous glass doors into the world of DEF CON.
Yesterday felt overwhelming, but it was Thursday, when DEF CON was just winding up. Today, Friday late morning, it's in full swing. Thousands of hackers are swarming around the entrance, and there's a huge banner, 100 feet wide, that's covered in every sticker you could imagine.
I spend the day sitting in a few talks – one about red teaming, another about automotive security – though I'm not really paying attention. My attention is squarely on my laptop, bug hunting my way through Volta's vast archipelago of git repositories. I'm glad I got a privacy screen for my computer!
I do take a break from hacking Volta to check out the Lock Picking Village. I had never touched a set of lock picks before, and was kind of intimated. But a nice group of guys showed me how pin tumbler locks work, using a transparent demo practice lock so you can look inside as you pick it.
I try my hand at a padlock. After about 10 minutes of fumbling around, putting constant pressure on the lever while poking around at each individual pin inside the lock, the padlock pops open! I picked my first lock!
That night, I end up at a party in Jade's hotel suite. She invited everyone in the Bug Bounty Besties group, and there's no way I would be missing that. There are ten or fifteen women in security here. Everyone's listening to music, drinking cocktails. Our laptops are out, they're sharing war stories.
I feel like this is where I belong.
A few hours later, I stumble back into my hotel room, feeling happy, drunk, and more than anything, like I'm the one in control of my life.
Saturday, late morning. I drag myself from my hotel room, through the scorching heat, and back to the convention center, another melted iced americano in hand. This time, I head straight to the Car Hacking Village.
There's an actual demo Volta Model Z there, waiting to get hacked. It's one thing looking at the source code, but it's another thing entirely seeing the binaries run on actual hardware. I've been focusing my Volta research on the infotainment system, and specifically the firmware update mechanisms. That code (which I'm not supposed to have access to) looks especially sloppy to me.
With help from a Volta bro, I was able to dump the firmware from the infotainment system and copy it to my laptop. This is what Volta is doing at DEF CON, after all: hoping hackers find bugs in their cars so they can fix them. Luckily it wasn't Julian Cross that helped me, because he's an asshole and I wouldn't be able to handle casually talking to him while hiding the fact that I completely owned his ass.
"We're hosting a big Volta party tonight at Mandalay Bay," the Volta bro tells me, handing me a flyer. "It's an open bar. You should come!"
I slide into a seat at the back of a main talk room about vulnerabilities in Over-the-Air update mechanisms for Internet-of-Things devices, just because it seems vaguely relevant to my current hacking-Volta obsession. My attention is split maybe 10% the talk, 90% the Volta infotainment firmware.
In my editor, I'm looking at the infotainment system's source code. In my terminal, I've extracted the firmware image into a little filesystem. I'm digging through the code, looking for the update mechanism.
Okay, this is the check-for-updates function. Here's where it downloads the new firmware image from an S3 bucket. Hmm, yes, and looking at the GitHub Actions, here's where it builds the firmware image to push to that bucket.
After downloading a firmware update, the update function extracts it and then verifies its digital signature. But wait, why does it extract it first, before verifying? And, what's this? It only verifies the signature if the version number has changed? If the version stays the same, it skips the signature verification?!
Holy shit. This is a legit vulnerability. A serious one. If someone can trick a Volta into downloading a malicious update to the infotainment system, all they have to do is keep the version number the same, and they can bypass verifying the signature.
I pull up Volta's bug bounty website and scroll down to the payout guide. Under Vehicle Targets, critical vulnerabilities pay out from $50,000 to $100,000.
$100,000 from Volta. Oh my fucking god. This will go so far in paying off my mom's legal bills!
"I think I just found a critical vuln in Volta's update mechanism," I text Jade. "The max payout is $100k!!!"
"Queen!" she texts back.
This is it. This is how I can finally help my mom.
And, on top of it all, I can embarrass the hell out of Volta. I can embarrass Jared too, give him a taste of his own medicine.
I'm riding high.
