1 00:00:01,360 --> 00:00:03,880 Before we get in today's episode, I want to ask a quick 2 00:00:03,880 --> 00:00:07,280 favour. We're running a short survey and 3 00:00:07,280 --> 00:00:11,040 if you work in security awareness, behaviour change, or 4 00:00:11,040 --> 00:00:12,800 anything on the human side of security. 5 00:00:12,880 --> 00:00:16,800 In fact, if you're listening to this podcast, this is for you. 6 00:00:17,360 --> 00:00:21,360 We want to understand what you actually want from a podcast, 7 00:00:21,440 --> 00:00:25,240 what you listen to, what's missing, and what you find 8 00:00:25,320 --> 00:00:29,840 genuinely useful so we can make sure the awareness angle and any 9 00:00:29,840 --> 00:00:33,800 new ideas we might have for podcasts are delivering exactly 10 00:00:33,880 --> 00:00:38,320 what this community needs. The survey is 12 questions, 11 00:00:38,320 --> 00:00:42,120 takes around 3 minutes, and is completely anonymous. 12 00:00:42,560 --> 00:00:45,160 The link can be found in the show notes wherever you're 13 00:00:45,160 --> 00:00:48,360 listening to this podcast or on our homepage at 14 00:00:48,360 --> 00:00:53,680 riskycreative.com. That's risky. creative.com, we'd 15 00:00:53,680 --> 00:00:56,760 really appreciate you giving us just three minutes of your time 16 00:00:57,120 --> 00:01:00,600 to answer 12 questions. And now on with this week's 17 00:01:00,600 --> 00:01:05,920 show. This week, Government passwords 18 00:01:05,920 --> 00:01:09,120 so bad they'd fail a primary school IT lesson. 19 00:01:09,680 --> 00:01:12,840 A million gym members finding out their bank details were in 20 00:01:12,840 --> 00:01:17,720 the wrong hands and booking.com customers get scammed with their 21 00:01:17,720 --> 00:01:22,440 own data before the company even told them anything goes wrong. 22 00:01:22,600 --> 00:01:26,200 We've also got Rockstar hacked for a second time in three 23 00:01:26,560 --> 00:01:31,520 years, auk energy firm that lost £700,000 because someone changed 24 00:01:31,520 --> 00:01:34,960 a number in an e-mail, and France is making a move that's 25 00:01:34,960 --> 00:01:38,800 going to force an entire government to learn new 26 00:01:38,800 --> 00:01:40,920 software. How's that for behaviour change? 27 00:01:41,400 --> 00:01:44,160 Plus, Microsoft's biggest ever patch Tuesday, a warning about 28 00:01:44,160 --> 00:01:48,240 PDF files you need to hear, and a survey from Sans that the 29 00:01:48,240 --> 00:01:51,720 security awareness community should absolutely be filling in. 30 00:01:52,200 --> 00:01:54,680 Wow, that's a busy one. All of that and a whole lot more 31 00:01:54,800 --> 00:01:56,800 on this week's The Awareness Angle. 32 00:02:08,800 --> 00:02:12,040 And with me, as always, is my partner in cyber crime 33 00:02:12,040 --> 00:02:14,240 prevention. It's Mr Luke pedigree. 34 00:02:14,240 --> 00:02:16,600 How you doing, Luke? And doing well. 35 00:02:16,600 --> 00:02:17,600 Thank you. How are you? 36 00:02:18,160 --> 00:02:21,680 I am good, yeah. Really good, Really good. 37 00:02:21,920 --> 00:02:23,560 A lot, A lot to get through tonight. 38 00:02:23,720 --> 00:02:26,560 Not all of it's juicy, but there's a lot of good, good, 39 00:02:26,560 --> 00:02:29,800 interesting stuff this week. So should we just get straight 40 00:02:29,800 --> 00:02:32,200 on with the breech watch? There you go for it. 41 00:02:32,960 --> 00:02:34,720 The here is this week's breeches. 42 00:02:34,760 --> 00:02:40,880 Of the week. So we have a number of breaches 43 00:02:40,880 --> 00:02:42,800 just to quickly whiz through with you this week. 44 00:02:42,800 --> 00:02:45,920 But the first one I want to talk about, and I love this. 45 00:02:46,320 --> 00:02:48,760 Did you know the people in Hungary seem to be Chelsea 46 00:02:48,760 --> 00:02:51,080 supporters or maybe West Ham supporters? 47 00:02:51,080 --> 00:02:54,520 Chelsea Football Club, Hungarian government passwords found 48 00:02:54,520 --> 00:02:58,520 floating online, including Frank Lampard. 49 00:02:59,200 --> 00:03:02,320 So Frank Lampard's now a manager, so maybe they support 50 00:03:02,320 --> 00:03:03,960 the team he's managing, I don't know. 51 00:03:04,720 --> 00:03:08,720 Investigative outlet Bellingcat have been digging through breach 52 00:03:08,720 --> 00:03:12,880 databases and have found nearly 800 e-mail and password 53 00:03:12,880 --> 00:03:17,200 combinations belonging to Hungarian government staff. 54 00:03:17,200 --> 00:03:19,480 And we're not talking junior admins. 55 00:03:19,880 --> 00:03:23,320 The list includes people in defence, foreign affairs, 56 00:03:23,320 --> 00:03:27,560 counterterrorism and Hungary's NATO delegation. 57 00:03:27,560 --> 00:03:29,360 These are some big, serious people. 58 00:03:30,720 --> 00:03:34,640 And the passwords? Well, let me read these to you. 59 00:03:34,720 --> 00:03:43,440 A district director used 123456 little A big A, A Colonel whose 60 00:03:43,480 --> 00:03:48,720 actual job was information security used Frank Lampard as 61 00:03:48,720 --> 00:03:51,840 his password. Capital F, capital L So, you 62 00:03:51,840 --> 00:03:54,200 know, he's got his, got his capitals in there. 63 00:03:54,920 --> 00:03:57,840 And a senior figure in Hungary's NATO team used a password that 64 00:03:57,840 --> 00:04:02,280 translates to cute. Someone else used a password for 65 00:04:02,280 --> 00:04:05,240 Snoopy. The breach data spans over a 66 00:04:05,240 --> 00:04:08,760 decade, but some of it's from as recent as this year. 67 00:04:09,240 --> 00:04:12,080 And there are signs that nearly 100 government devices may have 68 00:04:12,080 --> 00:04:14,320 been. Actively infected with malware 69 00:04:14,480 --> 00:04:16,880 designed to still log How? Did this happen? 70 00:04:17,320 --> 00:04:20,440 Staff used their official government e-mail addresses to 71 00:04:20,440 --> 00:04:25,360 sign up for personal accounts on dating sites, music platforms, 72 00:04:25,360 --> 00:04:29,240 sports apps and food websites. And those services got breached 73 00:04:29,240 --> 00:04:31,040 and the passwords came with them so. 74 00:04:31,680 --> 00:04:37,200 Well sounds like they didn't have a very good policy in place 75 00:04:37,200 --> 00:04:40,800 for their passwords and also a massive lack of education. 76 00:04:41,720 --> 00:04:44,360 You can't keep if this is the whole corporate using corporate 77 00:04:44,360 --> 00:04:47,400 identities for personal stuff. Don't use your risky creative 78 00:04:47,400 --> 00:04:49,280 e-mail address for anything personal. 79 00:04:49,400 --> 00:04:52,840 Luke because it's for corporate. Use is essentially what you need 80 00:04:52,840 --> 00:04:55,680 to tell people. So password reuse. 81 00:04:55,760 --> 00:04:57,760 They've used it everywhere, you know. 82 00:04:57,760 --> 00:05:00,560 Oh, I'll use the same password and e-mail address combination 83 00:05:00,560 --> 00:05:02,640 for my. Shop as I will for my work 84 00:05:02,640 --> 00:05:04,640 account as I will for my. Gym. 85 00:05:04,680 --> 00:05:05,840 As we'll find out. Later. 86 00:05:05,840 --> 00:05:08,320 So yeah, password reuse is. Terrible. 87 00:05:08,320 --> 00:05:10,280 And then they've been able to map this all back to their 88 00:05:11,080 --> 00:05:15,160 position of power and their sphere of influence, and it's 89 00:05:15,160 --> 00:05:18,040 frightening. Yes, it's not good. 90 00:05:18,560 --> 00:05:20,400 No. So there's a great story, 91 00:05:20,400 --> 00:05:22,840 there's some great examples there of talk about these 92 00:05:22,840 --> 00:05:25,640 things, quite often these. Like weak passwords that have 93 00:05:25,640 --> 00:05:28,760 been discovered, but this is how it can be used against you 94 00:05:29,640 --> 00:05:33,320 government officials. Yeah, right. 95 00:05:33,320 --> 00:05:34,560 That's the first breach this week. 96 00:05:34,560 --> 00:05:35,760 Do you want to dig into the second one? 97 00:05:36,640 --> 00:05:40,160 Yeah, so second one, we've got Rockstar Games hacked again, 98 00:05:41,520 --> 00:05:44,480 this time for a back door. Yeah, this one is a Mashable 99 00:05:44,480 --> 00:05:48,440 article and basically talks about how, yeah, GTA 6, the most 100 00:05:48,440 --> 00:05:52,560 anticipated game, is obviously being created by Rockstars at 101 00:05:52,560 --> 00:05:55,560 the moment, and they've recently confirmed that they've been 102 00:05:55,560 --> 00:05:59,240 hacked again. And this, no surprises here, was 103 00:05:59,240 --> 00:06:01,800 claimed by shiny hunters. Ding, Ding, Ding. 104 00:06:02,280 --> 00:06:05,560 And essentially A compromise the Fed buy company that Rockstar 105 00:06:05,560 --> 00:06:11,400 uses for the cloud cost monitoring says Anodot as the 106 00:06:11,400 --> 00:06:13,440 company. And essentially, yeah, the 107 00:06:13,600 --> 00:06:17,320 hacker said a ransom deadline of 14th of April, Rockstar's 108 00:06:17,320 --> 00:06:19,960 haven't paid and they are starting to been leaked. 109 00:06:20,320 --> 00:06:23,480 And Rockstar have said that player passwords and personal 110 00:06:23,480 --> 00:06:25,440 data is safe. And it seems to be internal 111 00:06:25,680 --> 00:06:29,200 business information including revenue and marketing plans 112 00:06:29,200 --> 00:06:31,920 believe as well. It's not affecting the launch of 113 00:06:31,920 --> 00:06:35,840 the new game at the moment, but we'll see how that goes. 114 00:06:35,840 --> 00:06:39,800 But yeah, it's a second time, as you mentioned, in three years 115 00:06:39,800 --> 00:06:43,320 that Rockstar were hacked back in 2022 and they were breached 116 00:06:43,320 --> 00:06:50,600 by a teenager who yeah, broken. And yeah, so I think this one 117 00:06:52,040 --> 00:06:55,920 from, from the looks of what's been shared, I saw something 118 00:06:55,920 --> 00:06:59,800 about financial information, how much money they're making off 119 00:07:00,320 --> 00:07:03,560 Grand Theft Auto online and other sort of other games that 120 00:07:03,560 --> 00:07:09,240 they have. But yeah, I guess the the good 121 00:07:09,240 --> 00:07:12,480 thing I guess is that your personal information safe so you 122 00:07:12,480 --> 00:07:15,160 maybe you won't get too many phishing emails or anything like 123 00:07:15,160 --> 00:07:17,080 that. Yeah, it's more of a more 124 00:07:17,080 --> 00:07:20,680 problem for Rockstar themselves. It's kind of this doesn't feel 125 00:07:20,680 --> 00:07:22,760 like a massive like it's an issue. 