You're listening to The Awareness Angle, the podcast
that cuts through the cyber security noise to bring you the
stuff that really mattered, from shady scams to boardroom
blunders. We break it down so you don't
have to. Everything you hear is just our
take, Not our employers, not our legal teams and definitely not
the PR approved version. I'm Matt Davis here with Luke
Pettigrew, the master of the mix, Wrangler of the road
headlines and always ready with a timely Fact Check.
Hello, Luke. Hey, Ann, Hey everyone.
How are we doing? I'm doing good.
How are you? Yeah, not too bad.
Thanks. Yeah.
I could be better. I'm deaf in one ear currently.
This is serving no purpose. I have I was on last week's
episode. So if I'm shouting, I'm sorry,
but I had a nasty incident with cotton bud and a five year old
that made me jump and it kind you don't need to go into it and
say yeah, it's I've got some ear drops and hopefully it'll all be
fine because I quite like my earring.
But there we go. So I'll do this one eared.
There we go. The other one will fall out.
Now, getting on with getting on with this.
Subscribe to the newsletter. If you don't, why not?
We've got nearly 750 subscribers.
Come on, get subscribing. You can get it at
riskycreative.com. There you can subscribe.
It lands in your inbox every Monday morning.
Or you can get it on LinkedIn. Just search for the awareness
angle and it will come up. It's free every Monday and tells
you everything you need to know about the week's episode.
Please subscribe to us on YouTube and the podcast
platforms. We need to get the YouTube
subscribers up, people. You get to see our wonderful
faces every week if you get it on YouTube.
And we're going to start posting more clips and parts of the
episodes as well. So please subscribe to us on
YouTube at Risky Creative. The links to everything are in
the notes of the episode or the show or at riskycreative.com.
Last bit of business before we get started, the awareness angle
interviews. This is where I sit down with
people from across the business spectrum who can offer something
to cybersecurity and cybersecurity awareness.
Last Thursday, we released an episode where I sat down with
Lori Stewart. Lori is from Canada, she's a
content marketing pro and she's worked with some massive
cybersecurity brands and had helped to make their messages
stand out. Essentially, we get into what
security teams can learn from B to B marketing, why security
awareness is a bit like a start up, why storytelling still works
and how to shift behaviours without boring them to death.
So if you've struggled with security, comms or engagement,
it's a worthwhile episode. Laurie's also a massive lover of
whiskey and we filmed it. She filmed it.
She was sat in the synthesiser repair place that she runs with
her husband. And it's got to be as far as
backgrounds go. I get mentions about this, but
hers looked awesome, sort of like steel and corrugated iron
and stuff like that. So it looks awesome.
So yes, that is the episode before this one.
Yeah. There we go.
Right. Should we get on with the news?
Yeah, let's get to it. Awesome.
OK so kicking off the news tonight and this is 1 I I saw
just before I saw this today and I was like Oh my Lord.
OK so fittify. Have you heard of Fittify?
I haven't, to be honest. I haven't heard of Fittify.
It's like maybe we need awareify.
Like thank you Spotify. Was Spotify the first?
I don't know. Anyway, Fittify's pub.
They are a fitness app and they're publicly accessible
Google Cloud storage bucket. Those are words that should not
go together has exposed hundreds of thousands of files.
Some of the files, you can guess where this is going.
We'll use the uploaded progress pictures that individuals
uploaded to track their body changes over time.
We got this story from Cybernews and after Cybernews contacted
the company, the unprotected instance was closed, so it is
now protected. But Fittify is a popular fitness
app. It has over 10 million downloads
from the Google Play Store and an estimated 25,000,000 total
installs across all platforms. In early May, the Cyber News
team reached out to Fittify owned.
Sorry. In early May, the Cyber News
research team discovered a Fittify Owned an accessible
Google Cloud Storage bucket. Most of the files exposed in the
unprotected instant will work out plans and instruction
videos. You know, nothing too sensitive,
but the photos that users are shared with the apps AI coach
and their body scans. So one of the comments here says
it's also worthwhile to note that progress pictures and body
scans are often captured with minimal clothing to better
showcase the progress of weight loss and muscle growth.
Therefore, most of the leaked images might be the types of
image that users normally wouldn't like to share and would
like to keep private and not get out to anyone on the Internet.
Yeah. So in total, there was 373,000
files shared 200 and six, 206,000 of these were the user
profile photos and 138,000 were labelled as progress pics.
So look, it's yeah, private photos on public servers.
Like that's definitely a no. Surely.
Yeah, yeah. The they should be kept secure.
It's as simple as that. If you work for a business that
has this kind of information about people, keep it safe, keep
it secret. You think?
It's. You'll be the priority and
building that sort of thing. It's clearly a mistake, isn't
it? It has to be.
It's clearly a faux pas. You know, it's, they haven't
done this on purpose, but it's, it's yeah, this is, it's, it's a
big one. So you kind of trust as well
that with a fitness app, your data is going to be kept safe.
You know, I wouldn't want to share progress apps on Facebook
or Instagram or Reddit, you know, where, where everyone can
see. No, especially as it's got a lot
of downloads, right, 25,000,000 installs across all platforms
and it says about how these were accessible without passwords or
any authentication. And it also says that there were
hard coded secrets that could enable attacks to access more
user data, so not ideal. No, no, yes.
So please be really careful. I mean, you can't really do
much. I mean, there's there's a sample
image here. It's not even worth sharing the
sample image because it's a pair of ankles and the rest of it's
just blacked out. But I'm guessing that's because
the rest of it was virtually nude and probably someone's
standing in their underwear, which is how most progress
picks. There's a Reddit again, there's
a Reddit called slash R slash lose it, which is where people
show how much weight they've lost.
And quite often the progress picks on there and it are not
safe for work. You have to Click to like, see
the picture. Something we'll come onto in a
minute because, you know, there's a lot of flesh on the
show. So, yeah, just if this was in
the UK and they were M&S, there'd be a class action
lawsuit against them now by some ambulance chasers like we spoke
about previously that yeah, just really think about the data that
you share and where you're sharing it.
Maybe you want to keep those on your own phone and not in an app
because you don't know who's built it, you don't know how
good it is, you don't know where the data is sitting.
You can't do. Most companies would do a like
if that was a company sharing data with Fidify, they would
probably get them to do a privacy screening assessment,
which would ask them how their data is stored, who has access
to it, where are the controls, all of that.