I meet up with some of the Besties for afternoon drinks and some lunch in a bar off the strip. This place is fancy. Everyone is having a great time.
Over beers, I explain to Jade exactly how the Volta infotainment firmware update verification bypass works. I stay vague about how I reverse engineered the firmware to confirm it works the way I think it does... because I didn't reverse engineer it. I just read the source code, but I don't want to let her in on that fact. I'm not supposed to have access to the source code.
"Oh my god, what an asshole," one of the women in our group says, looking down at her phone. "Look at this shit. Jared Vane is going psycho on his baby mama, Lyra Linwood, the one who's suing him over the deepfake nudes."
My world freezes.
"Is everything okay?" Jade asks me.
I didn't realize it, but I'm shaking and starting to cry. I tell her I'm fine, but I have to go, and I leave the bar.
On the way back to my hotel, I read Jared's social media rant. He just started his posts 30 minutes ago, but the view are already ticking up into the millions. He's calling Mom mentally ill. He's posting screenshots of her text messages that he obtained through the lawsuit's discovery process – he's not allowed to do that! That's illegal!
I scroll through the comments, and thousands of accounts are egging him on, lending support and encouragement to his misogynist screed. And there's more deepfakes. People are generating them, of my mom, in real-time.
I call Mom. "Hi Nyx," Mom says when she answers, and I can tell that she's trying to keep the crying out of her voice.
"I'm so sorry he's doing this to you, Mom," I say, and I'm crying too. "I'm gonna help you. I promise. I'm gonna help you."
Back in my hotel room, I wash my face.
I know I shouldn't, but I can't help doomscrolling the harassment.
If I submit this Volta bug bounty, and they actually pay out $100,000, and I give it all to Mom's legal bills, what will that actually change, anyway? Nothing.
Volta's market cap is $1.5 trillion. Jared's net worth is close to that too. The last estimates I saw, Jared was dumping $30 million into the lawsuit with Mom. $100,000 is a drop in the bucket, a rounding error.
And he's out there violating court orders! Tweeting screenshots from discovery! He doesn't give a shit, but neither do the courts. He might get fined, but it won't make a difference.
The law can't stop him. Money can't stop him.
You know who can stop him? Me.
Fuck the bug bounty. I'm going to burn Volta to the ground.
I spend the next several hours writing malware.
In the end, the payload is incredibly simple. One git commit. I add two lines of code. One deletes important files, which will basically brick the car. The other returns from the initialization function early, preventing the boot process from finishing. I also replace the PNG of Volta's logo that gets displayed when the infotainment systems boots with a new image of my choosing.
The tricky part is making sure everything is perfect so that the CI/CD pipeline triggers a new release build, uploads it to the S3 bucket, and pushes it out to every Volta on Earth. All nine million of them. I only get one chance at this, so I have to make sure I do it right.
I carefully explore the branch protection rules for the relevant GitHub repos, and I painstakingly read every single GitHub Actions check required to deploy the release. I have a plan:
- I'll make a new git branch for my malicious commit – using the name Julian Cross on the commit, of course.
- I'll create a new git tag, which will trigger GitHub Actions to build the release.
- I'll push the branch to GitHub, create a pull request, and use Julian's owner privileges to bypass the required checks, merging the pull request while skipping the review process.
Once I start, I need to finish this very quickly. As soon as I push a commit to GitHub as Julian Cross, someone might notice and cut off my access.
But there's a serious problem. Volta's release automation has an extra security check. It builds and deploys a release when a git tag is created, but only if it can verify that the tag has a valid PGP signature.
When I hacked Julian's laptop, I stole his .gnupg folder, which should contain his PGP secret key, which should let me make a signed git tag. But when I inspect it, I see that it actually only has a stub for his key. His actual secret key is on a smart card. Probably on a Yubikey, a little USB device that he's probably carrying with him right now.
I look at the time. It's 11:35pm.
I pull out the flyer I got at the Car Hacking Village this morning. "Party with Volta! Eyecandy Bar & Lounge, Mandalay Bay. Saturday at 11pm. Bring your DEF CON Badge. Open bar."
