Before we get in today's episode, I want to ask a quick
favour. We're running a short survey and
if you work in security awareness, behaviour change, or
anything on the human side of security.
In fact, if you're listening to this podcast, this is for you.
We want to understand what you actually want from a podcast,
what you listen to, what's missing, and what you find
genuinely useful so we can make sure the awareness angle and any
new ideas we might have for podcasts are delivering exactly
what this community needs. The survey is 12 questions,
takes around 3 minutes, and is completely anonymous.
The link can be found in the show notes wherever you're
listening to this podcast or on our homepage at
riskycreative.com. That's risky. creative.com, we'd
really appreciate you giving us just three minutes of your time
to answer 12 questions. And now on with this week's
show. This week, Government passwords
so bad they'd fail a primary school IT lesson.
A million gym members finding out their bank details were in
the wrong hands and booking.com customers get scammed with their
own data before the company even told them anything goes wrong.
We've also got Rockstar hacked for a second time in three
years, auk energy firm that lost £700,000 because someone changed
a number in an e-mail, and France is making a move that's
going to force an entire government to learn new
software. How's that for behaviour change?
Plus, Microsoft's biggest ever patch Tuesday, a warning about
PDF files you need to hear, and a survey from Sans that the
security awareness community should absolutely be filling in.
Wow, that's a busy one. All of that and a whole lot more
on this week's The Awareness Angle.
And with me, as always, is my partner in cyber crime
prevention. It's Mr Luke pedigree.
How you doing, Luke? And doing well.
Thank you. How are you?
I am good, yeah. Really good, Really good.
A lot, A lot to get through tonight.
Not all of it's juicy, but there's a lot of good, good,
interesting stuff this week. So should we just get straight
on with the breech watch? There you go for it.
The here is this week's breeches.
Of the week. So we have a number of breaches
just to quickly whiz through with you this week.
But the first one I want to talk about, and I love this.
Did you know the people in Hungary seem to be Chelsea
supporters or maybe West Ham supporters?
Chelsea Football Club, Hungarian government passwords found
floating online, including Frank Lampard.
So Frank Lampard's now a manager, so maybe they support
the team he's managing, I don't know.
Investigative outlet Bellingcat have been digging through breach
databases and have found nearly 800 e-mail and password
combinations belonging to Hungarian government staff.
And we're not talking junior admins.
The list includes people in defence, foreign affairs,
counterterrorism and Hungary's NATO delegation.
These are some big, serious people.
And the passwords? Well, let me read these to you.
A district director used 123456 little A big A, A Colonel whose
actual job was information security used Frank Lampard as
his password. Capital F, capital L So, you
know, he's got his, got his capitals in there.
And a senior figure in Hungary's NATO team used a password that
translates to cute. Someone else used a password for
Snoopy. The breach data spans over a
decade, but some of it's from as recent as this year.
And there are signs that nearly 100 government devices may have
been. Actively infected with malware
designed to still log How? Did this happen?
Staff used their official government e-mail addresses to
sign up for personal accounts on dating sites, music platforms,
sports apps and food websites. And those services got breached
and the passwords came with them so.
Well sounds like they didn't have a very good policy in place
for their passwords and also a massive lack of education.
You can't keep if this is the whole corporate using corporate
identities for personal stuff. Don't use your risky creative
e-mail address for anything personal.
Luke because it's for corporate. Use is essentially what you need
to tell people. So password reuse.
They've used it everywhere, you know.
Oh, I'll use the same password and e-mail address combination
for my. Shop as I will for my work
account as I will for my. Gym.
As we'll find out. Later.
So yeah, password reuse is. Terrible.
And then they've been able to map this all back to their
position of power and their sphere of influence, and it's
frightening. Yes, it's not good.
No. So there's a great story,
there's some great examples there of talk about these
things, quite often these. Like weak passwords that have
been discovered, but this is how it can be used against you
government officials. Yeah, right.
That's the first breach this week.
Do you want to dig into the second one?
Yeah, so second one, we've got Rockstar Games hacked again,
this time for a back door. Yeah, this one is a Mashable
article and basically talks about how, yeah, GTA 6, the most
anticipated game, is obviously being created by Rockstars at
the moment, and they've recently confirmed that they've been
hacked again. And this, no surprises here, was
claimed by shiny hunters. Ding, Ding, Ding.
And essentially A compromise the Fed buy company that Rockstar
uses for the cloud cost monitoring says Anodot as the
company. And essentially, yeah, the
hacker said a ransom deadline of 14th of April, Rockstar's
haven't paid and they are starting to been leaked.
And Rockstar have said that player passwords and personal
data is safe. And it seems to be internal
business information including revenue and marketing plans
believe as well. It's not affecting the launch of
the new game at the moment, but we'll see how that goes.