And to meet certain compliance standards, you have to have all
that. But as an end user, you just
download an app and take a picture and it's don't just
implicitly trust these apps. Yeah, cool.
Right, on to the next one. Yeah, so this one was quite a
big one this week. I'm sure everyone's heard about
it. It was all over social media and
probably all over LinkedIn as well.
So yeah, we we transfer have come out now and said that
they're not going to be training AI with with people's files
after this massive backlash. So obviously they came out with,
I believe, new terms of service and had some wording in there
that people took in a certain way.
Let's have a quick quote. What did it say?
So just to give people a bit of background, if you don't know,
We Transfer is a file transfer service.
So if it's a bit like Google Drive or Dropbox, it's it's very
much like Dropbox. You can upload a file to We
Transfer and send someone the link.
And it's a way to transfer big files, files that are too big to
e-mail. It's a way to share them with
someone. So it's used a lot in the
creative industry, video design, graphic, it's used a lot in the
creative industry. And we transfer as kind of one
of the industry leaders in this kind of drag and drop share
space. Yeah, So it was supposed to be
something that was going to come into effect on the 8th of August
and basically said that they'd use the uploaded files to
improve performance of their machine learning models.
And obviously that was met with a lot of backlash and people
saying that they're going to jump ship from using that
platform. And yeah, obviously they've now
come out in this BBBC News story where a spokesperson, A
spokeswoman from We Transfer has said that they don't use machine
learning or any form of AI to process content shared on We
Transfer, and nor do they sell it or that the content or data
to third parties. And then they've updated the
terms of service to now clarify, saying that they've made the
language easier to understand. It's all been a big
misunderstanding. We weren't really going to do
that, so we've just reworded it to make it clearer.
Yeah. OK.
It's it's funny, we've spoken before Vevida.
Vevida are obviously security awareness company, cyber
security awareness company that do escape rooms and Vevida reels
the TikTok style videos. Simeon their their CEO reached
out to me about this. Actually, he shared this with me
in shock before the backtrack or the clarity had happened when it
was first when news broke and it was we transfer a training AI on
your files. He was like in shock.
He's been a content creator for many years and we transfer, he's
like one of their go to tools and he's it's just not OK that
you're accessing all of my data and you're training AI on it to
like make other people's stuff better.
It's it was massive. And he highlighted another tool
that they use, Capcart, that they've used in some elements
that I don't think they use anymore.
He's highlighted that because Capcart have also said they've
changed their terms to say that they're training their AI on the
content you share with them. Yeah, I think as well as
mentioned about Dropbox back in 2023 had a similar thing I think
where they had to clarify their terms of service about AI
models. It's it's a tricky old world,
isn't it? It's funny.
I've got a funny enough you mentioned Dropbox.
I haven't seen this for Dropbox, but I saw this for cap carts.
Someone a post a month ago on on Reddit.
Someone of them asked ChatGPT to break down Cap Cut's terms of
service, it says. Here's a clear eyed breakdown of
the Cap Cut terms of service based on your request for
expletive that takes advantage of users.
While not every clause is malicious, several stand outs as
exploitative, overreaching or unfairly skewed in favour of the
company. SO and ChatGPT flags on this, it
says content owning and ownership and licencing.
You give them everything forever, you give them a
permanent licence to use anything you upload.
They can modify it and let others use it too forever for
free. They even say that if your
content involves music, you as the user must deal with the
music rights and performance rights organisations and if
there's any comeback, it's your fault.
There's numerous other things. We'll put a link to this Reddit
post in in the show notes. I won't go through it now, but
basically they just completely wash their hands of it.
In summary, it says there are some protective clauses, but
many terms strip users of rights, push liability onto the
user, and give the company free reign to exploit, modify, and
profit from user content. So.
That's crazy. That's Capcart we transfer.
Apparently we misunderstood the phrasing and they were never
going to do this, so we'll. See.
Cool next story. Yes, right.
Let me get that up. The next story tonight, this
comes from IT Pro. And apparently, the headline on
this reads, all U.S. forces must now assume their networks are
compromised after the SALT Typhoon breach.
So cybersecurity experts have issued a stark warning after the
US state's National Guard network was breached.
According to the Department of Defence, SALT Typhoon espionage
group breached and laid low in the network for almost a year,
potentially accessing sensitive military and law enforcement
data. So yeah, it's pretty, pretty
shocking really. There's been a long running
campaign that extensively compromised the National Guard
network from March 24 to December 24.
This follows similar cyber espionage attacks, including
attacks on telecoms firms AT&T and Verizon.
Verizon, sorry. In December last year, White
House officials warn this particular campaign saw the
group access and record private conversations of very senior US
political figures. There's been numerous instances
across public and private sectors where sensitive
information has been compromised by lateral movement.
So in in the US. So yeah, it's, it's frightening,
really. But just kind of title, Yeah,
they just now have to assume it's all been compromised.
So what do you do if it's connected to a Wi-Fi, you'll get
got an Ethernet cable plugged in.
You just assume it's compromised and everybody can see might be
able to see everything. Yeah, I'm yet no one can release
the Epstein files yet, but there we go.
I won't get into that. That's all I'll say.
It's funny like it it it's I did.
I'm not going to get into that because that's like just
something different. But I did hear something say,
why doesn't someone just leak them?
People won't leak them. The person that leaks something
like the Epstein files, if they exist, is going to be the most
haunted man or woman on the planet by the richest people.
If you've ever seen things like the game or you know, like there
was a film Michael Douglas who was like a manhunt for him or
the running Man, like the running man.
The trailer for the new film looks awesome.
Like the whole country is out to get this one man.
That's the person that would leak the Epstein files.
They'd be like billion billionaires after them.
So yeah, it's, it's safe to assume like big, big targets
like this compromise and they don't even know it.
Well, yeah, that's they won't be the only ones that's scary.
No they won't. Yeah, yeah, that's pretty much
all to say on that. I think this one's yours.
Oh yes, the next story we have is how Reddit now, well, they're
going to be introducing age verification in the UK ahead of
the rules, which they are from the Online Safety Act, and that
requires sites that show adult material to introduce robust age
checking techniques. So yeah, obviously Reddit is an
online community discussion forum.
So yeah, a lot of people want to stay anonymous in there as much
as they can unless they want to obviously expose who they are
with with their posts and stuff. But I guess that, yeah, this is
sort of more of a child safety thing, although it's probably
like an age of requirement of what, what, what what spread
it's age requirement for you? 13 years older.
