This week someone searches for Roblox cheats at work, gets
malware, and that one decision ends up breaching their sales
customers. Ritual shoppers find out that
their loyalty programme data has been downloaded by attackers
researchers trusted with. Half a million people's health
records put them up for sale on Alibaba.
Anthropic quietly installs browser hooks on your machine
without asking a. Scam e-mail uses an old
password. To convince you that they've got
footage of you, a journalist tracks a NATO warship by posting
it a $5 Bluetooth tracker and a greeting card.
And the UK government says it's time to stop using passwords.
I believe that when I say it. All that and more of this week's
The Awareness Angle. And with me, as always, is my
partner in cyber crime prevention, it's Mr Luke
Pettigrew. How you doing, Luke?
Hey, I'm doing well. Thank you.
How are you? All good, all good.
The sun's out, the sun is shining and yeah, yeah.
But that makes for a good day, so.
Should we get in some breeches? There you go for it.
OK, here's this week's breech watch, right?
Kicking us off this week, Versell.
If you're anywhere near cybersecurity, you've probably
heard about this one because everybody's been talking about
it. Versail breach widens, so it's
got bigger. So Versail is the company behind
the next Dot JS framework used by lots and lots of different
people, lots of businesses, lots of websites.
The breach. The breach originated from a
compromised third party AI tool called Context AI.
The breach they announced, and they've now announced that it's
even bigger than first thought. So Context AI is an AI
productivity tool. The adversal employee was using
third party AI tool. An attacker took over that
employees Google Workspace account through the compromised
AI tool and then use that access to pivot into their sales
internal systems and start decrypting customer environment
variables. So as the investigation has
expanded, their sales now found additional compromised accounts,
including some that appear to have been breached independently
through social engineering or malware before this incident
even began. And Hudson Rock traced the
likely patient zero to a context dot AI employee who got infected
with Loomis dealer after searching for Roblox auto farms
scripts. And it's still unclear whether
verses use of context AI office suite was officially approved or
just a case of shadow AI, which is where you know your people
use tools without asking the the the pieces together on this the
journey. It's huge.
There's so many bits to dissect from this.
You've got the shadow AI argument or or act third party
AI argument. I love that I love it.
I mean, I hate it, but I love it.
It's the fact that the. Way that they did that, an
attacker took over the employees Google Workspace account through
the compromised AI tools. So they've gone back and use
that access to them, pivot into Versailles internal systems and
then in investigation they find out that there's other people
that have been popped already and the average time isn't it
that breaches you only? Like you discover a breach
typically that your system is impacted 200 days or something
after the initial point of access, so.
They've found other people on their network.
It's frightening. Frightening.
Yeah, definitely have a monster of the Disney breach with the
BMNBMNG mode or whatever it was. And it makes you wonder, was
this person doing it on their work machine or was it bring
your own device like using their personal machine for work?
And it's quite crazy how it can just happen from such a what
you'd point the person doing it where you wouldn't think
anything of browsing for some Roblox thing.
You wouldn't. They wouldn't expect it to blow
up like this, right? You wouldn't.
And the other worst part of this is it's context AI is I mean the
report in we're reading here says it's context AI is employee
that has performed some that has made some questionable decisions
and because of the third party's employees decisions that's led
to versailes getting breached. So actually.
Versail haven't really done anything wrong, you know
they've. They've probably assessed the
third party, but when you do a third party approval, is there a
line on there that says do your employees look for Roblox cheats
online like you could? This could almost happen to
anyone and that's what makes this quite frightening.
It's yeah, the context AI is user has reportedly gone and
looked for Roblox cheats. There's probably someone in
every organisation of a certain size that is using their.
Computer for something personal at some point and it's.
Yeah, yeah, that's a very unique story.
Yeah, yeah. There's going to be unfair
parties as well. Just I feel like everybody's
going to Start Stop using third pies where they can maybe.
Yeah, yeah, and it's. Do you reckon?
It's difficult to know whether their cell were the initial
target and context AI was used as the bait.
You know, it's like, OK, I want to get into Versailles.
Context AI are a client. Therefore maybe I can poke at
them and then pivot across. Or did someone get access to
context AI and then go, Oh my God, like what have I got access
to? This is amazing.
Like, and they've just purely won the lottery to get access to
a massive client. This we don't know, but anyway,
that's that's I mean, that's how lead breach this week
Versailles, everybody's reported on it.
It's it's so many pieces to that links.
If you want to read more about that links to this story and
every story we talk about is in the newsletter.
You can subscribe at riskycraive.com or you can find
it by searching for the awareness angle on LinkedIn.
Right. Move on to the next one.
Cool. See our next breach.
We've got Ritual cosmetics. Hippitary breach customer
details are exposed such as four names, emails, phone numbers,
date of births, home addresses. Pretty standard sort of data set
of breach there. No payment information is
supported the accessed and no ransomware or extortion group
has claimed responsibility, which is interesting.
See, I'm not sure Rituals are a luxury body and home products
brand. I bought my wife a very
expensive room, smelly you know, bottle with sticks and it was
like 25 LB. It was a birthday present or
something. I I cost me more than that if
she's. Listening.
She doesn't listen. But yeah, they're they're quite
expensive. They smell lovely.
I think they do hotels as well. So yes, that's.
Rituals, Yeah, this is here as well.
