1 00:00:00,120 --> 00:00:03,360 Welcome back to the awareness angle, our breach of the week. 2 00:00:03,360 --> 00:00:07,640 Suspected Chinese hackers broke into the FB is own wiretap 3 00:00:07,640 --> 00:00:10,760 system, while we also look at the White House's new app being 4 00:00:10,760 --> 00:00:13,720 called a privacy nightmare by the people that took it apart. 5 00:00:14,040 --> 00:00:17,640 And my Google Drive just became a much better defence against 6 00:00:17,640 --> 00:00:20,400 ransomware. Attackers are using WhatsApp to 7 00:00:20,400 --> 00:00:24,160 deliver malware to Windows PCs, and Apple has quietly added a 8 00:00:24,160 --> 00:00:27,640 safety net for one of the cleverest scams doing the 9 00:00:27,640 --> 00:00:30,280 rounds. And LinkedIn, We've got the 10 00:00:30,280 --> 00:00:33,360 platform secretly scanning your browser for thousands of 11 00:00:33,360 --> 00:00:37,080 extensions without telling you. A campaign calling out the AI 12 00:00:37,080 --> 00:00:42,000 generated slop that's quietly making all of us easier to scam. 13 00:00:42,360 --> 00:00:45,480 And a professor that says app labels are basically the 14 00:00:45,480 --> 00:00:47,480 nutrition labels of the Internet. 15 00:00:47,840 --> 00:00:49,600 And we all know how well that works because. 16 00:00:49,760 --> 00:00:52,280 I still eat stuff that I probably shouldn't. 17 00:00:52,800 --> 00:00:55,120 All of that and a whole bunch more on this week's. 18 00:00:55,560 --> 00:01:06,640 The Awareness Act. With me, as always, is my 19 00:01:06,640 --> 00:01:09,640 partner in cybercrime prevention, Mr Luke Pettigrew. 20 00:01:09,640 --> 00:01:12,080 How you doing, Luke? And and doing alright. 21 00:01:12,080 --> 00:01:13,160 Thank you. How are you? 22 00:01:13,360 --> 00:01:14,880 Good. Yeah, I'm good. 23 00:01:14,880 --> 00:01:16,520 I'm good. See, Easter Sunday. 24 00:01:16,520 --> 00:01:20,000 We're releasing this a day later than normal so this morning's 25 00:01:20,000 --> 00:01:25,200 been kids and chocolate and everything and I had the week 26 00:01:25,200 --> 00:01:27,720 off this week so it was lovely. Bit of fresh air. 27 00:01:27,840 --> 00:01:29,200 And stuff. So that was nice. 28 00:01:30,200 --> 00:01:32,760 Yeah, right. Don't forget, all views and 29 00:01:32,760 --> 00:01:36,600 opinions expressed by Luke and I are our own and do not represent 30 00:01:36,600 --> 00:01:40,120 loads of our employers. But right now, let's get into it 31 00:01:40,120 --> 00:01:42,440 with this week's breach of the week. 32 00:01:46,160 --> 00:01:48,640 We had a bunch of stuff to choose from this week for breach 33 00:01:48,640 --> 00:01:50,840 of the week. An abundance of breaches. 34 00:01:50,840 --> 00:01:55,200 Hasbro have been hacked. The toy company Adobe, There's 35 00:01:55,200 --> 00:01:57,760 claims that Adobe have been significantly breached. 36 00:01:57,760 --> 00:02:00,800 They're denying it. So didn't choose that one 37 00:02:00,800 --> 00:02:03,600 because, you know, it's all suspect at the moment. 38 00:02:03,800 --> 00:02:09,039 A art gallery in Italy, the fizzy galleries say they've been 39 00:02:09,039 --> 00:02:11,520 breached. Sorry, say they've been attacked 40 00:02:11,520 --> 00:02:14,320 but say there's no breach. So there wasn't really a story 41 00:02:14,320 --> 00:02:16,160 there. So the one I'm bringing this 42 00:02:16,160 --> 00:02:21,560 week is one that I I read just a day or two ago, Chinese hackers 43 00:02:21,840 --> 00:02:25,680 breached the system that the FBI uses to watch people. 44 00:02:26,120 --> 00:02:28,640 So this is the watchers have been watched. 45 00:02:28,640 --> 00:02:31,000 Essentially, which I thought was quite an interesting angle on 46 00:02:31,000 --> 00:02:35,120 this, Suspected Chinese linked hackers have broken into the FBI 47 00:02:35,120 --> 00:02:40,560 system that stalls surveillance data like exposing phone numbers 48 00:02:40,560 --> 00:02:44,080 of people that the Bureau was actively monitoring. 49 00:02:44,560 --> 00:02:48,560 The FBI has officially classed this as a major incident and 50 00:02:48,560 --> 00:02:52,120 notified Congress, confirming that access was obtained through 51 00:02:52,120 --> 00:02:54,880 a third party. The system at the centre of the 52 00:02:54,880 --> 00:02:57,160 breach is part. Of the FBI's internal 53 00:02:57,160 --> 00:03:01,680 infrastructure used to manage court authorised wiretaps, which 54 00:03:01,680 --> 00:03:04,480 is essentially the database that tells investigators who they're 55 00:03:04,480 --> 00:03:08,400 watching and who those targets are talking to. 56 00:03:08,960 --> 00:03:12,360 This means whoever actually got in could potentially work out 57 00:03:12,360 --> 00:03:17,680 who the US is performing surveillance on, giving 58 00:03:17,760 --> 00:03:20,880 whoever's got this information a chance to tip off their assets, 59 00:03:20,880 --> 00:03:25,240 cut ties, or stay one step ahead of investigators. 60 00:03:25,560 --> 00:03:27,920 So this isn't, it's not just a breach. 61 00:03:27,920 --> 00:03:31,720 This effects who they can surveil, essentially so. 62 00:03:32,200 --> 00:03:34,720 Yeah, Yeah. A lot of money involved there 63 00:03:34,720 --> 00:03:37,400 potentially selling that data to people. 64 00:03:38,320 --> 00:03:40,560 You know, in this country there's been the odd news story 65 00:03:40,560 --> 00:03:44,840 about like MPs being Chinese spies and stuff like that. 66 00:03:45,800 --> 00:03:49,000 I wonder if, like the Mission Impossible in me wants to think 67 00:03:49,000 --> 00:03:50,560 that this is somewhat related to that. 68 00:03:50,560 --> 00:03:53,520 Like there's a spy network there that's about to be outed. 69 00:03:53,520 --> 00:03:57,240 They want to know who's being watched, so they go and get the 70 00:03:57,240 --> 00:03:59,760 surveillance system and then they can go right we. 71 00:03:59,760 --> 00:04:02,440 Know that the FBI is watching this one, this one and this one. 72 00:04:02,560 --> 00:04:04,320 Burn them. They're they're no longer a 73 00:04:04,320 --> 00:04:06,560 contact, but we know these ones are safe. 74 00:04:06,560 --> 00:04:08,280 It's kind of, it's got Hollywood. 75 00:04:08,280 --> 00:04:09,960 Written all over it, hasn't it? Really. 76 00:04:10,160 --> 00:04:14,360 Yes, I guess they're after the the Intel rather than the doing 77 00:04:14,360 --> 00:04:16,440 anything else with it. Yeah. 78 00:04:17,040 --> 00:04:20,560 It feels like it doesn't feel like this is a money orientated 79 00:04:20,560 --> 00:04:23,800 one or even a damaged like wiper like we spoke about with 80 00:04:23,800 --> 00:04:25,240 striker. This isn't a wiper. 81 00:04:25,560 --> 00:04:27,440 This isn't someone trying to get data to sell. 82 00:04:27,440 --> 00:04:29,800 This is literally like, what do they know? 83 00:04:30,200 --> 00:04:34,680 How exposed are we almost? Very Hollywood. 84 00:04:34,840 --> 00:04:37,520 What a great one to tell you people like this is. 85 00:04:38,200 --> 00:04:40,040 It's a good Hollywood story. There'll be a film. 86 00:04:40,040 --> 00:04:42,640 This would be like Born Born, Reborn. 87 00:04:42,920 --> 00:04:45,600 Why haven't they done that yet? This would be like some spy 88 00:04:45,600 --> 00:04:48,680 movie. Yeah, anyway, that that was it 89 00:04:48,680 --> 00:04:50,560 really. There's not a lot of info out 90 00:04:50,560 --> 00:04:54,520 there that I've found that basically he says the FBI access 91 00:04:54,520 --> 00:05:00,280 came for a third party vendor. So as is pretty common these 92 00:05:00,280 --> 00:05:05,320 days, find a weak link down the chain and get away in SO. 93 00:05:06,320 --> 00:05:10,360 And this isn't related to Kash Patel emails being breached, 94 00:05:10,360 --> 00:05:13,640 although the FBI are now. Offering a $10 million reward 95 00:05:14,000 --> 00:05:18,840 for information on that. But yeah, I thought it was good 96 00:05:18,840 --> 00:05:21,360 because they offered a, because they declared it a major 97 00:05:21,360 --> 00:05:24,200 incident. And that's any incident that is 98 00:05:24,200 --> 00:05:28,520 likely to result in demonstrable harm to the national security 99 00:05:28,520 --> 00:05:33,480 interests, Foreign Relations or economy of the United States. 100 00:05:33,640 --> 00:05:35,600 So they've deemed this a significant incident. 101 00:05:35,680 --> 00:05:37,360 That's probably it for this week's breach of the week. 102 00:05:37,360 --> 00:05:39,440 There was loads to choose from, but I thought that one was the 103 00:05:39,440 --> 00:05:42,680 most Hollywood, so the others might bubble to the top. 104 00:05:42,720 --> 00:05:45,760 If more information is about like the Adobe one, I'm watching 105 00:05:45,760 --> 00:05:48,520 that. Because if that is, if that's 106 00:05:48,520 --> 00:05:51,880 true, then there's a lot of information going to come out 107 00:05:51,880 --> 00:05:54,040 about that. Just for anyone listening, Mr 108 00:05:54,040 --> 00:05:56,280 Raccoon. It's just got to be one of the 109 00:05:56,480 --> 00:05:59,000 nicest name. Mr Raccoon doesn't sound very 110 00:05:59,000 --> 00:06:03,880 scary, but a threat actor called Mr Raccoon has alleged to have 111 00:06:03,880 --> 00:06:07,680 performed a massive data breach ran through a third party. 112 00:06:08,080 --> 00:06:12,600 Indian Business Processing Outsourcing or BPO firm. 13 113 00:06:12,600 --> 00:06:17,280 million support tickets, 15,000 employee records and bug bounty 114 00:06:17,480 --> 00:06:20,360 submissions pulled directly from Hacker. 115 00:06:20,360 --> 00:06:24,320 One SO. Adobe haven't confirmed, Yeah. 116 00:06:24,680 --> 00:06:26,360 So. We'll we'll talk about that 117 00:06:26,360 --> 00:06:28,200 maybe next week. There's lots of info. 118 00:06:28,240 --> 00:06:30,560 Out there but I just wanted to didn't want to speculate. 119 00:06:31,600 --> 00:06:32,640 Yeah. Like. 120 00:06:32,640 --> 00:06:36,520 We're interesting to see, yeah, yeah, a lot of Fed party stuff 121 00:06:36,520 --> 00:06:38,320 going on. Just no surprise. 122 00:06:38,880 --> 00:06:39,640 No. Yeah. 123 00:06:39,720 --> 00:06:42,880 Be interested to see if this FBI one comes out any further, but 124 00:06:42,920 --> 00:06:44,680 we might not hear about it given the. 125 00:06:44,680 --> 00:06:48,280 Nature of it might get buried. It's really tough out there at 126 00:06:48,280 --> 00:06:50,360 the moment with all the cyber news. 127 00:06:50,920 --> 00:06:54,880 We try to, we try not to be political on this podcast. 128 00:06:55,520 --> 00:06:56,840 But it's really, really difficult at. 129 00:06:56,920 --> 00:06:59,880 The moment because most of the news is really politically 130 00:06:59,880 --> 00:07:02,840 steered, not only because of what's going on in America, but 131 00:07:02,840 --> 00:07:04,600 what's going on in the Middle East as well. 132 00:07:04,640 --> 00:07:07,760 And it's there's always a political angle to many of these 133 00:07:07,760 --> 00:07:09,080 stories. So, yeah. 134 00:07:09,080 --> 00:07:11,560 But we, we, you know, we don't take sides here. 135 00:07:11,920 --> 00:07:14,320 We have those opinions. We keep to ourselves. 136 00:07:14,360 --> 00:07:18,640 But there we go. Move on to the news. 137 00:07:22,560 --> 00:07:24,400 I'll take the first one then. Yeah, yeah. 138 00:07:24,880 --> 00:07:29,160 So this is a continuation from the last episode for a security 139 00:07:29,160 --> 00:07:32,840 tool that we talked about last week just helped reach the 140 00:07:32,840 --> 00:07:36,280 European Commission. So, yeah, those that listened to 141 00:07:36,280 --> 00:07:41,240 last week's episode, remember we spoke about the trivia supply 142 00:07:41,240 --> 00:07:46,040 chain attack, which was a security scanner tool that was 143 00:07:46,040 --> 00:07:52,160 backdoor to effect Light LLM. And obviously this is now 144 00:07:52,640 --> 00:07:56,800 advanced to a bigger story where the European Commission, a cloud 145 00:07:56,800 --> 00:07:59,480 infrastructure has been briefed using the same compromised 146 00:07:59,480 --> 00:08:04,160 version of trivia says in this story that the initial access 147 00:08:04,160 --> 00:08:07,800 was obtained on March 19th through normal software updates. 