126 00:07:22,840 --> 00:07:24,680 Like they're being hacked, right? 127 00:07:24,680 --> 00:07:26,320 But. This could have been a lot 128 00:07:26,320 --> 00:07:28,480 worse. It's no shock that Rockstar are 129 00:07:28,480 --> 00:07:33,040 making a lot of money because, yeah, after what is it, 10-11 130 00:07:33,040 --> 00:07:34,880 years? Grand Theft Auto Online is still 131 00:07:34,880 --> 00:07:40,400 one of the biggest online games. And when GTA 6 comes out, the 132 00:07:40,400 --> 00:07:41,840 whole world's going to grind to a halt. 133 00:07:41,840 --> 00:07:44,400 Maybe that, you know, maybe that's what this world needs. 134 00:07:44,400 --> 00:07:48,280 It needs GTA 6 to, like, perform a big reset so everyone can 135 00:07:48,280 --> 00:07:53,440 chill out and just play GTA6. Wouldn't that be amazing? 136 00:07:53,440 --> 00:07:56,760 That's yeah, it's interesting. I mean, I guess a lot of this 137 00:07:56,760 --> 00:08:00,960 information is maybe not as much detail in like their sort of 138 00:08:00,960 --> 00:08:04,720 financial reports or whatever, like yearly reports. 139 00:08:04,720 --> 00:08:06,400 You'd probably find out how much money they're making. 140 00:08:06,400 --> 00:08:10,320 But yeah, it's interesting that they've gone for that kind of 141 00:08:10,320 --> 00:08:12,120 data. I guess they just got what they 142 00:08:12,160 --> 00:08:16,200 could. Yeah, yeah, yeah, yeah. 143 00:08:16,200 --> 00:08:17,240 Therefore is much more on this one. 144 00:08:17,600 --> 00:08:19,840 No. That's cool, see if it affects 145 00:08:19,840 --> 00:08:23,760 anything else in the future. Yeah, yeah, I'll move on to the 146 00:08:23,760 --> 00:08:26,760 next one then. And the next one is Basic Fit 147 00:08:26,760 --> 00:08:30,360 Gym Breach hits around 1,000,000 members across Europe. 148 00:08:30,360 --> 00:08:36,679 So Basic Fit is Europe's largest budget gym, train, gym chain Jim 149 00:08:36,679 --> 00:08:38,480 Chang. They've confirmed that around 150 00:08:38,480 --> 00:08:41,679 1,000,000 of its members had their data stolen in a cyber 151 00:08:41,679 --> 00:08:45,040 attack at The breach affected members across six countries, 152 00:08:45,440 --> 00:08:49,240 the Netherlands, Belgium, France, Germany, Luxembourg and 153 00:08:49,240 --> 00:08:53,040 Spain, and the data included names, home and e-mail 154 00:08:53,040 --> 00:08:57,920 addresses, phone numbers, dates of birth and bank details. 155 00:08:59,080 --> 00:09:02,600 Passwords were not accessed. But the company says it detected 156 00:09:02,600 --> 00:09:05,000 the breach through its own monitoring systems, stopped it 157 00:09:05,000 --> 00:09:08,680 within minutes of discovery, and there's no sign of the stolen 158 00:09:08,680 --> 00:09:12,640 data appearing online yet. But they're still investigating 159 00:09:12,640 --> 00:09:14,560 exactly. How it happened? 160 00:09:15,520 --> 00:09:18,960 The interesting bit about this one is that basic fit only 161 00:09:18,960 --> 00:09:23,120 confirmed the scale of the breach after the register 162 00:09:23,120 --> 00:09:26,760 pressed them for numbers. The initial public statement was 163 00:09:26,760 --> 00:09:30,760 really vague about how how many people were affected and which 164 00:09:30,760 --> 00:09:33,040 countries were involved, and then the register poked and 165 00:09:33,040 --> 00:09:35,280 prodded. And then basic fit. 166 00:09:35,280 --> 00:09:39,520 Said yes around 1,000,000 so that's. 167 00:09:40,920 --> 00:09:47,760 If you are a basic fit member or you have operations, you protect 168 00:09:47,760 --> 00:09:50,120 people that are in the Netherlands, Belgium, France, 169 00:09:50,120 --> 00:09:51,840 Germany. Luxembourg or Spain? 170 00:09:52,680 --> 00:09:56,480 This is a great story to talk about because you know it's 171 00:09:56,480 --> 00:09:58,760 relatable. You're bound to have if if 172 00:09:58,760 --> 00:10:01,400 you've got business operations. There's bound to be someone 173 00:10:01,400 --> 00:10:05,440 who's a member of basic fit who's impacted by this, I would 174 00:10:05,440 --> 00:10:06,240 imagine. Yeah. 175 00:10:07,000 --> 00:10:11,440 Yeah, bank details combined with name, address, contact detail, 176 00:10:11,440 --> 00:10:14,720 you know that's you can. You can do a lot with that. 177 00:10:14,920 --> 00:10:18,320 Even from a social engineering perspective, but you know, if 178 00:10:18,320 --> 00:10:21,000 you think. That's a lot of the other vision 179 00:10:21,000 --> 00:10:24,240 that you don't want. Yeah, to be exposed. 180 00:10:24,800 --> 00:10:26,760 Would that be enough to set up a direct debit? 181 00:10:26,960 --> 00:10:28,040 They probably would, wouldn't it? 182 00:10:28,040 --> 00:10:30,000 Possibly, if that depends on what? 183 00:10:30,560 --> 00:10:33,320 Into your bank details, Yeah, yeah. 184 00:10:34,000 --> 00:10:36,360 It's interesting they're not offering. 185 00:10:36,680 --> 00:10:39,920 Are they offering any identity protection like you often see? 186 00:10:40,000 --> 00:10:41,480 Doesn't seem to be reported on this one. 187 00:10:42,280 --> 00:10:45,520 No, no, I haven't seen any report of that. 188 00:10:46,080 --> 00:10:49,000 Maybe they'll get there. They were slow to announce the 189 00:10:49,000 --> 00:10:51,680 numbers. Maybe they'll maybe they'll get 190 00:10:51,680 --> 00:10:55,000 there. It's it's an interesting 1 191 00:10:55,000 --> 00:10:58,120 though, because a gym it's just another example. 192 00:10:58,120 --> 00:11:01,680 Like for many people a gym will be 1 of 20 or. 30 or 40 193 00:11:01,680 --> 00:11:04,400 subscriptions, memberships and stuff that they've got. 194 00:11:05,800 --> 00:11:09,040 And the more memberships and clubs and things. 195 00:11:09,040 --> 00:11:12,400 You sign up for the bigger your threat landscape looks like your 196 00:11:12,400 --> 00:11:15,720 person will threat landscape. And we don't often think about 197 00:11:15,720 --> 00:11:17,760 that as an individual. We talk about it in a business 198 00:11:17,760 --> 00:11:20,760 context about all of these, you know, third parties. 199 00:11:21,280 --> 00:11:24,240 But when was the last time, as an individual, you reviewed your 200 00:11:24,240 --> 00:11:28,240 own third parties? Like how many accounts have I 201 00:11:28,240 --> 00:11:30,280 got active that have got my details? 202 00:11:30,400 --> 00:11:31,520 That's that's. Yeah. 203 00:11:31,800 --> 00:11:35,000 That's an interesting one. And how many tiny little vendors 204 00:11:35,000 --> 00:11:38,640 have you shopped at? I bought some T-shirts today for 205 00:11:38,640 --> 00:11:41,640 an online shop that I love. I've bought their T-shirts 206 00:11:41,640 --> 00:11:42,800 loads. I love them. 207 00:11:42,800 --> 00:11:44,440 High hope clothing, really like it. 208 00:11:44,440 --> 00:11:47,800 Give me some. Free T-shirts please, but. 209 00:11:48,800 --> 00:11:51,760 If they had a data breach, I might never know about it 210 00:11:52,080 --> 00:11:56,200 because I don't know it it. Makes you wonder. 211 00:11:57,280 --> 00:11:58,480 Yeah. Yeah. 212 00:11:59,800 --> 00:12:03,840 Anyway, move on to the next one. Cool. 213 00:12:04,080 --> 00:12:07,160 The next one we've got, birken.com confirms customer 214 00:12:07,160 --> 00:12:11,040 data accessed in latest breach. So they've recently confirmed 215 00:12:11,040 --> 00:12:14,400 that hackers have accessed customer reservation data, 216 00:12:14,400 --> 00:12:17,920 including names, emails, phone numbers, booking details. 217 00:12:17,920 --> 00:12:21,520 The company emailed effect to customers over the weekend, have 218 00:12:21,520 --> 00:12:25,760 reset reservation Pins and say it's now contained and financial 219 00:12:25,760 --> 00:12:31,640 information was not accessed. But what they haven't said is 220 00:12:31,680 --> 00:12:34,240 how many people were affected or exactly how it's happened. 221 00:12:34,280 --> 00:12:37,200 And yeah, looking into it a bit further, seems like, yeah, 222 00:12:37,320 --> 00:12:39,800 people have already been receiving phishing emails and 223 00:12:39,800 --> 00:12:43,320 even prior to notificationofbeckon.com 224 00:12:44,000 --> 00:12:46,960 themselves. And there's a report of a Reddit 225 00:12:46,960 --> 00:12:50,760 post of two weeks before they're booking the content. 226 00:12:50,760 --> 00:12:53,880 Any notifications so ever that's to do with this or just a 227 00:12:53,880 --> 00:12:56,080 coincidence? Not too sure, but it seems a bit 228 00:12:56,240 --> 00:13:00,480 timely for it to happen at the same sort of time as the state 229 00:13:00,480 --> 00:13:04,360 has been stolen. So yeah, not the first time 230 00:13:04,720 --> 00:13:08,240 picking up. picking.com's been breached and they've got a lot 231 00:13:08,240 --> 00:13:10,480 of history with this sort of stuff. 232 00:13:10,520 --> 00:13:14,120 You often hear about compromised hotel accounts on the platform. 233 00:13:14,680 --> 00:13:16,080 We've talked about that reaching out. 234 00:13:16,920 --> 00:13:21,680 Cars before through the actual like internal messaging 235 00:13:22,280 --> 00:13:24,120 platform. But yeah, it's interesting they 236 00:13:24,120 --> 00:13:26,240 haven't said how many people are affected. 