This week Instructure paid Shiny Hunters and says the student
data is gone, but nobody believes them.
Twin brothers got fired on a Teams call, forgot it was
recording and deleted 96 government databases live on the
mic. Kids are beating age
verification with a drawn on moustache.
This isn't a joke, it is a news podcast.
Google says hackers used AI to find a zero day for the first
time and a Stoner just recovered $400,000 in Bitcoin after losing
his password whilst high in 2015 using AI.
All of that and more in this week's The Awareness Angle.
With me, as always is I'm sorry I've done it again.
I'm Matt Davis, obviously, and with me, as always, is my
partner in cybercrime prevention, Mr Luke Pettigrew.
How you doing, Luke? Hey, I'm good to you.
I'm good. What was the last thing you said
to me before I pressed record? Don't forget to introduce
yourself. And I did it again.
So there we go. Yeah, that's all right.
Another week of crazy news stories that sounds just as
made-up as last week. I like, it's unbelievable isn't
it? Drawn on moustaches, deleting
whilst live on a team's recording and AI recovering a
stone as Bitcoin. That's just the tip of the
iceberg. There's a few more we've got to
talk about this week, so let's get straight into it, shall we?
With this week's breech watch, right, first up, nobody believes
the hackers who breached Canvas actually deleted the student
data. So a couple of weeks ago, we
spoke about Instructure and Canvas.
This was all of the universities, not just in the US
as someone on Tiktok pointed out, but it's in the UK as well
that they were looking in to do finals and there was a lovely
ransomware message displayed. So shiny hunters claim 3.65
terabytes of stolen data from Canvas Stroke Instructure.
Canvas LMS is the product. Instructure is the company that
develops it. 275,000,000 users across 9000 schools worldwide.
It's huge. And the data included names,
emails, student IDs, and billions of private messages
between students and their teachers.
So it was reported this week that Instructure paid up.
They paid the ransom. They're all a ransom.
It's not been disclosed, I don't think.
And they've claimed to have received shred logs as proof of
data destruction. So they've paid to make the
problem go away. According to the Register, every
single security expert that they've spoken to doesn't
believe that the data is gone. And why?
Because back in 2024, Power School did exactly the same
thing. They paid $2.85 million in
Bitcoin, watched a video of the documents being deleted, and
then five months later, that very same data was used to
extort individual school districts.
It just moved down the pipe, moved down the line, went to the
supply chain. So it's it's almost a supply
chain attack at that point. So yeah, I think this is this is
an example of, and we've spoken about this before, many
businesses attitude to a ransomware attack will be pay
the ransom, get the problem, make it go away, make it go.
Away. Yeah, some.
It's also something that I mean, a lot of, I don't know, maybe
not a lot, but some governments recommend not to pay it, right.
Yeah. Maybe even some cyber insurance
might have some sort of stuff around that sort of stuff.
But no, it's you don't usually hear of companies doing that and
not so more recently. Not so openly as well.
Yeah. But yeah, I guess it makes you
wonder how many copies of it exists and is it backed up
somewhere? Someone copied it to the yeah
hard drive or something. The Register says that whilst
data suggests that fewer organisations are paying
criminal ransomware demands, Chain analysis found percentage
of paying victims in 25 dropped to a new all time low of 28%.
Despite previously hitting record highs.
The pay not paid debate still becomes much more complicated.
And we spoke about this actually.
I think organisations say publicly they won't pay and many
genuine don't. But when in that situation, your
playbook goes out the window and you just like, you know, you
start making those decisions in the heat of the moment and you
just want to get it solved. So yes, it's one to look out
for. If, if, if you've been affected
by the Canvas breach, keep your eyes peeled over the coming
months because and, or if you're a customer of if you're an
organisation or an Academy or an educational institution that
uses Canvas, this might not have gone away.
This just might have been gone. This just might have gone away
for now, I think is the message here.
It might, might not be Canvas's problem anymore in structure,
you know, we've dealt with it. Anything that comes down the
pipe's probably someone else's problem now.
So yeah, just remember as well, any views and opinions expressed
in this show are ours and do not represent those of you.
Our employers probably should have said that from the off, but
there we go. That's right, it had
prerecorded, Yeah, little piece drop as.
The disclaimer in the titles, right, Move on to the next one.
Cool. Next one, we got 716,000
impacted by Open Loop Health data breach.
So hackers have stolen personal data of individuals during
January 2026. It's a telehealth platform, Open
Loop Health, which is like a remote care consultation and
monitoring platform. Yeah, they've had they had
access for roughly 24 hours before being discovered and a
16,000 individuals have been affected.