148 00:08:08,960 --> 00:08:13,440 And yes, allowed the attackers to take stolen AWSAPI key that 149 00:08:13,440 --> 00:08:16,240 gave them access to the European Commission's cloud accounts, 150 00:08:17,400 --> 00:08:21,280 which they then used to still still various pieces of data, 151 00:08:22,640 --> 00:08:26,400 emails, personal details. And then it was published on the 152 00:08:26,400 --> 00:08:30,640 talk web by shiny hunters, according to this. 153 00:08:31,960 --> 00:08:35,600 And this effects up to 71 clients across the EU 154 00:08:35,600 --> 00:08:40,039 institutions. So quite a quite a big one here. 155 00:08:40,039 --> 00:08:42,799 So it says there's over 300 gigabytes of data. 156 00:08:42,840 --> 00:08:49,480 And yeah, so they've says here that they've said here that team 157 00:08:49,640 --> 00:08:54,240 PCP wasted no time validating stolen credentials, launching 158 00:08:54,240 --> 00:08:56,760 discovery operations, exfiltrating more data and 159 00:08:56,840 --> 00:09:02,240 attempting lateral movement. On March 28th, Shiny Hunters 160 00:09:02,240 --> 00:09:09,160 added it to their Tor based leak website. 340 give us the phone, 161 00:09:09,160 --> 00:09:12,160 compressed data, personal information, names, emails, 162 00:09:12,320 --> 00:09:16,600 usernames. Says here that 52,000 well 163 00:09:16,840 --> 00:09:19,920 nearly two 52,000 files represents automated 164 00:09:19,920 --> 00:09:24,040 notifications including bounce back messages containing user 165 00:09:24,640 --> 00:09:27,480 submit content, which could include personal information. 166 00:09:28,520 --> 00:09:32,880 And there's a lot of stuff in this but not too much clarity 167 00:09:33,000 --> 00:09:35,160 that looks at this. But the European Commissions 168 00:09:35,160 --> 00:09:39,360 have revoked the compromised accounts involved, deactivated 169 00:09:39,360 --> 00:09:43,280 and protected credentials and also have notified relevant data 170 00:09:43,280 --> 00:09:45,400 protection bodies. And it says as well that they've 171 00:09:45,400 --> 00:09:47,880 confirmed it's not affected internal systems. 172 00:09:47,960 --> 00:09:52,160 So shows I guess how various yeah, breaches leading to to 173 00:09:52,160 --> 00:09:55,040 further breaches, right? Yeah, yeah. 174 00:09:55,160 --> 00:09:57,840 They don't just stop, do they? Like one leads to another leads 175 00:09:57,840 --> 00:10:03,840 to another leads to another. So it's yes, it's, and it's 176 00:10:04,920 --> 00:10:11,000 originally when we spoke about team PCP, like now shiny hunters 177 00:10:11,000 --> 00:10:12,800 are involved. I don't know what the connection 178 00:10:12,800 --> 00:10:14,720 is there. Shiny hunters have leaked it, 179 00:10:14,880 --> 00:10:16,560 and we all know who shiny hunters are. 180 00:10:16,560 --> 00:10:18,000 Shiny hunters. Are the one that you know, 181 00:10:18,400 --> 00:10:20,880 threat actor group that have been behind everything 182 00:10:21,320 --> 00:10:25,000 significant for the past. Two years from MGM to M&S to 183 00:10:25,840 --> 00:10:32,520 Co-op to lots of a conference I was at, I'm pretty sure Joe 184 00:10:32,520 --> 00:10:38,200 Tidy, like displayed a Joe Tidy BBC cyber correspondent had a 185 00:10:38,200 --> 00:10:41,880 PowerPoint slide that had just all the company names on and 186 00:10:41,880 --> 00:10:44,440 that have had cyber incidents over the last like couple of 187 00:10:44,440 --> 00:10:46,960 years. Lots of household names, and a 188 00:10:46,960 --> 00:10:51,320 large, large percentage of those have been attributed to Shiny. 189 00:10:51,320 --> 00:10:55,480 Hunters, so that's. Yeah, the fact they're involved 190 00:10:55,480 --> 00:10:58,960 really doesn't surprise me. Yeah, I'm not sure what the 191 00:10:58,960 --> 00:11:04,120 affiliation is, but it says yeah, that team PCP breached 192 00:11:04,120 --> 00:11:07,240 them and then Shiny Hunters published it online. 193 00:11:07,440 --> 00:11:09,960 I mean, we've seen before, I don't know whether, I mean, it 194 00:11:09,960 --> 00:11:13,520 could just be simply, you know, one threat actor will gain 195 00:11:13,520 --> 00:11:17,480 access to a system and then they'll sell that access to 196 00:11:17,480 --> 00:11:20,480 another threat actor that will then deploy ransomware to that 197 00:11:20,480 --> 00:11:22,520 system. And we've seen, that's the tale 198 00:11:22,520 --> 00:11:25,520 as old as time, you know, different and again, different 199 00:11:25,840 --> 00:11:27,960 threat actors. It's like business models, 200 00:11:27,960 --> 00:11:30,320 different businesses specialised in different things. 201 00:11:30,720 --> 00:11:33,360 Some groups who specialised in gaining access. 202 00:11:34,120 --> 00:11:37,880 And some groups will specialised in ransom ransoming companies 203 00:11:37,880 --> 00:11:40,720 and getting the money. So some people just want to get 204 00:11:40,720 --> 00:11:43,600 the access, others want to like recap, Yeah. 205 00:11:43,880 --> 00:11:47,640 So yeah, I think that's it for that one. 206 00:11:48,440 --> 00:11:53,880 Right, The next news story, the White House released an app and 207 00:11:53,880 --> 00:11:55,880 security researchers aren't happy about it. 208 00:11:55,880 --> 00:11:57,800 So we'll try and keep the politics out of this. 209 00:11:57,800 --> 00:12:00,160 This like if they want to release an app, they can release 210 00:12:00,160 --> 00:12:03,120 an app they're entitled to. This has been widely reported by 211 00:12:03,120 --> 00:12:06,440 multiple sources now. But I first saw it on Instagram 212 00:12:07,040 --> 00:12:10,160 and I knew that an app had been revealed and it they were taught 213 00:12:10,160 --> 00:12:13,520 that teased the way the app was revealed, kind of teased 214 00:12:13,520 --> 00:12:15,720 something was coming. Everybody thought it was aliens. 215 00:12:15,720 --> 00:12:20,480 They bought aliens.gov apparently as a domain, but then 216 00:12:20,480 --> 00:12:24,040 the tease was that the White House is releasing its own app, 217 00:12:24,040 --> 00:12:28,280 which is essentially a news app. So the White House are releasing 218 00:12:28,280 --> 00:12:31,000 their own news. But let me just play you this 219 00:12:31,000 --> 00:12:33,880 video, which kind of brought it to my attention. 220 00:12:33,880 --> 00:12:36,720 Don't think this, I think I've skipped the political parts of 221 00:12:36,720 --> 00:12:38,640 it, but let me just explain this. 222 00:12:39,200 --> 00:12:41,600 When people started downloading the app, they quickly realised 223 00:12:41,600 --> 00:12:44,160 that they made a mistake. Permissions on the app allow the 224 00:12:44,160 --> 00:12:47,560 White House to see the user's precise location, modify and 225 00:12:47,560 --> 00:12:50,480 delete the contents of shared storage if you Wi-Fi 226 00:12:50,480 --> 00:12:54,680 connections, use fingerprint and other biometric hardware, and 227 00:12:54,680 --> 00:12:56,440 more. This guy was like look, if you 228 00:12:56,440 --> 00:12:59,160 have downloaded and installed the White House app and don't 229 00:12:59,160 --> 00:13:02,320 know by now, delete it and factory reset your phone and 230 00:13:02,320 --> 00:13:05,080 tablet immediately and change your credentials as well. 231 00:13:05,360 --> 00:13:09,000 But in general, I mean, this opens the box for the most 232 00:13:09,000 --> 00:13:11,440 Orwellian future that I could ever imagine. 233 00:13:11,840 --> 00:13:15,400 A declassified report came out in 2022 that outlines how the US 234 00:13:15,400 --> 00:13:17,400 government gets around the Foreign Intelligence 235 00:13:17,400 --> 00:13:20,320 Surveillance Act. We won't get into all of that, 236 00:13:21,480 --> 00:13:23,160 but I thought it was quite interesting. 237 00:13:23,160 --> 00:13:28,200 People have rushed to download this app, and I remember like, 238 00:13:28,400 --> 00:13:30,960 this isn't just the White House and the US government, OK? 239 00:13:31,520 --> 00:13:35,760 Pokémon were at it many moons ago when Pokémon Go first came 240 00:13:35,760 --> 00:13:38,320 out. Like when you make an app, I 241 00:13:38,320 --> 00:13:41,960 think the default was just asked for permission to everything and 242 00:13:41,960 --> 00:13:45,600 that's what they did. And there was news at the time 243 00:13:45,600 --> 00:13:48,440 Pokémon Go must have been out. Oh God, it must be nearly 10 244 00:13:48,440 --> 00:13:50,560 years now and everyone. Was like, Oh my God, it can see. 245 00:13:50,560 --> 00:13:52,760 Everything. And then they updated the 246 00:13:52,760 --> 00:13:55,400 permissions and rolled back a load of permissions. 247 00:13:56,080 --> 00:13:59,400 It is true, apparently, if we look at some other articles, I 248 00:13:59,400 --> 00:14:04,040 think this White House app can actually, it actually pings your 249 00:14:04,040 --> 00:14:10,960 exact location via GPS every 4 1/2 minutes back to the servers 250 00:14:11,760 --> 00:14:13,840 so they can sell exactly where you are. 251 00:14:14,120 --> 00:14:17,280 And this might not have been done intentionally. 252 00:14:17,400 --> 00:14:21,000 This might have just been, you know, let's just leave those 253 00:14:21,000 --> 00:14:25,080 boxes ticked and roll it out. It might not have been playing 254 00:14:25,080 --> 00:14:27,480 devil's advocate, the White House might not have done this, 255 00:14:27,480 --> 00:14:31,320 but the White House app has one signals full GPS pipeline 256 00:14:31,320 --> 00:14:35,960 compiled in, polling your location every 4 1/2 minutes, 257 00:14:35,960 --> 00:14:40,920 syncing your exact coordinates to a third party server. 258 00:14:41,080 --> 00:14:44,920 That's what I've just read from 1 Sweet by the Real Real Load 259 00:14:45,080 --> 00:14:48,680 1026. So yeah, if you have downloaded 260 00:14:48,680 --> 00:14:52,280 the White House app, you might want to look at the permissions. 261 00:14:53,040 --> 00:14:57,880 And something to consider before downloading any app is what 262 00:14:57,880 --> 00:15:01,440 level of access you're giving. That app I think is. 263 00:15:02,440 --> 00:15:05,000 Is what we want to just because it's official doesn't 264 00:15:05,000 --> 00:15:07,320 necessarily mean it's safe because it's a third party 265 00:15:07,320 --> 00:15:10,440 again, that third party service is getting your location so that 266 00:15:10,440 --> 00:15:13,480 makes that third party service a target like we've just explained 267 00:15:13,480 --> 00:15:20,200 with the FBI so. It's yeah, sounds like even just 268 00:15:20,640 --> 00:15:23,280 with the GPS location is probably going to drain you a 269 00:15:23,280 --> 00:15:24,880 battery that's having that app installed. 270 00:15:25,800 --> 00:15:29,240 Oh yeah, yeah, Lots to get into on this one. 271 00:15:29,240 --> 00:15:32,640 I guess with the specific data there's a lot of stuff it can. 272 00:15:33,400 --> 00:15:37,880 I mean, seen it, seen it, respected news, you know, 273 00:15:38,240 --> 00:15:41,000 technology news source, you know claim. 274 00:15:41,040 --> 00:15:43,160 I downloaded and deleted the White House app. 275 00:15:43,400 --> 00:15:45,320 You don't have to, it's the Hotmail. 276 00:15:46,240 --> 00:15:49,640 The app is a nightmare of a historically dangerous cyber 277 00:15:49,640 --> 00:15:53,920 attack waiting. So I basically say this is this 278 00:15:54,000 --> 00:15:55,680 has the potential to be absolutely. 279 00:15:56,200 --> 00:15:58,080 Help. Yeah, there's some some mentions 280 00:15:58,080 --> 00:16:01,320 in there as well about inside the app, there's some YouTube 281 00:16:01,320 --> 00:16:04,040 embeds and they're linked to a personal GitHub account. 