237 00:13:26,240 --> 00:13:28,800 I mean, I'm a I've used booking.com and I didn't receive 238 00:13:28,800 --> 00:13:32,520 an e-mail or anything about it. So maybe I'm not one of the 239 00:13:32,520 --> 00:13:34,680 affected people. But yeah, want to look out for 240 00:13:34,680 --> 00:13:39,000 if you are a booking.com user. Yeah, definitely, definitely. 241 00:13:41,360 --> 00:13:43,880 You can't thebooking.com, it just seems because they're such 242 00:13:43,880 --> 00:13:47,000 a big target. Such a big company with so many 243 00:13:47,000 --> 00:13:50,400 fingers in so many pies, they're going to be and it's really 244 00:13:50,400 --> 00:13:53,680 important that things are built properly and run properly. 245 00:13:53,880 --> 00:13:58,880 And I think with the the story we did before, they didn't take 246 00:13:58,880 --> 00:14:01,680 the blame for because it was the hotel accounts that were 247 00:14:01,680 --> 00:14:06,800 compromised and then used to. Accessbooking.com But you know 248 00:14:07,840 --> 00:14:09,080 it's. Be careful. 249 00:14:09,160 --> 00:14:11,200 Don't trust. Just because you recognise the 250 00:14:11,200 --> 00:14:13,600 name doesn't mean you should trust the interaction. 251 00:14:13,760 --> 00:14:17,520 Question everything. Yeah, especially if it comes 252 00:14:17,520 --> 00:14:20,880 from a hotel or whatever else you can do on booking.com. 253 00:14:20,880 --> 00:14:24,000 Like, yeah, people do like Airbnb type things as well now, 254 00:14:24,320 --> 00:14:27,480 not just hotels, right? So be wary of people reaching 255 00:14:27,480 --> 00:14:31,400 out about your existing bookings and stuff, but it's going to at 256 00:14:31,400 --> 00:14:34,040 least say, reset various pins and stuff. 257 00:14:34,040 --> 00:14:37,560 So because if you're travelling, you're travelling soon, you'll 258 00:14:37,560 --> 00:14:41,200 probably be all right. It says here booking.com 259 00:14:41,200 --> 00:14:43,880 repeated its notification. It will never ask for card 260 00:14:43,880 --> 00:14:48,920 details by e-mail, phone, WhatsApp or text. 261 00:14:49,720 --> 00:14:52,400 So that's probably worth repeating to your audience, 262 00:14:52,400 --> 00:14:53,680 your. People your colleagues if 263 00:14:53,680 --> 00:14:55,400 someone contacts them about booking. 264 00:14:56,040 --> 00:14:59,240 And asked to reconfirm payment details for another through 265 00:14:59,440 --> 00:15:01,760 through any other channel other than booking.com's website. 266 00:15:02,120 --> 00:15:03,200 It's a scam. Stop. 267 00:15:03,280 --> 00:15:06,080 Hang up, Disconnect report. Whatever, right? 268 00:15:06,160 --> 00:15:10,280 That's this week's breaches, so let's get on with the news. 269 00:15:10,360 --> 00:15:15,520 And the first story this week, Microsoft's biggest ever patch 270 00:15:15,520 --> 00:15:19,920 Tuesday. It's always the biggest ever, 271 00:15:19,920 --> 00:15:22,240 isn't it? I feel like I've said that line 272 00:15:22,240 --> 00:15:25,320 before on this podcast, but apparently it's the biggest ever 273 00:15:25,320 --> 00:15:29,120 Patch Tuesday, including a SharePoint flaw that's already 274 00:15:29,120 --> 00:15:32,160 been exploited. So if you don't don't know what 275 00:15:32,160 --> 00:15:36,880 Patch Tuesday is, every month Microsoft releases security 276 00:15:36,880 --> 00:15:40,800 fixes for its software, and it's called Patch Tuesday because it 277 00:15:40,800 --> 00:15:44,200 always happens on the second Tuesday of every month. 278 00:15:45,040 --> 00:15:48,960 This month's release is claiming to be the biggest in Microsoft's 279 00:15:49,040 --> 00:15:56,520 history, fixing 165 separate vulnerabilities across its range 280 00:15:56,560 --> 00:15:58,720 of products. The one grabbing the most 281 00:15:58,720 --> 00:16:01,600 attention is a flaw in SharePoint, which is the 282 00:16:01,600 --> 00:16:04,080 document sharing and collaboration platform used by 283 00:16:04,080 --> 00:16:10,480 millions and millions of it was already being actively exploited 284 00:16:10,840 --> 00:16:15,840 before the fix arrived. There's also a notable Windows 285 00:16:15,840 --> 00:16:18,280 networking vulnerability that security experts. 286 00:16:19,040 --> 00:16:22,280 Calling potentially wormable, which means it could spread from 287 00:16:22,280 --> 00:16:23,480 device. Device. 288 00:16:23,640 --> 00:16:26,000 Oh my God, I've got one who cried like nightmares. 289 00:16:28,040 --> 00:16:30,240 Yeah. So SharePoint, for anyone 290 00:16:30,240 --> 00:16:33,240 unfamiliar, is where you store and share files. 291 00:16:33,320 --> 00:16:37,560 And internal content, large companies, if they run Microsoft 292 00:16:37,560 --> 00:16:41,400 O365, they probably run if you've got Outlook for e-mail in 293 00:16:41,400 --> 00:16:43,360 the business. You've probably got SharePoint. 294 00:16:43,480 --> 00:16:45,920 So this, I mean, it's huge patching. 295 00:16:45,920 --> 00:16:48,240 It's a great opportunity to talk about patching, to talk about 296 00:16:48,240 --> 00:16:50,520 the importance of patching, because this won't just be 297 00:16:50,520 --> 00:16:53,760 corporate devices, this is personal devices as well. 298 00:16:53,880 --> 00:16:57,760 If you've got a Windows computer at home, if your mum, your dad, 299 00:16:57,760 --> 00:17:02,000 your nan, your aunt, your Gran have got Windows devices, they 300 00:17:02,000 --> 00:17:05,079 need to install these updates. Because they're being actively 301 00:17:05,400 --> 00:17:07,599 exploited. T5 is huge, isn't? 302 00:17:08,280 --> 00:17:11,000 It yeah, that does sound like one of the biggest we've spoken 303 00:17:11,000 --> 00:17:12,680 about. Yeah. 304 00:17:13,640 --> 00:17:17,079 And it's not because Microsoft are really bad at this stuff. 305 00:17:17,839 --> 00:17:20,200 It's because there's so much of it really, isn't there? 306 00:17:20,640 --> 00:17:23,000 Like you think of Microsoft suite of tools. 307 00:17:23,760 --> 00:17:25,839 It's not just like, oh, they write Windows, really. 308 00:17:25,839 --> 00:17:28,560 Badly, but. It's a whole product suite. 309 00:17:29,400 --> 00:17:34,200 Yeah, I, yeah, it's, Yeah, it's mad. 310 00:17:34,200 --> 00:17:37,960 Especially with like last episode, we spoke about that 311 00:17:38,160 --> 00:17:43,400 anthropic AI security vulnerability scanning tool, and 312 00:17:43,400 --> 00:17:46,360 there's obviously other ones out there that are more accessible. 313 00:17:46,920 --> 00:17:48,840 Yeah, yeah. And obviously, yeah, AI think's 314 00:17:48,840 --> 00:17:52,560 probably making it easier for criminals to find the 315 00:17:52,560 --> 00:17:54,360 vulnerabilities, right? Yeah. 316 00:17:56,440 --> 00:18:00,360 Yeah, And this is, this is a great opportunity to talk to 317 00:18:00,360 --> 00:18:04,280 your IT team because they're going to be stuff like this 318 00:18:04,280 --> 00:18:05,720 drops. And when there's major 319 00:18:05,720 --> 00:18:08,960 vulnerabilities that are garden, there's like a mass pressure to 320 00:18:09,560 --> 00:18:13,360 get these installed. Messages go out asking users to 321 00:18:13,360 --> 00:18:16,120 restart their devices. And users hate restarting their 322 00:18:16,120 --> 00:18:19,400 devices, especially when like backs seem to restart really 323 00:18:19,400 --> 00:18:22,520 well. But Windows, you know, Oh, my 324 00:18:22,520 --> 00:18:25,240 computer restarted in the middle of a meeting, in the middle of a 325 00:18:25,240 --> 00:18:27,800 presentation. I've got this presentation I've 326 00:18:27,800 --> 00:18:30,120 been working on. I've had it open for seven years 327 00:18:30,120 --> 00:18:31,800 on my desktop and I can't close it. 328 00:18:31,800 --> 00:18:36,240 It's like, I'm sorry, but you have to restart computers to 329 00:18:36,240 --> 00:18:38,160 apply patches. Not always. 330 00:18:38,240 --> 00:18:41,520 They're getting better. So it's a good opportunity to 331 00:18:41,520 --> 00:18:44,480 talk to your IT team and help grease the wheels from an 332 00:18:44,480 --> 00:18:47,040 awareness perspective. If you've got Champions Network, 333 00:18:47,040 --> 00:18:50,560 talk to your champions as well and help spread this message out 334 00:18:50,560 --> 00:18:52,280 to them. You're going to be asked to 335 00:18:52,280 --> 00:18:53,960 restart. There's some really nasty 336 00:18:54,800 --> 00:18:56,600 vulnerabilities. Out there that we need to patch. 337 00:18:57,320 --> 00:18:59,200 Here's what they do. It's interesting. 338 00:18:59,200 --> 00:19:01,760 You know it can be. It can be quite relatable, 339 00:19:02,480 --> 00:19:04,880 especially if you tell them about what to do at home. 340 00:19:05,480 --> 00:19:07,000 You know if This is why it's really important. 341 00:19:07,000 --> 00:19:09,640 If this is what if some of these could, yeah, some of them could 342 00:19:09,640 --> 00:19:13,880 apply at home as well. SharePoint won't like if anyone 343 00:19:13,880 --> 00:19:18,120 who's wearing running SharePoint at home is a tech nerd with, you 344 00:19:18,120 --> 00:19:20,320 know, running their household like a business. 345 00:19:20,760 --> 00:19:25,920 But the other vulnerabilities, yeah, there will be other 346 00:19:27,000 --> 00:19:31,040 Windows networking vulnerability will probably could very well be 347 00:19:31,040 --> 00:19:35,960 active on a home device. Word, Excel, Windows Paint. 348 00:19:37,040 --> 00:19:39,000 Yeah, anything. There's there's many, many 349 00:19:39,000 --> 00:19:41,840 different parts of Windows. Anyway, I think we've talked 350 00:19:41,840 --> 00:19:43,960 enough about that. Biggest ever patch Tuesday, 351 00:19:44,320 --> 00:19:46,520 install your updates. That's all it is. 352 00:19:46,560 --> 00:19:47,640 Doesn't matter what you're running. 353 00:19:48,360 --> 00:19:49,880 Update. We'll move on to the next one. 354 00:19:50,920 --> 00:19:56,080 So yeah, next one we've got front ditches Windows for Linux 355 00:19:56,320 --> 00:19:59,000 across the government. The the synergy biggest ever 356 00:19:59,000 --> 00:20:01,040 patch Tuesday, right? Windows is gone. 357 00:20:01,200 --> 00:20:03,360 Time for a Linux terrible friend. 