Names, addresses, emails, dates of birth, medical information,
Social Security numbers for natural data was not accessed.
Gotten to open loop and a frag to call in themselves stuck in
2019 claimed responsibility on the hacking forum.
I mean that they had 1.6 million patients, which is interesting,
certainly a lot more than the affected individuals.
And by posting some samples as proof that the forum listing was
taken down, which is a bit of a weird one.
And yeah, it this sort of effects multiple health care
organisations, not just one thing.
So they're AUS company, yes, not just not just limit to one
hospital or one on a clinic. So every organisation that uses
their infrastructure to deliver virtual care may be affected
with this? Yeah, it's discovered on January
7th, engaged fed by cybersecurity specialists,
confirmed that they were terminated within 24 hours and
they notified various various places.
And yeah, it's interesting that yeah, they've claimed 1.6
million records, but there was a confirmed number of 716,000.
But maybe there's some something weird going on there, duplicates
or some exaggeration there. But yeah.
And not too unusual. Affected individuals being
offered one year of free identity and credit monitoring.
I find this, I mean, this is a great example, 24 hours, they
had access for 24 hours and they've made off with, you know,
over 700,000 records and yeah, the damage is done.
You know, that's all it takes. It doesn't need more than that.
Yet the average time to discovery from your network
being compromised is like 200 days.
So it's imagine the damage they could do in 200 days, you know?
Yeah, it's mad. No, it's go crazy.
Yeah, so and the other thing here is they're a back end
platform. So they're not they're someone
that you wouldn't realise had your data necessarily.
And then she'd really done a deep dive.
So it's, you know, you may be affected by this and not
realise. Yeah, but that's the other scary
thing with this. So keep an eye out for fishing
obviously I think is the big one.
It's it's. Yeah, definitely.
Any data? Anything dodgy around your
medical because it's it's names, addresses, e-mail addresses,
date of birth and medical information.
So any how would they use that medical surveys, medication
surveys, counselling, you know anything new that doesn't look
normal that references anything medical related to you.
That information is out there. It's not like, Oh, well, it must
be true because only my doctor knows that.
Not anymore. Many more people know that now
or could know that. Yeah, so.
Well, hopefully those affected now may know who they are, but
there's not a lot of information on this article.
But yeah. Right, that's it for this week's
breaches. Let's move on to some news,
right? Top story this week.
I love this. I think this is brilliant.
Twin brothers deleted 96 government databases while still
on a recorded teams call. So the brothers, they worked for
a company called Opexus, a Washington, DC firm that sold
software and services to 45 different federal clients.
And they were fired after the company discovered that one of
them had a prior felony conviction during a background
review. How did they even get recruited?
It's only upon a further review that they've been fired.
So HR terminated them during a team's call.
Could can we have a team's call? Yeah, We're terminating your,
your contract because we've found this out.
The access for one of the twins was cut immediately, the one
that had the felony, but the other one had connected to the
VPN 10 minutes before the meeting and still maintained
full access. So that that twin Munib started
restricting changes to production databases and then
deleted them. And the entire conversation was
recorded because the HR person had been recording the call and
the brothers didn't leave the HR call after HR had disconnected,
they stayed on the team's call. So they had actual video
evidence of this and the entire conversation was captured,
including lines like people are locked out for the day, this is
the perfect time, don't worry about it, you don't do nothing.
It's like wow. Yeah exactly.
Also stolen 5 1/2 thousand username and password
combinations and built Python scripts to test them against
airlines and hotels and used stolen air miles to book himself
a flight. This is they've been found as
Sahib was found guilty by jury on May the 7th.
Mooney pled guilty in April but has since filed handwritten
letters from gaol trying to walk it back.
So they've potentially faced decades in prison.
This is where security needs to talk to HR to make sure that
this happened instantly after someone's been dismissed.
Security awareness around the dismissal process and the
leavers process needs to be nailed on somewhat.
I think like there's a perfect reason.
Send that to someone in your HR team and go, can we have a chat
about this? Could, could a scenario where
this happens occur here? And it's not necessarily the one
that they were actually according to this, it's the
brother that they were dismissing and the other
brothers done the actions. So, you know, you need to spread
your net a little wider. Husbands, wives, brothers,
relatives, that kind of thing. It's yes, the second someone's
fired, you need to cut that access immediately.
Yeah. And why background cheques not
been done before? Yeah, quite, quite bizarre, that
one. I, I, I love the fact it's all
been caught on video. Like these aren't stupid people.
