This week we've got a hack that lets strangers steal your season
tickets and quietly erase stadium bands at one of Europe's
biggest football clubs. A security tool that got
poisoned and turned into a weapon against the very
developers who trusted it. The AI app with a billion dollar
Disney deal that vanished in just six months.
Mehta's fighting back against scammers with AI, and Lloyds is
back in the news after nearly half a million customers briefly
got a window into someone else's bank account.
All of that and a lot more on this week's The Awareness Angle.
And with me, as always, is my partner in cybercrime
prevention, Mr Luke Pettergrove. Hello, Luke, How are you doing?
Yeah, well, thank you. How are you?
I'm. Good, I'm good.
How's your week been? Usual.
Yeah, not too bad. Yeah, pretty standard.
How are you? Yeah, not bad, not bad.
Been doing some filming and just going down on like the final
parts, preparing stuff. It's like scripts are written
and blogs are written and just prepping stuff before it all
gets published. So it's exciting times.
More on that at another point though.
Yeah. Awesome.
OK, Should we get into it? Should we just get cracking?
Yeah, let's go for it. Brilliant.
OK then first up, it's this week's Breach of the Week.
So this week's breach of the week is IAX Amsterdam Hack
exposed fan data and allowed attackers to steal season
tickets and lift stadium bands. So this comes from Bleeping
Computer. Dutch football club AFC IAX has
disclosed that hacker exploited vulnerabilities in its IT
systems and access data belonging to just a few 100
people. The security issues also allow
transferring purchase tickets to others and enabled modifications
to stadium bands the club. Found out about it not from its
own security monitoring, but from journalists.
RTL's investigation found that by poking exposed APIs and
reusing shared keys, it was possible to act as other users,
entirely transferring season tickets, alternate account
details and even lifting stadium bans.
Season ticket holders cannot prevent this, as the ticket can
simply disappear from their account and can no longer be
used. IAX have said that the
vulnerabilities have now been patched and the Dutch Data
Protection Authority and police have been notified.
I mean, that's there. Like the season tickets you can
sort? All that out, but the lifting of
stadium bans could have had potentially quite significant.
Impact, it could be quite bad, yeah.
Yeah, I just have visions of like, you know, like football
firms, like our Football Factory and a bunch of hooligans that
have been banned from matches get allowed back in for like 1
match and then like it's it's, it's got.
Hollywood movie or Channel 4 movie written all over it in
some ways. Oh, we're back in for one game.
Let's make the most of it so. Yeah, yeah, it's quite an
interesting one as well that they didn't find out themselves,
but they found out from a journalist who were tipped off
by the hackers. Yeah, that's quite an
interesting one. Yeah.
So I mean, that's IAX in Amsterdam, could have been any
football club. And it's just another place
where your data lives, your data resides.
You know, it's just another place where you wouldn't
necessarily think your data is going to get exposed, but there
it has could be any football club in the world.
You know it's. Big or small?
So yeah, I guess we're not those footballs are any events kind of
sports or other? It's interesting.
Yeah, yeah. And it's it says here that every
IAX app user had the same digital key to make adjustments
to their account, So purely by manipulating a sent data packet.
It was possible to perform actions on someone else's
behalf, such as transferring a ticket.
So that was a design flaw, not a sophisticated hack.
So some of the breaches don't require advanced tools.
They just find a little problem and it's a wide open door.
Like we spoke about last week with Companies House, it's a
similar thing, isn't it? Like.
Leaving the door open so. Yeah, yeah, right.
That's this week's breach of the week.
Just an interesting one. Different one.
The Sports Club. Yeah, something different.
So let's get on with this week's news, right?
And you're going to kick us off this week.
Yes, the first one we've. Got kick off this week, sorry.
I just realised. It was completely accidental.
I just realised what I did. Sorry, go on.
Yeah, so this one is Meta launches a new anti scam tool
across WhatsApp, Facebook and Messenger using AI.
So something we sort of spoke about before.
It feels like at last, but I wonder if it actually works.
OK, go on. Yeah.
So, yeah, obviously designed to fight scammers and to protect
people. It was launched a couple of
weeks ago, I think, by the looks of this.
But yeah, essentially it's a bunch of features across those
apps. On WhatsApp, there's a new
device linking warning that flags up any suspicious requests
before you accidentally sort of link your account to sub
criminal. Facebook has some alerts when
you send or receive send requests from accounts that have
suspicious, Yeah, suspicious activity Messenger is getting
expanded AI powers scam detection that watches for
patterns like dodgy job offers and ones before you communicate
any further. And they've also said that
they've removed over 159 billion scam ads in 2025.
Ninety 2% were taken down before anyone even reported them,
apparently. Well, we know.
That's not true. Well, we know that's not really
made a dent then, don't we? Because we'd see them near
enough every week. Yeah and yet it down over 10
million accounts linked to criminal scam centres.
So it's quite a few good improvements there.
I've said it's about time I have and yeah, now they're using but
yeah, AI told them that they have to fight back against
scammers which also use AIA lot of their posts or fake adverts
and videos. But we've seen a lot of them
deep fake type adverts promising various things or cryptocurrency
sort of scams with many manipulated videos and all over
Facebook for example, so. Do you remember weeks ago we
spoke about Brad Pitt in a hospital bed?
Do you remember that? And that was like WhatsApp and
Facebook Messenger. So that I imagine would have
been tackled by this as well, which is.
Cool. Yeah.
And then the interest is sort of ones here.
I think it's like the WhatsApp device linking.
It's not really something you typically talk about obviously
that you can link your phone to a web version of WhatsApp or
just like app version on your computer through through like a
QR code. I'm, I think we spoke about that
just a few weeks ago about that being an issue.
Yeah, there was a campaign going around that was targeting that.
So yeah, like all, all the sort of takers.
So I would give you the QR code to scan or or you'd go onto like
a dodgy web version of WhatsApp I guess.
OK, imitation website and you'd scan AQR code and so on and
you'd link your account to to their device.
But yeah, it basically asks you just sort of be careful with
what you're scanning, just to sort of double check before you
actually do scan code. And yeah, there's a lot of
adverts. 159 million seems like a huge number.
I wonder what, how many adverts they have in general across the
platform. It's a really nice accident.