They've it affects members of It's My Rituals loyalty
programme as well. So Tech has gained unauthorised
access to the company's systems and managed to download part of
the membership database before the company spoiled it and tried
it down. There's reportedly no sign of
data being publicly shared and the company have reported it to
the relevant authorities and have lost a forensic
investigation. So seems that they've done quite
a good job with that so far. Yeah, I guess it's just one of
those things, right? If you're a customer and look
out for told you emails claiming to be from them asking you to
like do things with your account, maybe might send like a
fake update your password and then it asks for your account
password and you revealed it that way and stuff like that.
Yeah, I think there's too much more.
We've got another story later on that kind of talks about
something that happened after a security incident.
So we talk about Grafana a little later.
There's a story we've got. It's kind of the kind of results
of what can happen after an incident or suspected incident,
so. Yeah, yeah.
Yeah, it's that one. Made quite a big.
Splash in the news that one I saw it reported in quite a few
places and it's, you know, there's not an attacker
announced. Rituals isn't the largest of
companies. The data hasn't been seen
publicly. It's not the richest of data.
It's a pretty. Common data set to be stolen.
So it's. I was surprised it made such a.
Big splash in the news, but it did.
There's no information on like how many people are affected or
how how big the data is, right? Usually you get that maybe it's
quite early and maybe they maybe didn't catch it quite early, so.
Rituals. Is not quiet anymore.
Rituals is quite a they're a luxury brand, so the that list
of if you're in a loyalty programme and you're regularly
buying these luxury products, you're probably a certain
profile of individual high wealth, you know?
High income so. That way it's it's quite an
attractive data set I would have thought.
You know, these are people with money and finances and credit
and stuff, so. Yeah.
Right, I'll move on to the next one.
And this one pinged on my phone. The Times pinged Breaking news.
UK Biobank health data found listed for sale on Alibaba.
So this has been reported everywhere.
The data. The UK government has confirmed
that health data from UK Biobank, one of the country's
most important medical research databases, was found listed for
sale on Alibaba, the Chinese e-commerce platform.
It's connected to Aliexpress, which you've probably heard of
more. Alibaba is like I think.
I think it's where you buy in bulk rather than end user.
Yeah. Technology Minister Ian Murray
told MPs the breach involved de identified data from nearly all
of the projects 500,000 participants.
But this wasn't a classic hack. The data had been legitimately
shared with researchers at 3 accredited academic
institutions, who were contractually bound to keep it
secure and use it only for health research.
But instead they put it up for sale online so.
UK bio bankers suspended access for those institutions, they've
shut down its research platform temporarily and they've imposed
new restrictions on data exports.
And the ICO is investigating, formerly the Information
Commissioner's Office. If we look at the data exposed,
I mean this is this. It's significant gender, age,
month and year of birth, socio economic status, lifestyle
habits and measurements from biological samples.
But there is no names, addresses, phone numbers or NHS
numbers. So.
This isn't a hack. This has been downloaded, you
know, by accredited researchers. They've just decided not to
research it and instead flog it, which is crazy.
Yeah, it's very bizarre to end up on e-commerce platform like
that. It's not even the dark web.
This is this is on the light web.
You know this is available. We can.
Any computer, depending on your work policies, but any any open
wide computer, phone, Internet connected device can go to
alialibaba.com and browse the items for sale.
These listings have been removed.
You can't go and browse these anymore and there weren't any
confirmed purchases, but the fact is it's been offered.
So. Yeah, it's an interesting one.
Like, again, third parties, who do you trust?
Can you actually trust them? And when they're all over the
world, you know, if you want to file charges against these
individuals and and stuff. Can you realistically do it if
they're? Based in China?
I don't know. Yeah, that's, that's
interesting. Yeah.
It makes you wonder like you sign up to do something like
this, I guess. And yeah, you don't know where
your day is going to end up, but thankfully, I guess it's de
identified, right? So maybe it'll get used to some
AI training or something and that's the reason now.
I mean, there's an interesting news case.
Yeah, it's quite funny you say that.
Actually. I remember last year at some
point there was 2 trailers parked in my local Tesco's and
they were be part of like a medical study and that kind of
thing. I it could be connected to this
and they were asking volunteers could go in and give blood and
get like, I can't even remember what it was, but it was, I don't
participate in stuff like that because you never know where
it's going to where it's going to go.
Maybe this was that. I don't know, right.
That's this week's breaches of the week.
So now let's get on with the news.
And the first news is you. Yeah, so this one I saw there
was quite an interesting story. GCHQ have released a silent
glass gadget which can block malware over HDMI and display
port cables. Something I never thought was
really a thing, but proudly it is.
So it's built by NCSC and it blocks malicious traffic
travelling between monitor and computer.
It's it's a small hardware device that sits between the the
computer and the monitor. It's aimed at high security
environments, government agencies and where the nation
state attackers have motivation and resources to exploit such a
unusual attack vector. Yes, this is here.
This previous research has demonstrated that attackers can
manipulate monitor brightnesses and exfiltrate data from a gap
machines, and how AI can reconstruct what's on the screen
by analysing the signals from patient mark cables.
It says as well that it's already being deployed in some
UK government systems. The device the design has been
licenced to go to Goldilock Labs and it's commercially produced
by Sony UK Technology Centre. So yes, an attack service I
never knew existed to be honest. I mean, the boxes are amazing.
I'm going to let me let me show and get them up on the screen
here. Essentially a little box.
There's a HD MY1 and a display port one and then there's a 5
Volt power socket and it's just a tiny little box really that
you that you plug in. There's not really much to it.
