You're listening to the awareness angle the podcast
gives you the weekly cyber news with a human twist.
This week, attackers pick up the phone instead of writing code,
fake QR stickers hit real parking metres, and even your
weather app might be quietly fingerprinting you.
All of that and a whole bunch more on this week's show.
With me, as always, is my partner in cybercrime
prevention. I'm sticking with that.
I still like it. It's Luke Pettigrew.
How you doing, Luke? Yeah, I'm yeah, doing well.
How are you? Good, I'm good.
How's your week been? Not too bad, Jeff.
How are you? Yeah, not too bad.
I'm I'm halfway through refurb in the studio.
So it's, it's looking lovely. You can't really see much of it
at the moment, but it's though once it's done there'll be more
content made in here so it'll look, it'll look and sound
better. We're getting there.
Yes, right.
We've mixing things up a little bit.
We're on a continuous improvement programme, so this
week might sound a little bit different to last week, but not
very much. So no breach watch this week?
We've got a breach of the week. Do you like it?
Yeah, that's good. Let's go for.
It OK, so adtech firm Optimisee confirms data breach after a
fishing attack fishing. Let's add that to the if you're
playing ishing bingo, there's fishing.
So Optimisee is notified an undisclosed number of customers
of a data breach because threat actors compromise some of their
systems in a voice phishing attack.
The intruders accessed internal business systems and CRM
records, stealing basic Business Contact information, but
reportedly failed to escalate privileges or access sensitive
customer data. So all the signs point to this
looking very much like shiny hunters who have targeted large
organisations, obviously by impersonating IT support and
tricking stuff into handing over single sign on and MFA
credentials. So Optimisely, do we know much
about Optimisely? I've not heard of them.
Nearly 1500 employees across 21 global offices, Their customer
list includes over 10,000 businesses including names like
H&M, PayPal, Zoom, Toyota, Vodafone, Shell, Salesforce and
Nike, according to the article in Bleeping Computer Optimise.
He told Bleeping Computer that they stole basic Business
Contact information, it was a sophisticated voice phishing
attack and they were unable to escalate privileges, install
software or create any backdoors in the optimising environment.
And we have no evidence that the threat actor was able to access
sensitive customer data or personal information.
So very confident statement, very they want.
To. Unable to escalate privileges,
install software or create any backdoors.
That's like, that's a certainty. I I admire their confidence.
So yeah. So yes, that's the breach of the
week. Optimisely.
If that's the name that your organisation uses, you might
want to reach out to them and find out if you're impacted at
all. Should we get on with the news?
Yeah. Let's go for it.
Excellent. OK.
Do you want to go? First you can go first.
OK, we should, we should we normally talk about this?
We don't always, right? So Royal Canadian Mounted
Police, the RCMPI love that they're still called the Royal
Canadian Mounted Police and you can't picture them without
picturing the programme due South with the guy on the horse
with the massive, massive hat. And I don't know if that's still
what they look like. So the RCMP are investigating
after fraudulent QR codes found on 75 Kelowna parking metres.
Now this might sound like, you know, where is Kelowna?
How does this impact me? This story is a great example of
localised cyber security issues. Police are investigating because
fake QR code stickers were placed on 75 parking metres,
redirecting drivers to a phishing website disguised as
the official parking payment service.
Pay by phone, paid by phone I think is 1 we have over here in
the UK as well. City staff spotted the scam
quickly and removed the stickers within hours.
With no confirmed victims so far, the incident highlights a
growing trend in physical world phishing.
Of course, like we've talked about this loads of times,
haven't we, Where QR codes, they bounced into life during COVID a
long time. For a long time we didn't want
to use them, and then we kind of used them because they were
convenient. But QR codes, man, it's scary.
Yeah, they do get used to a lot. You still see them, but yeah,
they're not hugely common for for sort of crime.
I love them. You see them?
Yeah. Lot on parking metres
potentially. Not for public, they have public
places, but yeah. Do you know it wasn't that long
ago I saw someone that had AQR code reader app on their phone
that was littered littered with adverts and stuff.
So a little public service announcement for anyone
listening that might not be aware.
You don't need a separate app now on Android or iPhone to scan
AQR code. You just open up the camera app
and put it on photo and look it, point it at the QR code and then
it will tell you where that QR code goes.
When we spoke ages ago, always verify where it's going.
We spoke ages ago about I was on a train and the URL didn't quite
match. Like it was really good because
the QR code on the back of the seat said, you know, this is
where this will take you. But the TLD, the extension right
at the end was different when you actually went to scan it and
it was like, oh, that's it. Like it's good but close but not
right. Do you know what I mean?
So yeah, always use the native camera app on your phone, scan
that QR code and then check on the little button before you
press to go to the link that it takes you somewhere where you
would expect to go. Check for spelling errors, check
it matches. Wherever that QR code will be,
will be a web address. You can go manually, type it in
manually would be the preference.
But people like the convenience of AQR code and you can't blame
them, can you? No, they are handy, yeah.
So yeah, 75 on parking metres in Kelowna.
Similar scam was recently discovered in Whistler.
And last August police in Penticton warned the public
about the same scheme. It's not just Canada, this thing
happens everywhere here in the UK, everywhere.
It's a common scam. Yeah, I see it a lot in the news
every now and then, don't you? Yeah, probably trying to avoid
scatting them, right? There's probably other ways to
pay like directly for the app or or a friend number, but even
then the phone number could be fake as well so just got to be
careful. If you see AQR code like if AQR
code is printed on a metal sign then I would probably trust it.