358 00:20:03,640 --> 00:20:08,040 I'm sorry anyone, friend. I won't try and try and do that 359 00:20:08,040 --> 00:20:10,000 myself. I've just offended a whole 360 00:20:10,000 --> 00:20:12,200 nation. So yeah, it's quite interesting 361 00:20:12,200 --> 00:20:14,640 on this one. So yeah, they've said that 362 00:20:14,760 --> 00:20:17,800 they're ditching Windows, switching to Linux across its 363 00:20:17,800 --> 00:20:22,440 government devices. Every department has until also 364 00:20:22,440 --> 00:20:26,160 of 2026 to submit a formal plan for how they're going to make 365 00:20:26,160 --> 00:20:28,160 happen. It's not not that long away. 366 00:20:30,280 --> 00:20:31,720 Yeah. And then yeah, the interesting 367 00:20:31,720 --> 00:20:35,720 thing here is that, yeah, it's come from a top down from the 368 00:20:35,720 --> 00:20:39,840 government because they seem to not want to rely on American 369 00:20:39,840 --> 00:20:44,000 made tech companies for some of these fundamentals. 370 00:20:44,000 --> 00:20:45,560 Their government computers as well. 371 00:20:45,560 --> 00:20:48,320 I'm sure they probably save a fair bit of money as well, 372 00:20:48,320 --> 00:20:52,120 right, Going from a paid operating system to something 373 00:20:52,120 --> 00:20:54,360 that's free and open source. Absolutely. 374 00:20:55,920 --> 00:20:59,320 So yeah, it's quite a big, but it's a pretty huge change, 375 00:20:59,320 --> 00:21:01,280 right? Most people probably won't know 376 00:21:01,280 --> 00:21:04,880 how to use a the next machine, so it's going to be a lot of 377 00:21:04,880 --> 00:21:09,960 change for people there. Completely different sort of 378 00:21:09,960 --> 00:21:14,080 feel, I guess, some different ways of potentially being 379 00:21:16,920 --> 00:21:21,400 exploited even. But yeah, there's not much more 380 00:21:21,400 --> 00:21:24,440 I don't think on this one as such. 381 00:21:24,440 --> 00:21:28,920 But it's just, yeah, quite interesting stories to share, 382 00:21:28,920 --> 00:21:34,040 perhaps. I do wonder, I wonder what build 383 00:21:34,040 --> 00:21:37,760 of Linux 'cause I imagine they'll go for something. 384 00:21:39,040 --> 00:21:41,840 I haven't dabbled it with Linux for a long, long time. 385 00:21:41,840 --> 00:21:45,360 Right, but it used to be that Linux Mint for example was not 386 00:21:45,360 --> 00:21:48,760 only lightweight, but it really resembled older versions of 387 00:21:48,760 --> 00:21:52,720 Windows and Ubuntu did to a degree until he got like below 388 00:21:52,720 --> 00:21:55,920 the when when you started delving with anything different. 389 00:21:56,120 --> 00:21:58,360 You know, you open up terminal. It's like, wow, this is a. 390 00:21:58,440 --> 00:22:00,880 Command prompt. So back back in my old IT 391 00:22:00,880 --> 00:22:02,920 support days. But it's funny, I had a 392 00:22:02,920 --> 00:22:06,160 conversation with a couple of Canadian companies over the last 393 00:22:06,160 --> 00:22:10,880 few months that were also looking to decentralise from AWS 394 00:22:10,880 --> 00:22:14,960 and and things like that. There is a real appetite at the 395 00:22:14,960 --> 00:22:19,800 moment, partly cost driven and partly political, that, you 396 00:22:19,800 --> 00:22:22,600 know, we need to own our own stuff. 397 00:22:22,600 --> 00:22:26,720 And I know France, I've read other news stories recently 398 00:22:26,720 --> 00:22:30,080 politically with France looking to like be more independent and 399 00:22:30,080 --> 00:22:33,160 stuff. And I think it's, yeah, it's not 400 00:22:33,160 --> 00:22:35,520 a bad thing that obviously there's some dependencies. 401 00:22:35,520 --> 00:22:39,120 Like the hardware is still going to be made in certain countries 402 00:22:39,120 --> 00:22:41,200 and the tech inside is still going to be made in certain 403 00:22:41,200 --> 00:22:42,960 countries. It does, I mean it. 404 00:22:43,280 --> 00:22:46,560 The behavioural change piece on this though, like you you said, 405 00:22:46,560 --> 00:22:49,000 is huge. You, you're going to have users. 406 00:22:49,720 --> 00:22:52,640 All of a sudden their user interface will change. 407 00:22:52,680 --> 00:22:55,480 The websites will remain the same, but the OS will be 408 00:22:55,480 --> 00:22:58,880 different. And if someone knows that what 409 00:22:58,880 --> 00:23:01,720 does click fix look like on a Linux device? 410 00:23:01,720 --> 00:23:04,440 Do you know what I mean? What does what does normal look 411 00:23:04,440 --> 00:23:06,080 like? They don't know anymore. 412 00:23:06,520 --> 00:23:11,600 So there needs to be some real. This is if. 413 00:23:11,800 --> 00:23:15,000 If you work for a French organisation Security Awareness, 414 00:23:15,000 --> 00:23:17,160 this is a. Huge opportunity to make your 415 00:23:17,160 --> 00:23:21,000 mark and really be involved in this now around that whole 416 00:23:21,000 --> 00:23:24,040 security change piece. That's that's quite exciting. 417 00:23:25,720 --> 00:23:30,320 Yeah, it's definitely a unique sort of scenario to to be in. 418 00:23:31,080 --> 00:23:33,960 Just looking at the comments, someone did say that Germany had 419 00:23:33,960 --> 00:23:38,600 done it already. I think it's quite a while ago, 420 00:23:38,600 --> 00:23:40,800 maybe not much, maybe just a couple years ago actually, 421 00:23:41,800 --> 00:23:43,200 right. There's a few other people that 422 00:23:43,200 --> 00:23:48,040 a few other countries that have migrated to Linux, so that's 423 00:23:48,040 --> 00:23:50,160 interesting. I wonder who will be next to 424 00:23:50,160 --> 00:23:51,680 them. Let's judge you by the way 425 00:23:51,680 --> 00:23:55,480 that's going. 11 comment on Reddit says Trump Donald Trump 426 00:23:55,480 --> 00:23:59,120 being a major catalyst to Linux desktop adoption was not on my 427 00:23:59,120 --> 00:24:05,600 bingo card, but but I love it. It's yeah, it's mad. 428 00:24:05,880 --> 00:24:07,640 Yeah, but there we go. So. 429 00:24:08,520 --> 00:24:11,480 If you're in a French organisation, get involved in 430 00:24:11,480 --> 00:24:15,400 this and please reach out. Hello at riskycreative.com. 431 00:24:15,480 --> 00:24:17,720 Let us know what you're doing and how that behavioural change 432 00:24:17,720 --> 00:24:19,520 piece works out. I'd really be interested. 433 00:24:19,840 --> 00:24:23,000 To know, I'll put some. Feelers out to the to. 434 00:24:23,320 --> 00:24:25,280 I mean, this French government, I don't. 435 00:24:25,560 --> 00:24:27,200 Know anyone that works in French government? 436 00:24:27,240 --> 00:24:30,360 But if you're in an organisation that's done it, I'd love to have 437 00:24:30,360 --> 00:24:32,200 a chat. Right, I'll move on to the next 438 00:24:32,200 --> 00:24:33,680 one. This is really relevant. 439 00:24:33,680 --> 00:24:39,480 UK energy firm loses 700,000 lbs, which is nearly $1,000,000 440 00:24:40,240 --> 00:24:47,320 after hackers redirect payment So British oil and gas company 441 00:24:47,320 --> 00:24:53,120 Zephyr Energy has confirmed that someone stole 700,000 lbs by 442 00:24:53,200 --> 00:24:57,200 intercepting a payment meant for a contractor and quietly 443 00:24:57,200 --> 00:25:00,080 redirecting it into their own account. 444 00:25:00,080 --> 00:25:03,680 So they've filed the disclosure with the London Stock Exchange, 445 00:25:03,680 --> 00:25:06,080 saying it's working with banks. To try and recover the money. 446 00:25:06,880 --> 00:25:10,320 They haven't said how it happened, but it fits a very 447 00:25:10,320 --> 00:25:14,240 well known pattern that security awareness professionals, you 448 00:25:14,240 --> 00:25:18,840 know, come across quite often. I would assume someone got 449 00:25:18,840 --> 00:25:22,880 access to an e-mail inbox or a payment system, what's for an 450 00:25:22,880 --> 00:25:26,960 invoice and then either swapped out the bank details or put 451 00:25:26,960 --> 00:25:29,360 phone calling going, oh, we've got some new bank details, can I 452 00:25:29,360 --> 00:25:33,120 give them to you? Waiting for a transaction duty 453 00:25:33,120 --> 00:25:35,440 enough to actually do that kind of engagement. 454 00:25:35,520 --> 00:25:39,000 You know these kind of anyone that works in a finance 455 00:25:39,000 --> 00:25:41,280 department will receive approaches like this quite 456 00:25:41,280 --> 00:25:43,000 commonly. It's not unusual. 457 00:25:43,080 --> 00:25:46,000 And then when the when the money goes into the wrong account, the 458 00:25:46,000 --> 00:25:48,560 attacker gets sees the money come in and it's gone. 459 00:25:49,280 --> 00:25:53,760 The FB is most recent cybercrime report, but total losses from 460 00:25:53,760 --> 00:25:57,000 this type of business e-mail compromise attack over. $3 461 00:25:57,000 --> 00:26:01,400 billion last year, which is huge, yeah. 462 00:26:02,520 --> 00:26:03,720 Yeah. And there's different types of 463 00:26:03,960 --> 00:26:05,920 we won't get into it. This is business e-mail 464 00:26:05,920 --> 00:26:08,760 compromise where I get access to your corporate. 465 00:26:08,760 --> 00:26:10,320 Account and then pretend to be you. 466 00:26:10,360 --> 00:26:12,640 There's different types of business e-mail compromise. 467 00:26:12,840 --> 00:26:16,280 Business e-mail compromise 1.02.03.0. 468 00:26:16,600 --> 00:26:20,080 I think there's 4.0 now and each one's like a different layer or 469 00:26:20,080 --> 00:26:22,000 something. But it keeps working because 470 00:26:22,000 --> 00:26:25,520 it's just human and it's abusing an existing conversation. 471 00:26:25,520 --> 00:26:29,160 That's already on the way in a trusted platform and a trusted. 