But yeah, it's a second time, as you mentioned, in three years
that Rockstar were hacked back in 2022 and they were breached
by a teenager who yeah, broken. And yeah, so I think this one
from, from the looks of what's been shared, I saw something
about financial information, how much money they're making off
Grand Theft Auto online and other sort of other games that
they have. But yeah, I guess the the good
thing I guess is that your personal information safe so you
maybe you won't get too many phishing emails or anything like
that. Yeah, it's more of a more
problem for Rockstar themselves. It's kind of this doesn't feel
like a massive like it's an issue.
Like they're being hacked, right?
But. This could have been a lot
worse. It's no shock that Rockstar are
making a lot of money because, yeah, after what is it, 10-11
years? Grand Theft Auto Online is still
one of the biggest online games. And when GTA 6 comes out, the
whole world's going to grind to a halt.
Maybe that, you know, maybe that's what this world needs.
It needs GTA 6 to, like, perform a big reset so everyone can
chill out and just play GTA6. Wouldn't that be amazing?
That's yeah, it's interesting. I mean, I guess a lot of this
information is maybe not as much detail in like their sort of
financial reports or whatever, like yearly reports.
You'd probably find out how much money they're making.
But yeah, it's interesting that they've gone for that kind of
data. I guess they just got what they
could. Yeah, yeah, yeah, yeah.
Therefore is much more on this one.
No. That's cool, see if it affects
anything else in the future. Yeah, yeah, I'll move on to the
next one then. And the next one is Basic Fit
Gym Breach hits around 1,000,000 members across Europe.
So Basic Fit is Europe's largest budget gym, train, gym chain Jim
Chang. They've confirmed that around
1,000,000 of its members had their data stolen in a cyber
attack at The breach affected members across six countries,
the Netherlands, Belgium, France, Germany, Luxembourg and
Spain, and the data included names, home and e-mail
addresses, phone numbers, dates of birth and bank details.
Passwords were not accessed. But the company says it detected
the breach through its own monitoring systems, stopped it
within minutes of discovery, and there's no sign of the stolen
data appearing online yet. But they're still investigating
exactly. How it happened?
The interesting bit about this one is that basic fit only
confirmed the scale of the breach after the register
pressed them for numbers. The initial public statement was
really vague about how how many people were affected and which
countries were involved, and then the register poked and
prodded. And then basic fit.
Said yes around 1,000,000 so that's.
If you are a basic fit member or you have operations, you protect
people that are in the Netherlands, Belgium, France,
Germany. Luxembourg or Spain?
This is a great story to talk about because you know it's
relatable. You're bound to have if if
you've got business operations. There's bound to be someone
who's a member of basic fit who's impacted by this, I would
imagine. Yeah.
Yeah, bank details combined with name, address, contact detail,
you know that's you can. You can do a lot with that.
Even from a social engineering perspective, but you know, if
you think. That's a lot of the other vision
that you don't want. Yeah, to be exposed.
Would that be enough to set up a direct debit?
They probably would, wouldn't it?
Possibly, if that depends on what?
Into your bank details, Yeah, yeah.
It's interesting they're not offering.
Are they offering any identity protection like you often see?
Doesn't seem to be reported on this one.
No, no, I haven't seen any report of that.
Maybe they'll get there. They were slow to announce the
numbers. Maybe they'll maybe they'll get
there. It's it's an interesting 1
though, because a gym it's just another example.
Like for many people a gym will be 1 of 20 or. 30 or 40
subscriptions, memberships and stuff that they've got.
And the more memberships and clubs and things.
You sign up for the bigger your threat landscape looks like your
person will threat landscape. And we don't often think about
that as an individual. We talk about it in a business
context about all of these, you know, third parties.
But when was the last time, as an individual, you reviewed your
own third parties? Like how many accounts have I
got active that have got my details?
That's that's. Yeah.
That's an interesting one. And how many tiny little vendors
have you shopped at? I bought some T-shirts today for
an online shop that I love. I've bought their T-shirts
loads. I love them.
High hope clothing, really like it.
Give me some. Free T-shirts please, but.
If they had a data breach, I might never know about it
because I don't know it it. Makes you wonder.
Yeah. Yeah.
Anyway, move on to the next one. Cool.
The next one we've got, birken.com confirms customer
data accessed in latest breach. So they've recently confirmed
that hackers have accessed customer reservation data,
including names, emails, phone numbers, booking details.
The company emailed effect to customers over the weekend, have
reset reservation Pins and say it's now contained and financial
information was not accessed. But what they haven't said is
how many people were affected or exactly how it's happened.
And yeah, looking into it a bit further, seems like, yeah,
people have already been receiving phishing emails and
even prior to notificationofbeckon.com
themselves. And there's a report of a Reddit
post of two weeks before they're booking the content.
Any notifications so ever that's to do with this or just a
coincidence? Not too sure, but it seems a bit
timely for it to happen at the same sort of time as the state
has been stolen. So yeah, not the first time
picking up. picking.com's been breached and they've got a lot
of history with this sort of stuff.
You often hear about compromised hotel accounts on the platform.
We've talked about that reaching out.