There's some really nice screenshots in the article that
they've. Shared Let me just share this
here. So this one for example.
This is a friend request. Check the details before you
confirm. They joined Facebook 6 days ago.
They appear to be in a different country.
You don't have many mutual friends confirm anyway.
So that's all that stops people creating that.
I mean, that's really good. That's it doesn't take it's not
rocket science. That's a good use of AI, but
like they didn't really need like a really advanced AI to
display that kind of information.
And then it safety tips, check profile details carefully.
Look out for duplicate accounts. That safety tips is hidden
behind a little blue text that says safety tips and no one's
ever going to see that safety tips window.
But that half screen thing that comes up when the frame request
is there, I think after you press confirm, please check the
details before you confirm. That's a really nice touch.
And there was one more screenshot here that is from
Facebook Messenger and the messenger image.
This chat could be suspicious. Scam detection found that this
chat could be suspicious. You can request an AI.
Review of messages in this chat against signs of a scam.
So again, that's quite good. And then you can send it off for
review and it comes back and says common scam signs, job
offers, work from home offers, job in exchange for money, that
kind of thing. So.
Yeah, I think that's it's positive that meta are doing
some with. I don't think this this won't.
Scratch the surface probably, but it's positive that meta are
actually doing something. It feels like a shift almost,
doesn't it? Yeah, I think the next story
kind of touches on AI and stuff, but I think, yeah, as we've
discussed a few times, that AI is so accessible now, it's so
easy to use for the wrong purposes and such.
So hopefully this does do something.
But yeah, like you said, it's probably going to be more that
needs to be done and then there'll be new ways around all
of these scan detections. And it's like a never ending
battle, isn't it? Yes.
Yeah, it is. Yeah, it is.
Well, I'll move on to the next one then.
You kind of queued that up nicely.
The next story is Open AI shuts down Sora video app and Disney
pulls it's $1 billion investment deal.
So from Variety, this has been reported everywhere.
Just six months after launch, Open AI has shut down Sora, it's
AI video generation app, which had hit a million downloads in
under 5. Days, I think it was the.
Fastest growing app at it's time the most downloaded app in
fastest most downloaded app after Open AI came out, so it's
now gone. Open AI says it's exiting the
video generation business entirely to shift it's
priorities elsewhere. So with the closure reported,
part of a wider move to simplify it's product line up ahead of a
potential IPO. So Disney had agreed to licence
iconic characters including Mickey Mouse and Cinderella to
open AI for use in Sora, and had planned to take a $1 billion
stake in the company. But they're now winding down
that partnership completely. Obviously everybody said that
SORA contributed to misinformation and AI slop
copyright holders. Had raised concerns about their
IP, their intellectual property appearing in videos, which is
one reason Disney did a deal I would imagine.
You know, let's like if we can't beat it, let's get in there and
own it. But I mean this I did read other
things that said open AI pulling out of this because they can't
compete with some of the tools that are coming out of China
right now. Like they're actually saw as
actually quite far behind the curve compared to some of the
leading ones coming out from China and that they just haven't
got the time, money or, you know, intelligence to artificial
or real to kind of compete. They're like can't keep up.
So in some ways it's good that Saura's gone or he's going
That's good because it might result in less AI slop on my
Instagram and TikTok feed, which is really annoying.
But this does also. Kind of move, move.
The problem? Many users are going to move to
other options that aren't owned by American or European
companies and aren't. Regulated or controlled?
And yeah, so I think this doesn't solve the problem.
It might just move it. But yeah, yeah, it's an
interesting, it's not really a security story, but it does mean
that we might see less AI slop on our feed.
So we might it's It's not now, not as easily.
Accessible in some ways. Yeah, that's interesting.
I just said there with the whole sort of regulations and stuff
behind AI and generated content, I think probably wrong, but I
feel like it's not there yet and it's kind of no one kind of has
come up with laws and whatnot. And now if, if, yeah, I guess if
they said these platforms go away, then there's less reason
for American companies or countries even to do anything
about it. If it's like a Chinese made tall
or something or any other country that's not not them.
But yeah, they said, I'm sure there'd be many other tools now
that people would just use instead.
I do wonder if this is a pause rather than a permanent
retirement though. I read I read something this
week that said because obviously the use of AI and all the data
centres that tell me if I'm wrong, but isn't that partly to
blame for like? High RAM prices and RAM
shortages and stuff like that because everyone needs it.
This kind of thing used to be graphic cards, but now it's RAM.
I saw saw something this week that said Google using AI had
found a way to like use six times less memory.
And that share prices in like some RAM manufacturers had gone
up because they reckoned that there was about to be like a all
of a sudden they'd been like a revolutionary breakthrough that
you don't need as much memory to do certain things now.
And if that's the case, we might see tools like that come back
reborn with new investment. Under a new skin, who knows?
Yeah, the techs, they've still got the tech.
Maybe they'll just shadow it. For a little while and then
relaunch it later. Who knows?
Yeah, right. Take the next one.
I think we're done on that one. Cool.
Yeah, so the next one we've got screen is quite a big one
recently. So how a poisoned security
scanner became the key to backdooring like LLM.
So it's quite technical one on this one, but try my best to get
it across. I think it's happened the week
of of a city last recording. So basically from what I've
seen, like LLM is a tool that provides access to various
models and allows businesses to monitor and track various things
and sort of, yeah, give access to employees as well with
various sort of guardrails and all sorts of things.
And it's also open source for, for use there.
But I think there is like a maybe like a business version of
something. But yeah, basically it makes it
easy for teams to give developers access to various
LLMS. And the story here is that 2
versions of the light LLM Python package were found to contain
malicious code. And this, this toll is
downloaded roughly 3.4 million * a day.
So obviously it's quite a large amount of potential compromise
there. But the story here is that the
attack didn't start with by LLM. They've compromised Trivy, which
is a open source security scanner that can sort of find
vulnerabilities and misconfigurations across code
repositories and like let them use that in their build pipeline
and it's trusted inside their their tool.
Yeah, that's obviously it's a security scanner.
So it scans all kind of aspects of the tool itself, which means
it can potentially get access to the higher privileged areas,
which could include sort of APIs and various keys, no other sort
of permissions. But yes, so they've sort of
supplied chain detects in that way of compromising one tool
used within another, bit of like an inception thing there.