Is it 18? Yeah, 13, but this is for this
is for like the not safe for work content, isn't it, or, or
the more adult topics. So Reddit maybe, maybe 17 plus
for Reddit but I don't know what's the latest on it but.
It's pretty open and free. Yeah, it's.
Yeah, there's no cheques at the moment, so that's what they want
to add in. The UK's Online Safety Act seems
to be leading the way on this. But it's not the only place, is
it so? No, indeed, this news article,
the, the one that has seen it mentioned was that I'd seen
mentioned before in other news stories was things like adult
websites. So yeah, they're all bringing it
in and it's the, the approach they're taking with this.
I think it's quite interesting because they're offloading it to
a third party. So and there's data privacy
reasons for that. Like you have to, you have to
like take to provide government ID in like a photo or something
like that. So obviously Reddit don't want
this data. And then if you've got a company
that is an ID or Reddit gets your age, like yes, we confirm
that this user is 18. So which means maybe they don't
even get your details. Maybe.
Maybe they just get your username.
It's interesting, don't quite know because it says that from
the 14th of July, but I haven't seen anything on that, so I
don't know if that's actually in place yet.
But yeah, it says how? Yeah, they're using that third
party persona. Yeah, who will need a selfie or
a government ID and passport they've added as well.
How percent of promises not to retain the picture for longer
than 7 days? It does.
It does make you wonder, Dave David on the article it says
David Greene, civil liberties director at the Electronic
Frontier Foundation, said that this whole UK Online Safety Act
is tragedy because we can't use the Internet without having to
provide their papers, as it were.
And he's disappointed that Reddit aren't challenging the
law now. Apple in some ways are because
they're still fighting that encryption and was it Meta have
gone in with them or WhatsApp have gone in Yeah, well,
someone. Someone WhatsApp I think it was.
I think it was met yeah, Meta because of WhatsApp.
But yeah, I mean, I suppose Reddit are picking the fight and
they're like, we don't want to fight the UK government, but it
there will come a time where they'll go.
It's in the interest of national security.
The persona must hand over this data so we can track who's been
looking at, you know, the wrong type of thing on the Internet.
Yeah. Just one more thing to add I
guess is how Ofcom, the UK regulators expect because
they're expecting other companies to follow with this or
face enforcement if they fail to act.
So not quite sure what that and finds 4 to 18 million or 10% of
worldwide revenue. That's a lot of money.
That's that's why they want to probably just get on board
that's. Bigger.
That's bigger than a GDPR breach from the ICO, which is 17 and a
half million or 4% of annual global turnover.
Yeah, so the rules come into force on the 25th of July, but
Reddit has started already. But I mean, I haven't heard much
about it or seen anything. The last line of the article
says in the most serious cases it can seek a core order for
business disruption measures, such as requiring payment
providers or advertisers to withdraw their services from a
platform or requiring ISPs, Internet service providers, to
block access to a site in the UK.
Oh well. So they will literally if you
don't conform to this, we can stop your website working in the
UK. That's massive.
That's mad, isn't it? That's insane.
It's completely unrelated, but I am.
I doubt I I got a link to AI. Can't remember what it was
called now. I got a link to a radio service.
It was like a, it wasn't he's an app, but it was a website and it
was like, you can listen to lots of local radio stations all over
the world. Social media.
But then a disclaimer came up and it said in the UK you can
only access UK radio stations due to copyright.
So you can see all these lovely dots all over the globe, all
these amazing radio stations in all these weird and wonderful
places, but in the UK you're not allowed to listen to them
because of copyright. It's kind of VPN I guess that's
what most people would do. So you turn on your VPN and
access them anyway. Now you just.
Yeah, yeah. Which I wonder, like I'm sorry,
but is this just oh, if this is just in the UK, what is to stop
a 15 year old lad downloading AVPN, turning it on and then
accessing a site he wants or looking at stuff on Reddit?
Yeah, yeah, I. Mean the step in the right
direction in the way, but it's going to be work around as with
everything. As a as a parent, I'm really.
As a parent, I'm really torn. Like I don't think it's enough
because I don't think, like where where do you draw the line
on the content as well? Because a Google search can show
offensive stuff. So that is a Google search.
Maybe to turn off safe search on Google, you're going to have to
provide government. I I don't know.
It's yeah, I'll tell you what, the ID business is probably a
good business to be in right now.
Yeah, people like persona, you know, they're going to get,
they're like, come to us, everyone come to us.
And then there'll be a right target if any exposed Google,
Google storage there to. They're going to be like these.
These handful of companies are going to have the identity data
for lots of people interested. Yeah, well, they said they'll
delete it after the days, so well, we'll see.
This will be some records I'm sure we have to see.
If that's true, there'll be a backup somewhere, someone, not
the same persona, but there'll be other people somewhere.
Yeah, test data or something. Right.
Moving on to the next story. This is really timely actually
because I've just covered this in a piece of, I've just, we've
just made some training and we use this as an example.
So and then I saw this and I was like, wow, what a coincidence.
UK pet owners have been targeted by fake microchip renewal scams.
So thousands of pet owners have reported receiving emails
claiming their pets micro microchip registration is about
to expire, urging them to pay a renewal fee through sites like
petchip.info. These messages look legitimate,
they include the pets name, breed, age and even microchip
number. But the key thing here, as a pet
owner, I know microchips don't expire.
There's no registration, there's no subscription and the
government doesn't charge annual fees.
It's there's. No.
Pay to get Yeah, yeah. Yeah.
You pay the vet for the insertion and that's it.
These messages are scams designed to collect payment and
personal details. But the level of personalisation
has raised questions around where the data's coming from.
So Pentest partners have issued a report and they say the issue
isn't just phishing, it's about how the microchip databases
manage access to sensitive data. They found that several
platforms allow users to enter a microchip ID to receive pet
details without any real limits. So these chip numbers are
predictable. So attackers can guess large
batches of ID. So you could literally go paste
in an ID, it give you the details, paste in an ID, give
you the paste in an ID paste, and you could do that all day
and at no point it'd go hang on a minute why you've got asking
for so many IDs. So the PET chip, whoever manages
the pet chip databases and looks after those, they need to up
their game and increase the security on those like pronto
because you've got names, addresses, pet names.
It's funny, the way, the way this came to relevance for me
was we were doing something on social media and be careful, be
careful what you share, how much information you share on social
media. And one of the examples we gave
was like a Twitter feed, I think it was.