Cars before through the actual like internal messaging
platform. But yeah, it's interesting they
haven't said how many people are affected.
I mean, I'm a I've used booking.com and I didn't receive
an e-mail or anything about it. So maybe I'm not one of the
affected people. But yeah, want to look out for
if you are a booking.com user. Yeah, definitely, definitely.
You can't thebooking.com, it just seems because they're such
a big target. Such a big company with so many
fingers in so many pies, they're going to be and it's really
important that things are built properly and run properly.
And I think with the the story we did before, they didn't take
the blame for because it was the hotel accounts that were
compromised and then used to. Accessbooking.com But you know
it's. Be careful.
Don't trust. Just because you recognise the
name doesn't mean you should trust the interaction.
Question everything. Yeah, especially if it comes
from a hotel or whatever else you can do on booking.com.
Like, yeah, people do like Airbnb type things as well now,
not just hotels, right? So be wary of people reaching
out about your existing bookings and stuff, but it's going to at
least say, reset various pins and stuff.
So because if you're travelling, you're travelling soon, you'll
probably be all right. It says here booking.com
repeated its notification. It will never ask for card
details by e-mail, phone, WhatsApp or text.
So that's probably worth repeating to your audience,
your. People your colleagues if
someone contacts them about booking.
And asked to reconfirm payment details for another through
through any other channel other than booking.com's website.
It's a scam. Stop.
Hang up, Disconnect report. Whatever, right?
That's this week's breaches, so let's get on with the news.
And the first story this week, Microsoft's biggest ever patch
Tuesday. It's always the biggest ever,
isn't it? I feel like I've said that line
before on this podcast, but apparently it's the biggest ever
Patch Tuesday, including a SharePoint flaw that's already
been exploited. So if you don't don't know what
Patch Tuesday is, every month Microsoft releases security
fixes for its software, and it's called Patch Tuesday because it
always happens on the second Tuesday of every month.
This month's release is claiming to be the biggest in Microsoft's
history, fixing 165 separate vulnerabilities across its range
of products. The one grabbing the most
attention is a flaw in SharePoint, which is the
document sharing and collaboration platform used by
millions and millions of it was already being actively exploited
before the fix arrived. There's also a notable Windows
networking vulnerability that security experts.
Calling potentially wormable, which means it could spread from
device. Device.
Oh my God, I've got one who cried like nightmares.
Yeah. So SharePoint, for anyone
unfamiliar, is where you store and share files.
And internal content, large companies, if they run Microsoft
O365, they probably run if you've got Outlook for e-mail in
the business. You've probably got SharePoint.
So this, I mean, it's huge patching.
It's a great opportunity to talk about patching, to talk about
the importance of patching, because this won't just be
corporate devices, this is personal devices as well.
If you've got a Windows computer at home, if your mum, your dad,
your nan, your aunt, your Gran have got Windows devices, they
need to install these updates. Because they're being actively
exploited. T5 is huge, isn't?
It yeah, that does sound like one of the biggest we've spoken
about. Yeah.
And it's not because Microsoft are really bad at this stuff.
It's because there's so much of it really, isn't there?
Like you think of Microsoft suite of tools.
It's not just like, oh, they write Windows, really.
Badly, but. It's a whole product suite.
Yeah, I, yeah, it's, Yeah, it's mad.
Especially with like last episode, we spoke about that
anthropic AI security vulnerability scanning tool, and
there's obviously other ones out there that are more accessible.
Yeah, yeah. And obviously, yeah, AI think's
probably making it easier for criminals to find the
vulnerabilities, right? Yeah.
Yeah, And this is, this is a great opportunity to talk to
your IT team because they're going to be stuff like this
drops. And when there's major
vulnerabilities that are garden, there's like a mass pressure to
get these installed. Messages go out asking users to
restart their devices. And users hate restarting their
devices, especially when like backs seem to restart really
well. But Windows, you know, Oh, my
computer restarted in the middle of a meeting, in the middle of a
presentation. I've got this presentation I've
been working on. I've had it open for seven years
on my desktop and I can't close it.
It's like, I'm sorry, but you have to restart computers to
apply patches. Not always.
They're getting better. So it's a good opportunity to
talk to your IT team and help grease the wheels from an
awareness perspective. If you've got Champions Network,
talk to your champions as well and help spread this message out
to them. You're going to be asked to
restart. There's some really nasty
vulnerabilities. Out there that we need to patch.
Here's what they do. It's interesting.
You know it can be. It can be quite relatable,
especially if you tell them about what to do at home.
You know if This is why it's really important.
If this is what if some of these could, yeah, some of them could
apply at home as well. SharePoint won't like if anyone
who's wearing running SharePoint at home is a tech nerd with, you
know, running their household like a business.
But the other vulnerabilities, yeah, there will be other
Windows networking vulnerability will probably could very well be
active on a home device. Word, Excel, Windows Paint.
Yeah, anything. There's there's many, many
different parts of Windows. Anyway, I think we've talked
enough about that. Biggest ever patch Tuesday,
install your updates. That's all it is.