The problem is if that QR code ever changes at any point and
the council have just gone round the slapped a sticker on it
because the service has changed. So a sticker over AQR code
should be a red flag. And then you should proceed with
caution because anyone can print a sticker with AQR code on and
slap it on some. You showed one a couple of weeks
ago where a guy did it on the plane and put AQR code up that
gave people free Wi-Fi on the plane, which was brilliant.
And then when someone went to it, it showed a picture of an
orangutan given the middle finger.
It's that's, that's an example. Trust, trust QR codes with
caution, right? Move on to the next one, Sir.
OK so this one is your Samsung web app is a fingerprint.
This looks like a sub security researcher or some kind called
the tradies for Intel. So it's a blog post.
It goes into a lot of detail on how this works.
Essentially it's they found the pre installed web app on Samsung
devices may and essentially create a persistent tracking
fingerprint. So according to what they've
sort of via researched is that the app sends reoccurring
requests to however API operated by the weather company and that
contains A hashed location identifier which is marked as
place ID and that's tied to save cities.
So it says here that each hash represents a location and
obviously a combination of save locations becomes unique and
could potentially identify a user across sessions and IP
changes in different networks. And this is something you can't
turn off, apparently. Let's look at this separate to
the location permission on on the.
So this could be like you saved your home, your work location,
your family's locations to your to your phone identifies if it
means inside the web app potentially that is what it
means. I mean, basically we wouldn't do
that, but essentially a sort of default system app that is
transmitting a somewhat of a unique identifier in the
background. It's a bit a bit concerning
potentially, but I really don't know how many people would use
simplifications for for weather, but.
Well, yeah, it's funny. If I open up, I'm not a Samsung
user, I haven't been for years. But if I open up the weather app
on my on my phone, I mean, yeah, I've got, and it's whether or
not it is my saved locations, like I've got the town I live,
the town where my kid goes to school, which is quite a way
away. And then three places, three
cities that I've been to in the last kind of six months.
So there is an idea of where I've been.
But if it's actually weather, apps track your location
constantly because if you open it and you can turn that
permission off, Definitely on iPhone you can, but this isn't.
I suppose Samsung's Weather app is just an example of what other
apps could potentially do when an app asks for access to your
location. Yeah, well.
My car app, my SAT NAV app, any some really random eBay asks for
access to your location. Just eat.
You know your food delivery app will ask for access to your
location. It's.
Yeah, yeah. I mean, yeah, listen,
misunderstanding it, this is that, yeah.
So yeah, the weather apps preinstalled and active with
default, the periodic API occurs without user interaction.
And yeah, it doesn't seem to say if you can turn it off, but I
don't think you can on this in this example anyway.
But yeah, a little bit concerning perhaps, Yeah.
So apparently I don't know if you can disable the app.
If that's I think it is a thing maybe on Android where you can
disable pre installed apps, but then you obviously lose the
Samsung web app other web. Apps are available.
Yeah, I don't know if. Any are better, you know, BBC,
you know, Meteo, Met Office, they're three that come to mind
like that and there's lots out there I think.
And the most kind of thing is, even if you turn off your GPS or
use AVPN, it can still identify your device.
Yeah, I think this isn't like this isn't a security incident
in itself that this kind of highlights the potential data
collecting activities that apps like this do that would make
apps like this a potential target for cyber criminals.
Because, you know, in in some ways this comes out.
I could now target that data or try and find a way to access
that data if I wanted to find out someone's location, for
example, you know, it's going to the weather, Was it the weather
company? Yeah.
It's interesting details of
that. If you if if that's tickled your
pickle and you want to find out more about that specific thing,
we'll put a link to it in the newsletter and the newsletter's
available at riskycreative.com or search for the Awareness
Angle newsletter on LinkedIn. It comes out every Monday
alongside every episode and contains links to all of the
stories that we talk about and sometimes a little bit more as
well. So we'll put a link to that and
Bochodi's threat Intel on the newsletter, Right?
Shall we move on to the next one?
UK has fined Reddit $19 million for using children's data
unlawfully. So the UK's ICO The Information
Commissioner's Office has fined Reddit £14.47 million for
unlawfully collecting and processing data belonging to
children under 13. Regulators found that the
platform lacked effective age verification controls until mid
2025, which allowed underage users to access the service and
have their data processed without valid consent or
safeguards. Reddit are planning to appeal
and arguing that stricter verification could cause
conflict with user privacy. Interesting.
My kids have asked for Reddit before and I'm an active.
I'm a very active Reddit user. I doom scroll Reddit all the
time. As you probably know from the
topics section on this podcast. But I would not really like my
kids to be on Reddit under the age of 13 and probably not over
the age of 13 as well. So yeah, we've talked about age
verification a lot on here. And I think it's really
important. I know when the Online Safety
Act here in the UK launched Reddit, all of there, we've
talked about it. Reddit locked down not just the
not safe for work content, but mental health channels and stuff
like that. Anything that touched on a topic
that was largely mature like suicide or self harm or stuff
like that. So yeah, it's, it was, but it
was wide open before then, properly wide open.
And it's so easy to create an account without any
authentication or it was then anyway.
I think it's probably harder now.
This is, This is why it's important, isn't it, that you
know who's using your service? The privacy angle I kind of get
like, oh, use a privacy, but I I'm happy to not.
I'm happy for the platform to know who I am as long as it
keeps that data safe or verifies it.
Again, we spoke about this just last week or the week before.
Verification on the device, confirm who I am and confirm my
identity. It's going to come, isn't it?
In a future, if it's not there already, a future version of
Android and iOS will contain a thing where it's like we can
confirm at a device level that this person is this old, this
old, this person is a certain age.