282 00:16:04,040 --> 00:16:07,040 So, so yes, so we said if that GitHub account gets compromised, 283 00:16:07,760 --> 00:16:09,560 yeah, things could get changed on the. 284 00:16:09,560 --> 00:16:13,600 Obviously there's also stuff about removal of privacy, 285 00:16:13,600 --> 00:16:15,920 consent banners, minimal security. 286 00:16:15,920 --> 00:16:20,040 Protections A source of removal of privacy consent banners. 287 00:16:20,960 --> 00:16:24,640 So they just don't display the consent banners for you to 288 00:16:24,640 --> 00:16:29,120 consent to privacy notices? That's interesting. 289 00:16:29,240 --> 00:16:33,240 Yeah, I saw something as well about mentioned about some of 290 00:16:33,240 --> 00:16:37,320 the baked into the app that exposed something, but. 291 00:16:38,720 --> 00:16:44,960 I can see Atomic Dock computer did a dive on this app and they 292 00:16:44,960 --> 00:16:48,840 said the GPS tracking infrastructure is dormant but 293 00:16:48,840 --> 00:16:53,600 remotely activatable. So it's there and it's not 294 00:16:53,600 --> 00:16:55,760 working. But it can be turned on 295 00:16:55,760 --> 00:17:00,080 remotely, yeah. Yeah, that doesn't sound great. 296 00:17:00,200 --> 00:17:04,359 It doesn't. And do you know what in in any 297 00:17:04,359 --> 00:17:11,319 other in any other cycle, this would be scandalous, but it's 298 00:17:11,319 --> 00:17:13,839 not right now. Like if this came out in the UK, 299 00:17:14,839 --> 00:17:19,800 there would be uproar. But it's kind of we've we've 300 00:17:19,800 --> 00:17:22,079 kind of become sanitised to it a little bit now. 301 00:17:23,480 --> 00:17:24,800 Yeah. I mean, even the app's got 302 00:17:24,800 --> 00:17:27,480 minimal security, hard hardening, full behavioural 303 00:17:27,480 --> 00:17:31,160 intelligence pipeline. You've said about the YouTube 304 00:17:31,600 --> 00:17:33,400 embeds. Yeah. 305 00:17:34,640 --> 00:17:37,680 Yeah, yeah. We'll put links to all of that 306 00:17:37,720 --> 00:17:39,960 and a whole lot more so you can make your own judgement calls 307 00:17:40,240 --> 00:17:42,360 and form your own opinions. We'll put the links to all of 308 00:17:42,360 --> 00:17:43,840 that in the newsletter. If you want to get the 309 00:17:43,840 --> 00:17:47,640 newsletter, it's available at riskycreative.com or you can 310 00:17:47,640 --> 00:17:51,640 search for the awareness angle on LinkedIn and get it where the 311 00:17:51,640 --> 00:17:54,240 majority of people get it on LinkedIn over 1100. 312 00:17:54,240 --> 00:17:57,480 Subscribers now to the weekly newsletter that comes out every 313 00:17:57,480 --> 00:18:00,600 Monday. Tuesday this week to align with 314 00:18:00,600 --> 00:18:02,800 every episode. Everything we discuss on every 315 00:18:02,800 --> 00:18:06,760 episode is in the newsletter. So let's move on from that 316 00:18:06,760 --> 00:18:10,720 before we dig ourselves a hole and end up being being having 317 00:18:10,720 --> 00:18:15,400 the FBI watching us. So yeah, right, move on to the 318 00:18:15,400 --> 00:18:19,000 next one. So this one is Apple Story. 319 00:18:19,080 --> 00:18:22,920 They've added a safety net for one of the cleverest scams 320 00:18:22,920 --> 00:18:30,640 around just so the new macOS version 26.4 essentially blocks 321 00:18:31,000 --> 00:18:34,000 pasting and executing potentially harmful commands 322 00:18:34,000 --> 00:18:37,400 into terminal windows and alerts about the possible risks. 323 00:18:37,400 --> 00:18:40,720 So yeah, obviously this is aimed at blocking a click fix type 324 00:18:40,720 --> 00:18:44,640 attacks, which were obviously pretty easy for people to to be 325 00:18:44,640 --> 00:18:49,160 socially engineered into pasting previously, and it would just 326 00:18:49,160 --> 00:18:53,840 run commands without any sort of problem or any notification. 327 00:18:53,840 --> 00:18:57,800 So now they've updated it and I'll try and put the screenshot 328 00:18:58,360 --> 00:19:01,040 up on the screen. We've talked about click fix 329 00:19:01,280 --> 00:19:04,640 near enough every other week on this, on this podcast. 330 00:19:05,400 --> 00:19:08,200 And I think we, we've always said that there needs to be an 331 00:19:08,280 --> 00:19:11,760 OS level kind of interception on this. 332 00:19:12,320 --> 00:19:15,680 It needs to be I I remember saying weeks ago, Microsoft 333 00:19:15,680 --> 00:19:19,320 should tell you what it does before it allows you to run it. 334 00:19:19,440 --> 00:19:21,240 You know, or. That kind of thing. 335 00:19:21,400 --> 00:19:25,720 So. You see on a Mac you now get 336 00:19:25,720 --> 00:19:30,640 this window in a pop up that says possible malware paste 337 00:19:30,960 --> 00:19:33,560 blocked your Mac has not been harmed. 338 00:19:34,240 --> 00:19:37,200 Scammers often encourage pasting and texting terminal to try and 339 00:19:37,200 --> 00:19:40,400 harm you, your Mac or compromise your privacy. 340 00:19:41,000 --> 00:19:43,120 These instructions are commonly offered by websites, chat 341 00:19:43,120 --> 00:19:44,920 agents, apps, files or phone call. 342 00:19:44,960 --> 00:19:49,040 And then you have a don't paste button as the primary option and 343 00:19:49,040 --> 00:19:53,000 then a paste anyway below, which I thought maybe they shouldn't 344 00:19:53,000 --> 00:19:57,560 just not have that bit, but maybe some false positives 345 00:19:57,920 --> 00:20:02,560 happening with this. But I mean, it's a good step to 346 00:20:02,560 --> 00:20:05,240 see. Yeah, on on that. 347 00:20:06,520 --> 00:20:07,360 I think it's. Brilliant. 348 00:20:08,200 --> 00:20:11,160 It's a long needed, long needed step and I hope Windows follow, 349 00:20:11,160 --> 00:20:16,760 I really do. Yeah, it does say here Apple has 350 00:20:16,760 --> 00:20:19,200 not published official support. Document about the new warning 351 00:20:19,200 --> 00:20:22,680 system, Yeah. One user concluded that these 352 00:20:22,680 --> 00:20:24,840 warnings are only delivered once per session. 353 00:20:24,840 --> 00:20:26,440 Yeah. So it talks about copy commands 354 00:20:26,440 --> 00:20:31,360 from Safari, but maybe it covers other web browsers as we've 355 00:20:31,360 --> 00:20:34,840 discussed last episode of think that they're kind of all based 356 00:20:34,840 --> 00:20:37,760 on that fundamentally. So you'd be interested to know 357 00:20:37,760 --> 00:20:40,640 more about this? There's a comment here on 358 00:20:40,640 --> 00:20:43,120 Reddit. So this was discussed on Mac OS 359 00:20:43,320 --> 00:20:48,520 Beta 16 days ago, and there's a comment here that says it 360 00:20:48,520 --> 00:20:51,480 doesn't blindly flag everything copied from the Internet and 361 00:20:51,480 --> 00:20:55,680 pasted into terminal Terminal. I had Claude generate a bunch of 362 00:20:55,680 --> 00:20:57,880 innocuous commands so that I had something to. 363 00:20:57,880 --> 00:21:00,320 Copy and paste. And none of them triggered A 364 00:21:00,320 --> 00:21:03,760 malware warning when pasted, so there is some sort of analysis 365 00:21:03,760 --> 00:21:07,720 or blacklisting going on. Even redirecting curl to bash 366 00:21:07,720 --> 00:21:10,560 and decoding basics before and redirecting to bash doesn't 367 00:21:10,560 --> 00:21:14,040 automatically. Trigger the warning, so yeah. 368 00:21:15,240 --> 00:21:18,520 Yeah, it'd be interesting to sort of see a bit more into it 369 00:21:18,520 --> 00:21:23,080 once it's maybe they'll release some official guidance on it. 370 00:21:24,960 --> 00:21:26,360 There's another comment on this Reddit. 371 00:21:26,440 --> 00:21:29,440 I swear people are so gullible. It's kind of crazy to me how 372 00:21:29,440 --> 00:21:31,800 people will do things like this without a second thought. 373 00:21:33,040 --> 00:21:35,720 It's good people don't like, like that's a real, I'm 374 00:21:35,720 --> 00:21:39,080 technical person and I don't get why people would fall for this. 375 00:21:39,320 --> 00:21:42,240 It's like, I bet your mum would or your dad, you know what I 376 00:21:42,240 --> 00:21:45,240 mean? Like, like just because you know 377 00:21:45,240 --> 00:21:47,920 the risks, lots of people never venture there and don't know 378 00:21:47,920 --> 00:21:51,280 what it does. It's a reply to that says it's 379 00:21:51,280 --> 00:21:55,200 not just targeting dumb people. There have been various high 380 00:21:55,200 --> 00:21:58,000 quality efforts to get unsuspecting or inattentive 381 00:21:58,000 --> 00:21:59,760 people to run their commands in the past. 382 00:21:59,880 --> 00:22:01,080 Yeah. And so. 383 00:22:02,200 --> 00:22:05,400 Yeah, this is an interesting one and maybe one for people to 384 00:22:05,400 --> 00:22:08,760 share with their business. If they have Mac devices and 385 00:22:08,760 --> 00:22:12,560 they're up to date, they can sort of talk about the feature 386 00:22:12,560 --> 00:22:16,840 and click fix a bit more. Maybe just remind you people to. 387 00:22:17,600 --> 00:22:20,880 You probably never want to pay something into that you found 388 00:22:20,880 --> 00:22:22,720 off the Internet unless you really know what it is. 389 00:22:22,720 --> 00:22:24,640 You're right though, this is a good opportunity, any 390 00:22:24,640 --> 00:22:27,200 opportunity to talk about the risk of click fix. 391 00:22:27,360 --> 00:22:31,080 This is a positive angle to talk about and this change was fair 392 00:22:31,080 --> 00:22:33,800 as well. Yeah, especially for Windows 393 00:22:33,800 --> 00:22:37,000 users as well, Like making them aware that this doesn't happen 394 00:22:37,120 --> 00:22:38,440 on Windows. Maybe just yet. 395 00:22:38,440 --> 00:22:42,480 Maybe they will follow suit. I also wonder from a tech, from 396 00:22:42,480 --> 00:22:45,600 a technical perspective, I wonder if they're if every time 397 00:22:45,600 --> 00:22:49,520 that warning is logged, that's logs every every time that 398 00:22:49,520 --> 00:22:51,880 warning is displayed. I wonder if the way that's 399 00:22:51,880 --> 00:22:53,440 interacted with is logged somewhere. 400 00:22:54,120 --> 00:22:56,240 Like there's a really nice behavioural metric there. 401 00:22:56,240 --> 00:23:00,440 If you can, someone presses paste anyway, Can you be 402 00:23:00,440 --> 00:23:04,080 informed of that? If someone presses don't paste, 403 00:23:04,080 --> 00:23:07,400 can you be informed of that? Because, you know, Thank you for 404 00:23:07,400 --> 00:23:11,000 not pasting on this occasion. You press paste Anyway, I'm now 405 00:23:11,000 --> 00:23:13,840 watching you to make sure your device isn't infected. 406 00:23:13,880 --> 00:23:17,000 That kind of, yeah. Like it'd be nice if that the 407 00:23:17,000 --> 00:23:22,400 the intelligence data behind that choice can be extracted and 408 00:23:22,400 --> 00:23:24,800 chucked into a human risk management system. 409 00:23:24,960 --> 00:23:28,280 That would be cool. Yeah, yeah, right. 410 00:23:28,280 --> 00:23:32,000 Well done, Apple for beating Microsoft to helping us defend 411 00:23:32,000 --> 00:23:35,840 against click fix. So that's cool, right? 412 00:23:35,840 --> 00:23:38,760 I'll move on the next story. This episode is from 413 00:23:38,760 --> 00:23:43,480 darkreading.com. And I thought this was just, 414 00:23:43,560 --> 00:23:47,720 again, I thought it was really, really reliable and good to tell 415 00:23:47,720 --> 00:23:51,640 your people. So app privacy labels are like 416 00:23:51,640 --> 00:23:55,840 food nutrition labels, and we all know how that's going. 417 00:23:56,280 --> 00:24:00,160 So, you know, the little like nutrition information on the 418 00:24:00,160 --> 00:24:02,480 side of a packet of crisps that has the calories, the salt 419 00:24:02,480 --> 00:24:06,960 content, the fat content. Well, Laurie Craner, director of 420 00:24:06,960 --> 00:24:10,560 Carlin Carnegie Mellon's University Cylab Security and 421 00:24:10,560 --> 00:24:14,960 Privacy Institute, Wow that's a Mouthful, makes exactly that 422 00:24:14,960 --> 00:24:18,040 comparison when it comes to app privacy labels, the data 423 00:24:18,040 --> 00:24:21,520 disclosures on the App Store and the Google Play Store. 