Doesn't matter what you're running.
Update. We'll move on to the next one.
So yeah, next one we've got front ditches Windows for Linux
across the government. The the synergy biggest ever
patch Tuesday, right? Windows is gone.
Time for a Linux terrible friend.
I'm sorry anyone, friend. I won't try and try and do that
myself. I've just offended a whole
nation. So yeah, it's quite interesting
on this one. So yeah, they've said that
they're ditching Windows, switching to Linux across its
government devices. Every department has until also
of 2026 to submit a formal plan for how they're going to make
happen. It's not not that long away.
Yeah. And then yeah, the interesting
thing here is that, yeah, it's come from a top down from the
government because they seem to not want to rely on American
made tech companies for some of these fundamentals.
Their government computers as well.
I'm sure they probably save a fair bit of money as well,
right, Going from a paid operating system to something
that's free and open source. Absolutely.
So yeah, it's quite a big, but it's a pretty huge change,
right? Most people probably won't know
how to use a the next machine, so it's going to be a lot of
change for people there. Completely different sort of
feel, I guess, some different ways of potentially being
exploited even. But yeah, there's not much more
I don't think on this one as such.
But it's just, yeah, quite interesting stories to share,
perhaps. I do wonder, I wonder what build
of Linux 'cause I imagine they'll go for something.
I haven't dabbled it with Linux for a long, long time.
Right, but it used to be that Linux Mint for example was not
only lightweight, but it really resembled older versions of
Windows and Ubuntu did to a degree until he got like below
the when when you started delving with anything different.
You know, you open up terminal. It's like, wow, this is a.
Command prompt. So back back in my old IT
support days. But it's funny, I had a
conversation with a couple of Canadian companies over the last
few months that were also looking to decentralise from AWS
and and things like that. There is a real appetite at the
moment, partly cost driven and partly political, that, you
know, we need to own our own stuff.
And I know France, I've read other news stories recently
politically with France looking to like be more independent and
stuff. And I think it's, yeah, it's not
a bad thing that obviously there's some dependencies.
Like the hardware is still going to be made in certain countries
and the tech inside is still going to be made in certain
countries. It does, I mean it.
The behavioural change piece on this though, like you you said,
is huge. You, you're going to have users.
All of a sudden their user interface will change.
The websites will remain the same, but the OS will be
different. And if someone knows that what
does click fix look like on a Linux device?
Do you know what I mean? What does what does normal look
like? They don't know anymore.
So there needs to be some real. This is if.
If you work for a French organisation Security Awareness,
this is a. Huge opportunity to make your
mark and really be involved in this now around that whole
security change piece. That's that's quite exciting.
Yeah, it's definitely a unique sort of scenario to to be in.
Just looking at the comments, someone did say that Germany had
done it already. I think it's quite a while ago,
maybe not much, maybe just a couple years ago actually,
right. There's a few other people that
a few other countries that have migrated to Linux, so that's
interesting. I wonder who will be next to
them. Let's judge you by the way
that's going. 11 comment on Reddit says Trump Donald Trump
being a major catalyst to Linux desktop adoption was not on my
bingo card, but but I love it. It's yeah, it's mad.
Yeah, but there we go. So.
If you're in a French organisation, get involved in
this and please reach out. Hello at riskycreative.com.
Let us know what you're doing and how that behavioural change
piece works out. I'd really be interested.
To know, I'll put some. Feelers out to the to.
I mean, this French government, I don't.
Know anyone that works in French government?
But if you're in an organisation that's done it, I'd love to have
a chat. Right, I'll move on to the next
one. This is really relevant.
UK energy firm loses 700,000 lbs, which is nearly $1,000,000
after hackers redirect payment So British oil and gas company
Zephyr Energy has confirmed that someone stole 700,000 lbs by
intercepting a payment meant for a contractor and quietly
redirecting it into their own account.
So they've filed the disclosure with the London Stock Exchange,
saying it's working with banks. To try and recover the money.
They haven't said how it happened, but it fits a very
well known pattern that security awareness professionals, you
know, come across quite often. I would assume someone got
access to an e-mail inbox or a payment system, what's for an
invoice and then either swapped out the bank details or put
phone calling going, oh, we've got some new bank details, can I
give them to you? Waiting for a transaction duty
enough to actually do that kind of engagement.
You know these kind of anyone that works in a finance
department will receive approaches like this quite
commonly. It's not unusual.
And then when the when the money goes into the wrong account, the
attacker gets sees the money come in and it's gone.
The FB is most recent cybercrime report, but total losses from
this type of business e-mail compromise attack over. $3
billion last year, which is huge, yeah.
Yeah. And there's different types of
we won't get into it. This is business e-mail
compromise where I get access to your corporate.
Account and then pretend to be you.
There's different types of business e-mail compromise.
Business e-mail compromise 1.02.03.0.