And then that's going to be a security feature that comes in a
version of iOS and Android very, very soon, I would imagine.
Yeah, I think so, especially since we've seen how poor the
third party versions have been. Was it a couple weeks ago the
Discord breach of all the all the IDs and stuff?
Yeah. Driver's licences and passports
and all that kind of stuff. Although it.
Wasn't was. I can't remember if it was
discord or a third party but yeah.
It was the third party that Discord we're using for the
service I think. I mean the ICO only in February,
so this month we're still in February or or at the time of
recording we're still in. I've just realised today's the
last day of February. So unless it's a leap year, is
it a leap year this year? Oh, I don't know.
No, it's. Not tomorrow is the first.
We're recording this on Saturday.
Tomorrow is the first. On the 5th of February there was
a similar penalty issued against Media Lab, which is the owner of
Image Sharing platform Imager. So they will also find a very
small amount in comparison. 247,590 lbs for failing to use
children's personal information lawfully.
Yes, that's essentially what you age verification.
It's really important. And if you're a parent, and
we'll get to more on this in a second, but if you're a parent,
be careful where your kids are patrolling the Internet because
Reddit's not a great place. It's a bit of a cesspit with
some very dark corners. There's a lot of snake pits on
Reddit. It's very easy to venture into
the wrong place. Yeah, right.
Move on to the next one. OK.
And. That's what we've got.
There's a blipping computer article Android mental health
apps with 14.7 million installs of the security flaws served in
a system research by Over Secured.
They're a mobile security company.
And so, yeah, millions of downloads on Google Play for
various mental health mobile apps contains security
vulnerabilities that could expose users sensitive medical
information. They've researched more than 85
medium and high severity vulnerabilities, some of these
AI companions as well. So they're designed for people
to talk to and communicate with. And yeah, they've got like a big
list of different app types and how many installs that apps had,
how many vulnerabilities it had. And they found over 1500 in
total that various sort of degrees of severity.
But basically it says here that most of these issues can then
intercept login credentials, spoof notifications, inject
HTML, locate the user. Quite worrying.
Yeah, Yeah, there's a whole bunch of information here.
I don't know if it says if any of them have sort of been taken
down or updated, but all the details I'm sure we can put in
the newsletter. But yeah, it's not surprising I
guess that all these different apps probably been coded by
someone small and bunch of AI features and stuff.
My initial thought on this was that it was terrible, right?
And that it's, you know, these people have rushed an app out
and it would be really easy to really quickly blame the
developers that have developed these apps.
But then you've just touched on that there.
It's quite possible that these apps have been developed by a
single person who's vibe coded something using AI or has
created an app using AI and it's gone.
Oh, this is really good. And so they're completely
genuine and honest in their intentions.
But because the way AI works and because of the availability of
unchecked and unmanaged AI tooling, there's vulnerabilities
in these. And I'm, I'm guessing the
oversecured, the oversecured scanner is probably a tool that
they're trying that's probably like.
See all these vulnerabilities? Well, now you can subscribe to
the Oversub, you know, that kind of thing, automated mobile app
security. So yeah, they're probably trying
to flog more of their platform. You go to their website and it
says scan your app. So that's, that's a given.
But the fact is that the availability of the tooling now
and it is, you can't blame the tools, you can't necessarily
blame the developers for all of these.
But you look at the names of some of these apps like AI
therapy, chat bot, AI, emotional health platform, health and
symptom tracker, depression management tool, CBT based
anxiety app. There's there's not a lot of
branding or brand identity gone into them, is there?
Especially when you think of some of the more well known apps
like Better Help, you know the the ones that you see
consistently advertised, which I'm assuming have better
security controls in place. Yeah, it doesn't seem to say
much on there's no like links or anything to further information,
but I guess it's all hidden behind their research.
There might be a better link for it maybe.
I was to say that the computer have refrained from sharing the
names of the impacted apps as the vulnerabilities are still
being disclosed by over secured. So I think those app types that
you this column is app. Type, Yeah, sorry, this column
is app type. But if I go to, if I go to,
yeah, I'm sure, yeah. There's probably loads, isn't
there? There's one here, mood and habit
tracker journal that's had all right 5000 downloads.
It's developed by core apps creation that have got a load of
basic apps and it was last updated on the 16th of July last
year. So it hasn't been updated for
seven or eight months? Yeah, it's.
Probably one of those things, isn't it?
Be careful what you're installing from these app
stores, even if they're genuinely installed.
It's just like browser extensions, right?
The other. Thing you can't do as well, if
you look at this on Bleeping Computer, that top app that it
highlights had over 10 million installs.
The next two have got over 1,000,000 installs.
So you kind of that herd mentality lead you to go like 10
million people have downloaded this.
It must be good. You know, you kind of follow the
herd. Oh, a million people have
downloaded that. It's got to be decent.
You know, there can't be anything wrong with it because
otherwise a million people wouldn't have downloaded it.
And it's like, actually. So yeah, it's really tricky.
Yeah, be careful. Who you trust, I suppose, is the
is the question. Headspace has got over 10
million downloads. They're a big name in this
space. I just want to say any of the
names that I'm mentioning, I I'm not saying that they're at
fault. The 2 apps, Headspace.
Here's a good example though. Headspace's app was last updated
9 days ago. So it's actively developed,
actively in support, and actively being maintained.
An app that was last updated nine months, 8 months ago is
probably not something you wanted.
So that would be check how many downloads, check the reviews,
check the permissions, and check the last time the app was
updated, which it tells you on both the Play Store and the App
Store. That's probably not something we
often say a lot. Mind health, CBT, mental health
last updated 2 days ago. 4.7 stars out of five.