These are intelligent people that can, you know, maintain
databases and steal passwords and write Python scripts.
But they forgot to press stop on the recording.
Yeah. Yeah, or even the call go to a
private one. Yeah, yeah, we're.
Just hanging up. All I had to do was hang up.
That's right. That's great.
That's great, yeah. I'll let move on to the next one
is brilliant. Go and you can have this one.
Go on next one, we've got some kids bypassing age verification
cheques with a fake moustache. So yeah, as we know, the age
verification systems, I guess, particularly the ones in the UK
with the Online Safety Act, are not very good as yeah, children
have been found to draw a fake moustache with makeup pencil and
they were able to bypass these cheques and be verified as being
old enough. So apparently if you have a
moustache, you're over 16. According to this, it's as.
Simple as that. So it's AUK based non profit.
Internet mass surveyed 1300 children aged between 9 and 16.
Half of them said the age cheques were easy to bypass. 1/3
said they've they've bypassed it.
So there were some methods, various methods drawing on a
moustache point in the camera, a video game character which we
covered before, totally funny faces, simple things that you
seem fake birthdays or boring parents ID.
I'm sure that's not borrowed or or like temporarily stolen.
Can I borrow your driver's licence?
No, it's going to be where's Mom's purse?
And yeah, the fake moustache trick works across multiple
different platforms, yeah. I wish I'd have, I wish I'd have
read this a few weeks ago because it was two or three
weeks ago. My son had to do the age
verification on Roblox and if it comes up for any of my other
kids I'm going to test this. We've got a fake moustache
somewhere. I was looking for it for this
episode because I was going to put it on but then I realised
I've already got 1 so it wouldn't really work.
Yeah. So obviously it's not just the
UK in this Australia, 25 U.S. states also have some form of
age ratification in place. And if it's some other, some of
countries isn't there, not just not just those, but yeah, many
governments are rolling this out as a requirement for social
media or adult content websites. And yeah, then you sort of, they
use these AI age estimating scans, which obviously aren't
very good or you upload your ID, but a lot of people obviously
don't want to upload their their ID to it.
And yeah, the idea is obviously to protect children from harmful
content, but in the the reality is that they're bypassing these
fairly easily. So yeah, there's not much of a
surprise that we're talking about this again.
I remember saying it was really good that Roblox had done it.
When we spoke about Roblox two or three episodes ago, I
remember saying, oh, it's really good that Roblox had done that.
So he gets age-related content. Completely naively, even me
having covered this before and I was doing this every week,
naively, I remember thinking, oh, that's all right, Yeah, it's
performative, isn't it? It's.
It's security theatre. It's.
Yeah, I and I felt they. Get fined but.
I felt victim to that as well. I was there thinking it'd be all
right because they're checking his age, but actually he could
have been doing anything. I think previously before it was
the game with Norman Reedus wasn't it?
Where they had his icon put in places.
Yeah, Death Stranding game. Yeah, Death Stranding.
It's so realistic, wasn't it? Yeah, yeah, yeah.
I guess after this check where your where your ideas.
Yeah, it should be right here, actually.
And just. No, it's here.
It's all right. I've got it.
Yeah. Yeah.
But yeah, that's. The amazing thing?
Let's just go back to the beginning of what you said
there. You said they surveyed around
1300 children aged 9 to 16. And basically the kids said
themselves that these are easy to beat.
Like it's a known these, these kids aren't stupid.
They've found a way round this. They're finding a way round
this. I mean, they're, they're the
share of their friends, right? They're not not going to keep it
secret. And they're not, it'll be at
school going, I can't play that game on Roblox anymore.
I'm not old enough. And one of them will be like,
yeah, yeah, all you need to do is open up this game, you know,
go to open up FIFA. Draw a moustache.
Draw a moustache on or open up FIFA and get they'll all be
coming into school with their sister's eyeliner.
Like I'll bring my sister's eyeliner in tomorrow and then
they'll all be after school with teach be like, why have you all
got moustache? Yeah, yeah, this is brilliant.
It's brilliant. Well, it's, it's brilliant.
And it's also it, it doesn't work like this is not the way.
Yeah. That's yeah.
It's really not great, No. And I wonder if it's ever going
to be improved. How?
Yeah, yeah, yeah.
Right, I'll move on to the next one.
Fake clawed code installer is stealing developer credentials.
So this is from Ontinue and it's a blog that they've posted
attackers and we've covered this before, but not for Claude
attackers set up fake Claude attackers set up fake Claude
code installation pages promoted through sponsored Google search
results. The fake page looks identical to
a legitimate Claude code documentation, but swaps the
install commands destination to an attacker controlled domain.