I think there's 4.0 now and each one's like a different layer or
something. But it keeps working because
it's just human and it's abusing an existing conversation.
That's already on the way in a trusted platform and a trusted.
Network it's. As if you're already expecting
the 700,000 of deals as such, you're not really going to
question the bank account if it's already sort of confirmed,
right? Yeah, You're not really going to
spot if it's changed to, isn't it?
No, no, exactly. Zephyr said on this case that
they were using industry standard security, but they
still lost the money. What's?
And that's quite important, isn't it?
Like industry standard, it's this is like compliance.
Compliance doesn't make you secure.
It's a baseline. It's where you should start.
From and then you need to build upon that.
Industry standard is probably just that baseline and then you
need to build. Upon that, there isn't much more
on this the company said it used.
Industry standard practises for it's tech and payment platforms.
And has implemented additional layers of security, but the
register reached out to Zephyr and they.
Didn't get a response. It's interesting that that kind
of thing doesn't get flagged. Perhaps I made it up to see if
it's a new contractor or whatever you've never paid
before. Maybe not.
But yeah, it's interesting that that was perhaps so easy for
them to to have them. I don't work in finance, but
maybe there's maybe there is processes that could be put in
place to stop this from happening.
Like any change of bank details won't be acted upon for 30 days
or or you know, has to be signed off by I.
Don't know practicalities I I. With all of the different
accounts and payments that are made, it's probably really
complicated, but it's also strange.
I know when I make a payment on my bank when I'm paying someone
and put in like an account number and sort code, it
verifies the account details. So it then goes this account the
account name doesn't match what you've put in.
It's this. Can you confirm?
So maybe there is a? Such if you're paying into the
business, yeah. So it can do that sort of thing.
Yeah, maybe corporate accounts aren't quite as mature as that,
I don't know. Yeah, it's interesting, yeah,
because it'd be more obvious if they asked for it in Bitcoin or,
or something. But what's really crucial on
this or or really significant is someone has got away with nearly
$1,000,000 without a breach without of a company.
They've they've gone to AI don't know.
It could have been your cleaning contractor, it could have been
your supplier for bread rolls in your canteen.
If you sell a £1,000,000 worth of bread rolls, I don't know.
It could be any company you deal with.
It's their weakness. They don't have to target you,
but they know that they know you.
You can work out who supplies who all day long.
Just it comes to there's an account hacked somewhere, but
it's not necessarily in your, that's not in your environment.
It's in someone else's You're safe and sound and this poor.
Person in finance that's made that payment, they're not a
fault. That's really important to
remember here. They're going to feel like
they've dropped the ball on this hugely.
They're going to feel guilt, you know, support them.
It's not their fault if they're followed process.
It's not their fault this stuff happened.
The process obviously wasn't. Up to it, but.
We often forget about the person right in the source of this is
the person that actually made that bank transfer the person
that signed it off and go, yes, make that payment to the wrong
person without, you know, unintentionally so they
shouldn't be penalised or punished.
They need support. I bet they don't always get it,
but they should. Probably not right?
Move on to the. Next one, move on.
To the next one so this was quite a good one.
I I dislike this a lot when it happens Google always coming for
websites that trap you when you hit the back button.
So yeah, you often get the experience where you're trying
to leave a website and you just can't seem to go back to where
you were originally and then you push the back button too many
times and you end up eventually getting through and go back way
too far. But and it knows this is what
it's called back button hijacking and Google was just
officially classed as spam. So the 5th from the 15th of
June, sites that dealers will face penalties in Google search
results, which will mean that they all appear lower down or
disappear entirely from Google. What's interesting, it says that
Google have seen a this behaviour's on the rise and
what's it gone, which I'm sure many people also haven't they
gone do. You know when I see, I mean, I
haven't. Do you know when I?
See it too often, but. Do you know when I see this
behaviour? I I find this quite ironic.
The Google app will notify me of a news story.
So I'll go into the Google app and it will be to my local, it
will be to a local news site that are typically really trashy
because they're full of ads trying to generate some income.
So like local newspapers trying to stay alive, The websites are
full of ads and pop ups and stuff like that.
And keep scrolling past this ad to view the news story or it
will take me to Manchester Evening News, you know, hundreds
of miles away. And then when I go back to go
back out of that, that's when I get like tooth whitening ads and
like fake news articles like this person lost 800 lbs in
weight from like. This blue thing on their teeth
or something like. That and it's.
It's the. Google app that took me there in
the 1st place. So it'd be really interesting if
the quality of news on the Google app is about to get a lot
better. They they are the cause of me
consuming most of this content. Yeah.
Yeah, there's much more on this one to be honest, but I guess
yeah, sometimes it could be used to, yeah, trap you on a dodgy
website last like potentially could get you to click on
something malicious even. I'm not sure everybody's aware
this is, I'm not sure everyone's aware this is a thing.
So this is a good opportunity to talk to people about back button
hijacking. What is back button hijacking?