I close my laptop and shove it into my backpack. I have a party to attend.
The music in the venue is so loud I can't hear myself think. It's packed with people. Most of them men, most wearing cargo shorts, most looking awkward, and most extremely drunk.
I push my way through the crowd toward the bar near the DJ. While I wait in line, I scan the crowd, looking for Julian Cross. There must be at least 300 people here, probably more. How am I gonna find him?
I order a Moscow Mule. When the bartender hands me the drink, I start systematically circling the room, sipping my cocktail, looking for Julian.
It takes over half an hour of searching – it's 1am at this point – before I finally see him. He's extremely drunk, standing with a group of dudes, talking to a girl.
"How you liking your first DEF CON?" he asks the girl, his voice a little slurred. He's standing uncomfortably close to her.
I look him over and don't immediately see any keys on his belt. But he has one hand a jacket that's laying over the side of a couch, his other hand holding a beer. I bet this is his jacket.
Without thinking it through, I finish off my Moscow Mule in one big sip, and smash my body into his arm, knocking his beer to the ground.
"Oh my god, I'm so sorry!" I say quickly. "I can be pretty clumsy when I'm drunk. Hey, let me get you another beer!"
While he's looking down at the beer that's now soaking his clothes, I grab his jacket and speed off towards the bar. "Uh, sure," he calls after me.
While waiting in line at the bar, my heart pounding, I search his jacket pockets. There it is, a keyring. With a Yubikey on it. I remove the Yubikey and pocket it, putting the rest of the keys back where they were. I order two beers at the bar.
I toss Julian's jacket back on the couch right before he sees me, and then I hand him the beer. "Sorry again about that," I say. "Hey, cheers!" and we clink glasses.
"Eh, it's fine. Hey, you're that chick from yesterday!" he says, recognizing me. "Your boyfriend was gonna play CTF or something, right?"
"Yup, that's me," I say. "CTF is definitely way to technical for me." I giggle, trying not to gag. "Ok well have a good evening!" I say, and hurry off to the opposite side of the bar.
I take a sip of my beer, and then pull the Yubikey out of my pocket, cupping it in my hand, and look down at it. Holy fucking shit, I can't believe that worked.
Well, it's now it or never.
I find a corner of the club that's already occupied by a few hackers nerding out on their laptops. I squeeze into the one empty seat, place my beer on the low table in front of me, and pull out my own laptop.
I plug in Yubikey. I type the command to create the signed git tag, take a deep breath, and press enter. A dialog appears saying, "Please enter your PIN (3 tries remaining):"
Fuck. Of course, his Yubikey is protected by a PIN. And if I guess wrong three times, it permanently locks. What am I gonna do?
Think, Nyx. I glance across the party and spot Julian, now typing on his phone. People re-use PINs all the time. Maybe Julian's Yubikey PIN is the same as the passcode he uses to unlock his phone. I need to watch him unlock his phone. With any luck, he'll use a passcode instead of biometrics, and with even more luck, he'll be the kind of guy that reuses passwords.
I spend the next 10 minutes preparing a really simple plan. This probably won't work, but it's the only idea I have.
First, I install signal-cli, a little command line tool that lets you register a Signal account on a computer. Then, I search for "throwaway SMS" and pick one of the several services that lets you receive SMS messages on random public phone numbers. I register one of them with Signal, and wait for the verification text to appear on the temporary SMS website.
Finally, I type a signal-cli command to send Julian a text message, pulling out the business card he gave me earlier to find his phone number. I type the message: "Yo Julian, you still at the party? We're heading to the after-party at the Flamingo"
But I don't press enter just yet.
My open laptop in hand, I shove my way through the crowd until I'm standing right behind Julian. He's holding his phone in his hand, but not looking at it. I pull out my phone, open the camera app, and start recording a video, and then I press enter.
Julian's phone buzzes, and he glances down at it. He puts his phone to his face, sees there's a notification, and types in a passcode. Is that really his passcode? He starts typing a response.