And yeah, they basically used, it stole credentials that were
used to publish packages to the official Python package
repository. And they published 2 poisoned
versions of the application. And those malicious versions
were available for about 3 hours before it was quarantined for
anybody installing like LLM during that time, which have the
version which has sort of harvesting capabilities for SSH
keys, cloud credentials, API keys, crypto wallets, solidly
harvested that back to an attack controlled server and also
leaves the back door for ongoing access.
So yeah, it's quite a big one of a lot of technical detail.
And we can put all that in the newsletter.
And I assume anybody that's familiar with these tours would
be already on it. You would have, Yeah.
And obviously it was sort of, I mean, a small and also a big
window of, of time that that compromised package was out.
But yeah, you'd heard people have already sort of been
updating to the type of versions.
But yeah, there's probably a lot to potentially go into on this.
But I think it just shows like we spoke about a lot of like MPM
packages getting compromised and everything else like Kodal,
GitHub and for example, let you people typically trust it.
And yeah, sometimes as well, you don't really realise that you
could be using this package within another package, sort of
things like Trivy, for example, being used inside the like LLM.
But yeah, it seems to be as well a group of team PCP who have
sort of done similar things before.
And there's a whole post about it on Snick's blog, so we can
link that there as well. Yeah, I'll put a link to that in
the newsletter as well. But yeah, but I mean, for anyone
listening that's not already been on the case and uses this
tool potentially, I think there's ways to sort of, yeah,
check your versions. It says here that 1.82.7 or 1.82
dot 8 is compromised. And then to sort of, yeah,
double check what double check versions you got update to a
secure version and then rotate credentials on affected systems,
which could be quite a big task. And there's also ways of looking
to see what is going on, I guess with your platforms to make sure
it's not compromised in any way this.
Is this is one of those incidents where it's big enough
that kind of the security world kind of stops, you know, lock 4J
was a similar one. This is like 1 where like I've,
I've seen so many people talking about this on TikTok and as a
security awareness professional, a lot of this, we're not
expected to understand all of this.
If you're a security awareness professional, you should, you're
not expected to understand the insurance and outs of this, but
what you can do is you can help translate it.
This is a great opportunity to work with those tech teams and
you can almost be the translator between the technical and your
end users. You can help bring that if
you've got established comms channels.
With the business, you can help get this message out there.
So it's this is a great opportunity to build some
relationships. I saw Sans, Sans have done a,
they've got a blog post when security scanner became the
weapon. They had an emergency webinar as
well. They've got a report PDF that
you can download threat Intelligence Report.
That's just Sans. Anyone and everyone we've
already mentioned SNIC, you know anyone and everyone has probably
got a write up and a report on this.
So touch base with your tech teams, offer them.
If you're an awareness professional, just offer them
some assistance. Anything I can help with?
Can I help you get the message out to support this ongoing in
over the next? Couple of weeks.
I think this is a really good opportunity to build some
bridges. Yeah, definitely.
You said, have you done some messaging on this where you are?
Yeah, there has been, yeah, yeah, yeah, yeah.
I think obviously it's quite a recent thing, right.
So not, not everybody would be on it potentially and.
Yeah. And if small organisation that
has just a handful of developers, you know, there
might not be the maturity that they're aware of what everyone's
using and these developers might live in a bit of a black hole or
a cave and not check out on socials regularly.
So just have the word introduce this to your people.
Like do we use this? Do you think is this something
we should care about? With.
Yeah, right. Should I move on to the next
one? Yeah.
OK, this is a, this is an interesting one.
This has got, Yeah, Apple, Apple have rolled out or is rolling
out age verification to UK iPhone users.
It's new age verification programme for UK users is going
to require customers to prove they're at least 18 to use some
features. And these features are going to
be turned on by default, which means that all users, including
adults, will have to prove their age via a credit card and other
payment methods on file or by submitting ID to be scanned.
So this new policy will reportedly be implemented when
UK users complete the latest iOS 26.4 software.
Update I've already done that. That's why it's quite a quite a
big bomb. I imagine there'd be people that
won't update if they can. Let me just see what number.
I'm Jim Raw. I'm pretty sure I'm on 26.4.
This is strange. I haven't been asked to verify
yet. So on March the 12th, the UK's
Information Commissioner's Office, ICO and Ofcom.
Both of which Regulate Child Online Safety, announced that
they're giving social media platforms several weeks to
report back on their plans to bolster child safety.
And the ICO, of course, said it was mulling further regulatory
action if they don't keep children under the age of 13 off
platforms. Yeah, this is.
Apple told users it's new policy comes in response to laws
requiring stringent mechanisms. This is required by law in some
countries and regions, the tech giant said.
In a blog post in certain countries, you might be required
to confirm you're an adult before downloading apps,
changing certain settings, or taking other actions with your
Apple account. I read somewhere that it was
also going to be just to perform a Google search.
You won't be. At like, unless you verify how
old you are, you won't be able to search Google on a iPhone or
iPad, which is an interesting one.
Yes. Do you wonder because it talks
about, yeah, if you don't do it or you are under age, you get
web content philtres turned on automatically.
But that's what just for the operating system and Safari or
does it go across because you can install that Chrome on a on
a iPhone, right? So I'm pretty sure that when you
install Chrome on and I might be wrong, someone please comment or
e-mail and let me know if I'm wrong.
I'm pretty sure that all third party browsers on Apple still
use Apple Webkit, so fundamentally they're all just
kind of still using Safari in a way.
I could be wrong, but I'm pretty sure they're all using the same
kind of bones as it were in a way that I not Internet Explorer
anymore. Is it in a way that edges
Chromium based? I think that on iOS they're all
Safari based. I could be wrong.
But sounds like a thing that Apple would do.
Yeah, in their kind of closed off ecosystem, absolutely.
I would love to know what happens.
We've often, we've criticised, you know, age verification
cheques for sending. Off data to third parties.
We kind of have to trust Apple. If you've got an Apple device,
you kind of trust them with everything anyway.
It would be interesting to know if that information is going
back to Apple or whether or not it stays on the device.
I'm sure we spoke before about it staying on the device in like
their, I can't remember what they call it.
They're like the name is, is there.