And it was like, oh, look at my new puppies, blah, blah, blah.
And you know, you think about when we put this together, I
thought, oh, pet names for passwords, right?
So maybe it's, it would help guess a pet name.
Like for a period of time, someone close to me used their
old dog's name as part of their password.
It's quite common. But actually, when this training
was all built, the guy that built it actually used it for
this exact reason. He was like, no, I'm going to
say that your pet needs. I think it was actually a chip
registration. I was like, Oh my God, that's
them. So when I saw this, it was
brilliant. And it just goes to show they'll
do anything. Yeah, hackers or cyber criminals
will, you know, if they can find something and if there's an
angle, if there's a cyber criminal angle, maybe that
should be the dark side podcast that we do.
Maybe we should do one of these talking about the good and then
put our hoods up and. Talk about the bad stuff.
Yeah. So yes, it's be really, if it
feels unusual or out of the ordinary, be really, really
careful, you know, deal with it. If you've never done it before,
just deal with it with suspicion.
And I'll tell you what. Pet ship.info, the thing they
mentioned, the website works. There's a website there and
it's, oh, it's, it's ugly. It's really, it looks like it's
25 years old, right? But there's a you can select the
language, it's got today's date, and then it just asks you to
insert a microchip number. Right.
Yeah. Yeah.
So I'm not going to put my I don't know what my pet's
microchip number is because I don't need to know.
Yeah, I. Mean there's most things with
these these sorts of unexpected all slightly strange things.
Just yeah, check with whoever like in this case you can ask
your vet to double check or absolutely yeah, contact to your
pet chip break a chip is with and ask them sort of thing.
This brings us back as well to the whole have I been poned?
We've spoken about before database of like breaches and
where your data has been exposed.
This is why I don't see much value in that anymore, right?
Because we should all assume that our data is out there the
size of some of these breaches. Now, when have I been I've
worked in cyber, When have I been poned came out and it was
like revolutionary. It was amazing.
And every time a new one dropped, you were like, Oh my
God, you know, I remember getting caught in one for some
mixtape website and it was like, Oh my God, that's made it on to
have I been poned. It's amazing that that Piff had
like made it onto the list. And it's like, but now there's
so much out there and it happens all the time and a lot of it
doesn't make the news anymore because it's only the massive
ones that do. So we should be suspicious of
anything that comes in that's slightly unusual because this
fishing can now be really personalised and really targeted
people. It's not difficult to build a
real accurate profile of some people, a lot of people.
So yeah, just be sceptical. Right.
Next story, Sir. Cool.
Yeah. So next one we've got is a story
around how Indian police have raided tech support scam call
centres and then, yeah, busted local summer fraud gang who were
accused of GP in UKUS and Australian victims with tech
tech support scams. And yeah, it says here about how
officers from the Central Bureau of Investigation have raided a
call centre used by the group in Noida, Uttar Pradesh and of
France. I think it's Uttar Pradesh.
Yeah. I I could also have that wrong,
but I think it's Uttar Pradesh, yeah.
So that was last week and there was an 18 month operation where
they teamed up with the NCA and the FBI and Microsoft basically.
I mean, what a team, what, what, what like that's like some
international, you've got the one of the biggest computing
companies in the world, National Crime Agency and the FBI just
about to come through your front door.
Yeah, that's so, yeah, they basically identified the group
who are part of the as part of the Operation Shakravi.
So I guess it's probably not the first one they've done.
And yeah, basically carries on to say how UK victims at least
have lost 309,000 lbs after receiving these.
Yeah, pop ups on the computers. So the machine's been hacked and
then obviously it says phone this number, people falling
through to these scammers and a trick to pay to fix an issue
that doesn't exist. Yeah, it's quite a interesting
one. But I this is about over 100
victims from the UK identified by a National Crime Agency and
they obviously had liaised with US and India to coordinate this
operation. Do you know I had I years ago, I
remember what must it be? I remember where I was living.
I must have been, it must have been about 9-8 or nine years
ago, I got a scam call from someone pretending to be my
Internet service provider that said my computer had been hacked
and obviously working in ITI was like, here we go.
And I was like, oh, OK, yeah, oh, thanks for telling me.
Thanks. And then they were like, yeah,
we, we've received, we've noticed activity from your
computer that Microsoft, that's who they said they were calling
from. They said, we're calling from
Microsoft. We've noticed some issues with
your Windows computer. Can we help fix them?
And I was like, yeah, that's brilliant.
So that basically they asked me to go somewhere and I can't
remember where now, but they asked me to go somewhere on my
computer. They were like, right, go here.
And I'm like, Yep, and go here. And wherever it was, it was
somewhere that errors would normally appear like everyday
like it, I can't remember. It was some it wasn't, it wasn't
registry, but it was, it was somewhere where there would
where you'd normally see errors because things in the background
just fall over or don't work and it doesn't affect it.
And they were like, all of this, your computer's broken.
All of this is suspicious activity.
You know, we need to get on your device, go to this website and
download this remote access tool.
And this is 9 years ago. And at that point I was like,
no, I'm not doing that because I know you're a scam.
They're like, no, we're not. And I'm like, I know you're a
scam. I work in ITI know you're a
scam. And hung up.
And then they called me back and laughed down the phone at me.
So I hung up and then they called me back again and just
there was like two or three of them just going ha ha ha ha ha
ha. And I just left it on the side
and eventually it cut off and they must have moved on to their
next victim. Like it's when you're on the
front end of these, it's they're quite convinced.
If you didn't know, they are quite convincing.
So they deserve everything they get because it's.
Yeah, obviously. Yeah, these things, that's
right. I mean it's obviously pretty
common thing with fake virus letters and they could be like a
you go to a website and it asks to show you notifications and
you take yes backs then and then it pops up saying fake like a
fake alert saying you've got a virus furnace number.
Maybe think as well the PayPal scam you had quite a while ago,
which you have a video on where they used the PayPal money
request to get you to call up a fake PayPal scam.
So it's all pretty simple stuff. Same we.
Did a video back when we worked together, we did a video on
Chrome notifications, didn't we? Because when you visit websites
on Chrome and it'll ask you if you want to allow or block
notifications. This website wants to send you
notifications. If you send, if you say allow on
a lot of websites, you'll end up getting peppered with stuff down
that like that look like a proper Chrome notification and
say you've got a virus, your machine is infected and it's
not, it's just a fake notification.