So we've spoken about Google Ads before.
Google decided in their infinite wisdom that ad blockers were bad
because they were costing the one of the richest companies in
the world lots of money. So they blocked the ability for
you block origin and ad blockers to stop working in Chrome, which
is the most widely used browser. And of course, now Google Ads
appear at the top of every Google search.
And this operation targets developers who search on Google
for install clawed code. And then the top results would
be a sponsored result. And it looks like a legitimate
clawed code page. We've covered this numerous
times. You found one that was a
compromised Google Ads account for Sydney Zoo.
You found another one for, AH Refs.
You know this, this happens so frequently.
We found them live on air whilst recording this.
That's how easy they are to come across.
And you can't unless you look at the domain or you look at the
download domain. You can't tell that easily,
especially when you kind of trust Google.
So this, this one's quite interesting.
It renders an altered one line installation command in HTML
that looks identical to the one from Anthropic, but sends you to
events.msft.msft23.com instead. The payload doesn't match any
known malware family, it's been compared to a number of
different ones, and there's no technical match, which means
this is either new or privately maintained.
And the malware cheques your Windows region settings and a
ports installation if you're in Russia.
Should we just all get AVPN to say we're in Russia?
Would that solve? Should we all just tell our
systems? Yeah, we're sat in Moscow?
This isn't, again, I would not just Russia, Russia, Iran or CIS
countries. This isn't the first time again,
that malware won't run if you're based in one of those countries.
And this is fresh this year. The date the the compiled date
on the helper places it within 60 days of Chrome 144, meaning
whoever built this is tracking upstream Chromium changes and
updating the tooling to match. So this is just this is being
maintained and being updated. So updating Google Chrome
doesn't fix this issue. It's still coming.
You cannot trust sponsored links on Google.
Full stop Google. Like we've said about Meta
selling advertising to anyone, Google should do better.
They could do better. How difficult is it to like it
it there's ways they could do this, but they generate too much
money. So and if you're a developer,
think about the access that a dodgy cloud code.
It's got the keys to your Kingdom, literally the keys to
your Kingdom that you're going to put in it.
It's be really, really careful. Go straight to the domain.
Don't Google it. Cloud dot AI,
claude.aianthropic.com something like that.
Just go there. Yeah.
Anyway, that's, that's yeah,
that's my rant over on that one. If you're in a business, have a
safe, why not have we used to have I built, when I worked on
help desk 1215 years ago, a shortcuts page in a Google site
that all the frequently visited links.
And this was before I really had a security hat on.
This was just convenience. All the regular links that we
had to visit as a team on help desk, I put them all on a single
page. So rather than searching through
your bookmarks, I mean bookmarks we spoke about a couple of weeks
ago, but I had a shortcut page. Businesses should have sites
that link to trusted download destinations.
And as an individual, bookmarks use bookmarks.
We're bringing bookmarks back. Come on.
Yeah, yes. Let me know how I am.
Maybe like a software repository that's maintained by all that
someone as well is the another option.
That would be the more mature option than a, than a
destination for the download page of bookmarks.
Yeah, I think that's it on that one.
It's yeah, Google ads, man. Just stay away from the
sponsored links. Yeah, yeah, it's a good one
maybe. What's the next one?
Yeah, so this one, Google have confirmed that hackers have used
AI to find a zero day for the first time.
So this is a it's a blog post on their Google threat Intelligence
group. But they still sort of said that
a cybercrime group has used AI to discover a previously unknown
vulnerability in an open source system administration tool and
built an exploit for it to deserve.
There's a report the details how this has sort of been done.
And yeah, they're basically found some some stuff in this
zero days sort of exploits code that proves that AI was heavily
involved in it. And they plan to to to use the
exploit for financial gain. So you had this Google threat
intelligence group alerted the offender to imminent threat and
they, and I think that's before, yeah, before the cyber crime
crime group initiated a mass, mass exploitation campaign.
But obviously some probably not the first time that attackers
have used AI, but it's the first time that Google have found
evidence that it's been used in the sort of in the world.
I was going to add a that we know of caveat to that because I
feel very much like really are we sure?
So this is probably that we know of that we can identify.
Yeah, been no surprise that they declined to identify what the
vulnerability was, I guess whether or not I had been
patched or name it. But it's a popular open source
web-based administration tool. I'm not too sure that what, what
it could be, but we've been sure you could Google it and find
out. But yeah, basically there was a,
a Python script that allowed attackers to bypass 2 factor
authentication for the service. And yeah, it says that the,
yeah, they've, they've sort of confirmed that AI was used
within it. Ham it doesn't say much more.