424 00:24:22,520 --> 00:24:26,120 So when you go to an app on Google Play or the App Store on 425 00:24:26,120 --> 00:24:29,760 Apple, it tells you what information the app collects and 426 00:24:29,760 --> 00:24:33,520 why. And in theory, just like food 427 00:24:33,520 --> 00:24:36,560 labels, these help you make an informed choice. 428 00:24:37,240 --> 00:24:41,520 But Laurie Craner from Carnegie Mellon and says that current 429 00:24:41,520 --> 00:24:45,840 versions are not at all useful. And what's worse is they create 430 00:24:45,840 --> 00:24:49,280 the impression that something meaningful is being done for 431 00:24:49,280 --> 00:24:51,000 your privacy when it actually isn't. 432 00:24:51,720 --> 00:24:54,960 Studies have found widespread inaccuracies in the labels. 433 00:24:55,440 --> 00:24:59,440 Apple and Google don't even use the same definitions for what 434 00:24:59,440 --> 00:25:03,400 counts as data collection, meaning the same app can look 435 00:25:03,400 --> 00:25:05,800 very different depending on which store you're buying it 436 00:25:05,800 --> 00:25:07,640 from. And there was a live example of 437 00:25:07,640 --> 00:25:09,640 that this week with the White House app. 438 00:25:09,720 --> 00:25:14,280 This is why it all comes round. The White House app declared it 439 00:25:14,280 --> 00:25:18,480 collected nothing whilst quietly sending device data to multiple 440 00:25:18,640 --> 00:25:21,320 third parties. On every single launch. 441 00:25:21,840 --> 00:25:24,840 So that's that's why this kind of flew into my attention 442 00:25:24,840 --> 00:25:28,920 because the the inaccuracies with the White House app and 443 00:25:28,920 --> 00:25:31,920 what it declared versus, you know, yeah. 444 00:25:33,120 --> 00:25:35,560 So I thought it was really, really interesting. 445 00:25:35,560 --> 00:25:40,160 This it just just it's a good example of like you can't 446 00:25:40,160 --> 00:25:42,560 necessarily you have to make your own judgement call. 447 00:25:42,640 --> 00:25:46,320 And it's the same with, you know, foods, food labels. 448 00:25:46,320 --> 00:25:50,520 We kind of in the UK at least you kind of, it feels like 449 00:25:50,520 --> 00:25:53,400 they're standardised and I would imagine they, I don't know if. 450 00:25:53,400 --> 00:25:54,360 They are. I probably should have 451 00:25:54,360 --> 00:25:56,200 researched. But I would imagine that they 452 00:25:56,200 --> 00:26:00,160 are standardised. But here it's, I mean, I think 453 00:26:00,160 --> 00:26:01,720 that's shocking. The White House app that we've 454 00:26:01,720 --> 00:26:04,480 just spoken about, if that declared that it didn't share 455 00:26:04,480 --> 00:26:08,320 any personal data, that's definitely a flaw in Google and 456 00:26:08,320 --> 00:26:10,400 Apple systems. They should standardise. 457 00:26:10,400 --> 00:26:12,720 There's some things that these companies should work together 458 00:26:12,720 --> 00:26:15,800 on. Other other app stores are 459 00:26:15,800 --> 00:26:18,600 available. But yeah, Apple and Google use 460 00:26:18,600 --> 00:26:20,680 different methodologies in their labels. 461 00:26:21,320 --> 00:26:25,760 Google defines data collection as any data transmitted from a 462 00:26:25,760 --> 00:26:29,600 user's device. Apple only considers data 463 00:26:29,600 --> 00:26:33,360 collected if it's transmitted from a user device and stored 464 00:26:33,360 --> 00:26:35,320 so. There's there's a difference, 465 00:26:35,600 --> 00:26:37,760 yeah. Yeah, I thought that was 466 00:26:37,760 --> 00:26:39,680 interesting. There's not really loads to say 467 00:26:39,680 --> 00:26:43,680 on that, but that's an opportunity and a recent example 468 00:26:43,800 --> 00:26:47,560 to highlight how users need to make these little micro risk 469 00:26:47,560 --> 00:26:51,520 assessments to make sure that they understand what they're 470 00:26:51,520 --> 00:26:54,640 actually sharing. And it says it like some of the 471 00:26:54,640 --> 00:26:57,120 some of the notes I've got here. Compliance isn't the same as 472 00:26:57,120 --> 00:27:00,080 protection. Companies post these labels for 473 00:27:00,080 --> 00:27:03,560 information purposes, and they don't necessarily have to prove 474 00:27:03,560 --> 00:27:08,960 it just because a label exists. Doesn't mean your data is safe. 475 00:27:10,040 --> 00:27:12,560 There was a time when there was a time when everybody said 476 00:27:12,560 --> 00:27:14,200 smoking was good for me. Look at it now. 477 00:27:14,200 --> 00:27:20,000 Do you know what I mean? Yeah, So that's that app privacy 478 00:27:20,000 --> 00:27:24,040 labels linked to that story will be in the newsletter as well. 479 00:27:24,320 --> 00:27:27,520 So I had let me just check, hang on. 480 00:27:27,520 --> 00:27:31,280 I had something else that was really I meant to bring and I 481 00:27:31,280 --> 00:27:36,080 forgot last week we there was a story we covered last week that 482 00:27:36,080 --> 00:27:39,200 I think was kind of similar to this. 483 00:27:39,240 --> 00:27:41,800 I don't know what it was. Michael from the cyber Escape 484 00:27:41,800 --> 00:27:44,880 room code sent me some stuff after we spoke about the Ajax 485 00:27:44,880 --> 00:27:48,520 Football Club breach in last week's episode. 486 00:27:48,520 --> 00:27:53,120 And apparently the Premier League teams have come together 487 00:27:53,120 --> 00:27:57,960 and actually worked to build secure solutions. 488 00:27:57,960 --> 00:28:00,680 And he sent me a link to a case study from a company called 489 00:28:00,680 --> 00:28:04,440 Cyber 4. Cyber 4 enabled a top tier 490 00:28:04,440 --> 00:28:07,960 Premier League football club to enhance its cybersecurity and 491 00:28:07,960 --> 00:28:12,200 data privacy capabilities. So they've worked on stakeholder 492 00:28:12,200 --> 00:28:14,720 engagement, data journey mapping, asset and risk 493 00:28:14,720 --> 00:28:17,520 management. So apparently there is a wider 494 00:28:17,520 --> 00:28:21,360 thing here in the UK that helps bring, helps make sure football 495 00:28:21,360 --> 00:28:24,360 clubs do protect their data. Well, I don't know if the same 496 00:28:24,360 --> 00:28:28,160 exists in Holland, but yeah, he sent me that after we spoke 497 00:28:28,160 --> 00:28:29,560 about that in last week's episode. 498 00:28:30,280 --> 00:28:33,160 So, yeah, slight interesting, slight divert there. 499 00:28:33,160 --> 00:28:35,360 But this made me think of that. I don't know why this all of a 500 00:28:35,360 --> 00:28:37,480 sudden made me think of that. But thanks, Michael, for 501 00:28:37,480 --> 00:28:39,240 sending, sending that over. Right. 502 00:28:39,240 --> 00:28:40,920 Move on to the next story, which is yours. 503 00:28:41,720 --> 00:28:44,800 Cool, yeah, yes, this one Google Drive, I can now detect 504 00:28:44,800 --> 00:28:46,800 ransomware and help get your files back. 505 00:28:46,800 --> 00:28:50,360 I think we spoke about this briefly before, you know, got 506 00:28:50,560 --> 00:28:52,040 done a website quite a while ago. 507 00:28:52,400 --> 00:28:57,080 But obviously ransomware is still a thing that happens a 508 00:28:57,080 --> 00:28:59,840 lot. And obviously you end up with 509 00:28:59,840 --> 00:29:02,440 encrypted files that you can no longer access. 510 00:29:02,440 --> 00:29:08,920 And then typically you demanded money to unlock them, which 511 00:29:08,920 --> 00:29:11,600 could really obviously effects companies in a massive way. 512 00:29:11,600 --> 00:29:15,520 But thankfully those who are using Google Drive, so Google 513 00:29:15,520 --> 00:29:20,640 Workspace businesses now have a feature specifically designed to 514 00:29:20,640 --> 00:29:23,840 take away the attacker's biggest bargaining chip. 515 00:29:24,080 --> 00:29:29,240 So now Google Drive for desktop, so it seems that you need to 516 00:29:29,240 --> 00:29:33,320 have that installed, but that detects for ransomware activity 517 00:29:33,520 --> 00:29:37,760 and pauses files syncing. So crypto files grant can't 518 00:29:37,760 --> 00:29:41,760 overwrite your clean cloud copies and also alerts you to 519 00:29:41,760 --> 00:29:47,520 what's happening. So this is a story by Android 520 00:29:47,520 --> 00:29:52,000 authority. So this is here, that this was 521 00:29:52,000 --> 00:29:55,040 previously a bit of availability, but it's now being 522 00:29:55,040 --> 00:29:59,160 rolled out widely and that Google have said that they've 523 00:29:59,160 --> 00:30:01,000 improved detection significantly. 524 00:30:01,240 --> 00:30:05,000 I've read that, yeah. So they've improved the AI 525 00:30:05,000 --> 00:30:08,720 system behind it to spot malicious encryption. 526 00:30:08,720 --> 00:30:13,840 And it claims that the latest model can detect it 14 * 14 527 00:30:13,840 --> 00:30:15,640 times more infections than before. 528 00:30:16,920 --> 00:30:20,040 Not huge on detail what exactly what that means, but there is a 529 00:30:20,040 --> 00:30:24,080 video here that can maybe play. So yeah, it's only a minute 530 00:30:24,320 --> 00:30:26,320 long. Could you bring it up? 531 00:30:26,360 --> 00:30:31,880 This just sort of shows how it looks to the video by Google. 532 00:30:33,680 --> 00:30:35,960 Ransomware is one of the most damaging threats facing 533 00:30:35,960 --> 00:30:38,240 organisations and individuals alike. 534 00:30:38,640 --> 00:30:41,200 It is malicious software that blocks access to your data by 535 00:30:41,200 --> 00:30:43,360 encrypting files and making them unusable. 536 00:30:43,880 --> 00:30:47,480 With Google Drive, we've built an entirely new layer of defence 537 00:30:47,480 --> 00:30:50,240 that helps to stop ransomware from being effective once it 538 00:30:50,240 --> 00:30:53,600 bypasses antivirus controls. Let's see it in action. 539 00:30:54,560 --> 00:30:56,440 Imagine you're working on your Windows device. 540 00:30:56,720 --> 00:30:59,520 A notification appears on your desktop letting you know Drive 541 00:30:59,520 --> 00:31:02,240 has to. So you can see this new pop up. 542 00:31:03,080 --> 00:31:06,760 This is syncing pause ransomware detected on the e-mail address 543 00:31:06,960 --> 00:31:08,760 that your Google Drive synced with. 544 00:31:10,720 --> 00:31:14,200 If this talks about what time it was paused and if you don't 545 00:31:14,200 --> 00:31:16,920 recognise it, action needs to be taken to prevent further 546 00:31:16,920 --> 00:31:19,320 corruption and you have an option for take action or I 547 00:31:19,320 --> 00:31:24,480 recognise it, which again is similar to that Mac Terminal 1. 548 00:31:24,480 --> 00:31:27,520 You kind of feel like maybe don't in this scenario, don't 549 00:31:27,520 --> 00:31:31,800 give the end user the ability to recognise it, but we'll carry on 550 00:31:31,800 --> 00:31:33,320 the video. Yeah. 551 00:31:34,560 --> 00:31:37,760 Detected A ransomware attack thanks to the new AI model that 552 00:31:37,760 --> 00:31:40,400 was trained on millions of real world ransomware samples with 553 00:31:40,400 --> 00:31:43,560 threat intelligence from Virus. Total Drive automatically pauses 554 00:31:43,560 --> 00:31:46,320 syncing of your files to the cloud to prevent data corruption 555 00:31:46,480 --> 00:31:48,560 and help stop the attack before it gets too far. 556 00:31:48,840 --> 00:31:52,080 To start the recovery, Drive guides you to the Restore UI, 557 00:31:52,320 --> 00:31:55,040 where you can easily select previous uninfected versions of 558 00:31:55,040 --> 00:31:58,320 your files and undo the damage. Unlike traditional solutions 559 00:31:58,320 --> 00:32:01,880 that require complex reimaging or costly third party tools, the 560 00:32:01,880 --> 00:32:04,800 intuitive web interface allows you to easily restore multiple 561 00:32:04,800 --> 00:32:07,520 files with a few clicks. This can help you minimise 562 00:32:07,520 --> 00:32:11,120 disruption and data loss even when using traditional software 563 00:32:11,120 --> 00:32:13,120 such as Microsoft Windows and Office. 