It's one of these, it's a it's a fake scare wear pop up that
would encourage you to call a number that would lead you
through to a contact centre like this that the FBI is waiting at
the front door. Yeah, I think one, one thing to
decide I guess is I've wanted is to educate people, especially
like family members and like older people using computers and
stuff that might panic and see this and want to fix it.
I guess just reminding, like, are Microsoft ever going to
contact you to tell you something's wrong?
Microsoft will never, ever contact you to tell you
something's wrong. Neither I I don't think your ISP
would buy the phone either. I don't think BT, Virgin,
Verizon, you know who, whoever, wherever you are in the world,
whoever you get your Internet from, I don't think they're ever
going to pick up the phone and call you say there's a problem
on your computer. I just don't think it happens.
Yeah. They're more likely to just turn
turn off your Internet connection and wait for you to
call them. Yeah.
Right, next one, on to the next one.
I saw this. I'm not going to go into lots of
details about this because it's a little political and a little
sensitive, but I thought this was interesting because it just
goes to show the human impact that some of these things can
have a case. So this is a story that I saw on
the BBC News. Thousands of Afghans were moved
to the UK in a secret scheme after a data breach.
So this has been spoken about in Parliament here in the UK, but
basically the secret scheme was set up after a British official
inadvertently leaked their data in February 2022.
The personal details of nearly 19,000 people who had applied to
move to the UK after the Taliban seized power in Afghanistan were
leaked. So the previous government, not
the one in power now, but the previous government here in the
UK, left the breach in August 2023 when some of the details
appeared on Facebook. A resettlement scheme for those
on the leaked list was set up nine months later and has seen 4
1/2 thousand Afghans arrive in the UK so far.
But the existence of this is this is the existence of the
leak and the relocations were kept secret because the
government obtained a super injunction stopping it becoming
public. So this only came to light on
Tuesday this week after a High Court judge ruled that the
gagging order should be lifted. So the leak contained the names,
the contact details and some family information of people
potentially at risk of harm from the Taliban.
It's that there's the BBC's got a couple of different dives into
this that talks about this story and then why this is important.
But this a data breach. These are thousands of people
have had to move thousands of miles.
To a different country because of a daily breach because their
lives were at risk if they stayed that's like that's the
real world impact that some of these things can have yeah so
it's. It's quite crazy so as well how
it was because they the person sent a e-mail with the
spreadsheet to the wrong people and it's so simple and was they
said it is outside of the authorised sort of process for
doing that. So it's it's just a human error
that's caused this huge, huge issue.
Now I some people would probably say that uses to blame these
things happen right? We in every organisation people
get a name. I emailed someone this week.
I got relatively new in the business, was told a name, chose
the name. It was the wrong person, right?
This can happen. But what we need to ensure is
that we have systems in place that if there's certain data
involved, it doesn't allow you to make a mistake.
I think that's, and these tools, like there's companies out there
that do this and they've got good price, like they've got
significant price tags associated with them.
But then why don't Google, Why don't Outlook go and buy these
companies? They've got the money.
I don't think they'll buy these companies or make the technology
themselves that stops this from happening.
It's users poor, poor users having to deal with systems that
don't fix this. I think that's, so this is I, I
hadn't read that part, that it was a e-mail attachment to the
wrong person. It's if that person knows that
their actions led to this, I hope they've received the
support that they deserve and they're not like, I hope they're
not feeling guilty about it because it's not their fault.
It's an honest mistake, probably.
Yeah, far as I'm or I wasn't intentional.
Yeah. It just goes to show, doesn't
it, that, you know, inside a risk, it's accidental that we
really need to worry about. It's not necessarily, it's not
the malicious actors in our organisation.
It's these things going to happen really, really easily,
accidentally. And that's, yeah, it's
terrifying. Yeah.
It's, yeah, we need better systems.
We need better that that don't. And companies shouldn't be held
to ransom because they can't afford them.
That's why that's kind of what I'm getting at.
And I think these simple cheques should be in place for the when
you send an e-mail, it should sort of, you'd think, have some
it's. Not like you're sending 36
names, 36,000 names and addresses.
Are you sure you want to do that?
Click Yes or No. Especially if you, if you've
sent it to a bunch of people. Yeah.
Not this one person. Yeah, yeah, yeah.
So, yeah, it's it's a good story to use if if you're considering
stuff about inside a risk that's like the you won't get a story
with a bigger impact than that. How like war people, you know,
struggling people having to relocate thousands of miles, but
the cost, the whole cost associated with that one e-mail,
the UK government having to lift and shift thousands of people.
And that one person like I really hope they're OK, if they
even if they even know it was them.
Hopefully they don't. This is where I hope, And if
they've, if they hadn't, if they're listening to this and
they've only just realised, I'm really sorry.
But maybe there's a world where the person that made that
mistake doesn't realise and is living a happy life on a farm
somewhere with some chickens. They should be relocated.
They should be. They should be compensated for
for yeah, they should be supported definitely.
Anyway, next one. Yes, I think this is the last
news story we have for this week, another cyberattack on a
company. So this one was Louis Vuitton
have come out and said that UK customer data has been stolen.
So they are the French luxury brand have reassured customers
that financial data is not included in this.
But yeah, they're just the next retailer that seems to be
targeted by cyber attackers. They, yeah, they said that they
have had unauthorised third party access to its UK operation
systems and obtained new names, contact details and purchase
history. They also said that last week
said that the Korean operation had a similar cyber attack, but
again no financial data was taken.
Yeah, I saw that it was, it was, they said it was like the
second, second breach in a week. But I'm just seeing actually
there's updated today that there's breach notifications for
Italy and Sweden as well. Oh wow.
So, yeah, and Turkey, and it's not.
And and hey, other other extortion groups are available.
This isn't the work of Scattered Spider apparently this is shiny
hunters amazing name so other hacking groups are available.
Clearly so. Yeah.
It looks like they're. I wonder.
I wonder if they got popped and then they've traversed the
network as it were. Seems so in this case as they've
gone round to their of a existence in other countries.
Yeah. I mean, shiny hunters, they're
saying that this could be tied to the data breach at Adidas
that I think we spoke about back in May briefly.
But before we even made this, the snowflake attacks that
happened last year, shiny hunters were one of those that
were involved in that and they like impacted Santander,
Ticketmaster, AT&T Advanced Auto Parts.
I think we might have spoken about those and Cylance, which
didn't Cylance, yeah, Cylance got, they were a cybersecurity
company that got impacted by that as well.