I mean, they they said that Google are confident it wasn't
Gemini or or Anthropic Smithos, which I guess was big one
potential thing we spoke about last episode of Mythos being
used in that way. But obviously, as we mentioned
as well, there's something AI tools out there and various
other companies or or countries are developing similar things.
Just the last episode, Mythos CEO basically said we've got 6
to 12 months till China and other people catch up.
So it's, yeah, maybe that was overly optimistic.
Yeah. So basically he says within
within this article that there were various artefacts in the
explicit code that were inconsistent with human
developers. So it included documentation
strings in Python, highly annotated code and hallucinated
a non existent CVSS score. So yeah, maybe they potentially
could have cleaned up the code a bit to disguise that, but maybe
they weren't sort of had the knowledge to to do that, right.
So they use AI to to create that.
Yeah. But yeah, obviously this is
probably not the probably not the first time, and it
definitely won't be the last time.
I love the fact that even that it worked even though it had
like hallucinogenic contents. Yeah.
Like why clean it up if it just works like?
There's no need to, that's true. Yeah, there's there's much more
on this one. I mean, obviously something to
be thinking about. I guess with AII mean obviously
cyber criminals using AIA lot whether it's in phishing emails
or obviously creating 0 days. But yeah, I guess I guess the
cow to these sort of things are potentially obviously depends on
the companies providing updates for software or you'd hope
there'd be a bit more information on what's what to
look out for. But I think this, there's a,
there's a blog post about it all, but I don't think it really
covers much. They're quite secretary, it
seems a lot what it was. It's they're probably trying to
be extra protective, which at the same time is frustrating.
But yeah, I mean, we can, we can drop this blog post to the news
now. Yeah.
Funeral wants to read. And of course, the newsletter is
available at riskycreative.com or you can find it on LinkedIn
at the Awareness Angle newsletter.
You can search LinkedIn for that.
It comes out every Monday and contains links and details of
everything we discuss on every episode.
So yeah, link to that and all the other stories will be in the
newsletter, which is out every Monday morning along with every
episode. Cool.
Shall move on to the next one. Yeah, go for the next one.
So we're back on Claude. Claude AI recovers Stoner's
$400,000 Bitcoin after an 11 year search.
I love this this is this is again like a script for a movie.
Dude, where's my Bitcoin? A man bought 5 Bitcoin in 2015
at a Starbucks for around $12150.
Change the password while high and then completely forgot about
it. And just to be clear, Claude
didn't crack Bitcoin encryption. OK, let's just calm down in if I
share this on the socials, just clarify that in the comments.
Claude didn't crack Bitcoin encryption.
It didn't break any cryptography.
What it did was sort through his messy archive of old files.
Find a forgotten backup wallet that still worked with the old
credentials and spotted a configuration error in the
recovery tool that had been blocking his progress for years.
This is like more digital forensic assistant than master
hacker. But this is brilliant because
it's, I mean, it just shows you what AI is really, really good
at, pattern matching and disorganised data sets that you
know would have taken him months to sift through.
To the other extreme, people uploading sensitive files,
private keys in the wallet to AI models.
You don't want to be uploading your Bitcoin stuff to AI in case
it spits it out to someone else. Yeah, especially if you haven't
configured any security sort of settings of that was called a
cloud bot being misconfigured or not protected in certain ways,
but. He spent eleven years trying to
recover this, including brute forcing it with 3.5 trillion
password combinations on rented GPU time, and then he found an
old mnemonic seed phrase in a college notebook and he dumped
the whole of his old college computer into Claude as a last
resort. Then that found the old backup
file from 2019 that predated the password change when he was
stoned and the mnemonic phrase was able to decrypt it.
I sent the password. Turned out to be LOL 420.
The police. That's the most stoned.
The most stoned password ever, I think.
Yeah. So were you stoned when you set
that password? So yeah, he's now worth what was
$12150 is now 400,000 lbs. So thanks to Claude, he's
probably bought a house. So that's amazing.
Like I'd be very happy with that.
It's not a bad return on investment.
Yeah, I think there's a key. Let's lol. 420 F the police,
whilst a very strong password and does meet many a password
criteria because it did have an exclamation mark on the end of
it and quite memorable. Clearly not memorable enough for
this individual. So password management is
something to be thought about. And don't go uploading all your
contents of your whole computer to Claude just in case.
