Skeptics Stack Exchange is a question and answer site for scientific skepticism. It only takes a minute to sign up.
Sign up to join this community
There is a man who calls himself Max the Hacker. He appears in many Dutch videos filmed in the Netherlands, such as this one in which he shows himself purporting to manipulate news readers' autocues on live television, and to change the speed limits on road signs.
It looks fake to me. If one could do that, the world we live in would be chaotic.
Did Max the Hacker really perform these hacks?
As is evidenced by the comments and current lack of answers over on this similar question, videos like this are inherently hard to debunk because, while they may have been faked, the acts they portray are theoretically possible.
First, it is perhaps most important to point out that this appears to be a viral marketing campaign for an IT training company in the Netherlands. User RedGrittyBrick pointed out in the other thread that an "online video marketing guide" explains that "One of the most popular ways for brands to reach huge audiences with online video is to create a clip that begs the question, 'Was that real or fake?'" In other words, these type of videos are most effective at advertising, and are routinely faked. Edit: Months after I initially wrote this answer, the company that produced the video released a statement admitting that it was a hoax. SQB reports on that in another answer.
Secondly, it is important to note that there is no evidence that Max the Hacker has ever gotten in legal trouble for his antics. Surely at least one of these hacks must have broken at least one law in the Netherlands, and publicizing it to a series of YouTube videos with collectively millions of views would surely have gotten the attention of the authorities. Yet, there have been no news reports of his arrest.
Thirdly, Max the Hacker is completely unknown to the security community. I was unable to find a single paper or conference talk attributed to the guy. Look at how much press and, more importantly, funding people like Charlie Miller have garnered from their car hacking research. If Max the Hacker were really technically savvy enough to remotely control a Porsche, he would almost certainly be aware of the economic incentives to provide that research back to the community and/or contract with car manufacturers as opposed to risking arrest by commandeering a car "for the lulz."
Specific to the videos, there are no direct trains from any station in The Netherlands to Alicante. Even if there was, the arrival boards at the stations are not digital; they are mechanical flip-boards:
So the only explanation is that either Max physically opened the board and manually added a new tag for Alicante, which is highly unlikely, or that part of the video was edited in post-processing. Edit: Hugo Zink claims in the comments that since at least 2010 the arrival boards in The Netherlands have been digital. I haven't ridden a train there since before 2010, so I cannot confirm. Even if that's true, though, it only supports the fact that these videos were a hoax, because the first video clearly depicts the flip-style boards at 6 minutes 14 seconds in.
The Porsche that Max remotely controls appears to either be a 996 or 997 Cabriolet. While remotely controlling a car is theoretically possible (see Charlie Miller's research linked above, and more recent work on the Tesla Model S), there always needs to be some mechanism for the remote controller to actuate the brakes and turn the steering wheel. This is possible in cars like a Prius or Tesla that have lane-keeping assistance (that overrides the steering input) or emergency braking assistance (that automatically applies the brakes if the car senses an imminent crash). Neither the 996 nor the 997 had any of these features. Therefore, at a minimum, Max would have had to physically break into the vehicle and attach remote-controllable manual actuators to operate the steering and brakes. Possible, but highly unlikely if the goal of the video was simply to impress his friends and the YouTube viewers.
There is a relevant thread with some anecdotal evidence on this security forum. The consensus is that, while the hacks themselves are theoretically possible, the videos themselves are fakes; as a professional security researcher myself, I concur. There are also some claims of evidence that Max is a part-time actor, however, I was unable to find hard evidence to support those claims.
Edit: There was a specific request for an explanation of the plausibility of the cell phone text message hack. There was a talk at last year's DEFCON conference that demonstrated a well-known technology to do that: Femtocell man-in-the-middle (MITM) attacks. The idea is that you can set up a small mini-cell tower (which are cheaply available as commercial off-the-shelf consumer items these days) and hack it to force all cell phones within its range to associate with it instead of the real cell provider's cell towers. Then you can send fake voice calls, text messages, etc., to all of the cell phones connected to it. You can even alter the data that is being sent from the "real" cell-tower, on the fly. For example, it has been demonstrated that you can alter the contents of a web page loaded on a smartphone. The trouble with Max's video is that, in order to get every phone in the room to receive the text message (which is what was depicted in the video), he would have needed a separate hacked femtocell transmitter for each phone carrier company used in the room. This is possible, but it would have required a lot of labor to set up, as each phone carrier potentially has a different encoding of text messages in their network.
As told by the company that produced the "documentary":
To prove that IT can be fun, we gave birth to a hacker
IT company Info Support was having a hard time recruiting new talents because of the industry's reputation of being very, very boring. Their initial request was a corporate video arguing that working at Info Support is not boring at all. We believed a corporate video wouldn't do the trick and we asked - no, begged - them to give us the freedom to develop a ballsy online video campaign. We are still thankful they let us do it.
We gave birth to Max the Hacker, a guy who is technically so advanced he's able to hack almost anything. He doesn’t misuse his technical skills; he is just having some fun… Max hacks electronic highway message boards, the database of NS (the Dutch Railway company) and the teleprompter of popular Dutch channel RTL4.
And then the craziness started. Within a few weeks, Max' films were viewed by millions of people, channels wanted to meet him and blogs in over 15 countries were reporting on his extraordinary hacking skills. We used our creativity to make everyone believe that what he did was real, and millions of people bought it! Our client became the market leader by restoring the industry's reputation and received dozens of job applications. The series of virals got 31 million views and is one of the most watched Dutch Youtube series ever.
(Emphasis mine).
Anecdotally, I've seen them on a Dutch talkshow, probably RTL Late Night, showing how they did it (image manipulation, actors, a hidden driver in the Porsche, a helpful station announcer), but I can't find a link to it.