Yeah, it's yeah. It's quite a bizarre thing.
It kind of feels like an April Fools story, to be honest.
But. I get that.
I get, I get why you'd say that. In some ways, yeah, it's I like
the name, a genius piece of branding silent glass.
It's that's right out of a James.
That could be a James Bond movie or something could do like.
Sign such as double O 7 in silent.
Glass it's. Yeah, it's cool.
Yeah. It's it makes you wonder about
all these different attack vectors that we haven't thought
about. Like you really wouldn't think
that just by plugging in an HDMI cable you you could be
compromised, but obviously there's data going down that
cable that can be. Intercepted, I suppose.
Yeah. So yeah.
That's a different, interesting one, yeah.
Right, I'll move on to the next one and the next one.
Clawed Desktop silently installs browser bridge across every
Chromium browser on your machine.
So this comes from that that privacy guy, I was going to go
American. Then that privacy guy, the
privacy researcher, discovered the installing clawed desktop on
Mac OS silently writes configuration files into every
Chromium based browser on the machine.
This is, well, lots of them. Pre authorising a browser
extension bridge that the user never asked for and may never
install. So the bridge doesn't do
anything on its own. It's dormant until a paired
browser extension activates it. But once triggered the
capabilities include full access to any site the user's logged
into, reading page content, filling forms and recording
sessions. The machine effectively pre
staging the hook for any future. Browser install SO.
Yeah, every time you launch Clawed Desktop, these files are
rewritten. So if you manually delete them,
it's pointless unless you remove called desktop completely.
The article argues that this is textbook dark pan like force.
Bundling across trust boundaries with no usability, divisibility,
no consent and no easy way to remove it.
Browsers affected include Chrome, Brave, Edge, Arc,
Vivaldi, Opera, and Chromium. Everybody switched to Safari and
Firefox. Right now, that's the only
answer. Yeah, and ironically, I used
Claude to help me prep some notes for this story because I
was interested. In what it would.
Say and hang on, I've got it. I've got it was quite funny
spicy one this full transparency.
This is about anthropic who make me.
Claude thinks it's spicy. Yeah, this is again.
I was almost scared to post this at work in case they're like.
Everybody removed the clawed desktop browser because that's
going to be the initial reaction.
Lots of businesses are are jumping onto clawed.
Clawed I think has just overtaken an open AI in.
I don't know whether it was value or something but.
There's a real swing towards people switching from open AI to
Anthropic. I've definitely I've made.
Personally have made that switch and I find.
Clawed so much better. So it's, yes, it's quite this
one. This is quite scary, the fact
that they reckon it's perfectly OK.
Yeah, it's kind of like them. There's a lot of things going on
with AI stuff and sort of kind of not similar as such, but how
TikTok recently added the, they've retracted it now.
But the whole AI remixing of your content, I think like
LinkedIn did something a while ago we spoke about using like
AI, you have your content to train AI and stuff.
And now this is like this being silently installed.
Even if it doesn't do anything yet, it potentially could,
right? And maybe criminals could get
access to it and do something bad of it in the future.
And it's just a little bit concerning in that way.
It really is. I mean, you can't audit.
I mean, in an ideal world, you'd be able to audit and check every
single permission of every single application that you
install on your device. But.
You really, really can't and. As we found like these tools
now, and I'm not blaming this researcher at all, but now it's
public that this information's out there, you can almost assume
that there's going to be people trying.
To take advantage of that. There's going to be people
trying to. Poke at it.
And see if they can weaponize it in some way.
It's almost nicer when this stuff isn't known, because then
it's not. So much of A.
Target but I now like by announcing it that privacy guy's
done the world a favour because now Claude have got to be
accountable, you know, and now we can make a decision from a
position of knowledge rather than just, you know, trusting
Anthropic. I love I love saying the word
anthropic. It's a really nice word to say.
It's a right mouthful anthropic. Yeah, there it's.
Yes, we spoke about Claude's, well, anthropic mythos, didn't
we? And I don't know if you're
talking about it this week, but that's what it was a news story
about how there was like the reported breach into the third
parties access, like unauthorised access to the
platform. And yes, like I said, like
they've announced that this tool can do all this amazing stuff
and find all these exploits for businesses in a in a positive
way. And obviously the criminals have
gone gone after it. You see, that's another.
Example though, isn't it? Because again, Anthropic, we're
like, we've got this amazing security tool that finds all of
these vulnerabilities, but it's so good we can't share it with
you. So we're only going to share it
with these companies. All of the attackers gone is
right. Let's go and try and attack
those companies. Then much in the way that we
spoke about earlier with Versal, you know, it'll be like, right,
let's find it, go through a third party to get into that
company. If if we can't get access, we'll
get access to the people who have access.
It's you're just kicking the can down the road and pass, you're
making it someone else's problem, but.
Yeah, makes you wonder like, yeah, you some company has
access to mythos, right And then that gets used by a criminal to
breach like find exploit in another company who's who's then
responsible for for that and stuff.
It's quite a boring thing. I wonder if there is probably
long either before we we hear a story of that as well.
I wonder if there is something here like essentially Claude
Desktop has rewritten some of the code in Chrome.
It rewrite rewrites files on every launch and I'm wondering.
Whether there's some protective boundaries, whether there needs
to be some siloing of stuff like this app is trying to perform
this action with this app. Do you approve or do you deny?
I get it on on my work device which is a Mac.
I get like Microsoft Updater wants to.