It's probably worth a gamble at this.
I probably I might have done the same, I don't know, but just be
prepared for it to be shared widely.
Yeah. Right.
I think that's that on that one. So do you want to move on to the
next one? Yeah, so next one you've got.
So anyone who who knows your Audi's VIN number can add your
car to their account. According to this to a security
researcher has found that anyone can add any Audi to their My
Audi account just by knowing the vehicle's VIN number.
And yeah, obviously a a VIN number can be visible through
the windshield of revved car. Yeah, it's printed on various
documentations, service and records.
Screen on the windscreen, it's that little like it's in that if
you look on the edge of your windscreen where it's all black,
it tends to be like shallowed out because it needs to be
visible. On both my cars it's visible.
Yeah, but basically they were able to add any vehicle as a as
a guest user providing limited access.
But the the researcher found API issues worth reporting.
Yeah, doesn't say that they responsibly disclosed the
findings to VW Group and car IAD which is VW software subsidiary.
This is after initial engagement.
VW Group stopped responding entirely, including two requests
of for any form of recognition for the research.
The researcher is an Audi owner himself and says he's genuinely,
genuinely concerned about the vehicles association logic.
But basically, yeah, they started digging into the My Audi
app after his app started cutting out for days at a time
and the Audi support went nowhere.
They used community projects as a sign point to understand the
authentication flow. He went sort of deeper into
looking into the API structure and found that the vehicle
association model treats Vins as if they're a secret.
But basically I was able to you, you're able to create an account
on my Audi portal or or other VW brand portals and add a vehicle
just by entering the VIN number. Yeah, it's doesn't say much
more. We obviously had tried to
communicate, the issue didn't and this the conversation just
stopped with VW group. Do you know, this isn't the
first? I thought this sounded familiar.
We're on episode 88 now. We spoke about vulnerabilities
in Volkswagen's In Car Entertainment on episode 5,
right? So go back to like over 12
months ago, Episode 5 would have been what, December 2024,
something like that. Yeah, this isn't And it, there's
probably, it's just like any software, right?
There's going to be vulnerabilities.
But I, I can't remember exactly. I can't find.
We didn't keep very good episode notes back then.
So I was searching for our topics doc, but we didn't create
one back then so I can't find it, but I don't think we thought
we'd still be going at this point.
So yeah, all I can find is a thumbnail and the thumbnail for
that episode said voice cloning risks, AI scams, Volkswagen
vulnerabilities, and meta breach.
So. Yeah, there's a few things I
guess from this sort of his, his research, right.
So obviously our VIN numbers aren't secrets and they're
pretty much public information. As we all mentioned, you can
actually go up to any car and just get the VIN number for the
windshield and potentially associate with your accountant
potentially do certain things or or at least view some data and
you might be able to view some information on the vehicle.
Doesn't doesn't seem to same. I haven't properly looked to the
article itself, but I'm not sure exactly what the limited access
was, but I guess it's the fact that you can connect or sign
into your account is it's not great in the first place.
And yeah, it's like we spoke about if like Internet of Things
and vulnerabilities there. We've spoken about car
vulnerabilities, like you said of quite a while ago.
And there was one of those events, wasn't one of the big
hacking events that they found like a vulnerability in a car or
it was in this this sun leaf or something?
Yeah, years ago, I remember years ago, yeah, years and years
ago they were able to take control of a Mitsubishi FEV PHEV
that was again at DEFCON or something.
Yeah, I remember an old colleague of ours, Piotr,
telling us about one of the vulnerabilities they did at
DEFCON. So yeah.
But yeah, obviously again, again, I don't know what access
was available, but with a smartphone connected car and
app, you can sort of you can see the car's location if you're
like properly authenticated, you can see the the range, it has
the mileage and various other things.
You can even unlock some some vehicles for the app and stuff.
That's there's privacy issues with this, like if, if you, if
you husband and wife have split up, you know, stalker, whatever.
You know, if, if, if it's possible to find out the
location of someone's vehicle and track that location.
That's got all kinds of consequences.
Yeah, it's the fact that Volkswagen Group have gone quiet
on that is a bit worrying. Yeah.
I mean, obviously with this one with not, not saying that that
is possible, but I guess it no, it could be possible, right,
Maybe not with this vulnerability, but other, other
vehicles over time. But yeah.
It's obviously I'm not great that they've not responded
either, so they don't want to. They don't want to pay a bug
bounty, so they're just quietly. Yeah, I guess until, yeah, until
someone breaks, breaks even more and becomes a big problem for
them. They maybe they will.