It's like an entrenched something.
They've got like a a secure enclave.
Secure enclave. That's the one.
Yeah, yeah. Who knows?
Isolate hardware area, isn't it? But yeah, I'd be interested in
this and know if it's a local processed sort of check that you
said. Yeah, Yeah.
It kind of normalises this as well.
And this is something, if you're in the business of security
awareness, this is something. You can communicate to your
customers, users, people, colleagues.
Let them know. What this looks like because
there may be phishing campaigns that try and imitate it or try
and leverage off it. This is such a big change, but
this is exactly the type of thing you can expect malicious
actors to take advantage of, like.
Your age verification has expired.
Click here to reverify and you'll take some bogus.
Apple with your details right? Exactly.
It's this is this is great fuel
for fishing men and women's. Yeah.
Just show your people what good looks like.
There'll be screenshots out there.
Get on the beta release. I'm on the beta release as well.
I haven't got it. Like, try and find out.
If I can find out more, I'll put it in the newsletter.
But maybe we'll come back to this next week.
If I actually get the prompt or not.
Right. Roll on to the next one.
Yeah, So next one, we've got Tiktok for business accounts is
being targeted in a new phishing campaign.
So this is impersonating login and schedule a call pages.
So this is a story from Blinking Computer.
It says here that it's a phishing campaign that prevents
security bots from analysing malicious pages when obviously
business accounts are being targeted because they could be
used from advertising campaigns and AD fraud.
And yeah, you sort of have a potential audience to share
malicious contact with. And it talks about how Tik Tok's
been used to spread information, silly malware through malicious
videos, the cryptocurrency scams for Pig, fake promotions.
And yeah, victims are being loaded with TikTok business
compromised accounts which take them to a cloud flare hosted
phishing page, which I would hope has been probably taken
down by now, but at least by the time this goes out.
It talks about a few details here because it the initial link
redirects viral legitimate Google storage URL in which
blocks spots using Cloudflare turnstile check and redirects to
the malicious page. The domains are all like
welcome.careers.com with some sort, there's a few different
wordings and essentially it's a malicious page that is
impersonating TikTok for business and Google careers
pages. So yeah, it seems like the not
quite sure exactly how you get these, how you get to these
pages, but they look like these. So it's kind of maybe it's
similar to probably spoke about the Google ads fake page before
and another one recently, but they're too.
Yeah, imitating invitation pages on the Tiktok for business.
I'll see so that but. That top page you've got there
that log into your Tiktok for Business account is almost
identical to the proper one. I've got the proper one up on
the screen next to me. The only difference is that
login with Google button isn't there on the legit one.
Login with Tiktok is there on the legit one, right?
And the only other differences is where it says you see,
they're steering you away from signing in with TikTok because
e-mail or phone and password. There's a used phone.
It it just says e-mail on the top one.
And then it's there's a button to use phone, which will change
you to a different login process.
And there's no forget password function as well, which is a
huge red flag actually that there's no, I haven't put a
forgot password function. But yeah, login with Tiktok will
be there when you try to log into a Tiktok page.
And it's not there. So they're obviously trying to
skim some Google credentials there as well, which is
interesting. Yeah.
And as you can see that the euro
is welcome.careersengage.com/TKlogin.
It's obviously another thing to look out for.
Yeah. And yeah, the Google careers
page as well. It's like harvesting some data
there. And I wonder then if they've if
someone would contact you. I guess to socially engineer you
don't seem to show anything more about.
Possibilities are endless though, aren't they?
I mean, that's, yeah. Career scams and you know,
resume scams and all stuff like that.
It this is the problem. You don't know how it's going to
be around that corner. And yeah, so it says about on
this one. Obviously they served that fake
login page which sells credentials and says here that
it can even take session cookies and exfiltrate them.
And it can also hijack your account if you have two FA
enabled, which I I presume it's sort of sits in between like the
the GMs service in a way that it would sort of push you a
notification and stuff to be like here's the multi factor
code to to log in. But I guess if you have, if
you're using like SMS or sometimes they just have built
in sort of, they'll e-mail you a 6 digit code sort of thing,
right? But if you had like a actual
authenticator app, you'd probably be in a safer position.
Or to use passkeys for example, you wouldn't necessarily get
compromised this way. Tick tock by default does.
I know this because I set up a new account just this morning.
Tick. Tock by default does send you a
verification code to your e-mail when you set up an account.
That's like it's default status. It doesn't do.
At no point during that sign up process to TikTok has it asked
me if I want to use an authenticator app or set up a
passkey, which is interesting. So maybe there is a maybe there
is a evolution there to happen on Tik Tok's side.
Who knows? Yeah, I said, yeah, just to sort
of clarify, I mentioned Google Storage and Cloudflare turnstile
gets used and that's like the legit services which obviously
allow it to appear more trusted and especially to like security
tools and stuff. Obviously this seems like a
Google storage link or a cloud flare token of some sort.
So sort of Belize is real. And yeah, they're sort of going
after TikTok for business accounts with this.
So I guess you have to be careful of any TikTok, as you
see. Yeah, it might be one that's not
real. Yeah, that's that one.
Cool, cool TikTok phishing. Right.
I'll move on to the next one. Lloyds app glitch turned
transactions into shared experience 447,000 users.
It's like a banking orgy. It's a faulty overnight update
at Lloyds Banking Group that we spoke about 3-4 episodes 234
episodes ago that caused a mobile app glitch on March the
12th. So it would have been two or
three episodes ago up to 447,000 users.
Nearly half a million users saw other customers transactions.
So that we know now the issue stemmed from an API defect
triggered by near simultaneous logins which broke account data
separation. So no money was accessed or
stolen, but sensitive details, including account numbers and
payment references were exposed. Lloyds has paid a goodwill
compensation, reported the incident to regulators, and he's
now reviewing how the bug passed testing.
So that all sounds like, please don't sue us.
Please don't find us. We're yeah, it's, yeah.
There's a whole article here on the register.
This has been reported in a few places, but so far Lloyds has
paid out £100 3625 customers for goodwill, distress and
inconvenience and it's going to consider further claims if any
financial harm emerges. So there's 443,000 people that
haven't been paid anything. Yeah, based on how you what, how
you get paid, not a Lloyds Banking customers.