564 00:32:14,480 --> 00:32:17,200 When the restoration completes, you and your collaborators Get 565 00:32:17,200 --> 00:32:21,960 full access to your files again. To recap, Google Drive stores 566 00:32:21,960 --> 00:32:23,760 copies. It's interesting. 567 00:32:23,760 --> 00:32:26,720 It seems like maybe something that Odie works. 568 00:32:26,720 --> 00:32:30,960 I said this should have maybe for a business, but. 569 00:32:31,960 --> 00:32:34,120 It'd be great for. Certainly use his hands, pretty 570 00:32:34,120 --> 00:32:36,760 much. Yeah, Yeah. 571 00:32:36,840 --> 00:32:40,720 I think there definitely should be a different admin level on 572 00:32:40,720 --> 00:32:43,040 that. I think, I mean, was it last 573 00:32:43,040 --> 00:32:46,240 week or the week before I think we were talking about, I think I 574 00:32:46,240 --> 00:32:48,640 mentioned how more people in organisations could run 575 00:32:48,640 --> 00:32:50,920 Chromebooks. Getting people to store stuff in 576 00:32:50,920 --> 00:32:53,240 the cloud is difficult when there's an abundance of local 577 00:32:53,240 --> 00:32:55,560 storage because it's still seen as inconvenient. 578 00:32:56,040 --> 00:32:58,240 Google Drive kind of deals with that. 579 00:32:58,400 --> 00:32:59,920 Google Drive for desktop does anyway. 580 00:32:59,920 --> 00:33:02,200 And a Chromebook also works brilliantly like that. 581 00:33:02,200 --> 00:33:04,720 My mum just this week, her Chromebook's years old. 582 00:33:05,160 --> 00:33:07,160 She was like, should I get a new laptop? 583 00:33:07,160 --> 00:33:08,920 And I was like, no, you should get a new Chromebook. 584 00:33:08,920 --> 00:33:11,160 And she's like, oh, Chromebook's still haven't. 585 00:33:11,160 --> 00:33:14,680 Like in education, they're everywhere, but they still kind 586 00:33:14,680 --> 00:33:16,680 of haven't for me. I don't feel like they've really 587 00:33:16,680 --> 00:33:19,960 broken through in the consumer market as a viable alternative 588 00:33:19,960 --> 00:33:24,840 to a new HP or Lenovo or Dell laptop, whereas they should 589 00:33:24,840 --> 00:33:27,200 because everything saves to the cloud natively. 590 00:33:27,200 --> 00:33:29,840 And yeah, you might have to pay for some storage at some point, 591 00:33:29,960 --> 00:33:33,560 but it just makes sense when you've got this kind of safety 592 00:33:33,560 --> 00:33:36,720 net, this kind of backup. I I, yeah, I think this is 593 00:33:36,720 --> 00:33:40,600 brilliant. Personal use as well, just 594 00:33:40,600 --> 00:33:43,280 having everything saved. Obviously make sure you have 595 00:33:43,280 --> 00:33:46,120 cloud accounts secure, but it's all there. 596 00:33:46,120 --> 00:33:50,520 I won't, I won't support my mum if she gets a new Windows laptop 597 00:33:50,880 --> 00:33:54,320 because the Windows laptop and this again, we spoke a couple of 598 00:33:54,320 --> 00:33:56,080 few weeks ago about the new MacBook Neo. 599 00:33:56,640 --> 00:33:58,640 It's almost tempting to try and talk her into getting one of 600 00:33:58,640 --> 00:34:02,920 them because again, the quality of the hardware, the operating 601 00:34:02,920 --> 00:34:06,320 system and stuff, you just know it's going to like a MacBook Neo 602 00:34:06,320 --> 00:34:09,320 is probably still going to be working fine in six years, 603 00:34:09,840 --> 00:34:14,920 whereas A6 year old £500 laptop is probably going to be creaking 604 00:34:14,920 --> 00:34:16,080 the battery is going to. Die. 605 00:34:16,080 --> 00:34:18,440 The keys will probably stop. You know, the build quality 606 00:34:18,440 --> 00:34:20,440 isn't quite there. Yeah. 607 00:34:20,440 --> 00:34:23,040 And also that's without the security layers that you need to 608 00:34:23,040 --> 00:34:25,159 add on top. So I think this is brilliant. 609 00:34:25,159 --> 00:34:28,280 Like this is great for Google. This is really, really good. 610 00:34:28,280 --> 00:34:31,880 And I think this should encourage more people to enter 611 00:34:31,880 --> 00:34:34,040 that Google ecosystem. We're not sponsored. 612 00:34:34,199 --> 00:34:35,800 If you want a sponsor as Google, please do. 613 00:34:37,159 --> 00:34:40,159 But I, I think this is great. I don't know if Microsoft has 614 00:34:40,159 --> 00:34:43,000 something similar. I really don't know if Microsoft 615 00:34:44,199 --> 00:34:46,800 has has a similar functionality for OneDrive. 616 00:34:47,280 --> 00:34:50,040 I don't. Feel like they do if they have 617 00:34:50,040 --> 00:34:51,880 they definitely haven't something about it but. 618 00:34:53,040 --> 00:34:56,760 Yeah. Yeah, it's an interesting one. 619 00:34:57,080 --> 00:34:59,400 There's a pop up post we can include an image there that 620 00:34:59,400 --> 00:35:04,880 talks about the Google Admin side of it, but it doesn't seem 621 00:35:06,160 --> 00:35:08,320 perhaps as customizable as it maybe should be. 622 00:35:08,320 --> 00:35:13,160 And yeah, I'm not sure. If I was running a business I'd 623 00:35:13,160 --> 00:35:17,200 want my employees to be restoring files whilst the 624 00:35:17,200 --> 00:35:19,160 ransomware attack is going on and stuff. 625 00:35:19,160 --> 00:35:21,520 That seems a bit messy. You kind of want to know about 626 00:35:21,520 --> 00:35:24,600 it, don't you? You don't want a user trying to 627 00:35:24,600 --> 00:35:27,520 deal with this isolated ransomware incident because it 628 00:35:27,520 --> 00:35:29,960 could spread somewhere else. You kind of want to know about 629 00:35:29,960 --> 00:35:31,640 it. If it's going to, yeah, it does 630 00:35:31,640 --> 00:35:34,680 say that the admins receive an e-mail in in the alert centre. 631 00:35:34,680 --> 00:35:39,360 But yeah, I don't know how it fully looks, but it's a good 632 00:35:39,800 --> 00:35:42,960 yeah, sort of yeah. Feature to to definitely have. 633 00:35:43,720 --> 00:35:46,920 Yeah, this yeah. Interesting the way that they've 634 00:35:47,760 --> 00:35:50,840 rolled out for the use users to be able to start restoring files 635 00:35:50,840 --> 00:35:52,520 and stuff. Yeah, absolutely. 636 00:35:53,280 --> 00:35:57,520 And that's the next one. OK yeah, next one hyped up right 637 00:35:57,520 --> 00:36:00,600 at the beginning of the show. LinkedIn has been secretly 638 00:36:00,600 --> 00:36:04,000 scanning your browser extensions and you weren't told. 639 00:36:04,440 --> 00:36:10,200 Now, I heard about this story and I saw this story posted on 640 00:36:10,200 --> 00:36:14,240 Reddit and then when I went back, the post had been removed 641 00:36:14,240 --> 00:36:18,000 and tagged as misleading. I and and at that point I was 642 00:36:18,000 --> 00:36:21,160 like, do I bring this or not? Like let's form the opinion 643 00:36:21,160 --> 00:36:23,160 ourselves. OK, so this is reported in 644 00:36:23,160 --> 00:36:26,840 Bleeping Computer. A new report dubbed Browsergate 645 00:36:27,120 --> 00:36:30,800 warns that Microsoft's LinkedIn. So let's remember Microsoft owns 646 00:36:30,800 --> 00:36:33,520 LinkedIn. Microsoft's LinkedIn is using. 647 00:36:33,520 --> 00:36:35,960 Hidden. JavaScript scripts on its 648 00:36:35,960 --> 00:36:39,440 website to scan visitors browsers for installed 649 00:36:39,440 --> 00:36:41,520 extensions and collect device data. 650 00:36:42,240 --> 00:36:45,240 So, according to a report by Fail Linked, which claims to be 651 00:36:45,240 --> 00:36:48,920 an association of commercial LinkedIn users, Microsoft's 652 00:36:48,920 --> 00:36:52,040 platform injects JavaScript into user sessions that cheques for 653 00:36:52,040 --> 00:36:55,160 thousands of browser extensions and links the results to 654 00:36:55,160 --> 00:37:00,200 identifiable user profiles. So it claims that this behaviour 655 00:37:00,200 --> 00:37:02,880 is used to collect sensitive personal and corporate 656 00:37:02,880 --> 00:37:06,680 information as LinkedIn accounts tied to real identities, 657 00:37:06,680 --> 00:37:11,360 employers and job roles. And it the report says LinkedIn 658 00:37:11,360 --> 00:37:16,360 scans for over 200 products that directly complete compete with 659 00:37:16,360 --> 00:37:20,440 its own sales tools, including Apollo, Lucia and Zoom Info. 660 00:37:21,200 --> 00:37:25,200 Because LinkedIn knows each user's employer, it can then 661 00:37:25,200 --> 00:37:26,880 map. Which companies use which? 662 00:37:26,880 --> 00:37:31,440 Competitor products extracting the customer lists of thousands 663 00:37:31,440 --> 00:37:35,000 of software companies from their users browsers without anyone's 664 00:37:35,360 --> 00:37:38,800 knowledge. Then it uses what it finds. 665 00:37:38,800 --> 00:37:42,360 LinkedIn has already sent enforcement threats to users of 666 00:37:42,360 --> 00:37:46,280 third party tools using data obtained through this covert 667 00:37:46,280 --> 00:37:48,240 scanning to identify its targets. 668 00:37:48,280 --> 00:37:50,360 Yeah. And and the script checked for 669 00:37:50,560 --> 00:37:54,800 and this was the bit that like I think this was reported 670 00:37:54,800 --> 00:37:59,800 previously and it was like 2000 extensions that it was scanning 671 00:37:59,800 --> 00:38:04,040 for. The script now cheques for 6236 672 00:38:04,040 --> 00:38:07,040 browser extensions. By attempting to access files, 673 00:38:07,040 --> 00:38:10,800 resource file resources associated with an extension ID, 674 00:38:11,160 --> 00:38:13,680 which is a common technique. It's got a fingerprinting. 675 00:38:14,000 --> 00:38:16,880 It's fingerprinting. This was previously reported 676 00:38:16,880 --> 00:38:19,640 last year, but it was only detecting 2000 extensions. 677 00:38:21,000 --> 00:38:24,800 A different GitHub repository from two months ago shows 3000 678 00:38:25,080 --> 00:38:30,920 extensions, and now we're talking about 6236 so. 679 00:38:31,960 --> 00:38:36,800 Wow, LinkedIn have LinkedIn doesn't dispute that it detects 680 00:38:36,800 --> 00:38:40,560 browser extensions, saying it's used to protect the platform and 681 00:38:40,560 --> 00:38:42,480 its users. However, the company claims the 682 00:38:42,480 --> 00:38:45,280 report is from someone whose. Account was banned for scraping 683 00:38:45,280 --> 00:38:48,040 content. So I think that's why they'd 684 00:38:48,040 --> 00:38:52,440 yeah, it's, I think essentially what the takeaway on this is. 685 00:38:52,440 --> 00:38:55,760 We all have to accept that when we visit a website, we're doing 686 00:38:55,760 --> 00:39:00,560 it on their terms. There was an angle made on this. 687 00:39:00,560 --> 00:39:02,640 There was an angle made about job searches. 688 00:39:02,640 --> 00:39:04,920 What makes it particularly uncomfortable is what those 689 00:39:04,920 --> 00:39:07,520 extensions can reveal. The scan list includes 690 00:39:07,520 --> 00:39:12,280 extensions, but identify practising Muslims, indicate 691 00:39:12,320 --> 00:39:17,560 political orientation, support neurodivergent users and perhaps 692 00:39:17,560 --> 00:39:22,960 most troublingly, over 500 job search tools, meaning LinkedIn 693 00:39:22,960 --> 00:39:26,880 could know you're secretly looking for a new job while your 694 00:39:26,880 --> 00:39:28,800 current employer is on the same. Platform so. 695 00:39:30,000 --> 00:39:32,120 Maybe if you work for Microsoft and you're looking for a new 696 00:39:32,120 --> 00:39:34,600 job, you might not. Want to install any job search 697 00:39:34,800 --> 00:39:40,200 extensions so it just brings it back to like Chrome extensions 698 00:39:40,280 --> 00:39:44,880 living such a cherished place that this there's such privilege 699 00:39:44,960 --> 00:39:47,360 associated that we don't even think about. 