Access these folders and these files.
Because Mac permissioning on like the, the it's quite nice,
but clearly not with Chrome. And I don't know where whether
that would be an OS problem or a Chrome issue or whether or not
this is just normal. And, and we're talking about
anthropic because it's the big one, but actually there's
hundreds of apps. That do this.
I don't know. It's the key thing to remember,
which this all boils back down to is it if a product is free or
extremely low cost, you are the product.
So with them, you know there is a free version of Claude.
If you're using that, you're selling your salt to Claude and
you are the product. So they will use you how they
deem fit. If you want to use it, you have
to work in accordance to their terms and conditions and in
their terms and. Conditions.
It states, you know, this is there in the TS and CS that it's
going to do this. So it's it's not hidden.
If anyone actually read the TS and CS?
Yeah, that's the thing, isn't it?
Yeah, yeah, it's I had something here about the TS and CS, about
what it said. But I can't find it.
So yeah, that's. Probably enough on that one,
move on to the next one. Cool.
So the next one we've got sextortion scam disguised as a
Grafana alert notification as a Reddit post a user shared in a
sextortion e-mail they received that's been dressed up to look
like an automated alert from Grafana using the branding and
alert template format. This is screenshot here, isn't
there? Doesn't mean it's not the
greatest screenshot. I'll quickly bring it up on the
screen so you can sort of see here.
It's branded test alert instance Grafana, the CMOS set
automatically for assistance contact security at
midwaymuseumstore.com. Interesting in your row.
And yeah, basically explains that there's a an issue here,
but not to panic, but also don't ignore it.
And it displays a password as well on there.
And obviously as in the in the body of the image, it says that
they've been monitoring your activity and they've captured
high definition video of you performing compromising acts.
So it's like a typical extortion template there.
It's interesting that they've put it into a Grafana template,
but basically it's asking for $800 in Bitcoin or they'll
release it. It's pretty standard stuff
there. But yeah, it seems like the
other thing here is that the Grafana breach that while ago
the informations were pulled from there.
So the victim has sort of been compromised across multiple
apps. So yes, it says here that the
the victim had actually been compromised across multiple apps
back in February. And it says change the password,
but that the e-mail contained a real password that they had
used. So obviously they didn't sort of
believe that it was something to be sort of concerned about.
I mean they use passwords like this to make it try and sound
genuine and it could be from any old breach, it doesn't mean it's
necessarily that tall. I found another write up about
this as well. That's and they say it's the
first time they've seen something.
Like this, the layout at the top of the e-mail makes it look like
a. Grafana alert and if you don't
know what Grafana is, they do data visualisation so they
analyse metrics, logs, profiles and graph it all nicely.
So networking, you know, we had win.
Admin teams and networking teams that had Grafana, you know, I
think, you know, organisations use it.
I think there's a free model and a premium model.
You know, it's, yeah, it's very widely used in tech companies
and, and beyond the. Functions, which is also
interesting. It's also strange because if you
didn't know what Grafana was, that's meaningless like.
Yeah, it's. Who my mum gets that she doesn't
know who Grafana is, She's got no idea it's meaningless so.
Yeah. So sort of quite a strange way
of of caring about that. But yeah, in the in the comments
that there is someone that says that they work for Grafana and
confirm that it's not legitimate.
And there's a statement from Joe McManus, Cesar, Grafana Labs.
And they said that over the weekend, we identified and
responded to an incident in which a malicious actor
exploited our platform to send a large volume of phishing emails.
We moved quickly to contain the activity and we implement
changes to effectively stop the campaign.
So it doesn't, the screenshot doesn't show, but maybe it did
come from Grafana. It's like an legitimate
platform. Yeah.
It's an interesting one to really say on that.
Yeah, there's a few posts on. I've just looked now looking at
the. So at the top of that
screenshot, it says this e-mail is sent automatically for
assistance contact security. At midwaymuseumstore.com.
There's no website currently at the domain, but there are a
couple there's on Reddit. There's another post in our
slash advice. The it's exactly the same text.
It doesn't mention Grafana, but it's exactly the same text and
it's just. The age-old sex, you know,
sextortion, you know, we have been monitoring your activity
we've taken over your webcam. We've spoken about it before you
know it's. It's just trying to scare you
into paying money. Yeah.
Again, though, it's a good thing these they can.
They can come in many different shapes, many different forms.
So it's good to. Something good to tell you
people about and keep an eye out.
For I think. Yeah, strange.
Well, yeah, next story. OK, the next one is 1.
I think this this happened the day we're recording this first
saw this bit Warden, the password manager that command
line interface has been compromised in a supply chain
attack. And the malicious version stole
developer secrets. So a malicious version of bit
Warden's command line tool was briefly published to MPM after
attackers compromised the GitHub action in bit Warden's build
pipeline as part of an ongoing supply chain campaign targeting
the check marks ecosystem. So this package ran a credential
stealer and even configuration files for AI coding tools.
It went out. Yeah, it went after developer
secrets GitHub. Actions.
SSH keys. If you found GitHub tokens, it
used them to inject malicious workflows into the victims
repositories, spreading the compromise further down the
chain. But Bit Warden contained the
incident within about 90 minutes and have confirmed that no user
vault data was. At risk?
But the attack is notable as reportedly the first time a
package using MPM's trusted publishing system has been
hijacked. This is linked to a threat actor
called Team PCP, whose EX account has since been
suspended, and follows the Shahalud supply chain attack.