It took me rewatching the video a few times to be sure, and yup, he passcode is 2-4-6-8-1-0.
I walk a few feet away until I find a table I can put my laptop down. Without waiting, I run the command to create a signed git tag again. "Please enter your PIN (3 tries remaining):"
I type 246810, press enter, and the command completes successfully.
I push my commit to GitHub.
It's Sunday morning, and everyone is talking about the Volta hack.
Not just the DEF CON crowd. I mean everyone. The bellhop at my hotel. Random tourists on the street. And yes, the DEF CON hackers too.
Every single Volta in the world, all nine millions of them, are bricked. Volta doesn't have a plan for fixing them yet. It's looking like the only way to get the cars working again is to physically tow each one to a Volta dealership.
There's a flood of messages in my Bug Bounty Besties group about it, but I just stay silent. People are talking about it in other Signal groups I'm part of too. It's on the front page of Reddit. It's at the top of Google News.
I walk into the Car Hacking Village, and hundreds of people are clustered around the Volta Model Z. I elbow my way to the front and lean in so I can see the display.
When the infotainment system boots, it normally shows a Volta for a second, and then continues the boot process. Now, though, it just shows the image that I chose, and it aborts the boot process, leaving the car broken.
The image is a screenshot of an email:
From: Jared Vane
To: Jeffrey Epstein
Date: December 25Do you have any parties planned? I've been working to the edge of sanity this year and so, once my kid heads home after Christmas, I really want to hit the party scene in St Barts or elsewhere and let loose. The invitation is much appreciated, but a peaceful island experience is the opposite of what I'm looking for.
This email is from the Epstein files. I remember this Christmas. He had only spent a few hours with me, but apparently being forced that much time with his daughter was just too much for him to handle. So, he emailed the world's most notorious child sex trafficker Jeffrey Epstein asking if he has any wild parties planned.
My phone buzzes. It's a Signal message from Jade: "Daaaamn, girl"
I take a deep breath. It's done.
"DEF CON was so much fun!" I tell Mom. "I met a bunch of awesome women. And I learned so much. Did I tell you I learned how to pick a lock?"
I'm sitting at our kitchen table, flipping through the latest headlines on my phone.
"Volta stock crash shocks the markets."
"FTC opens investigation into Volta after class-action lawsuit filed."
"Volta board fires visionary founder Jared Vane."
"Jared Vane, former trillionaire, wealth cut in half."
Mom isn't paying attention. She's engrossed in the legal documents that she's been skimming on her iPad. This morning – a week after DEF CON – she's looking more relaxed than I've seen her in years.
"Hey, what's the news with the lawsuit?" I ask her.
"I can't believe it, honey. Jared is offering a settlement. And it's like, a good settlement. He's dropping everything. He's giving up," she says.
I smile. "That's wonderful, Mom. I'm so happy for you. I hope this is the last time you have to deal with him."
"Me too," she says.
I open my laptop and get to work. I've got a spreadsheet full of oligarchs, mapping them to their corporations, sorted by which ones are propping up their wealth the most.
"What are you working on?" she asks.
"Oh, I'm just doing some research," I say.
There are still a lot of billionaires. I've got a lot of work to do.
AUTHOR'S NOTE: To give credit where credit is due, the email from Jared Vane to Jeffrey Epstein is an actual real email written by Elon Musk and sent to Epstein on Christmas Day. See the original at https://www.justice.gov/epstein/files/DataSet%2011/EFTA02706510.pdf. And while Lyra and Nyx Linwood are made up characters, they're based on kernels of truth: One of Elon's baby mamas, Ashley St. Claire, sued xAI for generating nonconsensual deepfake nudes of her and posting them all over X. Several of Elon's children from another baby mama, Grimes, have unpronouncable unicode symbols in their names. Another baby mama, Shivon Zilis, worked for Elon at both Tesla and Neuralink. Elon's adult child (from yet another woman), Vivian Wilson, called her dad "a pathetic man-child" because he's a bigoted asshole, and she's a trans woman.