So check the reviews, check the last time the app was updated
because that's a good tell. Yeah, definitely right.
OK, the next one, Instagram is to alert parents if teens search
for self harm or suicide content.
And this is an article from the BBC.
In this Meta is rolling out parent alerts on Instagram for
teens that search repeatedly for self harm or suicide related
content. There is a feature called Teen
Account Supervision Tools. Parents in the UKUS Australia
and Canada will be notified next week, with other regions
following later, and the alerts will include expert resources to
guide parents through sensitive conversations.
Charities such as the Molly Rose Foundation have criticised the
measure, a warning that forced disclosures may panic parents.
I was just thinking that to fail to address the underlying risks,
including Instagrams ongoing promotion of harmful content to
vulnerable users, it does kind of.
I don't know. What do you feel about this?
Yeah, it's a tricky one, right? It's, it's kind of a, a good
thing there's, you know, lots of sort of issues like what you
just mentioned there. And yeah, there's obviously
we've seen, yeah, the content available and the age
verification, all that sort of stuff probably needs addressing
and dodgy ads and fake bot accounts and AI generated
accounts that use fake AI generated people sort of thing.
There's lots of other things that probably need addressing as
well, but at least that this is kind of good in a way.
I read out that paragraph and I probably went on a bit of a
roller coaster as I read the different parts of that
paragraph because as a parent, I think great, I want to know
that. And I think I would handle that
situation potentially well if it was one of my own kids, like I'd
be devastated. But you know, I think that I
would perhaps handle that in the right way that would support my
children. I'm not sure all parents would.
And this is the problem. Like a parent gets a
notification of that. Some parents would just panic
and or fly off the handle or I've taken everything away.
You're not having this anymore, blah, blah, blah.
And that's. And yeah, all right, Instagram,
we're going to provide you with some guidance on how to talk to
your child, but that's not the right.
Like not everyone's going to pause for breath and read that
kind of. Some people are just going to go
steaming in. And we know that not everyone
can handle these conversations. Well, you know, I might not be
able to put in that situation. I don't know.
And then, yeah, it does. And then as I further read that
out, you know, I kind of. Yeah, actually this is a bit
like Meta passing the buck. Like the simple thing to do is
to alert the parents when something happens.
How about you make the platform safer using all these amazing AI
tools that you've got and all these millions of pounds and
blah, blah, blah. You know, all of the money in
the world that company has, they should be able to make this
platform safer. As we know, Facebook don't
because they make so much money off dodgy ads and dodgy content
that, you know, money, money rules the world.
So yeah, it's quite, the whole thing is quite a bit of a roller
coaster. I'm kind of torn.
I think it's good, but I also think it's kind of like them
passing the buck. There's a screenshot of what it
looks like. To be honest, it doesn't look
amazing. So alert about your teen safety.
It looks like your teen's account name repeatedly searched
Instagram for content related to suicidal self harm.
When we detect searches for topics like this, we share
resources to help and often block search results.
What you can do to support your team to check on your teen's
safety. Professionals recommend reaching
out and talking to your teen whilst listening calmly.
See how to navigate conversation.
Here's some links to resources. Contact the helpline.
Oh, that's like how many people are going to read that second
paragraph because they're going to read the first part and then
fly into a fit of panic. But like, Oh my God.
And all of a sudden when I like contact their teen, it's that's
not great. That's not great.
Here are some suggestions from outside professionals.
Validate their emotions. Try not to offer solutions or
convince them that things will get better.
I'm here for you. Tell me what's on your mind.
It's just, I mean, like up there for effort.
But really, it's yeah. This, that's that all reads a
bit like a is created that support.
Empathise and listen. You're important to me.
It sounds like you're having a hard time.
I get it. But it's it does sound very much
like AI generated self help content, doesn't it?
It's yeah. Yeah.
Yeah, I it feels like passing the buck to me, but do better
meta. Oh, there's a there's AT shirt
slogan. Do better meta.
All right, morph. Yeah, move on to the next one.
OK, yeah, last one we've got, I saw this one before security
floor allows and to accidentally gain control of nearly 7000
robot vacuums. So this is a The Verge I think
recorded this one. Subsequent researcher Sammy has
to file claimed he wasn't trying to hack every robot vacuum in
the world, he just wanted to control his brand new DGI Romo
vacuum with APS 5 game pad. That seems like something that's
completely unnecessary, but if you want to drive, if you want
to drive your vacuum cleaner around the house, I'm surprised.
There's not a game called like called Robot Vacuum Simulator
where you have there will be now.
There will be. Now, Yeah, there will be now.
So yeah, it says his homegrown remote control app, so maybe he
was trying to build something, but essentially tis app again, I
guess then was basically talking to DJI servers.
Maybe they have like an API of some kind for your vacuum
cleaner. Think I.
Read that it was through an API that he leveraged.
Yeah, but. Basically, it allowed him to
control roughly 7000 of them around the world.
And quite concerningly, he was able to remotely controlled
them. Look and listen through the live
camera feed and they could watch it map out each room of a house,
which generates a 2D floor pan. And then these robots had IP
addresses that of course you could get the rough location
for. And it looks like here there's a
nice picture of a dashboard he built from this.
Which charge? Yeah, a road map with all the
different DJI vacuum cleaners in the world, along with certain
pieces of information up here. So you can see which ones are
cleaning, which ones are idle, which ones are charging, which
households have pets, which have children, battery status as
well. And yeah, probably a few more
bits of information there. And then he was also able to
bring this on to the live feed and control the the robot, which
also seems to have audio, which I don't know why you're
completely need to have sound microphone on it, but yeah,
that's quite terrifying. There's a whole bunch more
information on here with further screenshots, but yeah, and I.