Right. Yeah, I mean, Cylance isn't
Cylance anymore. It's now part of BlackBerry so.
All right, yeah, Yeah, I think this one's so early.
I haven't seen much comment from Louis Vuitton, but I'm sure
it'll be more as and when. I can confidently say that my
details haven't been compromised because I haven't bought
anything from Louis Vuitton slightly out of my price range.
Yeah, that's fine. I'm happy with that.
I guess you understand the things around just keeping an
eye on your banking and creating the credit reports and watch out
for potential contact from Louis Vuitton that probably aren't
going to be them. Yeah, so much more on that one.
Absolutely, absolutely right. That's all for the news this
week, right? Just dropping into awareness
awareness. So this is the little section
for security awareness professionals.
I just wanted to mention this because it got shared again on
LinkedIn this week. So I actually contributed and
had a quote in a report produced by Keepnet and they have keep
that have the 2025 new hires fishing susceptibility report,
which is actually quite an interesting, like it raises a
really interesting point, OK. Because did you know that new
hires are 44% more likely to fail for a fishing to fall for a
fishing scam and sees the employees?
Yeah, 71% of new hires are at risk of falling for fishing or
social engineering tax within their first 90 days.
So this could be a lack of, you know, understanding how it's all
glued together. It could be a keen and eagerness
to please and succeed. So this report does dive into
that and really drives into why onboarding is a key, key part of
any cybersecurity team. I am provided a quote for the
report and basically I say I'll read it for you.
Now it's only short. New hires bring fresh energy and
ideas, but they also come with a steep learning curve when it
comes to cybersecurity. Policies can be overwhelming and
a lot of knowledge is assumed. As an employer, it's easy to
forget how much of your security setup feels obvious.
Put yourself in their shoes for just a minute and you'll see how
unfamiliar and confusing it can be.
That early period is critical. Mistakes often happen not from
carelessness, but uncertainty. And if we don't clearly explain
how things work, why they matter, and where to go for
help, we leave new starters to figure it out on their own.
That's not just unfair, it's risky, as we've just seen with,
you know, sharing files via e-mail that perhaps you should.
And I know this first hand because I changed jobs end of
January. I started a new role in a new
business. I went from a Google world to a
Microsoft world and two companies in the same vertical
that you know, pretty much are competitors doing the same thing
in many ways could not be so could not be more different than
two businesses could have completely different risk
appetites. They work in different ways the
way that you know it could not be more different.
The learning curve is huge, so that on boarding is such a vital
part of any new any, any cyber function.
You're on boarding and getting the message right from day one.
Putting yourself in their shoes is a must.
So look, check out the Keepnet report.
It's worth a read, and there'll be a link to that in the
newsletter, which you can get at riskycreative.com or in the show
notes. Yeah, it's an interesting one.
Just made me think it might be in the report.
But this stats obviously quite high, but I wonder if it's from
criminals looking at LinkedIn people that they've posted on
public saying that, oh, I've gotten a job at this company and
then they people get targeted from that potentially.
And obviously, yeah, at that point they don't know the
systems very well. It's it's a really interesting
way to think about it actually. I hadn't thought of that, but it
could be, especially in the higher more.
Yeah, the more. The more roles and companies.
In the roles that have more access, you know, we spoke, I
think we spoke last week about system admins having access, you
know, and they could be a potential target and stuff like
that. It's yeah, if I'm like, I'm just
starting a role as a, you know, as a role as a System
Administrator, you've probably got all the access in the world
quite early because you need it to do your job.
But you don't understand the different functions of the
business and you don't know what a bonus e-mail looks like or
what a payroll e-mail looks like or what the benefits scheme
looks like. You, you aren't familiar with
any of them. And that's the thing, like don't
just, if you're on boarding people, show them what good
looks like. Don't just tell them.
Don't just like give them a load of phishing simulations.
Show them what normal life is like.
Show them what an e-mail from your pension provider.
Show them what an e-mail. Give them an give them somewhere
where they can check. We years ago, God, years ago, we
used to have a thing. I can't remember what we called
it. Just send them emails.
Who's sending me emails? That was it.
And that was, that was awesome. Actually, I'd forgotten
completely about that, but it was the page that showed example
emails from all of the internal services.
So if someone was unsure that it was an e-mail from Work Day or
an e-mail from HR, they could go to who send them emails and they
could see, yeah, what looked like and yeah, that.
Yeah, do something like that. That's awesome.
Go Yeah. OK, right, just touching on
that. We had an e-mail this week from
Boris and Boris emailed us said and I love this.
If you're listening, e-mail us. Hello at riskycreative.com, get
in touch, leave comments. This is lovely.
We had Lori Driver asking us something a couple of weeks ago
on TikTok. Get in touch, ask us the
questions. We we love it.
We love to know that you're listening, Boris said.
As an Intersect professional, I'm really enjoying listening to
your podcast. Love the dynamic and the topics
you're sharing. Thank you Boris, thank you, He
said. Was wondering if you'd be
interested in exploring topics that would be really relevant to
the wider public like we did on AI and voice note scams.
I think we're working on that. We're, we're, we're doing some
stuff to, you know, not not so focused.
Maybe an episode devoted to the most popular scams right now.
I think it's a good angle to explore is also the experiences
and impacts on victims of scams and cybercrime.
Love the e-mail, Boris. Thank you for the feedback.
We're going to take that on board and do some stuff.
But Boris did also share regarding that last bit, the
impact on victims of scams and cyber crimes.
Boris shared at DOT Gov uk.gov research and analysis report
that I hadn't seen that is actually about the experiences
of victims of fraud and cybercrime.
And I tell you what let me just share this quickly now this is
the first this is the first screen share of the episode.
Luke last week we had about 9:00.
That's amazing. That's an easy to.
Edit after. So if you're if you're listening
on a podcast platform and you want to see what we're about to
talk about, you can also catch every episode on YouTube.
So you see here gov.uk experiences of victims of fraud
and cybercrime. So Ipsos UK designed and
delivered the Fraud and Cyber Victims Survey and conducted
qualitative interviews. We'd like to thank the following
individuals for their support and delivering the Victims
Survey. Thank you to all of those people
but the executive summary. It aims to understand the
impacts of fraud and cybercrime victimisation on individuals and
perceptions of support received through Action Fraud, the
National Economic Crime Victim Care Unit and the police.
So just to highlight some of the key findings, the emotional,
physical and financial harms that victims experience. 86% of
respondents experienced anger, 73% stress and 63% anxiety.