700 00:39:47,840 --> 00:39:50,840 So we need to be really, really considerate about the Chrome 701 00:39:50,840 --> 00:39:53,720 extensions and not just Chrome. This might be Chromium based. 702 00:39:53,720 --> 00:39:56,000 So we might be talking about Brave, We might be talking 703 00:39:56,000 --> 00:39:59,080 about, you know, Opera as well, Edge. 704 00:39:59,080 --> 00:40:01,520 Let's not lay it all on Chrome door. 705 00:40:01,560 --> 00:40:03,800 They're all built on the same backbone, those browsers. 706 00:40:04,160 --> 00:40:05,760 Yeah, I think it's safer these days. 707 00:40:05,760 --> 00:40:08,080 Does not bother with browser extensions. 708 00:40:09,240 --> 00:40:13,240 Yeah, yeah. I mean, would you really miss 709 00:40:13,240 --> 00:40:16,320 them if they were gone? Probably not that much. 710 00:40:16,920 --> 00:40:19,680 I downloaded a new browser extension this week, Save images 711 00:40:19,680 --> 00:40:23,280 PNG, because my save images type, as we spoke about a couple 712 00:40:23,280 --> 00:40:26,080 of episodes ago, it was compromised and I needed some 713 00:40:26,080 --> 00:40:31,000 images from a Google image search and they were web P So 714 00:40:31,200 --> 00:40:36,160 like, yeah, I think that's it on that, like LinkedIn, I don't 715 00:40:36,160 --> 00:40:37,800 know. Well, I've got I've got another 716 00:40:37,800 --> 00:40:39,880 story that we'll touch on LinkedIn a bit later, but just 717 00:40:39,880 --> 00:40:42,680 bear in mind that LinkedIn is seeing every browser and not 718 00:40:42,680 --> 00:40:45,000 just LinkedIn. This will be Many websites are 719 00:40:45,000 --> 00:40:47,720 seeing every single browser extension you've got installed 720 00:40:48,200 --> 00:40:50,280 and tying it to your. The thing with LinkedIn is 721 00:40:50,280 --> 00:40:53,320 you're signed in, so I'm guessing it's assigned it like 722 00:40:53,320 --> 00:40:55,160 they'll assign that to my user ID. 723 00:40:56,000 --> 00:40:59,720 So in the back end they can see my LinkedIn profile, all of the 724 00:40:59,720 --> 00:41:02,800 information I've shared, and all of the browser extensions I've 725 00:41:02,800 --> 00:41:05,160 got installed. It's the collating of that data. 726 00:41:05,440 --> 00:41:07,480 The aggregation of that data, that's. 727 00:41:07,480 --> 00:41:09,440 Yeah. Yeah, right. 728 00:41:09,440 --> 00:41:11,920 Move on to the next one. Cool. 729 00:41:11,920 --> 00:41:14,920 I think this is the last story we've got. 730 00:41:15,200 --> 00:41:17,640 First one. Attackers are now using WhatsApp 731 00:41:17,640 --> 00:41:20,440 to deliver malware to Windows PCs. 732 00:41:20,440 --> 00:41:24,960 And this is a sorry from the Hacker News, Microsoft's scoring 733 00:41:24,960 --> 00:41:27,320 attention to a new campaign that's leveraged WhatsApp 734 00:41:27,320 --> 00:41:31,960 messages to distribute malicious Visual Basic script files or VBS 735 00:41:31,960 --> 00:41:35,760 files. This is talking about activity 736 00:41:35,760 --> 00:41:41,880 beginning in late February 2026. This is quite kind of a 737 00:41:41,880 --> 00:41:45,640 complicated story as such, obviously. 738 00:41:45,640 --> 00:41:49,840 Yeah, people typically you sort of think about phishing emails, 739 00:41:50,400 --> 00:41:54,480 You don't really think about dodgy WhatsApp messages. 740 00:41:54,480 --> 00:41:58,440 I mean, sometimes you might get like a dodgy tracking URL for 741 00:41:58,440 --> 00:42:02,960 delivery or just a random group chat, but delivering sort of 742 00:42:02,960 --> 00:42:06,920 attachments in that way is not really what you think. 743 00:42:07,600 --> 00:42:13,520 And also if your Whatsapp's on mobile, not quite sure what this 744 00:42:13,520 --> 00:42:16,760 does, but I guess if you're running WhatsApp on the on the 745 00:42:16,760 --> 00:42:19,480 web, maybe you're more affected, right? 746 00:42:19,480 --> 00:42:22,280 But it says here that they're sending latest files through 747 00:42:22,280 --> 00:42:24,880 WhatsApp messages that once opened could give them full 748 00:42:24,880 --> 00:42:27,360 access to the victim's Windows computer. 749 00:42:28,960 --> 00:42:32,880 So it says here that the clever part is how hard it is to detect 750 00:42:32,880 --> 00:42:35,160 them. So once it's run, it copies 751 00:42:35,160 --> 00:42:38,720 legitimate built in Windows tools into a hidden folder. 752 00:42:38,720 --> 00:42:41,800 There's some fake names to look harmless, and then uses those 753 00:42:41,800 --> 00:42:44,880 same trusted tools to download the actual malware from well 754 00:42:44,880 --> 00:42:48,600 known cloud services like AWS, making the traffic look normal. 755 00:42:49,640 --> 00:42:52,400 It says that the final payload can include tools like any desk, 756 00:42:52,400 --> 00:42:54,960 which transit tech is for remote control of the machine. 757 00:42:54,960 --> 00:42:57,840 But yeah, a lot of social engineering aspects going on 758 00:42:57,840 --> 00:42:58,920 with this one. Yeah. 759 00:42:58,920 --> 00:43:02,400 There's bits of information everybody want for the 760 00:43:02,400 --> 00:43:05,760 newsletter. To be honest, I don't care. 761 00:43:06,040 --> 00:43:10,320 So she's not talking about WhatsApp for Web at all in this 762 00:43:10,320 --> 00:43:14,040 story, But I don't see how that isn't the case. 763 00:43:14,600 --> 00:43:17,480 But yeah, there's a whole bunch of detail in this. 764 00:43:18,280 --> 00:43:20,800 I think it's one that can probably just maybe want to 765 00:43:20,800 --> 00:43:24,240 share with around this WhatsApp safety in general and presumably 766 00:43:24,240 --> 00:43:26,120 WhatsApp for web is the cause here. 767 00:43:26,840 --> 00:43:29,040 Yeah, or the WhatsApp desktop client. 768 00:43:29,160 --> 00:43:33,280 I like Whatsapp's available on Mac, it's available on browser, 769 00:43:33,280 --> 00:43:36,920 it's available on Windows and obviously Android and. 770 00:43:38,200 --> 00:43:41,520 This is obviously targeting Windows devices because 771 00:43:42,040 --> 00:43:46,040 Microsoft has talked about it and it's running VBS files and. 772 00:43:46,800 --> 00:43:49,880 Yeah, I didn't think about downloading it. 773 00:43:52,440 --> 00:43:55,880 I I wonder, Well, you're not a Windows user heavily, are you? 774 00:43:56,160 --> 00:43:58,680 Not well I am, but I use WhatsApp for web. 775 00:43:59,800 --> 00:44:01,760 Yeah. I don't really like sorting apps 776 00:44:01,760 --> 00:44:05,160 for stuff like that. And, and this is the reason why, 777 00:44:05,160 --> 00:44:07,520 Luke. Yeah, this is the reason why. 778 00:44:09,040 --> 00:44:10,400 Yeah, it's. Yeah. 779 00:44:10,400 --> 00:44:13,000 I remember, like when obviously we used to work together. 780 00:44:13,000 --> 00:44:15,920 You always used the Slack client in the browser as well, didn't 781 00:44:15,920 --> 00:44:17,200 you? You never installed the Slack. 782 00:44:17,560 --> 00:44:19,680 Client, it was easier, yeah, yeah. 783 00:44:22,400 --> 00:44:25,440 I wonder how it note like. I wonder what percentage of 784 00:44:25,440 --> 00:44:27,520 WhatsApp users use it on Windows. 785 00:44:28,360 --> 00:44:31,440 Yeah. I wonder how they're targeting 786 00:44:31,440 --> 00:44:34,440 Windows WhatsApp users like that. 787 00:44:35,160 --> 00:44:37,560 That alone in itself is quite interesting. 788 00:44:37,640 --> 00:44:40,840 Is there a list somewhere? Have they got that data or are 789 00:44:40,840 --> 00:44:44,640 they literally just taking just trying their luck on it? 790 00:44:44,680 --> 00:44:47,960 I don't know. Yeah, doesn't seem to say much 791 00:44:47,960 --> 00:44:50,160 more. I've had it, but yeah, that 792 00:44:50,160 --> 00:44:53,760 seems like kind of interested to know how that works. 793 00:44:54,520 --> 00:44:58,280 Yeah, right. Let's move on now. 794 00:44:58,360 --> 00:45:00,160 That's that's it for this week's news. 795 00:45:00,160 --> 00:45:02,760 So let's move on to the fish of the week. 796 00:45:06,280 --> 00:45:09,560 Right, and this week's Fish of the Week obviously comes from 797 00:45:09,560 --> 00:45:12,400 the Threat Intelligence team at Hawks Hunt. 798 00:45:12,400 --> 00:45:15,720 So thank you Hawks Hunt for sharing this with us as always. 799 00:45:16,920 --> 00:45:21,800 This week's is AQR code in salary increase notification. 800 00:45:22,960 --> 00:45:28,200 So we can see here receive a company. 801 00:45:28,200 --> 00:45:31,800 So it would have your company logo on updated salary and 802 00:45:31,800 --> 00:45:35,760 compensation for all risky creative employees. 803 00:45:35,760 --> 00:45:39,160 It would insert your company name there and it would say dear 804 00:45:39,320 --> 00:45:41,680 Luke. It would probably say Dear Luke 805 00:45:41,680 --> 00:45:45,880 Pettigrew or whatever name, however they'd scrape the name. 806 00:45:46,240 --> 00:45:48,880 We're writing to inform you that a new company policy has been 807 00:45:48,880 --> 00:45:54,920 added Salary increase effective Friday, March the 27th, 2026 I 808 00:45:54,920 --> 00:45:57,400 I. I imagine that date may change. 809 00:45:58,360 --> 00:46:01,520 To access and review the update policy documentation, please 810 00:46:01,520 --> 00:46:03,480 scan the. QR code below your. 811 00:46:05,120 --> 00:46:07,480 Attention to this policy is greatly appreciated. 812 00:46:07,480 --> 00:46:08,920 Should. You have any questions or 813 00:46:08,920 --> 00:46:12,240 concerns, please don't hesitate to reach out to policy 814 00:46:12,240 --> 00:46:17,240 department. The policy department. 815 00:46:17,720 --> 00:46:21,760 Yeah, recipient company again, it says risky crave finance 816 00:46:21,760 --> 00:46:23,560 department. So then it says the finance 817 00:46:23,560 --> 00:46:27,040 department and then the nice. Little yellow box at the bottom. 818 00:46:27,040 --> 00:46:30,080 This content is confidential and intended exclusively for its 819 00:46:30,080 --> 00:46:33,360 designated recipient, Luke Pettigrew, or whatever your name 820 00:46:33,360 --> 00:46:35,200 may be. We kindly ask for your 821 00:46:35,200 --> 00:46:39,000 cooperation in safeguarding and security by not sharing this 822 00:46:39,000 --> 00:46:41,680 link or access code with anyone else. 823 00:46:41,680 --> 00:46:44,800 So he's encouraging you to shut up. 824 00:46:44,920 --> 00:46:46,200 It's. Encouraging you to be quiet. 825 00:46:46,480 --> 00:46:51,680 Like, don't tell your friends. So yeah, obviously QR code, it's 826 00:46:51,680 --> 00:46:54,480 asking to scan AQR code. Why does it ask you to scan AQR 827 00:46:54,480 --> 00:46:56,080 code? Because you do that on your 828 00:46:56,080 --> 00:47:00,240 phone and then it gets you off away from the security controls 829 00:47:00,240 --> 00:47:04,440 that you may have on your device and then encourage you to sign 830 00:47:04,440 --> 00:47:07,640 in in an unusual, strange environment. 831 00:47:07,720 --> 00:47:10,040 You know that isn't. Your your work computer. 832 00:47:10,960 --> 00:47:13,080 The subject line is also an interesting one. 833 00:47:13,080 --> 00:47:17,440 If we look at the points Hox hunt the flagged on this, the 834 00:47:17,440 --> 00:47:20,480 phishing message is delivered as an attachment within an 835 00:47:20,480 --> 00:47:23,600 otherwise empty e-mail. So that's that's interesting. 836 00:47:24,120 --> 00:47:27,240 So this actually came as an empty e-mail with a dot EML 837 00:47:27,240 --> 00:47:31,200 attachment and the e-mail file. So everything I've just read was 838 00:47:31,200 --> 00:47:34,840 contained in an e-mail file. So that's unusual straight away 839 00:47:34,840 --> 00:47:37,600 like that's normal. There's a red flag. 840 00:47:38,120 --> 00:47:42,600 I think, I think there was a time when we worked together 841 00:47:42,760 --> 00:47:46,960 that we discussed blocking dot e-mail attachments as an at an 842 00:47:46,960 --> 00:47:51,160 organisation level and I think we may have even done that for a 843 00:47:51,160 --> 00:47:54,240 while. The only time you even really 844 00:47:54,240 --> 00:47:59,200 need to forward a DOT e-mail attachment would be to our SEC 845 00:47:59,280 --> 00:48:03,280 OPS team to to analyse an e-mail I think, because then you get 846 00:48:03,280 --> 00:48:04,480 all the headers attached and stuff. 