Mean just to comment, right? This is DJI.
So this is one of the big manufacturers, you know, like
DJI are a big player in like connected technology cameras,
you know, action cameras. I've got DJI gimbal for the
phone. You know they make drones.
DJI are a big company. You can almost guarantee that
smaller companies, less mature, less sophisticated, less rich,
are probably even worse. Eventually, yeah, DJI have
packed this up and dealt with it, haven't they?
This has been patched, closed, problems gone away.
So yeah, they've, they identified it in late January
and patched it early February. But yeah, basically I think a
lot of it was sort of unauthenticated.
He only needed the serial numbers of the vacuum cleaner.
And I think it's just in the way that the vacuum FINA reported a
lot of information back to DJI, just just sort of the serial
number and I guess some sort of server was not built correctly.
Misconfigured. Wow, yeah, quite a crazy one.
Yeah, that's. Cool, That's cool.
That's crazy. Like don't don't just think
about what's if. This is the IoT thing, isn't it?
We have so many things connected to the Internet in a house now.
I think Virgin was shocked. Virgin Media, though, I had an
Internet problem ages ago now, like how many devices do you
have connected in your house? And it was like 46 or something
like that. And it's when you think like
cameras, phones, tablets, TV's, you know, streaming devices
fires. Vacuum.
Yeah, yeah. I guess one of those things
right update as well probably don't think the patch you I
don't know if you need to update your your robot vacuum or if
they've fixed it remotely. But again, we can put the
details in the newsletter for that I.
Am these lights I've got behind me?
I bought this week and put them in and they're TP Link.
Yeah, I know TP Link, which is still banned in America, I
think, but I like their products.
But the minute I plugged them in and configured them, it gave me
the option to update the firmware.
So and then I set it to update automatically because even a
pair of even a strip of LED lights could be used to
compromise my network. And just thinking on it, they
have the ability to move in time to the music.
So there's probably a microphone in there.
So if someone could compromise the TP Link servers, they could
probably listen to the behind the scenes of the awareness
angle by by listening to the microphone built into those
lights. That's really, I've never
thought about that before and that's quite scary.
Wow. There's actually a microphone in
the LED strip lights in several places in the house.
Wow. And this is it.
It's all this hidden. Well, yeah, it'd be great
because people might want to use them because then they can dance
and they'll flash in time in the music and.
Oh, that's a nice feature. How does it work?
There's a microphone. Yeah.
I don't know if TP Link
transmits microphone data back to TP Link.
OK, so that's disclaimer. I'm just assuming I'm not.
Yeah, sorry. TP Link.
Right. I think that's all the news for
this week. Yeah.
Awareness, Awareness. We were going to touch on this
week. Did you want to do your thing?
Yeah. Quickly Luke showed me
something. Luke showed me something.
And I was like, Oh my God, that's amazing.
How did you do that? And he's like, I'll show you on
the podcast, so the floor is yours.
Yeah, So, I mean, I can't take all the credit for this, but
basically a colleague at work pointed me to Gemini using it
for vibe coding e-learning content basically.
Yeah, you can let me geminize this one example or any talk and
probably do it. You sort of give it all your
requirements, what you want to, what you want it to be about and
ask it to build sort of interactive HTML based piece of
content. So we can probably do one live.
Now if you want to give me a topic, let me just bring up it
could be quite simple, just something like a course on
fishing, how to spot fishing or something.
Yeah, let's do a course on how to.
Is it going to be too technical if I say how to spot click fix?
Is that going to be too much? See what it does?
OK, click fix. A taxi is obviously where you
get a fake capture or something. We've spoken about them before
and it copies something to your clipboard and then it asks you
to do something by pasting code in and running code without you
realising what it does. Does click fix attacks if you've
listened to it before? We talk about it fairly often.
This is obviously the very rough example, right?
You can feed it a lot more information, but obviously
you've given it. I'll read this out for I want to
create an e-learning course module on how to spot click fix
attack. Can you produce this in HTML?
And it responded with creating a module on click fix attacks is a
great move. It's one of the more clever
social engineering tactics. It's always a.
Great move. Yeah.
And basically it says below is a complete responsive HTML for
e-learning module designed to be clean, interactive and easy to
drop into an existing LMS or website.
Obviously the disclaimer that be careful what you're producing
with this and you probably want to keep it internal.
If you're building it for your company and probably don't
exercise it to the Internet, don't go.
Publishing it to the Google Play store because then you're
featuring a bleeping computer news article about an app being
insecure so. Yeah.
So yeah, it produces some code HTML and then it says to make
this course truly effective, I recommend emphasising these
three psychological triggers to attack hackers using Cliff Fix.
Would you like me to add a knowledge check quiz at the
bottom of this code? So I'll just say yes.
So updates the HTML for me. That looks like a separate
section, say combine all together.
So just to confirm, is are you a subscriber to Gemini or is this
free Google Gemini? This is just the free.
This is the. Free Google Gemini that anyone
can access with a Google account.
You haven't paid subscriber. This isn't Gemini Premium or
whatever they call it. No, this is just the free
version of. This is the our workspace
account down on earth. It gives you something
different. We haven't paid for advanced
Gemini on that. So because, yeah, I'm not
generally user, yeah. We'll display what it's got now,
but it continues to say, let's add more and more and more, but
let's just go back to a fresh Gemini because it just seems
like this is the easiest way of doing it.