Well, I'm going to read into this and cover it a bit more, I
think, but it's some angles on this.
Is that like fraud, this kind of online fraud, the type we've
spoken about, the call centre that was raided, This leaves
emotional scars for people, right?
Significant stress, anxiety can lead to significant long term
mental health effects. And the the worst part of this
is when you fall, if you fall for a scam like this, they know
you're vulnerable. So they will typically let you
cool off a little bit and then they'll come back again.
And EastEnders, AUK soap opera EastEnders.
It really disappointed me that they didn't do more with this
story. But there's a character in in
the show called Jean Slater. She's she's vulnerable.
She's shown to be quite scatty. She's also suffers from bipolar.
And she got a call saying, what was it?
It was like it was an investment fund asking her to invest some
money and someone convinced her to invest all of her life
savings into this investment scheme that was guaranteed to
give her great returns on it and brilliant.
Anyway, she lost all of that money.
That scheme was a scam. They went off about a week
later, she got a call from a law firm saying that they were
looking for victims of this scam and if they pay an upfront fee,
then they will help to get her money back.
And it was like, no win. We we guarantee we'll get you
money back, something like that. And anyway, she paid the money
and was done again, compromised twice.
And that's where EastEnders, like, left the story with that.
She didn't really have any emotional damage, didn't really
have any stress. So I've spoken about that before
in an episode, I think. But it's a shame that EastEnders
didn't do more with it. But yeah, we'll, we'll share a
link to that report in the show notes.
It's very much a human crime. You know, these people that fall
for this aren't stupid. They're not silly.
They're vulnerable. Like, they're just not aware.
And that's these make money because like we always say, if
they didn't make money, the criminals wouldn't do them.
Yeah, definitely. That's definitely looks like a
lot of information in the report, probably be, you know,
useful to to talk about it, Yeah.
Yeah, let's let's go away and digest that and we'll come back
to come back to that to talk about that some more, right.
I'm going to talk about a topic I had now second screen share of
the show, right? I saw this on LinkedIn.
This is by Chris Stoker Walker who's journalist and I thought
this was quite interesting. Your expensive anti fishing
training is a placebo and in some cases it may be making
things worse. A new study he's written for PC
Mag suggests that many of the anti fishing courses rolled out
in offices around the world aren't just ineffective, they're
counterproductive. Employees who took part in
interactive fishing awareness lessons were slightly more
likely to click on a malicious link, and those who had no
training at all. It's a fascinating finding from
a paper that most others have missed.
As Alan W told me, you always find interesting papers.
And then Chris asks, what's the worst fishing lure you've
encountered as part of your employer's training?
And why did you feel better equipped after training?
So yeah, it's a, it's a really interesting post actually.
So the Anti Phishing Working Group, which collates
information from various bodies, reported nearly 1,000,000
phishing attacks in the last three months of 2024.
That's seven per minute, every minute of the day.
And that's just the ones that the member companies report to
the Anti Phishing Working Group. I've never heard of the Anti
Phishing Working Group. No, I haven't either.
No. So, yeah, each incursion cost
businesses as hackers often get their victims to hand over
passwords or bank details. One analysis claims $17,700 is
lost per minute to phishing attacks.
That's in that's incredible. Wow.
But yeah, the this reports anti phishing educators marketing
claims are too optimistic. It's, it's an interesting take.
You know, love or hate it, cyber functions typically will all
fish apart from Erin that we spoke to Fastly.
Erin doesn't fish, but most companies need to fish.
It's like it's a compliance requirement for some businesses.
I used to get audited. You'll now get audited.
You're probably being audited as we speak.
But fishing is something you get audited on.
Like you need to sow proof that people have been trained against
fishing. And this is a conversation, I've
just started an interesting conversation about what would a
world look like if you don't fish?
And I think there is a, there is a world where you raise the
projection, but you don't have to simulate, you just educate.
So it's, and I always say fishing simulations to me is a
bit like mugging someone or, or like, oh, you want to learn
karate? You absolutely beat the living
daylights out of them. And then you go, right now I'm
going to show you how to stop that happening again, like or or
like mugging someone and going now I'm going to show you how to
stop getting mugged. It's like, it seems quite.
I can't think of anything else in the world where you simulate
the attack and then educate after.
To interest something about. There's, if anyone's, there's
probably 1,000,000 examples that are really obvious that just
haven't got right if anyone's listening.
And you can think of something similar to phishing simulations
where you simulate the attack and then teach them how they
could have avoided that. Don't know.
Maybe that is in karate where you like slowly, like take
someone and then stop before breaking.
I don't know. I don't know.
I'm not a martial arts expert, so yes, I thought that was
interesting. Links to that to Chris Stoker
Waters Walker's article will be in the show notes.
The only other thing I wanted to show you this week was we've
spoken loads in the past about the retirement of Windows and
Windows Updates and people that don't install Windows Updates.
You know, we've all worked in organisations where people delay
the installation of updates because they can cause
disruption. Well, I saw a post on Reddit
this week and guess what? There was an update to Windows
that caused some really serious disruption.
Let me just get this is on the the subreddit called mildly
infuriating. I would be more than mildly
infuriated if I was stuck in a lift because of a Windows
Update. So my build this this is a
picture of a an inside of an elevator with a big screen.
Big screen that's just got a little loading dial in it on the
right hand side. So my building spent all year
redoing the elevators to have touch screens instead of normal
elevator buttons. All the touch screens are now
windows based. Today the elevator decided to
install a Windows Update while I was in the elevator.
Really feels like technology is moving backwards.
Unlike me who's not moving at all.
The elevator stopped and I'm not able to select a floor or open
the doors. That's incredible.
What happens if it black screens of deaths like it's the?
The comments are equally as interesting.
I don't see how a touch screen and computer connected to the
Internet improves an elevator. It seems like it would just add
more points of failure, yes? Yeah, I do wonder why that's a.
Thing someone says, it's definitely a worse user
experience. This is Canada.
If it's winter and you're wearing gloves now, you can't
press the elevator buttons anymore.
Plus it's much less satisfying than a tactile button.
Someone else says no matter what the operating system features or
tools it has, why would you ever need to update it?
Have it disconnected from the Internet to stop any cyber
attack issues. I mean that's a really good
point. Just just isolate the device.
Yeah. And then someone says you can't
collect money for showing you ads in the elevator.