I'm not, my mum is, but like I said she had about £8 in the
account. If I go 139000, divide that by.
362. £538.34 per person, yeah. So that's not a lot is it,
£38.34? Yeah, so.
I mean, get your takeaway, I suppose.
What's that going to cost? If they paid that to everybody
impacted, that would cost them 16.9 million.
That'd be why they haven't. Which is probably less than the
fine. Which is like 4% annual
turnover. Yeah, that's the cheaper option.
But yeah, I'm not sure. I don't know what.
Stop the fine. 33 lbs. I mean at least the customers
are getting something from that. They get fined by the ICO.
What happens with the money when people?
What happens with the money the ICO gets when the ICO finds a
company? What happens with the?
That's a really interesting. I just asked Claude, Claude
says. The short answer is it doesn't
go to the victims, it goes to the government.
So yeah, awesome. Let's let's let them give 33 lbs
to each victim rather than the government getting 20 million
or. Whatever they will get.
So yeah, that's interesting. I'll, I'll dig, dig deeper on
that because. Yeah.
Anyway, so yeah, not really much more on that, just an update on
that story. 447,000 users. No financial harm has been
claimed and they're paying £33 roughly to each affected.
Customer, but they've only done it to three and a bit 1000.
Customers so far. So it's interesting like, yeah,
how they said this happened from a bug in the code and it got
pushed out overnight as well. That seems like a bad time to do
it. But I get they probably do it at
that time because less people are using the the app and stuff
looking more like a maintenance time.
Isn't that you typically do that?
But yeah, yeah, there's a quite, quite a bad one.
There's a lovely comment here at the bottom of the article from
the Register. In response to Lloyd's update,
Chair of the Treasury Committee Dame Meg Hillier said modern
banking methods mean we can now perform a variety of tasks on
our phones in a matter of seconds and almost anywhere.
What this incident brings into focus is the fact that there is
a trade off. By moving more interactions with
our bank online, we place our faith in technology which can
suffer unpredictable errors. It's critical that consumers
understand this, and that's why my committee continues to push
banks to be transparent when things go wrong.
And then it says it finishes off.
Banking apps are built on one basic rule.
Your account is yours. For a few hours.
On March the 12th, that rule didn't hold.
So yeah, interesting. Yeah, I'm sure there'll be more
on that. We'll see what happens with the
ICO and if there's any more information in future episodes.
This week's fish of the week, of course, comes from the threat
hunting threat intelligence team at Hawks Hunt.
Big shout out to that team for the awesome work and for sharing
this with us right here it is. It is ChatGPT impersonation fake
subscription invoice. So you can see here subject
ChatGPT plus from a compromised e-mail account.
We have your ChatGPT plus invoice for the current billing
period is now available for review.
Please check the details to ensure uninterrupted access to
your plus features. To maintain your ChatGPT plus
subscription benefits, please review this invoice promptly.
Thank you for being a ChatGPT Plus subscriber, the ChatGPT
Plus team. So yes, this e-mail mimics a
subscription invoice notification.
It uses ChatGPT branding and a generic e-mail layout.
Now to me, this looks like a very much a vibe.
Coded, you know, AI generated. Layout If if you're listening
and you're not actually watching, you can see it on the
see it on YouTube or check out the newsletter, which you can
get by searching for the awareness angle on LinkedIn or
subscribe at Risky Creative. Dot com.
See, Yeah, obviously this is asking you to verify invoice
details, and it's creating urgency by suggesting.
You're going to lose access or you've been charged.
For something that you don't think you.
Have subscribed to so yeah, it's, it doesn't scream like it,
it doesn't scream compromise, does it?
In some ways, but it's there, you know, it's Yeah.
See here. The verify, verify invoice
details button these to a malicious website.
So obviously pressuring the recipients to act quickly and
these we've seen it time and time again unexpected
subscription. Problems such a.
Common phishing law, they're always used.
It says this always confirm billing or subscription issues.
So even if you're a ChatGPT subscriber like I'm I was, I've
just ended my ChatGPT subscription.
If I was a chat TBT subscriber, I wouldn't click that.
I would go directly to the site and check it from there.
And that's kind of what you need to do, really, because it's so
common that these types of scams take place, isn't it?
Yeah, now you see it quite often, not just obviously chat
to Petite, but right, it could be anywhere.
Anything. Yeah, yeah, literally, they'll
choose. It could be it used to be
WhatsApp Gold. Do you remember WhatsApp Gold?
They used to be like your WhatsApp Gold subscription.
There is no such thing as WhatsApp Gold.
So it could even be made-up. But if not an existing service
like this may have been, I don't know if there's been a ChatGPT
breach. I don't know if they've got a
list of ChatGPT subscribers. I don't recall anything.
So the chances are this has gone out to anyone and everyone.
And the point being that, you know, it just I'm not paying for
that. What am I paying for?
Oh my God. Quick, I better check.
I want to cancel. So yeah, you don't have to be a.
Subscriber to be a victim. I think that's the key point
there I. Think as well like you said, if
you want a subscriber you you're probably more likely likely to
click the link in the e-mail as well.
Not necessarily going to be like oh I need to go to chat GBTS
website and log in and stuff like that.
So again, if it's unexpected and you've never subscribe to it,
probably to ignore it, report it.
I never get emails from ChatGPT either so as far like I don't
remember receiving one. I might of when I signed up.
Maybe I get a monthly invoice from them, I don't remember.
It I think there is, yeah. You do OK.
Yeah, I don't know if you get a try, sorry.
Similar. Yeah, I get details, the plan
and stuff, though. Where is that right?
Didn't, no, didn't have any details.
It's very generic, isn't, It's just.
A very simple message, no context.
I mean, it could have had context.
Just because it had more details doesn't mean you should trust
it. But yeah, go to chat CBT.
With, at least in Gmail and with open AI, they have like the
verification, the check mark in the e-mail which you can hover
over and it says that it's verified that they own the
domain perhaps. Yeah, some of the things to look
out for, I guess they're obviously.
Yeah, that's. That's a bit more of a
complicated technical thing. I think.
Like we said, if you don't, I'm not expecting it.
That's the safest bet, right? Yeah, let me just see.