Basically you copy the code and start a canvas and then just you
could say preview this code and then paste it in.
It brings it up. In like a.
Code editor, eventually it will preview it for me.
I mean, obviously is what you could save this to a HTML file
and open it that way, but this way you can sort of continue to
update it. So it's doing a whole lot of
things. It's finished and this is what
it's produced. So it's now.
The number to page go on. Sorry you go, Yeah.
And as I. Said over the slammers might be
completely wrong and terrible, but obviously it's something
that you can sort of build from. So yeah, it's build built like a
page that pretty generic looking.
You could not ask it to change the aesthetic.
It's called security awareness. The click fix attack explains
what it is has a little golden rule.
Nice read sort of prompted section.
Never use the wrong command. Windows are.
So it goes through how there's different steps, talks about a
bunch of information there. So then it has a little
interactive quiz, it looks like, or some further information.
So spot the red flags like these scenarios to reveal why the
dangerous website claims arrow font not found and asked for a
system fix. A little bit of information
there. Small knowledge check here you
see a pop up saying Chrome update failed run the following
fix ask you to copy a block of text.
What do you do? You click fix to say secure or
close the tab and check Chrome settings manually.
So let's say, oh, click fix to say secure.
We failed that one. And again, you can you could
enhance how this is portrayed. So we could say, let's give this
really interactive and modern. That's it.
Again, you probably want to be a bit more specific on your
prompts, but this is a quick example.
We're knocking this. Out quickly for a demo on a
podcast. This isn't yeah, but it just.
Shows like yeah, you could give it a bunch of information and
build out something that's relatively decent, a bit more of
it. Let's give this a really
interactive and modern aesthetic.
And the response has been I will update the training module with
a more immersive modern aesthetic.
This version includes a Glass Morphism inspired UI, smooth CSS
transitions, A dynamic live simulation area.
And now it looks like a vibe coded website because it's got
those like blue gradient tones and the floating curved boxes.
And yes, yeah. What was a little error there,
but it's just all that. So yeah, it's sort of changed
the change the look relatively the same to be honest.
But yeah, I'll bring up another example quickly of what I showed
you. So yeah, similar sort of thing
about phishing emails and I asked it to give it 8 bit games
console style interface. And so, yeah, basically built
this sort of Game Boy looking device.
Called the defender. Running SEC OS version 1 and
yeah, sort of like a gamified version of of some training,
right? You could, you could embed this
into a web page. Obviously there's no back end to
like track results. You could probably implement
that if you wanted to. But again, I will say there's a
few visual errors occurring. So you'd sort of need to spend
some time to fix it. But and as well you'd need like
a instructions of how to play this right.
But essentially you can you presented with an e-mail.
It's all sort of a bit gamified and a bit shortened in a way.
So it's from admin talks. User pass expires in 120
minutes. Probably want to say password on
this one update or lose all Q3 files and there's a little
button there that you can hover over and it pops up.
You can't really see that, but it's like a domain.
How long? Did it take you to make that?
This was just a few minutes, so the fact.
You've gone from nothing to that in just a few minutes.
Yeah, it needs mopping up in places you know, and it needs
tweaking, which you can do. But this is an example of how
the barrier you have an idea or not even really an idea.
You have like the the seeds of an idea on I want to do
something that looks maybe in that kind of theme on this
topic. And then within just a couple of
minutes, you get that like, it's incredible.
It's quite cool. So yeah, you can essentially
build it out if you want it to be.
This is like 3 levels of phishing emails, right?
So you've you've select the red flags.
So you've successfully identified that one.
I've clicked on the button and I failed here.
So it pops up like I didn't even ask it to do this either.
It just, it just did it. So it sort of popped up as a
fake ransomware. Your device is being encrypted
and you can view the report which gives you the red flags
displayed on the that the content had.
And obviously I was successful at identifying one of them, but
I failed the rest. So you sort of go back and retry
and yeah, you can sort of go through a little game, different
examples, different difficulty levels.
I guess you could build it, but basically see, like there's
visual bugs here, but that's stuff that could be, could be
fixed. But yeah, for it's quite a call
to show, but yeah. I think it's brilliant that you
can get from the seeds of an idea to actually having
something physical like that in just a few minutes for free as
well. Like, that's Gemini's free tier,
so yeah. That's cool.
I think for you'd have to check what kind of usage rights you
have with Gemini 3. Sure.
It's sort of yours to use as such, probably not for
commercial, but if you're building it in town or for a
small demo for like Cybersecurity Awareness month
for something, it could be a way of building something fun and
different that's sort of customised to your own thing and
you could give it all your branding elements, right?
Yeah. Give it your logos and your
colours and build something quite cool.
So yeah, I think that's. That, yeah, awesome.
Awesome. If anyone's listening and you do
build something awesome with the AI tools that you think's really
useful, reach out to us.hello@riskycreative.com and
we'd love to show your stuff in a future episode.
So that'd be cool, right? Moving on, I had a couple of
topics to talk about this week, and the first one have you car
manufacturer Dacia. Dacia, I think it's duchier the
right way to say it, the more budget part of Renault.
Have you heard of a Duchier Sandman?
OK, so I first heard about the Duchier Sandman a while ago,
right? And the Duchier Sandman is
basically a really awesome looking campervan.
Like it looks cool. So let me show you if you Google
Google Duchier Sandman, a whole bunch of images come up.
I'll just share quickly. This is immoral about like stuff
you see online. So here you can see lots of
images, the Dutchie of Sandman. These are based on like an old
like Renault traffic kind of model, last generation Renault
traffic. And it's a 4x4 awesome looking
camper with LED lights and all kind of vents and awnings and
stuff. And it's cool.