472 00:26:30,080 --> 00:26:32,640 Network it's. As if you're already expecting 473 00:26:33,280 --> 00:26:37,040 the 700,000 of deals as such, you're not really going to 474 00:26:37,040 --> 00:26:41,040 question the bank account if it's already sort of confirmed, 475 00:26:41,040 --> 00:26:42,840 right? Yeah, You're not really going to 476 00:26:42,840 --> 00:26:44,840 spot if it's changed to, isn't it? 477 00:26:45,400 --> 00:26:48,880 No, no, exactly. Zephyr said on this case that 478 00:26:48,880 --> 00:26:52,800 they were using industry standard security, but they 479 00:26:52,800 --> 00:26:55,800 still lost the money. What's? 480 00:26:55,840 --> 00:26:57,080 And that's quite important, isn't it? 481 00:26:57,080 --> 00:27:01,560 Like industry standard, it's this is like compliance. 482 00:27:01,560 --> 00:27:03,960 Compliance doesn't make you secure. 483 00:27:03,960 --> 00:27:05,800 It's a baseline. It's where you should start. 484 00:27:05,800 --> 00:27:08,080 From and then you need to build upon that. 485 00:27:08,440 --> 00:27:13,200 Industry standard is probably just that baseline and then you 486 00:27:13,200 --> 00:27:15,600 need to build. Upon that, there isn't much more 487 00:27:15,600 --> 00:27:18,600 on this the company said it used. 488 00:27:18,600 --> 00:27:21,840 Industry standard practises for it's tech and payment platforms. 489 00:27:22,280 --> 00:27:24,840 And has implemented additional layers of security, but the 490 00:27:24,840 --> 00:27:27,240 register reached out to Zephyr and they. 491 00:27:27,240 --> 00:27:29,560 Didn't get a response. It's interesting that that kind 492 00:27:29,560 --> 00:27:32,560 of thing doesn't get flagged. Perhaps I made it up to see if 493 00:27:32,560 --> 00:27:35,600 it's a new contractor or whatever you've never paid 494 00:27:35,600 --> 00:27:36,720 before. Maybe not. 495 00:27:36,720 --> 00:27:40,880 But yeah, it's interesting that that was perhaps so easy for 496 00:27:40,880 --> 00:27:45,000 them to to have them. I don't work in finance, but 497 00:27:45,000 --> 00:27:48,000 maybe there's maybe there is processes that could be put in 498 00:27:48,000 --> 00:27:49,800 place to stop this from happening. 499 00:27:49,800 --> 00:27:53,440 Like any change of bank details won't be acted upon for 30 days 500 00:27:53,440 --> 00:27:56,520 or or you know, has to be signed off by I. 501 00:27:56,520 --> 00:28:01,280 Don't know practicalities I I. With all of the different 502 00:28:01,400 --> 00:28:04,400 accounts and payments that are made, it's probably really 503 00:28:04,400 --> 00:28:06,200 complicated, but it's also strange. 504 00:28:06,200 --> 00:28:09,320 I know when I make a payment on my bank when I'm paying someone 505 00:28:09,320 --> 00:28:12,480 and put in like an account number and sort code, it 506 00:28:12,480 --> 00:28:16,520 verifies the account details. So it then goes this account the 507 00:28:16,520 --> 00:28:18,760 account name doesn't match what you've put in. 508 00:28:19,480 --> 00:28:21,240 It's this. Can you confirm? 509 00:28:21,240 --> 00:28:23,720 So maybe there is a? Such if you're paying into the 510 00:28:23,720 --> 00:28:26,240 business, yeah. So it can do that sort of thing. 511 00:28:26,240 --> 00:28:30,840 Yeah, maybe corporate accounts aren't quite as mature as that, 512 00:28:31,560 --> 00:28:34,320 I don't know. Yeah, it's interesting, yeah, 513 00:28:34,320 --> 00:28:37,480 because it'd be more obvious if they asked for it in Bitcoin or, 514 00:28:37,840 --> 00:28:41,400 or something. But what's really crucial on 515 00:28:41,400 --> 00:28:45,240 this or or really significant is someone has got away with nearly 516 00:28:45,240 --> 00:28:51,320 $1,000,000 without a breach without of a company. 517 00:28:51,440 --> 00:28:55,080 They've they've gone to AI don't know. 518 00:28:55,080 --> 00:28:57,920 It could have been your cleaning contractor, it could have been 519 00:28:57,920 --> 00:29:02,640 your supplier for bread rolls in your canteen. 520 00:29:02,640 --> 00:29:06,160 If you sell a £1,000,000 worth of bread rolls, I don't know. 521 00:29:06,160 --> 00:29:08,360 It could be any company you deal with. 522 00:29:08,760 --> 00:29:11,360 It's their weakness. They don't have to target you, 523 00:29:12,200 --> 00:29:13,840 but they know that they know you. 524 00:29:13,840 --> 00:29:16,720 You can work out who supplies who all day long. 525 00:29:18,040 --> 00:29:21,120 Just it comes to there's an account hacked somewhere, but 526 00:29:21,120 --> 00:29:23,920 it's not necessarily in your, that's not in your environment. 527 00:29:23,960 --> 00:29:27,240 It's in someone else's You're safe and sound and this poor. 528 00:29:27,240 --> 00:29:31,000 Person in finance that's made that payment, they're not a 529 00:29:31,000 --> 00:29:32,760 fault. That's really important to 530 00:29:32,760 --> 00:29:35,240 remember here. They're going to feel like 531 00:29:35,240 --> 00:29:38,520 they've dropped the ball on this hugely. 532 00:29:38,520 --> 00:29:42,200 They're going to feel guilt, you know, support them. 533 00:29:42,200 --> 00:29:45,240 It's not their fault if they're followed process. 534 00:29:45,800 --> 00:29:47,600 It's not their fault this stuff happened. 535 00:29:47,600 --> 00:29:50,600 The process obviously wasn't. Up to it, but. 536 00:29:50,640 --> 00:29:54,000 We often forget about the person right in the source of this is 537 00:29:54,000 --> 00:29:56,360 the person that actually made that bank transfer the person 538 00:29:56,360 --> 00:30:00,280 that signed it off and go, yes, make that payment to the wrong 539 00:30:00,280 --> 00:30:04,360 person without, you know, unintentionally so they 540 00:30:04,360 --> 00:30:05,920 shouldn't be penalised or punished. 541 00:30:06,320 --> 00:30:09,280 They need support. I bet they don't always get it, 542 00:30:09,560 --> 00:30:11,760 but they should. Probably not right? 543 00:30:11,760 --> 00:30:13,640 Move on to the. Next one, move on. 544 00:30:14,720 --> 00:30:17,400 To the next one so this was quite a good one. 545 00:30:17,640 --> 00:30:21,880 I I dislike this a lot when it happens Google always coming for 546 00:30:21,880 --> 00:30:24,440 websites that trap you when you hit the back button. 547 00:30:26,160 --> 00:30:29,040 So yeah, you often get the experience where you're trying 548 00:30:29,040 --> 00:30:33,400 to leave a website and you just can't seem to go back to where 549 00:30:33,400 --> 00:30:35,640 you were originally and then you push the back button too many 550 00:30:35,640 --> 00:30:39,440 times and you end up eventually getting through and go back way 551 00:30:39,440 --> 00:30:41,160 too far. But and it knows this is what 552 00:30:41,160 --> 00:30:45,680 it's called back button hijacking and Google was just 553 00:30:46,640 --> 00:30:50,360 officially classed as spam. So the 5th from the 15th of 554 00:30:50,360 --> 00:30:54,680 June, sites that dealers will face penalties in Google search 555 00:30:54,680 --> 00:30:58,440 results, which will mean that they all appear lower down or 556 00:30:58,440 --> 00:31:01,320 disappear entirely from Google. What's interesting, it says that 557 00:31:01,320 --> 00:31:04,640 Google have seen a this behaviour's on the rise and 558 00:31:04,640 --> 00:31:07,280 what's it gone, which I'm sure many people also haven't they 559 00:31:07,280 --> 00:31:08,680 gone do. You know when I see, I mean, I 560 00:31:08,680 --> 00:31:09,600 haven't. Do you know when I? 561 00:31:09,760 --> 00:31:12,680 See it too often, but. Do you know when I see this 562 00:31:12,680 --> 00:31:15,120 behaviour? I I find this quite ironic. 563 00:31:15,840 --> 00:31:18,800 The Google app will notify me of a news story. 564 00:31:19,720 --> 00:31:22,720 So I'll go into the Google app and it will be to my local, it 565 00:31:22,720 --> 00:31:27,440 will be to a local news site that are typically really trashy 566 00:31:27,440 --> 00:31:29,920 because they're full of ads trying to generate some income. 567 00:31:30,440 --> 00:31:35,000 So like local newspapers trying to stay alive, The websites are 568 00:31:35,000 --> 00:31:37,120 full of ads and pop ups and stuff like that. 569 00:31:37,120 --> 00:31:41,040 And keep scrolling past this ad to view the news story or it 570 00:31:41,040 --> 00:31:44,200 will take me to Manchester Evening News, you know, hundreds 571 00:31:44,200 --> 00:31:47,360 of miles away. And then when I go back to go 572 00:31:47,360 --> 00:31:51,120 back out of that, that's when I get like tooth whitening ads and 573 00:31:51,120 --> 00:31:55,720 like fake news articles like this person lost 800 lbs in 574 00:31:55,720 --> 00:31:58,320 weight from like. This blue thing on their teeth 575 00:31:58,320 --> 00:31:59,720 or something like. That and it's. 576 00:32:00,640 --> 00:32:03,640 It's the. Google app that took me there in 577 00:32:03,640 --> 00:32:06,960 the 1st place. So it'd be really interesting if 578 00:32:06,960 --> 00:32:10,320 the quality of news on the Google app is about to get a lot 579 00:32:10,320 --> 00:32:13,040 better. They they are the cause of me 580 00:32:13,040 --> 00:32:15,360 consuming most of this content. Yeah. 581 00:32:15,480 --> 00:32:19,120 Yeah, there's much more on this one to be honest, but I guess 582 00:32:19,120 --> 00:32:23,960 yeah, sometimes it could be used to, yeah, trap you on a dodgy 583 00:32:23,960 --> 00:32:28,040 website last like potentially could get you to click on 584 00:32:28,040 --> 00:32:34,120 something malicious even. I'm not sure everybody's aware 585 00:32:34,520 --> 00:32:37,520 this is, I'm not sure everyone's aware this is a thing. 586 00:32:37,760 --> 00:32:41,120 So this is a good opportunity to talk to people about back button 587 00:32:41,120 --> 00:32:43,800 hijacking. What is back button hijacking? 