It's just going to be a bunch of news articles talking about
ChatGPT anyway. Yeah, that's the fish of the
week from Hawks Hunt. Big thanks to the Hawks Hunt
team for sharing it with us. I can't find any ChatGPT emails,
but I'm sure they exist. Yeah, right.
OK, that's the fish of the week. So let's move on to some
security socials. Social Security, that's what I
called it, Social Security. OK, I've got got a number of
things to share this week and they kind of go here, there and
everywhere. So let me just share this with
you. The first one was something I
saw on Reddit. I'm going to share this with you
quickly. Now, how do you deal with users
who refuse to lock their laptop when walking away?
Now you tell me an organisation where this isn't a problem.
This is a problem absolutely in every organisation when you've
got smart people that think they know the best.
One of the recurring issues I run into is users leaving their
laptop unlocked when they walk away.
Recently I told someone to lock their laptop when leaving it
unattended and instead of just taking it on board they looked
me straight in the eye and said. So what?
What are you going to do? That kind of response irritated
me more than the unlocked device itself because it shows they
either don't understand the risk or just don't care.
Summed it up brilliantly. I'm interested in how others
approach this. We do have a policy for it. 15
minutes. So policy exists.
And then I thought the response is to this.
I've worked. There's been different
mentalities where I've worked at different places, and my old job
users who didn't lock their computers were fair game for
shenanigans. Changing wallpaper, changing the
keyboard layout, cranking the speakers and stuff like that.
One place I worked they would always have a love poem sent to
the boss for them or something like that.
Saying posting on slack, hacked by or something like that is
really common. Why would I discuss with users?
Never argue with users. Escalate to managers.
But what do you do if the manager doesn't care if they're
caught? Not locking.
That's against policy so they will be written up.
If it happens again, they will be terminated.
I'd love to know what organisations do that because
none of the organisations I've ever worked in would do that.
Like, yeah, policy says that, but have you ever fired someone
because of a acceptable use IT policy?
It's in a in a, that person's tagged governance, risk and
compliance. So yeah, I get that, but it's
just not. It's the professional.
Answer, it really depends on the the business, yeah.
Cultural change starts with an e-mail to the rest of the team
saying I left my computer unlocked so I'm buying
everyone's snacks today. After a penis two to three
times, you'll soon get the rest of the team joining in.
Yeah, it's really, really we, we trialled ages ago at the
organisation we worked together at.
We trialled like RFID sensors or Bluetooth tooth things.
So when you they unlock the device, when you approach the
device and a kind of like, you know, keyless entry, but it's
it's keyboardless locking almost, you know what I mean?
So yeah. And I know I've seen red team
exercises where this has been flagged and unlocked computers
and unlocked Linux. Linux terminal has been the
point of entry on more than one red team, so.
Yeah, it's tough. I've also seen computers left
unlocked just on a command prompt, just like with a post it
note saying don't switch off and it's like what the hell, Is it
useful then you know it's so yeah.
Yeah, it reminds me, I think it's yours.
Somebody you saw, they have a month or so someone on the train
didn't they leave her laptop unlocked?
And it's like, yeah, if they're if they're not locking their
computer in the office and they're doing it in public,
that's even worse. Do you know that was someone
with architectural drawings on a train to Leeds, from Stevenage
to Leeds? So it's like a two hour, 3 hour
train journey. It's a long train journey and I
think it was 9 minutes. They left their laptop
unattended, open, unlocked on a table in a train that wasn't
that busy. And there was architectural
drawings like schematics on the screen.
I mean, just imagine if I kind of understood that and changed
the density of some steel or the thickness of something, you
know, like a whole building could have been built and fallen
down because I tweaked with it on a train and you'd like trace,
trace that back to me. It's just, it's madness.
And you see it on LinkedIn all the time, people sharing stuff
from coffee shops. And from trains where?
People have just walked away and left it unlocked.
I just. Yeah, it's so easy.
To unlock it, and if you've got a MacBook and you set it up to
unlock with your watch or just to pass like it's.
Touch ID. Touch ID. £100 more on the new
MacBook Neo. But it's so it's just easy, like
come on now, lock your screens. It's really simple.
But there's clearly a communication issue with that
individual. They clearly don't understand
the risks and they think that they're in a safe space in their
office bubble. So then talk about tailgating,
talk about how easy it is to get in, run a red team, get people
to actually sneak in, you know, and do some stuff.
Film it, tell the story, like bring them along on the journey.
See if you can make them your North Star.
You can change that stubborn individual's behaviour.
You've that's a success metric to report to your board.
Like this individual was a right a hole.
We've made them change their behaviour.
Yeah, anyway, that was the first topic.
Let me move on to the next one. Some of these are are these are
some of these are quite quick. I have more than two this week.
I was sat in the reception area at my kids school this week and
a poster caught my eye and we've we've spoken about child online
safety on on here before, you know, lots of times.
I've got a couple of things that touch on that this week.
I loved this poster and this is again not all cyber security but
it is in a way, and I love this most parents and carers.
This is LGFL Safeguard Ed Put a link to it in the newsletter. 6
top tips for parents to keep your children safe online.
Top one, don't. Worry about screen time, Aim for
screen quality. Oh my God.
Scrolling through social media isn't the same as making a film
or story or video calling grandma.
Use the children commissioners digital 5A day to plan or review
each day together and that includes be mindful, connect, be
active, get creative, give to others.
I love that my my 6 year old is using her iPad.
She's watching like craft videos on YouTube, loads of YouTube,
but she's crafting. While she's watching, she's
using it as inspiration. So it's amazing, even though
they've just, the government just released advice that I
think under 5 shouldn't be on screens for more than an hour a
day or something like that. So some important ones here are
whizzed through these. Check the safety settings are
turned on, whether it's your home Internet, mobile devices,
consoles or apps, there's lots of settings to make them safe.
We've talked about this before, parental controls.
So many parents don't realise there are potential parental
controls. Restricted mode on YouTube, safe
search on YouTube. I'm going to do a bunch of
videos on this stuff because no one talks about this and I think
it's something that we can probably help with.
So just that kind of simple. It's so simple to access.
People just don't know it's there.
Get your children to show you their apps and games.
You don't need to know. About the latest game or app,
but they can show you what they're doing and who they're
doing it with and you can work out just don't be terrified by
Italian brain rock because it's. Steal a brain rot and like
there's some kids. What?