Well, if you go to a news website and you press back and
it doesn't. Actually take you back to the
page. Because more often than not,
when you press back and it does display a list of fake news
articles or ads, more often than not, I would guess they're
scammy, potentially harmful. They don't ever look legit or
good quality. So I think this is probably good
in some ways. It's a good opportunity to talk
about back button hijacking. Let's not forget though, not
everybody uses Google. Some people out there do use
other search engines that won't be implementing.
This yet so. Again, Yeah, good to talk about.
Yeah, they might follow suit. Good Hope.
Or it could be a good reason Sir use Google instead.
But yeah, yeah. So yeah, Moreover, unheard of
sort of thing, but I'm sure people have experienced it,
yeah. Next one, right?
I'll move on to the next one. And the next one tonight is
Adobe has pushed out an emergency security patch for
Adobe Acrobat Reader and it's being actively exploited in the
wild. So this floor apparently has
been in use since December last year, which means it's being
exploited for months and months and months without anyone
noticing. All you have to do.
So it isn't as an end user, as a user, you get sent a malicious
PDF. All you have to do is open it.
There's no clicking a dodgy link, no approving anything,
just opening the file because the malicious PDF spotted in the
wild were disguised as legitimate documents as well,
some were in Russian and related to gas supplies.
An emergency response which would suggest that this is
probably targeted. But Adobe has released an
emergency fix and the US government's cyber agency has
ordered federal agencies to apply the patch by April the
20th. Now I did when I saw this news
article, I did record a little short for TikTok and posted it
on TikTok. But if you use Adobe, make sure
you update it now and what are the comments?
Let me just see if I can read you.
You can probably guess what the comment on this is going to be
because it's it didn't come as any great surprise.
If we if you want to follow follow me on TikTok, it's at
infosec and. On TikTok.
There was one comment on it and it says has a flaw.
It's been only bugs for years now.
Every single month. Don't use Adobe.
I must admit I think Adobe perhaps as often as Microsoft,
if not more frequently. And there it does seem to
regularly, regularly regularly be exploits and vulnerabilities
in Adobe Acrobat. Again, though, it's the number
one PDF reader in the world. Which is why target it.
I don't know. I would hazard a guess and say
75% of Windows computers have Adobe Acrobat installed.
I don't know. Yeah, I'm going to find out.
Yeah, go for it. Adobe Acrobat, Mark, I'm well
off. OK, I'm well off.
Well, I'm not. Adobe Acrobat Reader Adobe DC
52.0952% market share. When you combine that with Adobe
Acrobat Pro it goes up to 59%. So just shy of 60% run of
computers run. Adobe Acrobat.
So yeah. With that kind of market share,
you're going to be a target. Oh yeah, definitely.
Yeah. I guess your average users
probably just going to have use the built in like PF years or
web web browsers can sort of view them like on this preview.
Yeah, I don't know what they're doing.
The second second biggest PDF readers probably Fox it or
something like that, which has probably got a 2%.
Market share or something like that, yeah.
Right. So if you have Adobe Acrobat,
again, another great story, install your updates is actively
being exploited since December. We're now in April, that's four
months. Yeah.
Installs of hatches. Scary one to just need to open
it. Just open it.
Yeah. That's so innocent, right?
That is it for this week's news. So now we'll have a little bit
of awareness, awareness, this week's awareness awareness.
The Sands 2026 Security Awareness Report survey is now
open. So if you're a security
awareness professional, if you work in the field of human risk,
this one is for you. Sands Institute runs the biggest
annual benchmark survey for awareness and human risk
management professionals, and the 202026 edition is now open.
It's 24 questions, takes around 8 minutes and the findings feed
into a free report that security awareness practitioners around
the world used to benchmark their programmes, justify
investment and work out what actually moves the needle on
human risk. It's been running for 11 years
now, and it's one of the most credible data sets in the field.
If you work in security awareness in any capacity, your
voice belongs in this. I use that.
I use the SANS security awareness report to get money to
employ you so many years ago. So it does work because without
that, this wouldn't exist, probably.
So thank you, SANS, for making this exist.
Yeah. Probably not.
So yes, I used it to build a business case on maturity and
you know it. It tells you salary expectations
and jobs and roles and businesses and what the function
looks like. Size of an ad.
It's it's amazing. This year's 2025's report.
It's always good. 2025's report is out there If you work in
awareness and you want to contribute to 2026.
The link is in show notes or you can probably find it by looking
for Sans on LinkedIn or Lance Lance Spitzner.
Go look for Lance. Lance.
Will be talking about it, I guarantee it.
Right, that's it for the awareness.
Awareness this week. So should we do some security
socials? Yeah, yeah, I haven't got loads
this week. Normally I come with a big long
list. I've come with 1, so this will
be quick. And this is a post I saw on
Reddit, of course, and it's not anything scandalous or unusual,
but I just thought it this quite a little talking point.
It's worth a worth a discussion. I know what I know what you
think your opinion may have changed because we've had this
conversation when we worked together.