588 00:32:43,800 --> 00:32:46,720 Well, if you go to a news website and you press back and 589 00:32:46,720 --> 00:32:48,400 it doesn't. Actually take you back to the 590 00:32:48,400 --> 00:32:51,160 page. Because more often than not, 591 00:32:51,200 --> 00:32:54,000 when you press back and it does display a list of fake news 592 00:32:54,000 --> 00:32:57,560 articles or ads, more often than not, I would guess they're 593 00:32:57,560 --> 00:33:03,840 scammy, potentially harmful. They don't ever look legit or 594 00:33:03,840 --> 00:33:08,040 good quality. So I think this is probably good 595 00:33:08,160 --> 00:33:10,320 in some ways. It's a good opportunity to talk 596 00:33:10,320 --> 00:33:14,520 about back button hijacking. Let's not forget though, not 597 00:33:14,520 --> 00:33:17,000 everybody uses Google. Some people out there do use 598 00:33:17,000 --> 00:33:19,600 other search engines that won't be implementing. 599 00:33:19,600 --> 00:33:22,880 This yet so. Again, Yeah, good to talk about. 600 00:33:23,080 --> 00:33:26,360 Yeah, they might follow suit. Good Hope. 601 00:33:27,760 --> 00:33:30,840 Or it could be a good reason Sir use Google instead. 602 00:33:30,840 --> 00:33:36,040 But yeah, yeah. So yeah, Moreover, unheard of 603 00:33:36,880 --> 00:33:39,040 sort of thing, but I'm sure people have experienced it, 604 00:33:39,640 --> 00:33:40,600 yeah. Next one, right? 605 00:33:40,920 --> 00:33:44,920 I'll move on to the next one. And the next one tonight is 606 00:33:45,240 --> 00:33:48,720 Adobe has pushed out an emergency security patch for 607 00:33:48,720 --> 00:33:55,040 Adobe Acrobat Reader and it's being actively exploited in the 608 00:33:55,040 --> 00:33:57,520 wild. So this floor apparently has 609 00:33:57,520 --> 00:34:01,320 been in use since December last year, which means it's being 610 00:34:01,320 --> 00:34:03,640 exploited for months and months and months without anyone 611 00:34:04,280 --> 00:34:06,080 noticing. All you have to do. 612 00:34:06,080 --> 00:34:11,679 So it isn't as an end user, as a user, you get sent a malicious 613 00:34:11,679 --> 00:34:14,719 PDF. All you have to do is open it. 614 00:34:15,639 --> 00:34:18,840 There's no clicking a dodgy link, no approving anything, 615 00:34:18,840 --> 00:34:22,840 just opening the file because the malicious PDF spotted in the 616 00:34:22,840 --> 00:34:26,280 wild were disguised as legitimate documents as well, 617 00:34:26,280 --> 00:34:30,080 some were in Russian and related to gas supplies. 618 00:34:30,639 --> 00:34:33,440 An emergency response which would suggest that this is 619 00:34:33,440 --> 00:34:35,960 probably targeted. But Adobe has released an 620 00:34:35,960 --> 00:34:40,360 emergency fix and the US government's cyber agency has 621 00:34:40,360 --> 00:34:44,520 ordered federal agencies to apply the patch by April the 622 00:34:44,520 --> 00:34:47,400 20th. Now I did when I saw this news 623 00:34:47,400 --> 00:34:51,080 article, I did record a little short for TikTok and posted it 624 00:34:51,080 --> 00:34:53,000 on TikTok. But if you use Adobe, make sure 625 00:34:53,000 --> 00:34:54,880 you update it now and what are the comments? 626 00:34:54,880 --> 00:34:56,719 Let me just see if I can read you. 627 00:34:56,800 --> 00:35:00,080 You can probably guess what the comment on this is going to be 628 00:35:00,080 --> 00:35:03,400 because it's it didn't come as any great surprise. 629 00:35:04,760 --> 00:35:07,960 If we if you want to follow follow me on TikTok, it's at 630 00:35:07,960 --> 00:35:10,040 infosec and. On TikTok. 631 00:35:10,120 --> 00:35:14,440 There was one comment on it and it says has a flaw. 632 00:35:14,960 --> 00:35:17,280 It's been only bugs for years now. 633 00:35:17,440 --> 00:35:19,840 Every single month. Don't use Adobe. 634 00:35:20,560 --> 00:35:23,520 I must admit I think Adobe perhaps as often as Microsoft, 635 00:35:23,520 --> 00:35:27,400 if not more frequently. And there it does seem to 636 00:35:27,400 --> 00:35:31,280 regularly, regularly regularly be exploits and vulnerabilities 637 00:35:31,640 --> 00:35:35,600 in Adobe Acrobat. Again, though, it's the number 638 00:35:35,600 --> 00:35:39,440 one PDF reader in the world. Which is why target it. 639 00:35:39,520 --> 00:35:41,320 I don't know. I would hazard a guess and say 640 00:35:41,320 --> 00:35:45,800 75% of Windows computers have Adobe Acrobat installed. 641 00:35:46,280 --> 00:35:48,760 I don't know. Yeah, I'm going to find out. 642 00:35:49,400 --> 00:35:53,360 Yeah, go for it. Adobe Acrobat, Mark, I'm well 643 00:35:53,360 --> 00:35:55,920 off. OK, I'm well off. 644 00:35:56,040 --> 00:35:59,160 Well, I'm not. Adobe Acrobat Reader Adobe DC 645 00:35:59,600 --> 00:36:05,600 52.0952% market share. When you combine that with Adobe 646 00:36:05,600 --> 00:36:13,600 Acrobat Pro it goes up to 59%. So just shy of 60% run of 647 00:36:13,600 --> 00:36:16,200 computers run. Adobe Acrobat. 648 00:36:16,480 --> 00:36:19,160 So yeah. With that kind of market share, 649 00:36:19,240 --> 00:36:21,640 you're going to be a target. Oh yeah, definitely. 650 00:36:21,760 --> 00:36:23,000 Yeah. I guess your average users 651 00:36:23,000 --> 00:36:26,600 probably just going to have use the built in like PF years or 652 00:36:26,640 --> 00:36:29,720 web web browsers can sort of view them like on this preview. 653 00:36:30,200 --> 00:36:31,560 Yeah, I don't know what they're doing. 654 00:36:31,560 --> 00:36:35,840 The second second biggest PDF readers probably Fox it or 655 00:36:35,880 --> 00:36:39,120 something like that, which has probably got a 2%. 656 00:36:39,120 --> 00:36:41,000 Market share or something like that, yeah. 657 00:36:41,080 --> 00:36:43,480 Right. So if you have Adobe Acrobat, 658 00:36:43,480 --> 00:36:46,880 again, another great story, install your updates is actively 659 00:36:46,880 --> 00:36:51,400 being exploited since December. We're now in April, that's four 660 00:36:51,400 --> 00:36:53,080 months. Yeah. 661 00:36:54,000 --> 00:36:57,880 Installs of hatches. Scary one to just need to open 662 00:36:57,880 --> 00:36:59,120 it. Just open it. 663 00:36:59,480 --> 00:37:01,480 Yeah. That's so innocent, right? 664 00:37:01,520 --> 00:37:05,160 That is it for this week's news. So now we'll have a little bit 665 00:37:05,160 --> 00:37:09,280 of awareness, awareness, this week's awareness awareness. 666 00:37:09,320 --> 00:37:15,000 The Sands 2026 Security Awareness Report survey is now 667 00:37:15,000 --> 00:37:17,520 open. So if you're a security 668 00:37:17,520 --> 00:37:21,760 awareness professional, if you work in the field of human risk, 669 00:37:22,240 --> 00:37:25,920 this one is for you. Sands Institute runs the biggest 670 00:37:25,920 --> 00:37:28,920 annual benchmark survey for awareness and human risk 671 00:37:28,920 --> 00:37:33,480 management professionals, and the 202026 edition is now open. 672 00:37:33,600 --> 00:37:37,880 It's 24 questions, takes around 8 minutes and the findings feed 673 00:37:37,880 --> 00:37:41,680 into a free report that security awareness practitioners around 674 00:37:41,680 --> 00:37:44,240 the world used to benchmark their programmes, justify 675 00:37:44,240 --> 00:37:47,680 investment and work out what actually moves the needle on 676 00:37:47,680 --> 00:37:49,680 human risk. It's been running for 11 years 677 00:37:49,680 --> 00:37:53,280 now, and it's one of the most credible data sets in the field. 678 00:37:54,080 --> 00:37:56,640 If you work in security awareness in any capacity, your 679 00:37:56,640 --> 00:37:59,000 voice belongs in this. I use that. 680 00:37:59,920 --> 00:38:05,080 I use the SANS security awareness report to get money to 681 00:38:05,280 --> 00:38:10,440 employ you so many years ago. So it does work because without 682 00:38:10,440 --> 00:38:13,000 that, this wouldn't exist, probably. 683 00:38:13,000 --> 00:38:14,960 So thank you, SANS, for making this exist. 684 00:38:14,960 --> 00:38:15,640 Yeah. Probably not. 685 00:38:16,200 --> 00:38:20,000 So yes, I used it to build a business case on maturity and 686 00:38:20,280 --> 00:38:22,920 you know it. It tells you salary expectations 687 00:38:22,920 --> 00:38:25,960 and jobs and roles and businesses and what the function 688 00:38:25,960 --> 00:38:27,560 looks like. Size of an ad. 689 00:38:27,560 --> 00:38:30,680 It's it's amazing. This year's 2025's report. 690 00:38:31,160 --> 00:38:34,440 It's always good. 2025's report is out there If you work in 691 00:38:34,440 --> 00:38:36,560 awareness and you want to contribute to 2026. 692 00:38:37,040 --> 00:38:42,120 The link is in show notes or you can probably find it by looking 693 00:38:42,120 --> 00:38:46,560 for Sans on LinkedIn or Lance Lance Spitzner. 694 00:38:46,560 --> 00:38:47,840 Go look for Lance. Lance. 695 00:38:47,840 --> 00:38:49,920 Will be talking about it, I guarantee it. 696 00:38:50,080 --> 00:38:51,320 Right, that's it for the awareness. 697 00:38:51,320 --> 00:38:55,280 Awareness this week. So should we do some security 698 00:38:55,280 --> 00:38:58,560 socials? Yeah, yeah, I haven't got loads 699 00:38:58,560 --> 00:39:00,480 this week. Normally I come with a big long 700 00:39:00,480 --> 00:39:03,640 list. I've come with 1, so this will 701 00:39:03,640 --> 00:39:06,240 be quick. And this is a post I saw on 702 00:39:06,240 --> 00:39:12,240 Reddit, of course, and it's not anything scandalous or unusual, 703 00:39:12,240 --> 00:39:16,200 but I just thought it this quite a little talking point. 704 00:39:16,200 --> 00:39:19,440 It's worth a worth a discussion. I know what I know what you 705 00:39:19,440 --> 00:39:21,760 think your opinion may have changed because we've had this 706 00:39:21,760 --> 00:39:23,280 conversation when we worked together. 707 00:39:24,480 --> 00:39:29,520 Reddit cybersecurity R slash cybersecurity engaging versus 708 00:39:29,520 --> 00:39:32,480 time saving training. What's better? 