That first service this year we've talked.
About that before, definitely. Yeah, it's don't start panicking
about your password manager being compromised.
Maybe don't tell your business. If you're in a business, don't
tell them about this because you don't want to go.
Oh, This is why password managers are bad.
You know all your passwords in one place.
You can't hack my head. Password management were all OK
honestly. It's yeah, but the malware?
Interesting. The malware was designed to skip
execution on systems with a Russian locale.
Are you in Russia? You're OK.
We'll just move on. Don't worry, that's interesting.
Isn't it? Yeah.
And it tells you where it came from I guess.
Yeah, we won't get into that though.
So yeah, this happened on April the 22nd, which was Wednesday
gone and was only live for around 90 minutes.
So it seems like Pete Warden have done done good, smacked it
down really quickly and closed the threat.
So. Yes, but it's again supply chain
it's it's all that trusted third parties and everything.
It's just yeah, right, move on to the next one.
Yeah. So next we've got It's got a
amusing one, although quite a serious one as well.
At the same time, a $5 Bluetooth tracker.
It is inside a postcard exposed to NATO's warship location for
24 hours. And this says AM story where a
touch the journalist hit a cheap Bluetooth tracker inside a
postcard, mailed it to HNLMS Everstein, which is a
$584,000,000 Dutch air defence frigate deployed as part of NATO
group. And this, yeah, essentially the
tracker used the personnel's phones on board, I guess, like a
Aqua tag or or whatever device. And it obviously then pings the
location as it sailed across the world basically for roughly 24
hours. So the journalist was able to
follow some publicly posted instructions from the Dutch
Ministry of Defence for sending mail to deployed personnel.
And he says that postcards weren't X-rayed like packages
were. So the track obviously found its
way to the to the mail sorting facility on board, but by the
time it was discovered, the movements were already exposed.
And since this happened that they've banned greeting cards
containing batteries and is reviewing their policies around
mailing stuff like that. Similarly, I thought we spoke
about a couple of episodes ago as well about how the there was
a French officer border carry a ship which leaked the the
location through the Strava, running up as they went on like
a drug around the ship. Didn't realise that, but
publicly displaying the location of that, yeah, quite a wild
story really. I mean if a Dutch.
Journalist can do this. Yeah, anyone can do it.
Yeah, it's. Yes.
All of a sudden, every ship in the world is getting sent
Bluetooth trackers disguised in postcards.
It's quite a crazy story really, isn't it?
It's really possible as well, because if you think about the
size of an air tag and the size of a tile, like I don't have an
air tag, I have a tile. You think about how small they
are and then you think about the plastic housing, the actual chip
inside. It's just a slim piece of it's
just a tiny little battery and a steam PCB and there's not a lot
in there at all, so. Dennis, it's kind of crazy to
think about all these different ways of potentially compromising
to location of it. And obviously like the the
Strava ones, obviously unintentional, but obviously up
there's no sofa, sofa policies and lack of education maybe on,
on that, on that one. That's quite concerning that
it's that easy to compromise the location.
Yeah, of a. Warship, I kind of feel like the
Strava one that we spoke about, I kind of feel like there needs
to and there might be. And again, this this leans back
into stuff, but something that you mentioned frequently with
the Strava one, I reckon after you finish the run and it says,
do you want to share it? There kind of almost needs to be
like a second warning, like everybody that you're about to
share your exact location publicly.
Are you sure you wish to continue?
But the problem is people get, if someone's used to always
doing that, they just get alert fatigue and they just end up
going. Yes, yes.
Yes, yes, yes. Because the default action is
yes, you normally you're normally good to pick up on
default. Actions and I've been writing
some stuff about. Defaults and stuff like that at
the moment, you know, opt in is always less adopted than you
know, if that decision's made for you and it's opt out so.
Yeah, yeah, yeah. Right, I'll move on to the next
one and it's the last news story we've got tonight and this is
something that I saw on tech radar.
NCSC, the UK's national cybersecurity Centre, has
officially declared pass keys should replace passwords as the
default. So they've said passkey should
be your default way of logging into online services and
passwords should be treated as the fall back, not the norm.
So this is a massive shift from decades of advice about making
your password stronger. But NCS CS own research has
found that pass keys are more secure than even the strongest
password. Paired with two Step 2 step
verification. And they're resistant to
phishing because there's no secret to intercept or reuse.
They work by storing A cryptographic cryptographic key
on your device and they're staying unlocked with your face,
your fingerprint or PIN. So there's nothing to remember
and nothing to type. They didn't fully endorse pass
keys last year because of inconsistent support across
platforms, something we've talked about on here before.
Everyone talked about passwords and.
It was like, how the hell do I use?
Them someone please explain it. But the industry has caught up.
I now use them on my Google accounts and Apple seamlessly
which is really good across iPhone, Mac, Windows, you know,
anything. So that problem's really been
mopped up where pass keys aren't available yet.
The advice is still to use a password manager and multi
factor authentication. So.
I think this is about as close to official as it gets for for
advice. Like they haven't, you know,
they haven't officially gone. Yeah, this is what you should
do. But they're kind of saying you
should do this. Like this kind of means next
year we're going to be telling you to do this.
So yeah, some interesting stats. Pass key logins can be completed
up to 8 times faster than the username, password and an MFA
code over. 50% I can't believe this over 50.