847 00:48:06,400 --> 00:48:09,160 Obviously. Hoxon also flagged fake salary 848 00:48:09,160 --> 00:48:13,120 increase used as a lure to scan malicious QR codes. 849 00:48:13,120 --> 00:48:15,000 It's playing into the human emotions. 850 00:48:15,000 --> 00:48:16,040 Isn't it all zero increase? Yes. 851 00:48:17,520 --> 00:48:19,240 Please, that's. We all like to. 852 00:48:19,800 --> 00:48:22,480 You know, receive a little more money and stuff like that. 853 00:48:22,480 --> 00:48:26,320 So, yeah, I think that's that was a good one. 854 00:48:28,600 --> 00:48:30,120 Yeah. So. 855 00:48:32,360 --> 00:48:34,600 Oh, there's much more. Steps to this I should have. 856 00:48:34,600 --> 00:48:39,000 Looked at, there's more to it. So leading to device. 857 00:48:39,000 --> 00:48:41,360 Code phishing. So when you log in, so when you 858 00:48:41,480 --> 00:48:45,680 scan the QR code, takes you to a malicious URL, takes you to a 859 00:48:45,680 --> 00:48:50,480 fake DocuSign page, log in to DocuSign with a signing code. 860 00:48:51,800 --> 00:48:53,560 So let's see what that's talking about. 861 00:48:53,560 --> 00:48:56,760 So this is the fake DocuSign website instruct you to use a 862 00:48:56,760 --> 00:48:59,240 signing code. The button directs to a 863 00:48:59,520 --> 00:49:03,480 legitimate. Microsoft website setting up the 864 00:49:03,480 --> 00:49:10,720 next step of the attack. And here is the device. 865 00:49:10,720 --> 00:49:11,800 Code phishing. So this is all 866 00:49:11,800 --> 00:49:16,040 genuinemicrosoftonline.com. Enter a code to allow access. 867 00:49:16,040 --> 00:49:17,040 Pick an account. Are you? 868 00:49:17,040 --> 00:49:22,440 Trying to sign into Microsoft Microsoft Office device. 869 00:49:22,440 --> 00:49:24,120 Authentication. So then that opens a. 870 00:49:24,120 --> 00:49:26,560 Legitimate Microsoft Device authentication window. 871 00:49:27,400 --> 00:49:29,960 And the focus on code entry shifts attention away from the 872 00:49:29,960 --> 00:49:35,080 app permissions and identity. So this attack authorises access 873 00:49:35,080 --> 00:49:37,880 without stealing passwords. So what this is actually doing 874 00:49:37,880 --> 00:49:41,160 is giving someone access to your device. 875 00:49:41,160 --> 00:49:43,800 This is device code phishing, which I think we've spoken about 876 00:49:44,480 --> 00:49:51,320 before, So yeah, yeah. We'll put details of that. 877 00:49:51,320 --> 00:49:54,080 That's just goes to show, I thought that I should have 878 00:49:54,080 --> 00:49:56,880 scrolled down further from the off, so apologies for that. 879 00:49:57,000 --> 00:50:00,720 It's lack of preparation there. But what looks like just a 880 00:50:00,720 --> 00:50:03,840 simple QR code credential capture is actually something 881 00:50:03,840 --> 00:50:06,640 way more complicated with multiple steps. 882 00:50:07,640 --> 00:50:10,800 And why so why so complex? Because it works, right? 883 00:50:10,920 --> 00:50:14,640 Like the DocuSign page gives you a sign in code, you click 884 00:50:14,640 --> 00:50:17,920 continue to Microsoft and then you're actually giving. 885 00:50:17,920 --> 00:50:20,320 Someone access to your device so. 886 00:50:22,960 --> 00:50:24,400 That's this week's Fish of the Week. 887 00:50:25,680 --> 00:50:27,800 Thanks for the team at Hawks on for sharing that with us. 888 00:50:28,080 --> 00:50:30,480 Yeah, thank you. Time is ticking. 889 00:50:30,480 --> 00:50:33,200 This week seems. This this episode seems to be 890 00:50:33,200 --> 00:50:36,720 going on and on and on. There was a lot to talk about. 891 00:50:40,480 --> 00:50:45,000 Yeah, so let me. Just pull up my next one. 892 00:50:45,000 --> 00:50:47,360 I had a couple of topics. Just a couple of topics to talk 893 00:50:47,360 --> 00:50:49,000 about this week. Last week I had loads. 894 00:50:49,400 --> 00:50:52,040 The first thing I wanted to talk to you about this week was I was 895 00:50:52,040 --> 00:50:53,680 influenced. I was looking for some wall 896 00:50:53,680 --> 00:50:58,760 panels for my son's bedroom and I had a Google and then was 897 00:50:58,760 --> 00:51:02,040 browsing social media and a cheap, cheap offer came up on 898 00:51:02,040 --> 00:51:05,240 Instagram. I was like OK, so I did my due. 899 00:51:05,240 --> 00:51:06,920 Diligence I went through. I checked the. 900 00:51:06,920 --> 00:51:10,480 Website checked the company, I felt confident that they were 901 00:51:10,480 --> 00:51:13,080 legit and I'm feeling confident they were legit. 902 00:51:13,080 --> 00:51:15,680 They're due to be delivered Easter Sunday. 903 00:51:16,400 --> 00:51:17,320 They're due. To be I missed. 904 00:51:17,320 --> 00:51:18,880 Delivery Tuesday because I wasn't here. 905 00:51:19,000 --> 00:51:21,160 They're due to be delivered today, Easter Sunday, and 906 00:51:21,160 --> 00:51:23,560 apparently they're like they'll be here in the next hour. 907 00:51:25,040 --> 00:51:33,920 But I received an SMS message this week after I'd missed 908 00:51:33,920 --> 00:51:38,480 delivery the same day, 2 hours after I'd missed delivery at no 909 00:51:38,520 --> 00:51:41,360 an hour. Delivery was attempted at 11 and 910 00:51:41,360 --> 00:51:43,680 then I got this message delivery processing on hold. 911 00:51:44,000 --> 00:51:46,240 We attempted delivery at nine O 3. 912 00:51:46,240 --> 00:51:48,080 No. They didn't because I've got a a 913 00:51:48,680 --> 00:51:50,200 camera doorbell. No one. 914 00:51:50,200 --> 00:51:53,200 Was at my doorbell. Around that time someone was in 915 00:51:53,200 --> 00:51:56,640 the house my my father-in-law. We're unable to complete it as a 916 00:51:56,640 --> 00:51:59,720 signature was required. Parcel remains on hold to 917 00:51:59,720 --> 00:52:01,440 proceed. Please review and update your 918 00:52:01,440 --> 00:52:03,160 delivery details. Wait for this. 919 00:52:03,160 --> 00:52:11,000 This is the interesting part HCTPSDPD dot parcel STAG OK dot 920 00:52:11,120 --> 00:52:17,520 bond forward slash com reply Y. And then reopen the. 921 00:52:17,520 --> 00:52:20,840 Message to continue. If needed, paste the address 922 00:52:20,840 --> 00:52:23,320 into your browser. You may choose a new delivery 923 00:52:23,320 --> 00:52:28,360 slot or redirect the parcel. Now the timing on this really 924 00:52:28,360 --> 00:52:30,000 uncanny. I don't get a message like this 925 00:52:30,000 --> 00:52:31,440 for ages. I'm expecting something 926 00:52:31,440 --> 00:52:34,120 delivered Tuesday. They tried to deliver it at 927 00:52:34,120 --> 00:52:38,600 11:00 and then at 12:19 I get this text message. 928 00:52:39,640 --> 00:52:44,160 This text message is clearly fake and I really, really mean 929 00:52:44,240 --> 00:52:47,680 this is fake the the website address. 930 00:52:48,520 --> 00:52:52,000 So let's let's analyse this the website address itself, DPD dot 931 00:52:52,000 --> 00:52:55,480 parcel STAG OK dot bond forward slash com. 932 00:52:55,880 --> 00:52:58,520 That is not a legitimate website. 933 00:52:59,560 --> 00:53:02,800 We can't, we can't even claim for a second like let's let's 934 00:53:02,800 --> 00:53:05,960 see if it's still. I shouldn't really do this, but 935 00:53:05,960 --> 00:53:09,560 let me, let me open, let me open a brand new browser. 936 00:53:11,640 --> 00:53:19,320 Can I open Firefox? And we're going to go to DPD 937 00:53:19,720 --> 00:53:28,120 dot. PARCELSTAG OK dot bond. 938 00:53:28,560 --> 00:53:33,480 Forward. Slash com Hey Firefox say 939 00:53:33,480 --> 00:53:37,960 deceptive site ahead. So they know. 940 00:53:38,400 --> 00:53:45,440 They know. And if I go to that site, is it 941 00:53:45,440 --> 00:53:48,320 going to even let me? Surf Shark has now blocked it. 942 00:53:49,680 --> 00:53:53,680 Look I went to it on mobile and it was a fake DPD website asking 943 00:53:53,680 --> 00:53:57,280 me to input all details. It probably asked me to ask me 944 00:53:57,280 --> 00:53:59,120 for credit card details or something like that, but it 945 00:53:59,120 --> 00:54:01,360 asked me for full address details so. 946 00:54:02,080 --> 00:54:04,680 Straight away the timing. 'S really weird that I order 947 00:54:04,680 --> 00:54:07,720 something from an unknown brand new company I've never used 948 00:54:07,720 --> 00:54:12,240 before online and then I get this text message and then so I 949 00:54:12,240 --> 00:54:14,640 just ignore this. The interesting thing is the 950 00:54:14,640 --> 00:54:17,480 link doesn't work because Apple added that as a security 951 00:54:17,480 --> 00:54:21,320 protection a short while ago. Until you replied, you need to 952 00:54:21,320 --> 00:54:24,320 reply to it to. Activate that URL, which is why 953 00:54:24,320 --> 00:54:27,960 they tell you reply why and then reopen the message because if I 954 00:54:27,960 --> 00:54:30,040 do. That that is then clickable. 955 00:54:30,080 --> 00:54:33,960 I could then click on that right, but that wasn't the end 956 00:54:33,960 --> 00:54:36,840 of it 2. Days later, I get another 957 00:54:36,840 --> 00:54:39,960 message from a different number. This one's a foreign number. 958 00:54:40,240 --> 00:54:43,520 The first one was at UK Mobile. This one's a foreign number. 959 00:54:44,040 --> 00:54:48,280 Your parcel remains undelivered following an attempt at 9:35 960 00:54:48,280 --> 00:54:51,040 today. Address details are incomplete, 961 00:54:51,320 --> 00:54:55,720 preventing further processing. My wife, I read this to her, she 962 00:54:55,720 --> 00:55:00,000 goes if the address details are incomplete, how did they attempt 963 00:55:00,000 --> 00:55:03,880 delivery your. Parcel remains. 964 00:55:03,880 --> 00:55:05,440 Undelivered following an attempt. 965 00:55:05,440 --> 00:55:08,680 At 9:35, address details are incomplete. 966 00:55:09,240 --> 00:55:12,160 That's a contradiction. Please confirm your details to 967 00:55:12,160 --> 00:55:15,680 proceed. And it's a similar shaped URL, 968 00:55:15,680 --> 00:55:20,160 but it's different. The the last three digits of of 969 00:55:20,160 --> 00:55:24,000 the prefix are different. But again, simply reply with 970 00:55:24,000 --> 00:55:26,840 why? Close the SMS and reopen it to 971 00:55:26,840 --> 00:55:30,760 activate the link. You may arrange. 972 00:55:30,760 --> 00:55:33,360 Delivery and collection retention ends. 3rd of April, so 973 00:55:33,360 --> 00:55:35,880 there's a deadline there. I just it's really. 974 00:55:35,880 --> 00:55:39,840 Funny that I don't. Receive a message like this for 975 00:55:39,840 --> 00:55:42,560 months and months and months. Order something from a new 976 00:55:42,560 --> 00:55:44,720 business that I've never ordered from before. 977 00:55:45,200 --> 00:55:47,800 Delivery fails. 2 scammy messages. 978 00:55:48,800 --> 00:55:52,160 I want I. You've got to wonder, is there a 979 00:55:52,160 --> 00:55:56,640 compromise system there? Is there a is this a side 980 00:55:56,640 --> 00:55:58,680 hustle? You can earn more money if you 981 00:55:58,680 --> 00:56:00,960 sell us your delivery detail. And you know I don't I. 982 00:56:00,960 --> 00:56:03,880 Don't know, I'm not going to mention who they are, but. 983 00:56:04,280 --> 00:56:09,080 It all feels a little bit dodgy. But we'll see if it's the. 984 00:56:09,640 --> 00:56:12,600 If I actually get my wall panels shortly this morning, we'll see 985 00:56:12,600 --> 00:56:14,520 I suppose. Did I cover if you said sorry? 986 00:56:14,720 --> 00:56:17,360 Was it DPD? That you were getting it from? 987 00:56:17,760 --> 00:56:20,880 No, no, I've got. I've got no. 988 00:56:20,880 --> 00:56:23,120 Idea. Who this delivery company is? 989 00:56:23,120 --> 00:56:27,880 Because the tracking identity is again some really dodgy URL. 990 00:56:27,880 --> 00:56:33,400 Tracks are dot IO, the word tracks are dot IO. 991 00:56:33,400 --> 00:56:35,280 So it looks like. Some third party. 