Reddit cybersecurity R slash cybersecurity engaging versus
time saving training. What's better?
Building a cybersecurity awareness training and got in a
debate with myself. Option A Engaging and
interactive. In theory, users should resent
this type of content less and gain practical skills for
dealing with threats. This format takes a bigger
portion of participants time than clicking through a
presentation, but it builds muscle memory and improves
knowledge. Option B Save people's time with
a less interactive approach, but except that the training becomes
a wall of text we all click through without reading, thus
minimal knowledge or skills will be gained.
Obviously the ideal scenario would be to me in the middle and
provide somewhat interactive but time efficient training, which
is what I'm trying to do. If I ask employees at our
company, they would all tell me that they want it faster to
complete it. The question is, if you had
option A and option B, which would you choose?
It's an interesting 1 isn't it? Engaging versus time saving.
I've in the last, in the last three years I've done both and
I've worked in organisations where we've done both.
There was a time we did engaging, really effing
engaging, like awesome. And then we flipped and went
time saving. But for a reason.
This doesn't take other things into account, does it?
I don't think. Yeah, this.
This is difficult 1 I think. My initial thought was this was
written by bot, but I've checked the post history, I don't.
Think it is. I think it's legit.
But some of the comments say you want the middle ground between
A&B. Someone says if you've asked the
employees and they've said they want it faster than no amount of
engagement and interactivity. Will help because they don't see
the value in it. But if you start from a place of
helping people understand why the training is important, then
I think the delivery mechanism becomes secondary.
However, if even Netflix is struggling by competing with the
second screen in people's hands, I think any content is going to
be a tough one. The second screen is an
interesting one. But So what did we do?
Let's just rewind. OK, we may.
We used to buy off the shelf training and then we made some
training that was awesome and engaging and took 10 minutes and
people loved it. And then we ended up flipping it
completely and just going along with compliance and minimal
viable product. But we engaged.
We didn't need training to engage.
And that's what this doesn't cover, does it?
This, it doesn't talk about what else is going on.
If training's all you're doing, if you, if, if this is your only
behavioural change mechanism, then option B will not bring
around any behavioural change. Option A will potentially.
Yeah, I think, yeah, like you said, it can't be a stand alone
thing. And because you can't expect
someone to care about it if they don't know about it kind of
thing, if it's the first, the only thing they see from the
cybersecurity team, they're probably not going to give a
damn about it. Like I've said before, I said
this at a presentation on Cave. Conference few weeks.
Ago training is draining. People find training draining
unless you disrupt and give them something like No Before.
No Before claims to do this with the Inside Man.
They make it different and a big Hollywood thing it inside man,
the kind of Hollywood film video.
You sit there and watch this big dramatised thing that's run for
seven seasons. It's not going to, it's not
going to hang with everyone, not everyone's going to engage with
that, but you've got to find that happy place for your
organisation. We found that happy place, but
then we decided we didn't need training anymore.
Because we were engaging elsewhere.
So I thought that was thought that was interesting because
that sounds like someone's at the beginning of a behavioural
change journey but needs to think beyond just training.
Yeah, I think as well maybe very good to engage with any other
departments. And if, if, if your company has
like even a digital learning sort of team because yeah, if if
you're getting lots of training outside of sub security, then
it's even harder to do either option to penis.
Everybody wants to do training now.
Everybody sees training as a silver bullet.
You've rewind 10 years. There was I think we had
security training, fire training maybe or health and safety.
I think there was like two or three trainings.
But if I think about like more recently, you had compliance,
fire, health and safety, code of conduct, GDPR and data proof,
like the list goes on. And everybody thinks, and I
don't know whether the compliance world has changed and
now there's a million different compliance requirements to
deliver, a million different types of training or whether
everybody's just thought, oh, I know, we'll solve that.
I'm going to build a training course.
Training is this silver bullet but behaviour change Doing an
annual doesn't really. Does it mention?
It doesn't mention if it's annual.
I'm assuming annual, but it doesn't say that here, but
annual training. It's not going to change
behaviours, I don't think. If it's going to have.
Any chance of changing behaviours?
You need to make it engaging and interactive.
Yeah, anyway, that's that. That's all I've got for you.
So did you have anything? Yeah, I got just one video to
share. It's not really anything new to
us, but it's what worth sharing It might be 1 to share with
friends and family for the most part.
Couldn't bring it up on the screen.
Yeah, this is someone we've watched before.
Many times Jeremy finds AII think he's changed his name.
To be fair, Jess is a video. Just.
I don't think he used to be called Jeremy Finds AI, but I
know we've seen him before. He did the home.
Was he did he do the fake? Yeah.
He just set ones like Home Alone.
That one and a few others, like lots of AI versus real stuff.
But yeah, that's what this one was interesting to share.
So it's obviously nothing new, but I think it's sort of covers
a bit how AI, as we've sort of spoken about this, makes it
easier for people to create scam people, like with social media,
fake social media accounts and fake websites.
And yeah, like money scams through fake products and stuff.