Percent of active Google users in the UK already have a pass
key registered. EBay, PayPal and other platforms
now support them and this was announced at Cyber UK in
Glasgow, which was held this week alongside Silent Glass
which were covered earlier. So both were announced by NCSC
at Cyber UK this week. So yeah, are.
You. Using Are you using pass pass
keys? There's passwords, pass phrases,
pass keys. It's they're like we need to
work on the branding. Are you using pass keys?
I do, but not for everything, because, you know, not
everything supports it, right? And yeah, sometimes, obviously
when you can, you can still use a password as well.
So yeah, I tried to use it where I can, but yeah, it's not always
straightforward. Do you know what?
I like it because I I used to be a LastPass user for password
managers because when we worked together for a.
Time LastPass was the approved password manager.
And then they went to Keeper. Keeper didn't have an
authenticator app. At that time, so I didn't.
Use that. But then I had a Microsoft
Authenticator app because that was required for work.
And then I used Bit Warden. So I've got Bit Warden
Authenticator and I also have Google Authenticator because
like back in the day I think Google was probably the first
one. So I'm currently running 4
authenticator. Apps.
Four, yeah, with a pass key I don't need them.
Well, I need them for fall back. But and the problem is with
authenticators is when you want to change that authentication
app. You need to go into the account,
you need to go into settings, you need to find out where you
do it, and then you've got to go through the whole like it's
time. You don't have to.
People don't have. Time to be moving authenticators
from one to the other. Pass keys kind of, you know,
kind of works. So I never you never used to
but. Maybe it did, it just wasn't
clear how. But I think it Google have kind
of nailed it now. I think there's lots of there
are lots of. Lance Spitzner from Sans has
spoken loads about. The amount of different phrases
and terminologies used NCSC, if they jump on and own this and
then they can get on with Cesar in America, we can agree some
terminology about what we're going to call stuff that would
be good. Like let's standardise the
naming convention across the board.
Maybe bring in a certification of a standard of.
Quality or something that would force adoption.
I think that's what we need to do because everybody's calling
them different. But yeah, pass keys.
Yeah, it's interesting. Just remembered as well as what
password day on May month. So it'd be interesting to see
what, what businesses and people like Google and stuff that they,
yeah, talk about pass keys, for instance.
Will it be World Pass key days soon?
Boy, yeah, that's the thing that I don't think there is a pass
phrase day. Maybe that's what they need to
do. Maybe they need to say like this
is the last ever world password. We should have a in memoriam for
passwords maybe, I don't know. They have maybe one for people
obviously working in our area as well to raise some education on.
Absolutely. For for what password?
They can talk about pass keys and authenticator apps and MFA
and everything else. It's passwords aren't going away
anywhere that I mean, that's worth remembering because not
every service supports pass keys, but it it clearly more
are. But there's always going to be
passwords are going to be around for years because pass keys are
going to require a certain level of maturity to adopt.
There's always going to be legacy systems or legacy
platforms or your local Bowling Club or something that you're a
member of that, you know, has a really old forum, you know, not.
Everywhere has 2F8 yet you know that's that's that's the
frightening thing. Not everywhere.
There are still places out there that doesn't.
You that don't use MFI? Yeah.
Reminded me of Microsoft's password.
This default thing that we spoke about.
Yeah. Yeah, it's good that Microsoft
it's it's nice that Microsoft did the password less thing the
the tools, Google e-mail, Microsoft e-mail, eBay, PayPal,
those high volume services that everybody uses day-to-day.
It should all be like. This.
I think the sign in processes for TikTok and Insta might be a
little different because people use mobile and there's
verification through another logged into the stuff like that,
but. These anything browser based
should definitely be like that, yeah.
Yeah, cool, cool. OK.
Benefit for this? Yeah, so let's move on to this
week's Security Socials. So the first one is from a
subreddit called SIPS T and this isn't specifically about
security awareness. I kind of feel cybersecurity
felt relevant in this conversation.
OK. I'm just going to share the.
Screen here and then I'll read it to you.
This is called controversial opinion and it says HR is the
only department that gets a free pass for being completely
useless. They produce 0 revenue, they
kill morale with endless policies, protect the company
not you, and somehow still get invited to every meeting like
they're essential. If you remove 90% of HR
tomorrow, the business would run smoother, faster, and happier.
Changed my mind. Let me just read that back to
you but slightly different. Security is the only department
that gets a free pass for being completely useless.
They produce 0 revenue, kill morale with endless policies,
protect the company not you, and somehow still get invited to
every meeting like they're essential.
Remove 90% of security tomorrow and the business would run
smoother, faster and happier now, I think I I don't think the
only bit I think that isn't right when you reframe it as
security is that somehow still get invited to every meeting
like they're essential. I don't think security gets.
Invited to every single meeting. I think we need to be invited to
more. We quite often, no matter where
you, no matter who I talk to or where you are, we're the
afterthought where they're like, oh, this goes live in a week and
we haven't put it through security or something like that.
But I can imagine how users see that, like people in a business
probably see security or they're there.
They don't make any money. All it is is policies and more
policies and they're just here protecting the business And they
make my work slower. You know, they make it more
difficult, make it more challenging.
I I saw that and I just thought there was a security spin on
that. Yeah, I think I could say it
probably works for a lot of departments maybe.
But yeah, no, it's one I guess that people in our space for
really need to prove the the worth, right.
It's why we're here. Talk about stuff and share
stories and explain why. But yeah.
Maybe HR needs an awareness team, maybe there needs to be an
HR awareness. Who knows?