Are you doing, oh, we're playing steal a brain rot?
It's like, Oh my God. Don't try to hide news about
scary things in the news. Talk to them about it, because
that kind of dissolves the fake news.
Quite often at dinner, one of my kids will.
Come out with something they've seen about and it'll be
something. And it's like, no.
Iran aren't bombing London. Like read beyond the news like.
You know, it's just. Read beyond that.
And yeah, I, I, I won't go into that.
I'll share a link to it on the newsletter.
I'll leave that there, but I thought it was quite a
refreshing approach compared to the don't.
Let them see anything. Don't let them use anything like
you can't escape it. Yeah.
While we're on an educational angle, let me just give you this
one really quickly. This is a website I stumbled
across, stumbled across this completely randomly.
My 11 year old said me and a friend when we're older are
going to make a games company and we're going to call it
Barefoot Games. I was like amazing.
I thought that name probably exists.
So I googled it and I came across this, The Fisherman, an
underwater adventure barefoot from computing at school and BT.
Hi, I'm Turtle, the new head of the cyber security team in our
underwater village. Help me beat today.
I am here to help you learn about fishing.
Don't know what fishing is? Don't worry all will become
clear soon. 1st I'm going to need your need.
So obviously this is Turtle and there's lots of like undersea
kind of stuff. It's BT colour theme.
So clearly BT have sponsored this.
You type in your nickname. I'm just going to go with Han.
You choose your avatar. You can have a llama with a hat
on, a Stingray, a a anglerfish, jellyfish, or a starfish with
sunglasses or a diver. It's amazing.
Hey. And if I you eat.
As you you earn cyber points, so it's gamified.
You'll learn cyber points. You can turn the music on.
How Well? You're doing.
As well. But for every mistake you make,
you'll also lose a life. In a moment, you shall be able
to see how many lives you have left at the top of your screen.
Right, lives and points. Let's just go.
I've got 5 lives, no points. I'm glad you found me, we have
had some problems with our villagers personal information
being stolen. Button says personal
information. Transformation is data such as
your name, date of birth or address.
Let me show you what your information looks like.
Personalinformationgeneratedetailsandthereitisann@fishmail.co.uk Password Home address, payment
card number Yeah, it's. Were you paying?
Attention. I'll stop this there because
then it goes on to like quiz me for it.
But I thought it was just really nice and accessible.
I haven't shown my kids. That yet, but I can imagine
them. Getting involved in that and I
just stumbled across that, so yeah, it's called.
C stuff out there and that extension, it's probably not
well advertised. I've never seen it before, no.
I've never heard of it before SO.
We'll put a link audience. Maybe we're not, but we can help
spread the word, can't we? Because again, in an
organisation you have parents, so share this with them, they
can share it with their kids and it gets them to fishermen.
Why is it called Fishermen with a pH?
Oh, that's because of phishing emails.
Opens up a conversation about cybersecurity and you can go on
with that game and learn a whole lot more about.
Personal information and fishing and stuff.
So it's really there'll be other stuff out there.
We've talked spoken before about is it Joe Hurd and the stuff
that he's done. So anything like that.
If you see something like that, share it with us and we'll
spread the good word. Cool, right.
I had one last thing. No, I didn't.
I had to. I'm sorry.
I won't be much longer. I just want to share these with
you. This is something I saw on
TikTok. Look at me sharing a TikTok.
It's normally you. So let me share this with you
spot in a deep fight. Have you got this as well?
Yeah, that's cool. I think the algorithm obviously.
Or what? What what?
Why would that be? So let me just explain.
This is a guy on camera spotting a deep fake using one sentence.
OK, and I'll play this. I I think it plays fine.
There's a guy sat in a chair with headphones on and and you
can't see the voice the the English voice that's speaking
this guy's. Very soft like it's a very poor
quality webcam, very soft and. Fluffy around the face, but I'll
play the audio. Why do I know you're not some AI
thing or what what what? Why would I be able?
To tell here, man, Yeah. Oh.
He's just shown a certificate. It's not AI.
Yeah, I was doing. So kind of proving.
That's our director. Proving that the background is
an AI. No, no, no.
That's our director. We have a multiple.
You see all of them here. That's all I see.
Not Ronnie, but. But you know, that's some way of
telling whether you're real or not.
Can you like hold up three fingers in front of your face?
Oh, come on. Not.
Come on. Oh, you don't want to do that?
Well, I'll do that here. He's holding them just below his
face. Too much.
Come on, Ronnie. Why would it?
Would it affect the AI if it was in front of your face?
Well, not at all, but. Can you do that too?
Much to ask somebody well. Make sure you're not AI is not
unreasonable. I mean, can you do that in front
of your face? Well, I think that that's too
much to ask somebody. Don't you think that?
No, I don't think it is. If I'm making sure you're not
AI, I think that's a reasonable thing to ask.
Can you hold up three fingers in front of your face?
Well, I think that, well, is that enough?
No, it's on the side of his face.
Well, that's too much, don't you think?
Yes it is because you know if you were real, you would put up
three the. Host has ended this meeting.
How do I know you're not? See, I you obviously saw that as
well. The algorithm obviously, I mean
it's gone really viral. It's.
It's had loads of views but. It's Luke.
Can you hold three fingers in front of your face?
Is. It a dip.
I I'm not doing it. I think that's too much to ask.
Come on, that's too much. That's.
Quite a good one, yeah. I mean, yeah, there's a lot of
giveaways in there, isn't there? But.
When you watch it back, you can see when you watch it back that
he's got a curl of hair that kind of phases in and out of
existence. Where there's obviously some
deep fake face there, so the hair's real, but this curl of
hair, kind of the tip of it kind of keeps vanishing and
reappearing and vanishing and reappearing.
Don't what you're looking at the face, you're looking at the
eyes, you're looking at the body.
You don't look for those tying and kind of tells, but it's very
soft. The face is very soft.
Yeah, it was. I like the eyes and the mouth.
Very odd. Yeah.
But the part of the reason it is low quality as well is because
that kind of it gets less obvious if it's low quality
isn't it? It's if it was HD then it would
be really easy to tell. But with it all being a bit
crap, laptop cameras need to get better to help prevent AID fakes
in some ways. For that kind of thing.