Well, this week also Carl said we invented the Duchier Sandman
and the incident fell for it. Will Duchier ever build the
Sandman campervan concept that has taken on an AI life of its
own? So this article basically says
that the the person that's written this article, colleague
Goodwin created it. It was his a figment of his
imagination. So 2019 auto cars genius artist
Ben Summerall Yud came up with the concept for an affordable
campervan badged as a dachier but based it on the previous
generation red eye traffic. The name Sam Man came from the
1970s Australian Holden panel van that featured cool
psychedelic graphics and they went for simplicity.
You know, being dachier Dachie is very much a budget range.
So simplicity, steel wheels, tough black plastic protectors,
wheel arches, no entertainment because you have a smartphone.
And if you're into cars, that's the kind of model that the slate
pickup truck in America that's backed by Amazon has kind of
followed cheap bring your own phone, plug it in Bluetooth
speaker and, and this is a basic, basic thing, right?
And they created it and it basically took on a mind of its
own and people latched onto it. And then now there's all kinds
of stuff. There's all videos about it
online and yeah, it's crazy. And you can see they spoke to
Dutchie about it and some of them have talked about bringing
4 by 4 on it. The traffic isn't available in 4
by 4. So Thatchie would never do that
because it would put the price up.
It kind of does does away with it.
So yeah, now they're saying that, like Thatcher have said
themselves, like, Oh yeah, it would be a great thing to do.
But so if you Google it, you'd really be led to believe that
this thing existed, or at least was coming.
It's a rumour, yeah. AI overview because it's cool,
Yeah. Just go and read it.
Rumour. The Dutchie Salmon is a
rumoured, highly anticipated and rugged compact crossover
expected around 2026, designed as an affordable adventure
vehicle. It's interesting.
Then it's over. Note, as of February 2026, this
vehicle is not an official product, but a concept created
by auto car journalists. It's absolutely mad.
There's a video of a concept design and everything.
So yes, the hype wasn't real. They weren't making this.
So there's an example that don't believe everything you see on
the interwebs because it's not always true.
I just thought that was that was some more AI fake news I thought
was quite interesting. Yeah, it's good that the
overview pointed out that it wasn't real, but it probably
could have been a bit of a bigger banner of some sort,
right? Saying that this is probably not
real. Well.
The AI overview still says it's a rumoured highly anticipated
rugged compact crossover van, expected around 2026.
And then this is from the end. Yeah.
Like. Why does it still say it's
expected around 2026 when it then goes it's not an official
product but a concept like yeah, bit messy.
Isn't it? Well, it.
Almost feels like someone's tapped that little bit of like
code on the end, like bumped it on.
I don't know how it works, but because it may be made the news,
there's even a Reddit post here from there's a Reddit post here
from three years ago. What do you think about the
upcoming Duchess Sandman? It will cost about €16,000 with
a picture of a green Renault traffic with surfboards on the
roof. Bad news, it's been delayed.
Says the top comment. Dream car.
Yeah, so don't believe everything.
All the hype was not real. I had one more post I wanted to
share this week that I saw on Reddit and it's a simple one.
Popped up when I was trying to read an article.
Diabolical. You can see here this is from
mildly infuriating the subreddit.
I can see so many people falling for this and it's a cloud flare.
Again. It's a cloud flare.
Click fix. Complete these verification
steps. Use keyboard to prove you are
not robot. Just use.
Keyboard to prove you are not robot, press and hold Wing key
plus R in the verification window.
Verification window, press Control key V and then press
enter. But really nice though, top one
top comment on that from tripped out Lobster.
For anyone curious, this technique is called click fix
social Engineering technique. It's not something new.
It's been around for some time. When you see this in your
browser, a command line snippet has been copied to your
clipboard as if you copied something with control plus C
When you follow the instructions shown, that command line snippet
is executed. So yeah, nicely explains it, but
just these things are absolutely everywhere.
Absolutely everywhere. No legit website will ever ask
you to do this, you know? The comments are really helpful.
Once was once 30 something hours without sleep and autopilot did
one of these without thinking for a supposed verification I
needed. I realised and fully woke up on
the spot like 2 minutes later in panic.
Antivirus caught and purged it. I did a rollback and password
resets to be safe so it was fine.
Very annoying though because I did it right before I was going
to go to bed and it kept me up for an extra 1 to 2 hours.
Doing a rollback. Like in some cases doing a
rollback isn't always sufficient, but not everyone
knows. I'm probably doing a fresh
install these days. Yeah, yeah.
And then there's a comment. They act like people using ad
blockers as a basic safety precaution, other villains.
So I know there's tools out there and I don't want to
promote anything specific, but I know there's there's browser
defence tools out there coming that protect against stuff like
this, which is awesome and very much needed because these are
absolutely everywhere. Click fix now.
They're pretty much every week we see something new.
Yeah. Yeah.
Talk to you and this is an important one to talk to
everyone about like if you're sat there having dinner with
your family, this could be a really interesting conversation
to bring up just like, you know, never ever if a website, I saw
this website the other day that asked me to press control and
see we'll put a link to that show that image because my mum
would probably follow those instructions you.
Know you need. To It's everywhere, right?
Yeah, that's me done. What have you got?
Got one video to share and a e-mail to share quickly so I'll
create a pop up the video. You've all seen this to do
Samsung S26 or S20, yes? Yes, this is awesome.
So good. Yeah.
Says showing off the privacy display feature and this is M KB
HD very well known tech YouTube and everything else got it to
play the video obviously people watch listening won't be able to
see it but I just. Noticed Marcus has upgraded his
lapel mics. That's a really nice nice.