Yeah, I'll move on to the next one.
The next one was a video I saw and this is on a subreddit
called Interesting as F, and this guy built a script that
calls back spam callers and traps them in an endless loop.
I won't play at all, but let me just play a little bit to you
because it's it's quite humorous here.
Here's a guy explaining to his daughter, who's probably about 8
or 9, what he's built all the time.
All the time, right? Yeah, Punch them, right.
So what I've done is I've created this script and jipped
it. What this is going to do is
going to call them back, right? It's going to wait for them to
answer. It's going to interact with the
prompts automatically. And when they answer, it's going
to play Rick Astley. Never going to give you up.
So now and then he hung up. But see what you don't know.
See what you don't know about the script though, is that I
have it on repeat. It's a, it's a 0 loop integer I
put in here. So it's so this guy, you can
hear that. OK, I take it, yeah, that that
guy's made a a script that gets a scam call.
It calls the scam caller back, and then it goes through all the
prompts automatically and then plays Rick Cassidy, never going
to give you up down the phone. And then when they hang up, it
does it all again. And it just keeps calling and
calling and calling, playing Rick Cassidy every time, which
seems really funny, but then you scroll and look at the first
comment. Oh God, this is a bad idea.
Spam callers spoof their phone numbers.
There's a good chance you're calling some poor guy in
Nebraska hundreds of times. Ask me how I know.
He was the person in the video. And then there's another guy.
I had some dude call me and freak out because the.
He because I wouldn't stop calling him.
I tried explaining to him about phishing scams and number
spoofing. He didn't believe me and got so
angry that he put my phone number on Craigslist for a
listing for a cheap motorcycle. He may have been an idiot, but
he kind of won that encounter. So yeah, it's it's a lovely idea
in principle, but kind of falls down a little bit in execution.
I suppose. The next one I wanted to share
with you. This one came from this one came
from iPhone Help and this is an interesting one.
I iPhone 17 Pro stolen, now being contacted by Chinese
reseller to remove the device from iCloud.
Is my data safe? So this person says the phone
was immediately locked and set to wipe upon restart but that
hasn't happened and now I'm getting these texts that say
they might go after my data or scan me if I don't allow them to
wipe it. All I care about is my data.
The phone's gone so it'll take the target off my back by
removing it so they can wipe it and sell it.
But I just want to make sure that my data is safe, so you can
see here on the screenshot. I've bought an iPhone 17 Pro I'm
using. It has your messages, emails,
cards, banknotes and personal information on it, even your SIM
number. That you transferred I get.
Your calls it was not erased. Did you make insurance claim
then another message the erase request you made didn't work.
It was connected on Wi-Fi in China, then got gaolbreak and
still saying pending it won't erase remotely.
I'm telling you because the phone is going to be auctioned
on the black market with your personal information and
everything about you that you had on it.
All your info including phone number, address, everything will
be cloned. That's why I'm telling you so
you can remove it. From your device list and I will
factory reset it manually and remove the number.
To remove it, open the. Find my app, it's on your home
screen. Then go to Devices, click the
old. Device and hit Remove this
device at the bottom. And then it goes on.
I'm very sad now. This is an old iPhone I bought
in second hand electrical appliance market in China, which
I bought for my daughter. There's the emotional angle,
which I bought for my daughter. I'm very sad.
I regret buying an old iPhone because it was bound with your
Apple Idi cannot download the App Store I went to.
Find that business, but it's not open today.
I'm really sad now. Would you please help me remove
it? Thank you very much indeed.
Then there's an image that didn't load.
I'm sad I still didn't remove it.
My daughter is angry because she didn't go to school today.
I want to kill myself now. I'm so sad.
Maybe I should sell it to someone else.
I don't know what to do. Please help me remove it.
OK. And then?
Your old phone is recycled by us.
We are now just recycling merchants.
We are not the ones who steal your phone if you don't remove
it your old. Phone motherboard will be sold
to customers. Maybe they will hack your phone
and steal your credit card or contact your family.
And then some screenshots. It's I mean.
This whole interaction is just like mad, but that was like the
five stages of grief we had. Like anger we had, sadness we
had. Like it was and then social
engineering at work. This is what the top comment
says. Put it in loss mode.
Ignore the text. Leave here that nobody is
hacking the onboard storage. The ability to do that is worth
billions. Seriously, iPhone encryption is.
Robust. So there we go.
Yeah. So just I mean, it's this is AII
found this really interesting, the kind of peaks and troughs
and all the different angles that that person's tried to use.
I, I think it's, I think I thought it was really quite
amazing, all the emotions. Yeah.
And if you do that kind of bizarre, leave it in, leave it
in loss mode. Don't ever erase it.
Leave it in loss mode and. Forget about it, because they.
Can't access the data on it and the device is only useful for
certain parts then. Yeah.
Now. I had one more.
Let me just show you this one. This one was sent to me by Liam.
This is a TikTok video. It's only really short and and
this is a a play on privacy. OK, let me just show you how.
This is called my cocoon. You want privacy on a long
flight but still need to work? Welcome to my privacy park.
You can see it. That's great.
It's the when you delve into the comments, this is shared by the
company that make these my cocoon.
But when you dive into the comments, so if sorry, if you're
listening and you're not watching, someone sat on an
aeroplane with essentially a cocoon like a purple cloth are
all over. You can't see them at all.
It's like they it's like they've climbed in a duvet.
Cover. And have just got them over it.