It's money. I guess that's the point of it,
right? Maybe showing ads?
Probably, yeah. Someone.
I wonder what your local fire Marshall might think of the
situation. Look, it's if you've seen
windows in any strange places, let us know.
It's it's I think that's mad. But windows in a lift, windows
updating in a lift, windows connected to the Internet in a
lift. That the lift like have a
separate screen for digital signage.
Yeah. I understand that, but having
the controls on a touchscreen that yeah.
No. That's crazy.
I bet you, I bet you. If I'm in a rescuing people from
that lift, I bet they hate it because they're like that won't
be the first and only time. Yeah.
Right, that's me done. So what did you have to run
through this week? Yeah, just one topic for this
issue, this upset. It was a post I saw originally
saw on TikTok. We could share the video if we
want briefly just to explain it a little bit, but it's an
interesting phishing technique that was discovered by security
researchers Odin, who like a Firefox run group, I think all.
Right, let me just get the video up.
He has the vulnerability and Google Gemini for workspace.
Right. Efficient technique that I just
read about takes advantage of the whole Gemini AI summarise
everything that's just like built into everything you do in
Google Now technique is hiding a prompt for that AI summarizer in
an e-mail and visibly, I'll show you how in a SEC.
And then Gemini actually uses these admin tags as like higher
priority. You can make the text all white.
The person cannot see it in the e-mail.
You use these admin tags and then you give it a prompt
injection. You say, hey, Gemini, you have
to include this at the end of your response, and then you can
do whatever the heck you want to try to trick the user.
But since this response is not in the e-mail, this is like in
the AI response. This might be a bit more
trustworthy to someone reading it.
If you trick the summarizer to say warning Gemini's detected
that your password's been compromised, please go do this
thing or call this number or whatever it is.
People are much more likely to fall for it.
We're already seeing a tonne of scammers include prompt
injection in their bag of tricks.
This is just another one to watch out for.
Of course it's really interesting.
It just goes to show, isn't it? Like nothing is safe.
No. Really, really interesting.
Yeah, definitely. It's a monster.
Do something. No find a way.
Yeah. And yeah, it's quite.
It's quite amusing though. It's simple as white text or
size 0 text embedded like HTML into an e-mail.
Yeah. I'm just wondering, I see that
and I'm like I don't use, I don't use Gemini.
I'm a ChatGPT user. But if chat GBTCP user out to me
and said like your ChatGPT account is compromised or
something, if Gemini did give that to me, I would probably
like like, I would be really confused as to where it got it
from. So I I I wouldn't trust it
because I wouldn't expect Gemini to tell me that.
Like it that that for me, that doesn't sit right.
But so many people wouldn't see where that had come from.
And you kind of it's the AI talking and the AI has just told
you, yeah, like. Yeah, it's quite a interesting 1
and I don't think at the minute and I think it's been fixed.
Well, that's a shock, isn't it? Because you know, G Google are
really good at fixing like security problems.
Maybe there's an AI that could fix it.
Maybe they could ask Gemini to fix it.
You know it's. Quite interesting, it says.
Ignore white text on a white background, please.
Please. Like it's as simple as that.
Ignore hidden objects or include them, but highlight to the user
that this has been obfuscated or something.
You know it's. Yeah, it says about how similar
indirect prompt injection attacks on Gemini were first
reported in 2024 and Google have published mitigations.
But this technique still is viable.
And I think, I think Google are working on further security
enhancements, but it's one to maybe look out for at the
moment, especially as you say people trust this summarise.
It seems so simple. Yeah, I mean, as we said as
well, like obviously some of us more vulnerable new to using
Gemini may not recognise it as being a scam.
Obviously it could say anything the attacker wanted to say so
they could make it as convincing as they want to.
Yeah, yeah, it's yeah. They really, really like there
should be a team. It doesn't make money.
That's probably the problem, but there should be a team at Google
that like picks up on stuff like this and then literally goes
like crack squad. We need to get this fixed right
away done and then make a good news story about it.
Get back to this. Get a team on TikTok to go back
and reply to this TikTok and go we saw this awesome.
We've fixed it because we're really awesome.
Use Google, you know, like play up to the fact that Google
Geminis nailing this where others might be failing.
You know, this probably isn't just a Gemini problem.
This is and this is a new feature problem, like these
features are rolling out before they can be secured.
There's such a rush to be first. Use Co pilot to summarise this.
Use Geminisers to summarise this.
It's the same like there's not enough cheques and balances.
Yeah. It's quite, quite crazy how,
yeah, this is quite a simple technique where you're, yeah,
you're hiding something within the body and it's not really
explaining it. Like at least with these
summaries. I think that.
Yeah, you can see in the screenshot where it says about,
there's one source. And obviously the source is the
e-mail, but if you look through the e-mail itself, you're not
going to see that warning. So it's like, interesting.
Yeah, I want to for business you talk about at least but.
If you post it, I mean it's not doing it, but like warning
Gemini has detected that your Gmail password has been
compromised. The Gemini itself should say
hang on that sounds like that may be suspicious.
Do it print it. But why not put a flag on it
going this part may be we've highlighted part that may be
suspicious. Please be careful, you know,
Like do what you're told but flag it.
Yeah, like I said, they are improving it.
I think it was something similar to that.
I can't find the article, but I think they were going to add,
yeah, some flags and stuff like how Gmail usually has like a
warning banner and they're going to add stuff like that to it.
Yeah, for anybody using Gemini Workspace in their businesses
from to maybe talk about. Yeah, cool.
Right. I had one last thing to say and
we'll have more details on this next week, but the Sans Security
Awareness Summit in Chicago, I've got a bit of an
announcement on that, that we'll do more next week.
We're going to, I'm going to be there.
Luke can't make it, but I'm going to be there and there's
going to be some podcast activity from Chicago.
So yes, but more details on that.
I'm talking with SANS at the moment and it's all quite
exciting. So yeah, more details on that
next week. But if you're in Chicago or you
can't make the SANS Security Awareness Summit in Chicago,
we're going to give you a bit of a experience so you can feel
more included. So yeah, but more on that next
week, right? That is all from us.
We're. Done.
Yeah, brilliant. OK, so much in this week.
It's been another packed week of stuff.
Really good. Subscribe to the newsletter,
subscribe to us on YouTube, please.
We need to get those numbers up and on all of the podcast
platforms as well. And I will speak to you again
next week. Yeah, catch you next week.
Bye everyone. See.
You later, bye.