Yeah. Right, I'll quickly share the
last one I had, and this was a LinkedIn post that I saw from
Maxime Hawks Hunt. I haven't told Maxime that I'm
sharing this, so I hope he doesn't mind, but it is on
LinkedIn, so it's kind of public domain in some ways.
This is a real smishing campaign currently circulating around
France, shared by a friend. A fake delivery message like
we've seen many, but with A twist.
There's a picture of a package, a recipient's name on the label,
full home address in the SMS and a personalised link.
That picture is what makes it interesting.
It creates a strong sense of legitimacy.
You don't just read the message, you see your parcel waiting for
you. My friend immediately said crazy
what AI can do. Looking closer, it seems more
like a simple image template with text overlay.
But it's somewhat scary glimpse of what AI will enable.
The mass personalisation of scams with visual cues that our
brains instantly trust. So yeah.
And it's the message actually said hello, I came to your home,
full address for name. I sent your package back to the
warehouse because it didn't fit in your mailbox.
Please choose how to get it delivered with a link to a
malicious website. That's crazy, isn't it?
Yeah, crazy. Yeah, yeah, just yeah.
Like he says, Yeah, enhances those typical tracking like fake
shipment links texts that you get which are just very basic
and aren't personalised anywhere near as much as that.
No, no, I know where. They get the home address from.
I guess it's this day of breaches and it's very targeted.
It's probably all public record, isn't it?
I'm actually seeing, I've just done a search for that and it's
actually made, it's actually made the French news.
So there's an article there with that very same photo with the
name blurred out on a msn.com. Yeah.
So that, I mean, it's obviously big enough that that's made the
French news. So I thought that was.
Just it's another good example, isn't it, of stuff that we can
share with our people. You know, it's another attack
vector. There's so, so many.
That's my security, social, Social Security done.
So I'll pass over to you after I stole one of yours, So I'm
sorry. That's right.
Yeah. Sorry about one to share.
So this one TikTok I saw, it's basically, yeah, a sort of
example of how people could be using personal devices and sort
of exposing certain things, I guess.
So I'll just share the video. Easier to to watch it.
And then if you saw it at all, oh wow, I'll play it and I can
probably listen along. Have some news right now?
A French service member accidentally opened up his
Strava on the Charles de Gaulle aircraft carrier and well, we
now know the location of France's aircraft carrier
because he decided to go on a 7 kilometre run in the middle of
the ocean. According to French news LeMond,
this service member decided to use Strava in the middle of the
ocean on the aircraft carrier as it was moving.
Now, it's no surprise that the aircraft carriers in water, but
it's an operational security risk that we now know where it
is. This is going viral on Twitter.
So it's not, I'm not revealing anything that isn't already
public, but as you can see, it's in the Mediterranean Sea.
And the exact location is now known because Arthur decided to
go on a run about 36 minutes, going for about 7 kilometres on
the on a Strava app in the middle of the ocean.
So anyways, spread the word itself, yeah?
Want to share with the risks of unintentional sort of innocent
thing, but probably should know better and that sort of this
scenario I guess should be more restricted but.
Yeah, I got sentenced by a couple of different people.
I think this happened just after we'd recorded the last episode
or something like that. I got sentenced by a couple of
different people. And obviously this isn't the
first time that military stuff has been leaked through Strava.
And I think it was 20188 years ago that some British soldiers
decided to go for a run and reveal where their kind of semi
secret military camp was. And this is a like maybe this is
a security awareness issue for armed forces, right?
Like Strava can be public, it can also be private.
And yeah, the I mean, think of the.
Potential issues that this could cause if they were on like,
secret military operations, like their location has to be quite
secret anyway. But supposing as as a result of
Arthur's run, they get torpedoed and destroyed and a whole like
ship of French servicemen get killed, all because Arthur
decided to go for a run and turn on his Strava, Yeah.
It's one of those sort of things, right?
Maybe not Philly, our area, but just like the whole permission
saying like, yeah, cheering up your location on your personal
device for an app like that whilst you're in a sort of
sensitive scenario, there's a lot of awareness to be sort of
shared there. And not just that kind of
scenario, there's probably lots of other similar things that
could happen different ways and it's all sort of unintentional.
We can't blame Strava for that because Strava aren't a fault.
Maybe Strava and it won't cover all solutions, but maybe Strava
needs to go. It looks like you're on a boat.
Are you sure you want to make this public?
But then if you're just running around the secret military camp
in the deserts, like there's, it's likely there's about to be
a whole load of servicemen in the Middle East, a whole load
more servicemen in the Middle East in places that's probably
quite sensitive. One of those has their Strava
turned on. Someone notices that could be
catastrophic. So like, yeah, if you're a
service member or or secret security guard at a secret
installation and are going for a jog on your break, Strava hides
your starting point. Now that was something they
didn't do it kind of. Blurs your starting point, but
it still gives so much away. Yeah, yeah.
But it's, yeah, could be. I can't think of any examples,
right? Just the whole thing of personal
devices and permissions and yeah, yeah, all kinds of things
there. Maybe, maybe there's something,
maybe Strava really needs to double down on the you are
sharing your location with the world.
Do you wish to continue? Maybe having just as a default
public setting isn't enough. Maybe before every activity they
need you need to explicitly declare that you are happy to
share your location publicly and then there needs to be awareness
to service members to not do that.
It's tough, though. Tough.
Nobody is right. But then not everybody reads it.
Everybody engages with it. Nope.
Yeah, yeah.
Cool, OK, well, I think that's it this week and we we've done
the whole week without talking about the director of the FB is
personal emails getting hacked by Handala because everybody
else has probably spoken about that.
But in case you missed it, there you go.
We did include it in the episode.
Kash Patel's emails got hacked personal e-mail not his FBI.
The FBI are fine. Personal e-mail got hacked by
Handala, years of photos, emails, resume has been leaked
by them and what they claim is just the latest of a long line
of high profile compromises. But we're not going to talk
about that because we try and avoid the politics.
So yeah, right. Yeah.
OK. I think that's it for this week.
Thank you very much for your time.
OK. Thank you.
Thanks everyone. Got you there.
Speak to you next week, see you later.
Bye bye.