But yeah, yeah, I think that's it.
OK. In which case, I think that's it
for this week's news. Oh yeah.
Let's do security socials. So this one this week is
something I saw on LinkedIn from Amy Stokes Waters.
Amy is of course CEO at the Cyber Escape Room Co and she
posted just a day ago. Unbelievable.
Scammers have gone back to writing letters now apparently
because my dad got through this. Got this through the post today.
WTF and we spoke about this. We had this before.
I can't remember who shared it, but we've definitely shared a
letter on here before. Hello Waters surname.
I respectfully request your kind indulgence in reading this
letter in its entirety. While I understand this may not
be the conventional approach to establishing trust, I hope you
will appreciate the urgency and sincerity of my reaching out.
My name is Mr Kenji Tahara and I'm an official with the Hatchi
Juni Nagano Bank. I've made several attempts to
contact you without success. I obtained your contact
information through public records in the UK.
I'm writing regarding my deceased client, Engineer Smith
Waters, an oil industry entrepreneur who resided in Hong
Kong for 21 years. He and his immediate family
passed away in the onset of the Russia Ukraine conflict.
Before his passing, Mr Waters deposited the sum of 606.
So hang on $60,500,000. Wow.
Under the management of our bank.
So yeah, here we go. This is very, very similar to
the one we had before. Different region obviously
mentions the Ukraine, Russia, which the other one didn't.
The other one was more E, more, more W than that.
And then yeah, I have worked out all modalities to complete the
transaction without mincing words.
I assure you that the operation is 100% legal and risk risk free
if and only if you adhere strictly to my instructions.
As soon as the estate is released to you, we shall share
the ratio of 50% for me, which will go towards helping refugees
from Ukraine war through various NGOs around Europe, 45% for you,
while the remaining 5% will set aside for expenses incurred,
incurred during and cause of securing this deposit.
The expenses. That's a lot of money for
expenses. What's 5% of 60 million?
Wow. If my proposal is acceptable,
kindly reply to my private e-mail address.
Mr Kenji Tahara. That's incredible.
I think that's brilliant. I mean, obviously it's so fake,
but Oh my God, it's $60 million and that all the.
There's more to that letter. I'll put a picture of that in
the newsletter. It's brilliant.
Yeah. And that's just arrived.
Just boom 3 letterbox. Yeah, it's the new lots of the
Nigerian Prince scam type thing. Yeah, but it's very bizarre.
Perfect. I presume AI Brian potentially?
I love though, like I assure you that the operation is 100% legal
and risk free if and only if you would hear strictly to my
instructions. So cool, so cool.
Yeah, that was the first one which I thought was brilliant.
You know, that's what a great story to tell the people in your
organisation though, because it's different.
It's it it kind of the old ways still work in the age of AI.
People are still doing stuff in the more traditional, old tried
and trusted way. So the next one I wanted to
share to you came from a friend of mine, Liam Stock Rabat in
Canada. Hello, Liam.
He sent me this video last week. I forgot to include this last
week, so I'll include it this week and it's called annual
corporate training. Be like this is from TikTok.
OK, I think it's fairly I if you're listening on the podcast
platforms, I think you probably get the picture.
It's a man sat in front of a computer and we're looking at
the man from the bottom of his keyboard.
This module will take 45 minutes to complete that one and we will
test you on your knowledge at the end.
Harassment. Click, click, click.
Let's click so let's So what would let's take a look have a
thing about don't forget it is the response.
Here's a list so to some harass you might be in the workplace.
There are always these are the key.
Well, I he he your employee breaks punch dinner bullying
harass. You've reached the end of the
module. We will now do a test.
Samantha walks in on Billy in the lunchroom.
Samantha says to Billy, get out of my way, you fat, disgusting
idiot. Is this acceptable workplace
behaviour? Congratulations, you scored 100%
on the test. The module is now.
Complete and and if ever you needed an argument against like
click and next training, that's it.
I mean he's click, click, click, click, click, click, click,
click.
I used to find it really interesting when we did livid
training. If you look at the time to
complete training and you can, when you look at the time it's
taken someone to complete training, you can tell who's
done that. But also the question at the
end, Oh, we've got to have a question at the end.
You've got, you've got to check that they've watched the video.
Quick put question at the end, but the question's so simple
that you don't have to have watched the video or the to the
other extreme like compliance teams go in the video, it stated
how much the fine was for the ICO, blah, blah, blah.