Just to geek out on that for a little bit, but yeah, go on.
Yeah, I'll play the video, but obviously people listening,
we'll need to watch it to see how it actually looks.
Yeah, cool. You know, there's privacy.
Screen protectors that are supposed to black out your
screen from the side so no one can spy on you.
Well, this S 26 Ultra obviously doesn't have a screen protector
on it, but if I just turn on privacy screen, it turns off
individual pixels to achieve the exact same effect, which is
pretty sick. But not only that, since it's
built into the display, you can have it turn on only when
opening certain apps like your banking app or Messages or
Photos. But what's sick is you can have
it just block out notifications as they come in or just the
password field when entering a password.
Honestly, Unreal levels of display innovation so that you
can hide whatever you're hiding. That's so impressive, that's so
clever, like iPhone will probably I think Samsung make
the iPhone displays. So that'll probably console
iPhone in about four or five years, but that's some that's
really impressive. Like that's awesome.
And the fact that they've taken it down to an app level or a
notification level as well. Wow, that's cool.
That's really. Clever.
I've never, I think I had one years ago, like one of those.
So basically he's turning the screen and as he turns the
screen away from the camera, the screen goes black and then as he
turns the screen away from the camera on like a notification
goes black. Or you can select specific apps.
I've I had a privacy screen like that ages ago and I never really
thought about it. But since starting my new job,
when I went to their office, loads of people had them for the
laptops but also for the phones. And it's like, oh OK, like it's
I didn't really. I don't know if it's a cultural
thing, but it's pretty much the norm in some places now.
So it's, yeah, I think that's a really, really cool tool.
That's awesome, yeah. Interesting to see, like you
just said, that I feel, you know, quite a trickle to laptops
at some point as well. Probably a very expensive
laptop. Yeah, it's rather tech will
become a normal thing in the future.
Yeah, it probably. Comes because you can turn it
off as well. It probably doesn't come at any
cost of quality or that kind of thing.
You know, quite often you'd think it would be the quality of
something that would suffer, yeah.
I think like using a proper previous screen is pretty
horrible experience to be honest.
So yeah, it's quite cool. Funnily enough, I've just
ordered one and it's expected today from Timu, so I will tell
you how good my Timu privacy screen is when it turns up.
Please don't hate me for ordering stuff from Timu, but
yeah, they were dirt cheap and they're expected today, so I'll
give you a iPhone privacy screen update next week, yeah?
That's cool. Cool.
One more thing to share quickly. So this is something we I think
I brought up quite a while ago, which was the Ahrefs fake
website on Google ads. Google Ads spot.
Yeah, with a website claiming to be Ahrefs, but I only received
an e-mail. Sorry, this was.
When you searched that ahrefs in Google, the top result was a
paid for Google Ads listing, leading you to a fake AH refs
website. Yeah, we did.
Similar ages ago, didn't we, with Google where there was an
ages one Ads 1A Google Ads one, wasn't it Google Ads own website
was spoofed and someone had bought an ad for Google Ads and
it they compromised Sydney Zoo's account.
That was amazing. That was incredible.
Yeah, yeah. But yeah.
Sorry, go on. It wasn't.
Too long ago as well the yeah I was trying to go to AHS and had
the same thing. Where ended up on like AI think
it's like a Squarespace website or something but basically,
yeah, I received an e-mail from AH refs like 2 days ago talking
about this exact same thing which seems like quite a delay.
I'm pretty sure it was quite a while ago when we brought this
up. But yeah, basically this said
we're writing to you to warn you about an active phishing attack
called targeting AH, refs, users and other platform subscribers,
but bit delayed there, but it basically points out what's
happening. Some nice screenshots on
comparing the phishing ad versus the real one.
Points out the website address. There's a clone website.
When you try to sign in, you prompt it to fake to a fake
Google sign in Page and it says here that.
If you grant permissions to attack against access to your
Google Ads accounts, obviously, then they go on and do more
spoofing of AHFS or fake other websites.
And it says here that confirmed victims have lost over $30,000
each from their accounts getting drained this way.
That's an interesting way to say it.
And yeah, then it has a few steps on how to protect yourself
and A blog post about why is sort of not so easy as a block.
And then a bit of information on you.
If you believe your account's been compromised to support,
contact their support team. Yeah, I thought it was just an
interesting update on something we spoke about a little while
ago. Yeah.
Yeah, that is, that's quite like you say, quite a while ago.
It was weeks ago we spoke about that.
I think I was just trying to trying to look up when it was.
Yeah, it's mad. It's mad.
Yeah, I just. Had sponsored ads on Google.
Terrible. Avoid sponsored ads on Google
all day long Yeah, it's and This is why the death of ad blockers
like we we just said that with click flick.
One of the comments on that click fix Reddit post said it a
world without ad blockers is a less safer space.
So Google killing you block and stuff like that.
But again, it's money over safety.
Google want to make money, they just like Meta passing the buck.
We now have to deal with these additional risks because they've
blocked people making us safer so.
Congrats. This week go to Meta for passing
the parental buck to us and for Google yet again making the
world a less safe space. But I mean, it's great that 8
refs have come out with that. I keep wanting to call them R
refs because these are it's great that they've come out with
that blog post, but it has taken them a while.
It's definitely that was it was a few weeks ago we talked about
that. Yeah, yeah, yeah.
That's my OK. Yeah, that's great.
Right. If there's well, that's all
we've got. So we will be back next week
with more human sides of cyber stories.
Have a good week and I'll speak to you next week.
See you later. Bye.