I don't think FAA rules will let you fly because they can't check
the seat belt. They can't see what you're
doing. There's all kinds of security
concerns. So actually I'd like, I don't
think this would be allowed to happen.
I think people in the comments reckon that this is like you can
rent a plain fuselage for videos and films and photos.
Like half a fuselage. More of a scam maybe?
I think it's either a scam or it's just designed to go viral.
Let's just build something unbelievable so more people
think about it. But they do they sell them for
like working spaces and, you know, all different.
It does look quite. I think I'd rather use a privacy
screen at that point, Ryan. Why not a?
Little bit better. Why not?
That was embarrassing. Yeah, yeah.
Have you seen the guy in the cocoon?
Like what's his problem? Yeah.
Anyway, that's that's everything I had.
What have you got? Carl yeah, this one video to
share this one's talking about the new GPT image two
generation. Yep.
System. It's video Jeremy fans AI again.
So same same guy you've spoken about before.
Jeremy, welcome back. Yeah.
I wonder if you ever watches this?
Maybe yeah, I'll play the video and we can sort of see what it's
about. Cool.
Images are basically undetectable, and that's a huge
deal because it's coming from open AI.
There have been other great AI image generators, but numbness
powerful and when Google released Fano Banana Pro in
November, they released Synth ID along with it.
So even if it generated a really good AI image, there was always
a backup. There's no such system here.
It is not perfect, but it is almost there.
In the best case scenario, I was able to generate this image of
Obama, this image of Harris. I was not able to generate a
certain New York financier. I might just not use the right
words. You can't use them by name for
any of these, but you can just describe people and it will
generate them. It is not perfect.
There are probably mistakes still being made here, but it
can do really accurate text generation.
It is very customizable. And look, if you're excited
about some cheap diagrams or funny photos or cheap
advertisements, I understand. But that comes with the cost of
no one being able to trust any new photo they see on the
Internet anymore. Software is not going to come to
save us anytime soon. Our systems aren't ready for
this. Photographic evidence isn't
dead, but that does not scale. A chain of custody doesn't scale
on social media. It's a very sad moment, and it's
an incredibly cynical release from Open AI.
Open AI is new. Quite a concerning time.
It is, it is. It's almost when you see with
all of this, when you see a video, I mean, this is images,
like I saw something today about images from the Iran war and how
many of them were fake. And I see that last week we
talked to I talked about, I think it was last week I said
about the video from Married at First Sight Australia of the guy
like saying unbelievable things and like I me and the wife were
like, this has got to be AI. Actually, it wasn't.
AI. He's just said those things,
which was. Which was mad, but this is the.
Point we're at right where you can't tell if it's AI or not and
all of a sudden you start discrediting the genuine stuff
and you start believing the stuff that's disingenuous.
It's this genie's not going back in the.
Box as well like what do we I I don't know what the future holds
like you need to be able to only trust we're going to go back to
people on street corners like yelling the news because you
need to hear it from an individual because you can't
trust anything this. I don't know.
No, it's crazy. Like I feel like yeah, there's
no, I mean, I thought it might be misinformed, but it's not,
doesn't seem to be any laws on or regulations on this sort of
stuff like the watermarking or metadata and stuff like that.
There's no standards it seems. Stuff out there obviously like
the Google SIMF ID, but this chat community doesn't have
that. There's this makes me think of
two things that I'm getting really deep now on a podcast
episode that probably should have ended 10 minutes ago.
Fahrenheit 451 is a book by Ray Bradbury.
And in the book Everybody goes Home.
Books are banned. They've burnt all the books.
Books are banned. Everybody goes home and has to
stand in front of these screens or sit in front of these screens
and consume everything. And it feels like that's the way
we're going. Like, you're not.
They're literally setting fire to books.
Books are illegal. And the other extreme is the old
HG Wells time machine. I remember the film from the.
60s. And they find an old library
where all the books just fall apart.
And it's kind of feels like, yeah, to the same extreme Gen Z
apparently a craving analogue more than ever.
And going back to, like, wired headphones and, you know, dumb
devices. Yeah.
It's. That's probably a whole
different conversation for a whole different time.
Yeah, yeah. Anyway, so interesting time,
right? Here, don't trust it, you can't
trust it. So we're about to just as saw a
dyed the video AI video generation tool just as that was
discontinued because like slop, they've replaced it with
something that makes the text is good, like the fact it's made
better text. I'm up for that now, because
when you now. But that's an AI tell that's
gone like it used to be. Is this AI?
Look at the text. Of course it is.
Oh no, and I haven't even war marked it, which Google did.
Nice one Google legislation. Maybe it's not going to happen
under the current American government, but maybe under the
next American government, if it changes, there will be some
legislation that puts all this stuff in some.
It needs to be controlled much in the way that France are
trying to do and the UK have spoken about.
There needs to be some some. Barriers put in place, surely?
Yeah. Cool, right?
Sorry, I've ranted too long. Thank you.
Right. Don't forget.
Get the newsletter at riskycreative.com.
Search the awareness angle on LinkedIn.
We haven't even mentioned the SANS and survey.
We'll put that in the newsletter.
The SANS survey is still open. Thank you for everyone that
filled in the podcast survey as well.
The results of that have been useful and stay tuned for stuff
coming in the future. A couple of big announcements
coming in the next couple of weeks as well, which is
exciting, right? Have a great week and I'll speak
to you next week. Oh yeah, catch you later.
See you later. Bye bye.