709 00:39:33,640 --> 00:39:36,160 Building a cybersecurity awareness training and got in a 710 00:39:36,160 --> 00:39:38,840 debate with myself. Option A Engaging and 711 00:39:38,840 --> 00:39:41,200 interactive. In theory, users should resent 712 00:39:41,200 --> 00:39:45,280 this type of content less and gain practical skills for 713 00:39:45,280 --> 00:39:47,840 dealing with threats. This format takes a bigger 714 00:39:47,840 --> 00:39:50,440 portion of participants time than clicking through a 715 00:39:50,440 --> 00:39:53,280 presentation, but it builds muscle memory and improves 716 00:39:53,280 --> 00:39:56,320 knowledge. Option B Save people's time with 717 00:39:56,320 --> 00:39:59,480 a less interactive approach, but except that the training becomes 718 00:39:59,480 --> 00:40:03,240 a wall of text we all click through without reading, thus 719 00:40:03,240 --> 00:40:05,240 minimal knowledge or skills will be gained. 720 00:40:06,200 --> 00:40:08,640 Obviously the ideal scenario would be to me in the middle and 721 00:40:08,880 --> 00:40:12,000 provide somewhat interactive but time efficient training, which 722 00:40:12,000 --> 00:40:15,120 is what I'm trying to do. If I ask employees at our 723 00:40:15,120 --> 00:40:17,880 company, they would all tell me that they want it faster to 724 00:40:17,880 --> 00:40:20,360 complete it. The question is, if you had 725 00:40:20,360 --> 00:40:23,000 option A and option B, which would you choose? 726 00:40:23,000 --> 00:40:27,280 It's an interesting 1 isn't it? Engaging versus time saving. 727 00:40:28,600 --> 00:40:33,440 I've in the last, in the last three years I've done both and 728 00:40:33,440 --> 00:40:36,160 I've worked in organisations where we've done both. 729 00:40:36,160 --> 00:40:39,760 There was a time we did engaging, really effing 730 00:40:39,760 --> 00:40:43,440 engaging, like awesome. And then we flipped and went 731 00:40:43,440 --> 00:40:45,360 time saving. But for a reason. 732 00:40:45,480 --> 00:40:47,760 This doesn't take other things into account, does it? 733 00:40:47,920 --> 00:40:50,160 I don't think. Yeah, this. 734 00:40:51,000 --> 00:40:55,360 This is difficult 1 I think. My initial thought was this was 735 00:40:55,360 --> 00:40:59,280 written by bot, but I've checked the post history, I don't. 736 00:40:59,280 --> 00:41:00,920 Think it is. I think it's legit. 737 00:41:01,000 --> 00:41:03,920 But some of the comments say you want the middle ground between 738 00:41:03,920 --> 00:41:06,680 A&B. Someone says if you've asked the 739 00:41:06,680 --> 00:41:09,480 employees and they've said they want it faster than no amount of 740 00:41:09,480 --> 00:41:12,400 engagement and interactivity. Will help because they don't see 741 00:41:12,400 --> 00:41:15,600 the value in it. But if you start from a place of 742 00:41:15,600 --> 00:41:18,760 helping people understand why the training is important, then 743 00:41:18,760 --> 00:41:22,200 I think the delivery mechanism becomes secondary. 744 00:41:22,800 --> 00:41:25,680 However, if even Netflix is struggling by competing with the 745 00:41:25,680 --> 00:41:29,080 second screen in people's hands, I think any content is going to 746 00:41:29,080 --> 00:41:31,480 be a tough one. The second screen is an 747 00:41:31,480 --> 00:41:34,600 interesting one. But So what did we do? 748 00:41:34,600 --> 00:41:38,400 Let's just rewind. OK, we may. 749 00:41:38,400 --> 00:41:42,160 We used to buy off the shelf training and then we made some 750 00:41:42,160 --> 00:41:47,560 training that was awesome and engaging and took 10 minutes and 751 00:41:47,560 --> 00:41:50,440 people loved it. And then we ended up flipping it 752 00:41:50,440 --> 00:41:53,240 completely and just going along with compliance and minimal 753 00:41:53,240 --> 00:41:56,000 viable product. But we engaged. 754 00:41:56,000 --> 00:41:57,880 We didn't need training to engage. 755 00:41:57,880 --> 00:41:59,640 And that's what this doesn't cover, does it? 756 00:41:59,640 --> 00:42:02,800 This, it doesn't talk about what else is going on. 757 00:42:03,360 --> 00:42:07,680 If training's all you're doing, if you, if, if this is your only 758 00:42:07,680 --> 00:42:12,120 behavioural change mechanism, then option B will not bring 759 00:42:12,120 --> 00:42:15,840 around any behavioural change. Option A will potentially. 760 00:42:15,840 --> 00:42:20,440 Yeah, I think, yeah, like you said, it can't be a stand alone 761 00:42:20,520 --> 00:42:22,320 thing. And because you can't expect 762 00:42:22,320 --> 00:42:26,560 someone to care about it if they don't know about it kind of 763 00:42:26,560 --> 00:42:31,800 thing, if it's the first, the only thing they see from the 764 00:42:31,800 --> 00:42:34,560 cybersecurity team, they're probably not going to give a 765 00:42:34,920 --> 00:42:39,320 damn about it. Like I've said before, I said 766 00:42:39,320 --> 00:42:42,040 this at a presentation on Cave. Conference few weeks. 767 00:42:42,040 --> 00:42:45,280 Ago training is draining. People find training draining 768 00:42:45,280 --> 00:42:50,680 unless you disrupt and give them something like No Before. 769 00:42:51,080 --> 00:42:53,840 No Before claims to do this with the Inside Man. 770 00:42:53,840 --> 00:42:58,240 They make it different and a big Hollywood thing it inside man, 771 00:42:58,240 --> 00:43:00,280 the kind of Hollywood film video. 772 00:43:00,720 --> 00:43:03,360 You sit there and watch this big dramatised thing that's run for 773 00:43:03,360 --> 00:43:05,200 seven seasons. It's not going to, it's not 774 00:43:05,200 --> 00:43:07,840 going to hang with everyone, not everyone's going to engage with 775 00:43:07,840 --> 00:43:11,120 that, but you've got to find that happy place for your 776 00:43:11,120 --> 00:43:13,920 organisation. We found that happy place, but 777 00:43:13,920 --> 00:43:16,360 then we decided we didn't need training anymore. 778 00:43:16,640 --> 00:43:18,560 Because we were engaging elsewhere. 779 00:43:19,160 --> 00:43:21,720 So I thought that was thought that was interesting because 780 00:43:21,720 --> 00:43:25,640 that sounds like someone's at the beginning of a behavioural 781 00:43:25,640 --> 00:43:31,160 change journey but needs to think beyond just training. 782 00:43:32,280 --> 00:43:37,600 Yeah, I think as well maybe very good to engage with any other 783 00:43:37,960 --> 00:43:40,920 departments. And if, if, if your company has 784 00:43:40,920 --> 00:43:46,040 like even a digital learning sort of team because yeah, if if 785 00:43:46,040 --> 00:43:49,560 you're getting lots of training outside of sub security, then 786 00:43:49,640 --> 00:43:53,360 it's even harder to do either option to penis. 787 00:43:54,040 --> 00:43:56,040 Everybody wants to do training now. 788 00:43:56,040 --> 00:43:58,080 Everybody sees training as a silver bullet. 789 00:43:58,960 --> 00:44:02,920 You've rewind 10 years. There was I think we had 790 00:44:03,800 --> 00:44:08,880 security training, fire training maybe or health and safety. 791 00:44:09,000 --> 00:44:11,840 I think there was like two or three trainings. 792 00:44:11,840 --> 00:44:16,360 But if I think about like more recently, you had compliance, 793 00:44:16,440 --> 00:44:21,400 fire, health and safety, code of conduct, GDPR and data proof, 794 00:44:21,720 --> 00:44:24,800 like the list goes on. And everybody thinks, and I 795 00:44:24,800 --> 00:44:27,800 don't know whether the compliance world has changed and 796 00:44:27,800 --> 00:44:30,040 now there's a million different compliance requirements to 797 00:44:30,040 --> 00:44:32,920 deliver, a million different types of training or whether 798 00:44:32,920 --> 00:44:35,320 everybody's just thought, oh, I know, we'll solve that. 799 00:44:35,720 --> 00:44:37,080 I'm going to build a training course. 800 00:44:38,920 --> 00:44:42,720 Training is this silver bullet but behaviour change Doing an 801 00:44:42,720 --> 00:44:45,440 annual doesn't really. Does it mention? 802 00:44:45,600 --> 00:44:47,120 It doesn't mention if it's annual. 803 00:44:48,200 --> 00:44:51,480 I'm assuming annual, but it doesn't say that here, but 804 00:44:51,480 --> 00:44:53,080 annual training. It's not going to change 805 00:44:53,080 --> 00:44:56,160 behaviours, I don't think. If it's going to have. 806 00:44:56,200 --> 00:44:57,800 Any chance of changing behaviours? 807 00:44:57,800 --> 00:44:59,480 You need to make it engaging and interactive. 808 00:44:59,480 --> 00:45:03,040 Yeah, anyway, that's that. That's all I've got for you. 809 00:45:03,360 --> 00:45:07,920 So did you have anything? Yeah, I got just one video to 810 00:45:07,920 --> 00:45:11,280 share. It's not really anything new to 811 00:45:11,280 --> 00:45:15,400 us, but it's what worth sharing It might be 1 to share with 812 00:45:15,400 --> 00:45:17,280 friends and family for the most part. 813 00:45:18,760 --> 00:45:20,480 Couldn't bring it up on the screen. 814 00:45:20,600 --> 00:45:23,040 Yeah, this is someone we've watched before. 815 00:45:23,160 --> 00:45:26,360 Many times Jeremy finds AII think he's changed his name. 816 00:45:26,360 --> 00:45:31,480 To be fair, Jess is a video. Just. 817 00:45:31,480 --> 00:45:34,480 I don't think he used to be called Jeremy Finds AI, but I 818 00:45:34,480 --> 00:45:36,120 know we've seen him before. He did the home. 819 00:45:36,320 --> 00:45:37,680 Was he did he do the fake? Yeah. 820 00:45:37,680 --> 00:45:39,240 He just set ones like Home Alone. 821 00:45:39,240 --> 00:45:45,160 That one and a few others, like lots of AI versus real stuff. 822 00:45:45,160 --> 00:45:48,800 But yeah, that's what this one was interesting to share. 823 00:45:48,800 --> 00:45:51,880 So it's obviously nothing new, but I think it's sort of covers 824 00:45:51,880 --> 00:45:56,520 a bit how AI, as we've sort of spoken about this, makes it 825 00:45:56,520 --> 00:46:03,400 easier for people to create scam people, like with social media, 826 00:46:03,400 --> 00:46:06,320 fake social media accounts and fake websites. 827 00:46:07,840 --> 00:46:11,080 And yeah, like money scams through fake products and stuff. 