But I'll just play the video, see what it's about.
This account blocked me so I couldn't tell you that they're
AI but I have burners so I'll tell you their whole story.
They make AI sob story videos with this character who pretends
to hand make these cheap watches.
Their profile links to this Shopify website and this is
where the clues start. By inspecting the source code I
can see it uses a custom Shopify theme which includes a reference
to Jordan Welch, a YouTube are who makes drop shipping
tutorials. While following that tutorial
they made a Shopify site that didn't survive but its theme
did. And since then they've used this
theme on four other websites. This includes metalheads dot
store and it looks really similar to grim light watches
but they sell blankets and necklaces instead.
By using AI videos to target different niches and spinning up
sloppy websites alongside, they can jump around until they find
something that sticks. In this case it was grim light
watches. But these tutorials and things
like this get hundreds of thousands if not millions of
views, which is why there are so many of these AI scams right
now. So if you come across a website
using this layout, it is designed specifically for drop
shippers. This is not a legit artist's
website. Take the time to check out a
page's whole operation before buying anything online.
This is. So yeah, the surprises like AI
being used. To AI video.
Create characters Ryan sob stories.
It's quite a big thing. Do you see on TikTok especially?
I know we spoke a few weeks ago about Sora, the Sora app being
discontinued by Open AI, but I saw something the other day
about Sea Dance versus NVIDIA I think it was, and it was a
comparison video of a number of shots the same prompt put into.
Both. Sea Dance was unbelievable like
it was, it was looked so realistic.
There was there was one bit and it was a card like speeding
through a street, swerving around other cars and one of
them the the kind of dynamics of the car, the back end, it would
have spun out it. Was like all over the place.
But this one was really good. It's funny, just I'm I'm going
to make a really embarrassing claim now.
Myself and my wife have been watching Married at the First
Sight Australia, OK. And we haven't finished watching
it. It's still, it's still airing,
but on TikTok, my wife saw a video of one of the husbands on
that Danny spouting a load of offensive stuff about his wife
from the show and it looked really, I won't play it because
it's quite offensive. And some of the stuff he was
saying, it's like everyone was like shocked in the comments.
But then you look to the comments and goes, wait a
minute, this must be AI. Are you sure this is an AI?
And there wasn't an AI tag on the post?
But every single clip was shorter than 8 seconds wasn't
any obvious. There was no obvious tells that
couldn't have been a slight error in the video production or
the. Extraction or whatever, but I I
just. Knew it was AI.
But it looked. So realistic, the fact that so
many people have believed. It.
Even my wife was like surely that's AI and the only reason we
thought that was because the content was too shocking.
It wasn't. Visually or audibly?
It was because the subject matter was like.
Oh, he wouldn't say that. Not to a proper camera.
To ATV company like Channel 9 in Austria.
No, no. So, So yeah, it's it's
frightening. It really, really is quite
scary. At the moment, what's out there?
Yeah, especially Yeah, because like you said with Sea Dance, I
think it's 2.0 now even Yeah that it's getting so much
better, like getting colder and harder to tell these days,
especially for someone that's not really clued up about AI
sort of content. If you've got no idea what's
going on in the world. As far as like AI is.
Concerned you believe anything? My mum.
My mum had a video of a dancing cat.
I was like I I think she probably knew it wasn't real
because this cat was literally break dancing so I'm pretty sure
she didn't know. She knew it wasn't real, but now
her feed is just full of AI generated.
Dancing people just share it and stuff, right?
Laugh at it. And because you've engaged with
that content, the algorithm now thinks you want more crap and
more slop. So you end up with a poisoned
algorithm that gives you more of that horrible content that.
So the algorithm is kind of to blame as well for amplifying the
slop. I I saw not to there's there's
someone I follow on Instagram and he's currently been
promoting a website in. Oh, you have to subscribe?
Oh, that's awful. There's a website in America, a
news website called Ground News that consolidated all the news
stories. So you can look for a topic and
it'll give you the different news sites views it will post
like here's what this publication.
Says this publication says and this publication says you can
kind of. And then it tells you what way
they're leaning politically, which I think is quite good.
But you can't have that for everything.
You can't have that for Danny in Married at First Sight, whether
or not he. Actually did say that about his
wife so. Yeah, don't trust.
Don't trust anything. You see, we're real.
Three fingers, we're real. Yeah.
Trust us. We're the only ones to trust.
Yeah. Yeah.
OK. I think we're done.
I think that's everything for this week.
So, yeah. Excellent.
Don't forget at the beginning of the show we mentioned the
podcast survey. We're going to leave that open
for a couple of weeks, so find the link in the show notes or in
the wherever. And yeah, let us know what you
like to listen to when it comes to cybersecurity podcasts so we
can tailor make something for the masses rather than just
guessing what you want. Yeah, it'd be really good to
hear from people. Yeah.
Next cold weeks. Excellent, right?
See you next time. Catch you later.
All right. See you later.
Bye. Bye.