How much was that fine? It's I don't remember out of
that video. You expect me to remember a A6
figure number or A7 figure number like Yeah, everything
that's wrong with. Me send with that, Yeah, no,
that's good at all. The link to that as well will be
in the newsletter. If you're listening and you
really want to see it to get the full picture, then get the
newsletter, Risky creative.com or the Awareness Ankle
newsletter on LinkedIn, right? Have you?
Did you have anything this week? Yeah, I have on video to share.
So this is a videos on TikTok. Jamie's finance is the is the
guy. I haven't fully researched to
see if this is 100 and true, but I think it overall is in a way.
But I thought it was interesting to sort of bring it to others
play. It's not too long, I don't
think. With NatWest RBS or Ulster Bank,
there is a significant data risk that you should be aware of.
So let's talk about biometric data.
So for instance, the Face ID on your Apple iPhone or your
biometric fingerprint on any other phone.
So typically that is secure. So what that means is, for
instance, Apple's Face ID that will only ever be stored on that
device, never uploaded to the cloud, which is why if you ever
get a new phone, you'll notice you'll have to set up that
again. Even if you transfer all your
data across because it's never even transferred from device to
device because that's your biometric secure data.
And that's back onto the wrong hands.
That would be seriously detrimental.
If you lose your password, well, you can just make a new
password. But if somebody gets access to
your face, well, you can't really change your face.
And that's the same with your fingerprint or your voice.
So let's approach. How has NatWest done it?
So many banks in the UK will integrate Apple's Face ID or any
other biometric system that any other phone has, but NatWest
decided to do it themselves and they use it on the cloud.
So your biometric data is stored on the cloud with Amazon Web
Services. This is not a good look.
Let's say they got hacked and your biometric data was leaked.
Well that would be seriously detrimental for you.
Well, at least for now you can consent to this after the 20th
of May. They are changing it in a very
small and very interestingly hidden positive change.
They are changing the way that they process that data from
consent to legitimate interest. They no longer need to ask you
for consent to use that data. That is highly alarming and I
would remove your biometric data from that W RBS or Ulster Bank
immediately. It's interesting because I'm
just looking at some of the comments there as well.
The top comment that sounds like BS.
The biometric data doesn't leave my phone if I log into the app
using face Idi think that's true, but then there's another
comment further down that says you can log into the app using
Face ID, which is fine. That's not what this is about.
There's a separate process for asking for biometric data for
large payments, which is data they store, and it's what this
video is. Now I know I've got a NatWest
account. I'm pretty sure it's the NatWest
accounts currently. Actually, I don't use Face ID to
sign into my NatWest account. I use a six digit PIN, which
which is quite interesting. The Face ID fell off the app.
The app updated and I needed to set it up again or something and
I didn't. I'm sure it's NatWest that you
have to put your face in a picture, like you have to show
it. There's a ring that appears on
the screen and you have to get your phone just right and then
it scans your face that way. I wonder if it's this that
they're talking about. Yeah, sounds like it.
There's a few old comments as well.
There's one here I think of someone saying oh you don't
understand how it's stored the and then someone believe it.
He replied saying obviously a cloud based data will never be
as private or protected as locally stored and there's no
reason to hold this data online. And then someone says I'm a
cyber engineer here at a large UK bank.
This data is stored on Prem so nothing leaves the bank's
infrastructure. And I mean maybe, but that
doesn't particularly mean it's 100% secure.
It doesn't. But also Crip Zones talking from
their own experience. Well, yeah.
Not having worked at three large retailers over the past three or
four years, every single one's different.
Every infrastructure, the way every business does it, is
unique. Yeah.
But I want to have a have a look at if you're a customer of one
of these banks. Yeah, yeah, interesting.
I just just lastly something I forgot to add, but I thought
just as a little fun closer this week, I saw an article on the
BBC Waymo, the self driving cars, right?
They're recalling thousands of their self driving cars in the
US because software issues could allow them to drive into flooded
roads. And I, I haven't got the video
here, but I'd seen a video of a Waymo car that's tried to drive
into a flood and then kind of kind of avoided it.
So yeah, the voluntary recall effects 3800 robo taxis using
the company's 5th and 6th generation driving systems.
And on the 20th of April in Texas, an empty Waymo vehicle
emptied, entered a flooded road and was swept into a Creek.
Oh well. Self driving cars might not be
quite there yet, but yeah, yeah, right.
I think that's it for this week then.
That's a snappier episode than normal, but that's all good,
right? Yeah, thank you very much.
And let's do it all again next week.
Cool, awesome, right? See you later.
See you. Bye.