828 00:46:11,080 --> 00:46:13,480 But I'll just play the video, see what it's about. 829 00:46:16,040 --> 00:46:18,320 This account blocked me so I couldn't tell you that they're 830 00:46:18,320 --> 00:46:20,440 AI but I have burners so I'll tell you their whole story. 831 00:46:20,480 --> 00:46:23,640 They make AI sob story videos with this character who pretends 832 00:46:23,640 --> 00:46:25,440 to hand make these cheap watches. 833 00:46:25,520 --> 00:46:28,160 Their profile links to this Shopify website and this is 834 00:46:28,160 --> 00:46:30,720 where the clues start. By inspecting the source code I 835 00:46:30,720 --> 00:46:34,120 can see it uses a custom Shopify theme which includes a reference 836 00:46:34,120 --> 00:46:36,720 to Jordan Welch, a YouTube are who makes drop shipping 837 00:46:36,720 --> 00:46:38,520 tutorials. While following that tutorial 838 00:46:38,520 --> 00:46:41,360 they made a Shopify site that didn't survive but its theme 839 00:46:41,360 --> 00:46:43,200 did. And since then they've used this 840 00:46:43,200 --> 00:46:45,960 theme on four other websites. This includes metalheads dot 841 00:46:45,960 --> 00:46:48,920 store and it looks really similar to grim light watches 842 00:46:48,920 --> 00:46:50,880 but they sell blankets and necklaces instead. 843 00:46:50,960 --> 00:46:54,240 By using AI videos to target different niches and spinning up 844 00:46:54,240 --> 00:46:58,040 sloppy websites alongside, they can jump around until they find 845 00:46:58,040 --> 00:47:00,480 something that sticks. In this case it was grim light 846 00:47:00,480 --> 00:47:02,800 watches. But these tutorials and things 847 00:47:02,800 --> 00:47:05,560 like this get hundreds of thousands if not millions of 848 00:47:05,560 --> 00:47:08,160 views, which is why there are so many of these AI scams right 849 00:47:08,160 --> 00:47:09,920 now. So if you come across a website 850 00:47:09,920 --> 00:47:13,120 using this layout, it is designed specifically for drop 851 00:47:13,120 --> 00:47:14,920 shippers. This is not a legit artist's 852 00:47:14,920 --> 00:47:16,400 website. Take the time to check out a 853 00:47:16,400 --> 00:47:19,600 page's whole operation before buying anything online. 854 00:47:19,880 --> 00:47:26,080 This is. So yeah, the surprises like AI 855 00:47:26,080 --> 00:47:27,680 being used. To AI video. 856 00:47:27,880 --> 00:47:31,160 Create characters Ryan sob stories. 857 00:47:33,120 --> 00:47:36,840 It's quite a big thing. Do you see on TikTok especially? 858 00:47:37,760 --> 00:47:42,040 I know we spoke a few weeks ago about Sora, the Sora app being 859 00:47:42,040 --> 00:47:45,800 discontinued by Open AI, but I saw something the other day 860 00:47:45,800 --> 00:47:50,480 about Sea Dance versus NVIDIA I think it was, and it was a 861 00:47:50,480 --> 00:47:54,320 comparison video of a number of shots the same prompt put into. 862 00:47:54,320 --> 00:47:58,560 Both. Sea Dance was unbelievable like 863 00:47:58,560 --> 00:48:01,760 it was, it was looked so realistic. 864 00:48:02,200 --> 00:48:05,760 There was there was one bit and it was a card like speeding 865 00:48:05,760 --> 00:48:08,440 through a street, swerving around other cars and one of 866 00:48:08,440 --> 00:48:12,040 them the the kind of dynamics of the car, the back end, it would 867 00:48:12,040 --> 00:48:13,880 have spun out it. Was like all over the place. 868 00:48:14,320 --> 00:48:17,720 But this one was really good. It's funny, just I'm I'm going 869 00:48:17,720 --> 00:48:20,240 to make a really embarrassing claim now. 870 00:48:21,320 --> 00:48:23,440 Myself and my wife have been watching Married at the First 871 00:48:23,440 --> 00:48:28,240 Sight Australia, OK. And we haven't finished watching 872 00:48:28,240 --> 00:48:29,840 it. It's still, it's still airing, 873 00:48:30,600 --> 00:48:34,800 but on TikTok, my wife saw a video of one of the husbands on 874 00:48:34,800 --> 00:48:38,760 that Danny spouting a load of offensive stuff about his wife 875 00:48:38,840 --> 00:48:43,960 from the show and it looked really, I won't play it because 876 00:48:43,960 --> 00:48:46,360 it's quite offensive. And some of the stuff he was 877 00:48:46,360 --> 00:48:48,840 saying, it's like everyone was like shocked in the comments. 878 00:48:49,320 --> 00:48:50,960 But then you look to the comments and goes, wait a 879 00:48:50,960 --> 00:48:54,240 minute, this must be AI. Are you sure this is an AI? 880 00:48:54,240 --> 00:48:56,280 And there wasn't an AI tag on the post? 881 00:48:57,200 --> 00:49:00,800 But every single clip was shorter than 8 seconds wasn't 882 00:49:00,800 --> 00:49:03,960 any obvious. There was no obvious tells that 883 00:49:03,960 --> 00:49:08,160 couldn't have been a slight error in the video production or 884 00:49:08,160 --> 00:49:11,080 the. Extraction or whatever, but I I 885 00:49:11,080 --> 00:49:12,360 just. Knew it was AI. 886 00:49:12,480 --> 00:49:15,120 But it looked. So realistic, the fact that so 887 00:49:15,120 --> 00:49:16,360 many people have believed. It. 888 00:49:17,120 --> 00:49:20,240 Even my wife was like surely that's AI and the only reason we 889 00:49:20,240 --> 00:49:23,640 thought that was because the content was too shocking. 890 00:49:23,760 --> 00:49:25,800 It wasn't. Visually or audibly? 891 00:49:26,240 --> 00:49:28,400 It was because the subject matter was like. 892 00:49:28,600 --> 00:49:30,960 Oh, he wouldn't say that. Not to a proper camera. 893 00:49:31,080 --> 00:49:33,800 To ATV company like Channel 9 in Austria. 894 00:49:33,800 --> 00:49:37,560 No, no. So, So yeah, it's it's 895 00:49:37,560 --> 00:49:40,160 frightening. It really, really is quite 896 00:49:40,160 --> 00:49:41,800 scary. At the moment, what's out there? 897 00:49:42,560 --> 00:49:47,080 Yeah, especially Yeah, because like you said with Sea Dance, I 898 00:49:47,200 --> 00:49:50,760 think it's 2.0 now even Yeah that it's getting so much 899 00:49:50,760 --> 00:49:54,320 better, like getting colder and harder to tell these days, 900 00:49:54,320 --> 00:49:57,920 especially for someone that's not really clued up about AI 901 00:49:58,200 --> 00:50:00,680 sort of content. If you've got no idea what's 902 00:50:00,680 --> 00:50:03,160 going on in the world. As far as like AI is. 903 00:50:03,160 --> 00:50:05,480 Concerned you believe anything? My mum. 904 00:50:05,760 --> 00:50:07,520 My mum had a video of a dancing cat. 905 00:50:07,520 --> 00:50:11,040 I was like I I think she probably knew it wasn't real 906 00:50:11,400 --> 00:50:15,560 because this cat was literally break dancing so I'm pretty sure 907 00:50:15,560 --> 00:50:18,800 she didn't know. She knew it wasn't real, but now 908 00:50:18,800 --> 00:50:21,000 her feed is just full of AI generated. 909 00:50:21,000 --> 00:50:23,440 Dancing people just share it and stuff, right? 910 00:50:23,960 --> 00:50:26,880 Laugh at it. And because you've engaged with 911 00:50:26,880 --> 00:50:30,720 that content, the algorithm now thinks you want more crap and 912 00:50:30,720 --> 00:50:34,000 more slop. So you end up with a poisoned 913 00:50:34,520 --> 00:50:38,440 algorithm that gives you more of that horrible content that. 914 00:50:38,440 --> 00:50:44,520 So the algorithm is kind of to blame as well for amplifying the 915 00:50:44,520 --> 00:50:49,080 slop. I I saw not to there's there's 916 00:50:49,080 --> 00:50:53,440 someone I follow on Instagram and he's currently been 917 00:50:53,440 --> 00:50:56,240 promoting a website in. Oh, you have to subscribe? 918 00:50:56,920 --> 00:51:00,200 Oh, that's awful. There's a website in America, a 919 00:51:00,200 --> 00:51:03,880 news website called Ground News that consolidated all the news 920 00:51:03,880 --> 00:51:07,160 stories. So you can look for a topic and 921 00:51:07,160 --> 00:51:11,880 it'll give you the different news sites views it will post 922 00:51:11,880 --> 00:51:13,720 like here's what this publication. 923 00:51:13,720 --> 00:51:16,520 Says this publication says and this publication says you can 924 00:51:16,520 --> 00:51:18,680 kind of. And then it tells you what way 925 00:51:18,680 --> 00:51:21,000 they're leaning politically, which I think is quite good. 926 00:51:21,840 --> 00:51:23,560 But you can't have that for everything. 927 00:51:23,560 --> 00:51:26,760 You can't have that for Danny in Married at First Sight, whether 928 00:51:26,760 --> 00:51:28,760 or not he. Actually did say that about his 929 00:51:29,080 --> 00:51:32,800 wife so. Yeah, don't trust. 930 00:51:32,800 --> 00:51:35,400 Don't trust anything. You see, we're real. 931 00:51:36,400 --> 00:51:37,920 Three fingers, we're real. Yeah. 932 00:51:38,680 --> 00:51:40,480 Trust us. We're the only ones to trust. 933 00:51:40,680 --> 00:51:42,080 Yeah. Yeah. 934 00:51:42,120 --> 00:51:44,200 OK. I think we're done. 935 00:51:44,280 --> 00:51:45,720 I think that's everything for this week. 936 00:51:45,920 --> 00:51:49,520 So, yeah. Excellent. 937 00:51:50,160 --> 00:51:52,000 Don't forget at the beginning of the show we mentioned the 938 00:51:52,000 --> 00:51:53,560 podcast survey. We're going to leave that open 939 00:51:53,560 --> 00:51:58,240 for a couple of weeks, so find the link in the show notes or in 940 00:51:58,240 --> 00:52:02,520 the wherever. And yeah, let us know what you 941 00:52:02,520 --> 00:52:05,360 like to listen to when it comes to cybersecurity podcasts so we 942 00:52:05,360 --> 00:52:08,200 can tailor make something for the masses rather than just 943 00:52:08,200 --> 00:52:10,360 guessing what you want. Yeah, it'd be really good to 944 00:52:10,360 --> 00:52:11,800 hear from people. Yeah. 945 00:52:12,280 --> 00:52:14,560 Next cold weeks. Excellent, right? 946 00:52:15,160 --> 00:52:17,160 See you next time. Catch you later. 947 00:52:17,160 --> 00:52:18,360 All right. See you later. 948 00:52:18,560 --> 00:52:18,960 Bye. Bye.