992 00:56:36,360 --> 00:56:39,960 Tracks are dot IO, it's just even that looks like. 993 00:56:40,640 --> 00:56:41,880 The only. Reason I got that tracking 994 00:56:41,880 --> 00:56:44,800 information was because I emailed them asking that's just 995 00:56:44,800 --> 00:56:46,560 like some third party tracking service. 996 00:56:47,480 --> 00:56:50,040 I emailed them asking where it was on Tuesday and they emailed 997 00:56:50,040 --> 00:56:53,040 me back yesterday saying it'll be delivered tomorrow, Right. 998 00:56:53,800 --> 00:56:57,320 Easter Sunday, the holiest Christmas Day, Easter Sunday. 999 00:56:57,920 --> 00:57:00,680 I wouldn't expect a delivery today, but apparently yeah, fair 1000 00:57:00,680 --> 00:57:02,560 enough. One more thing I. 1001 00:57:02,560 --> 00:57:05,760 Wanted to mention was I. Saw something in a newsletter. 1002 00:57:05,760 --> 00:57:08,960 I subscribed to a newsletter by someone called Laura Olin. 1003 00:57:09,760 --> 00:57:12,880 She's kind of talks about pop culture and stuff like this, and 1004 00:57:12,920 --> 00:57:16,320 she talked about a something that I think I'd missed 1005 00:57:16,320 --> 00:57:19,320 completely. It's called Stop Sloppy Pasta. 1006 00:57:21,200 --> 00:57:26,360 Sloppy pasta verbatim LLM output copy pasted at someone unread, 1007 00:57:26,560 --> 00:57:30,040 unrefined and unrequested from slop. 1008 00:57:30,600 --> 00:57:32,520 And I thought this. Was brilliant because it kind 1009 00:57:32,520 --> 00:57:34,440 of. You just got an unread message 1010 00:57:34,440 --> 00:57:37,360 notification. Maybe it's on Slack or Teams, a 1011 00:57:37,360 --> 00:57:41,200 text message or an e-mail. Maybe you were tagged in Notion 1012 00:57:41,200 --> 00:57:43,840 or an Office talk. You open it to find several 1013 00:57:43,840 --> 00:57:48,600 paragraphs of text or perhaps a listicle with all the hallmarks 1014 00:57:48,600 --> 00:57:53,520 of AI generated writing headings heavy formatting with it's not 1015 00:57:53,520 --> 00:57:59,800 X, it's Y&M dashes sprinkle gratuitously throughout the 1016 00:57:59,800 --> 00:58:03,440 person who sent it probably spent about 10 seconds on it for 1017 00:58:03,480 --> 00:58:08,520 me I just we talked about LinkedIn earlier and I see a lot 1018 00:58:08,520 --> 00:58:13,760 of this on LinkedIn and some time ago was probably. 1019 00:58:13,840 --> 00:58:17,760 Guilty of this? In some ways myself, you can see 1020 00:58:17,760 --> 00:58:20,880 like earlier episodes have been released and there's emojis 1021 00:58:20,880 --> 00:58:24,920 sprinkled in LinkedIn articles. Well, there's not anymore 1022 00:58:26,400 --> 00:58:30,240 because it just didn't feel we, we talk about humans and the 1023 00:58:30,240 --> 00:58:33,800 human side of things. And yeah, you can, you can tell 1024 00:58:33,800 --> 00:58:37,520 when something's written by AI. And this is a, this is a kind of 1025 00:58:37,520 --> 00:58:41,040 campaign to raise awareness about don't actually like use 1026 00:58:41,040 --> 00:58:45,200 AI, but do something. Different, you know. 1027 00:58:45,640 --> 00:58:48,040 Do something a little different. It's got three different 1028 00:58:48,040 --> 00:58:51,920 characters here. The eager be the like, I want to 1029 00:58:51,920 --> 00:58:54,880 be really quick to get involved in a on a in a conversation. 1030 00:58:54,880 --> 00:59:01,040 So I just ask a chat pot and the Oracle someone asks a specific 1031 00:59:01,040 --> 00:59:04,720 question that someone puts in a chat pot and paste the response. 1032 00:59:05,240 --> 00:59:08,240 It's not a security thing, but I think it's an engagement thing 1033 00:59:08,240 --> 00:59:10,120 for us. We we talk about engagement. 1034 00:59:11,280 --> 00:59:14,640 If we're creating security awareness content that's written 1035 00:59:14,640 --> 00:59:19,360 by AI, people can tell. If you're posting stuff on 1036 00:59:19,360 --> 00:59:23,600 LinkedIn and it's written by AI, people can tell. 1037 00:59:24,280 --> 00:59:27,360 You know, look at your posts from two or three years ago. 1038 00:59:27,920 --> 00:59:32,040 Did you litter them with emojis? I don't think you did, but you 1039 00:59:32,040 --> 00:59:35,080 do now because the AI puts the emojis in for you. 1040 00:59:35,520 --> 00:59:37,760 So it's, you know it. Yeah. 1041 00:59:37,920 --> 00:59:40,880 I like half of the emoji usage on LinkedIn. 1042 00:59:40,880 --> 00:59:43,200 It's not. It's not convenient to use 1043 00:59:43,200 --> 00:59:45,280 emojis. M dashes was the biggest 1044 00:59:45,280 --> 00:59:49,960 giveaway. I never used M dashes ever ever. 1045 00:59:50,360 --> 00:59:55,120 But good people that used to use M dashes now can't use them 1046 00:59:55,120 --> 00:59:57,440 because people automatically assume it's written by AI. 1047 00:59:58,240 --> 01:00:01,160 So. If you want. 1048 01:00:01,160 --> 01:00:02,880 People to engage with your content. 1049 01:00:02,960 --> 01:00:05,200 If you're writing awareness content, you're writing scripts, 1050 01:00:05,200 --> 01:00:07,200 you're writing posters, you're writing blog posts. 1051 01:00:07,440 --> 01:00:11,960 If you want people to engage, make sure if you're using AI 1052 01:00:12,440 --> 01:00:16,280 they humanise it because otherwise people won't engage. 1053 01:00:16,280 --> 01:00:19,280 People will think you've put little effort in, which means 1054 01:00:19,280 --> 01:00:22,640 they won't. Put any effort in essentially. 1055 01:00:22,640 --> 01:00:25,200 Yeah, I think yeah, it's definitely. 1056 01:00:25,200 --> 01:00:29,720 Good to use it in the right way, yeah, like come up with your own 1057 01:00:29,720 --> 01:00:33,280 sort of things and give it a lot of ingredients, I guess to 1058 01:00:33,280 --> 01:00:35,480 generate something rather than just asking it to do everything. 1059 01:00:35,480 --> 01:00:41,560 But it's funny when I see all the time on like Facebook, like 1060 01:00:42,240 --> 01:00:44,920 you've put that like what they put there and that one about 1061 01:00:45,600 --> 01:00:48,400 someone asked a question. And then people will just go and 1062 01:00:48,480 --> 01:00:52,000 ask AI for the answer and paste in as if it's like their own or 1063 01:00:52,000 --> 01:00:54,520 if it's the truth even. And in some cases it's just 1064 01:00:54,520 --> 01:00:57,760 made-up things or it's like we've seen before with Google's 1065 01:00:57,800 --> 01:01:00,360 AI summary with focus information. 1066 01:01:03,200 --> 01:01:05,440 I see it as well, just, well, going on too much more. 1067 01:01:05,840 --> 01:01:10,360 I see randomly on Facebook people ask them to edit my photo 1068 01:01:10,360 --> 01:01:13,280 or change this person, blah, blah, blah, blah. 1069 01:01:13,280 --> 01:01:15,880 And all the responses are there's people using AI tools to 1070 01:01:15,880 --> 01:01:18,760 generate this image for them rather than someone actually 1071 01:01:18,760 --> 01:01:20,840 using Photoshop or whatever to do it. 1072 01:01:20,920 --> 01:01:23,080 And it's just like, yeah, AI is everywhere. 1073 01:01:23,240 --> 01:01:24,520 Yeah. And it's not. 1074 01:01:24,640 --> 01:01:27,480 It's not necessarily clever. Because it's so accessible now. 1075 01:01:27,680 --> 01:01:31,040 Anyone. Can you remove dear ChatGPT? 1076 01:01:31,040 --> 01:01:33,000 I tried it. I tried it yesterday. 1077 01:01:33,000 --> 01:01:37,560 My son's got quite long hair and I just uploaded the pictures, 1078 01:01:37,560 --> 01:01:39,720 chat TPT and I was like, can you give him a short haircut? 1079 01:01:41,000 --> 01:01:42,480 Yeah. And a different person came 1080 01:01:42,480 --> 01:01:46,240 back. My 8 year old turned into a 32 1081 01:01:46,240 --> 01:01:48,920 year old man with a crop top with a you know, it's like, 1082 01:01:49,280 --> 01:01:52,240 that's not the same person, but thank you for your effort. 1083 01:01:52,320 --> 01:01:56,000 Like it's yeah, yeah. But anyone like it's not, it's 1084 01:01:56,000 --> 01:01:59,320 not clever. Anyone can use AI and I think 1085 01:01:59,480 --> 01:02:04,440 yeah, Anyway, yeah, I did have one last thing I saw and I I 1086 01:02:04,440 --> 01:02:05,920 know your story is probably going to. 1087 01:02:06,400 --> 01:02:09,360 I'm not going to steal your fire on this Artemis. 1088 01:02:10,480 --> 01:02:14,640 Obviously the Artemis 2 has gone to the moon or round the moon. 1089 01:02:15,840 --> 01:02:18,520 I heard this little clip astronauts calling Houston 1090 01:02:18,880 --> 01:02:21,120 because the computer on the spaceship is running two 1091 01:02:21,120 --> 01:02:24,400 instances of Microsoft Outlook and they can't figure out why 1092 01:02:24,840 --> 01:02:28,880 NASA is about to remote into. We suspect the issue with your 1093 01:02:28,880 --> 01:02:29,680 PCD. Maybe. 1094 01:02:29,680 --> 01:02:33,800 Optimus software we were able to connect to PCD one on you can 1095 01:02:33,800 --> 01:02:36,360 see on the network. So with your go, we can remote 1096 01:02:36,360 --> 01:02:43,080 in and take a look directly. Yeah, go for it. 1097 01:02:43,120 --> 01:02:44,640 And then I also see that I have two. 1098 01:02:44,640 --> 01:02:47,240 Microsoft Outlooks and either one of those are working. 1099 01:02:47,320 --> 01:02:49,720 If you want to remote in and check the Optimus on those two 1100 01:02:49,720 --> 01:02:53,320 Outlooks, that would be awesome, All right. 1101 01:02:53,320 --> 01:02:56,160 We will join in on your PCB. And we'll let you know when 1102 01:02:56,160 --> 01:02:58,640 we're done. So we know Artemis 2 is probably 1103 01:02:58,640 --> 01:03:02,240 running Windows, and we know that they have two versions of 1104 01:03:02,240 --> 01:03:04,360 Outlook installed, and neither of them are working. 1105 01:03:04,520 --> 01:03:07,000 Like, I can't believe that we've sent people to the moon and 1106 01:03:07,000 --> 01:03:09,240 we're relying on Outlook for e-mail for them. 1107 01:03:09,280 --> 01:03:10,800 It just seems mad. Yeah. 1108 01:03:11,000 --> 01:03:13,120 Like it makes you wonder. Why? 1109 01:03:13,120 --> 01:03:17,200 Why would they need Outlook? Just like live chat stuff these 1110 01:03:17,200 --> 01:03:18,800 days. They need to check their emails, 1111 01:03:19,440 --> 01:03:21,840 yeah? Can you imagine being? 1112 01:03:21,840 --> 01:03:25,000 Fished. Whilst orbiting, like, my God, 1113 01:03:25,000 --> 01:03:28,720 you imagine being fished while orbiting like I've just sorry, 1114 01:03:28,720 --> 01:03:30,560 we're being ransomwered in space. 1115 01:03:31,840 --> 01:03:34,040 There's a Hollywood story. For you orbiting the. 1116 01:03:34,040 --> 01:03:37,400 Moon And then you get infected with ransomware because you 1117 01:03:37,400 --> 01:03:40,120 scanned the QR code sent in your e-mail because you thought your 1118 01:03:40,120 --> 01:03:42,080 salary was increasing. Hey. 1119 01:03:42,080 --> 01:03:43,800 Bob, we've got a salary increase. 1120 01:03:44,000 --> 01:03:44,400 Oh. Cool. 1121 01:03:44,400 --> 01:03:45,760 Let me set, Let me open the e-mail. 1122 01:03:45,760 --> 01:03:48,360 Yeah, you can. Yeah, yeah. 1123 01:03:49,200 --> 01:03:50,600 Right. Move on to your topics. 1124 01:03:50,600 --> 01:03:51,840 Sorry. Wait, that's right. 1125 01:03:51,840 --> 01:03:54,880 Yeah, move on to yours. Did this on that topic kind of 1126 01:03:54,880 --> 01:03:58,640 thing I did. See the the Artemis 2 was using. 1127 01:03:58,640 --> 01:04:02,840 IT Office 365. On some custom computer that was 1128 01:04:02,840 --> 01:04:05,320 radiation proof and all sorts of things it's quite interesting. 1129 01:04:06,040 --> 01:04:11,560 But Office 365 again, something lighter. 1130 01:04:11,560 --> 01:04:15,200 Weight you didn't know. Like 365 offline? 1131 01:04:15,680 --> 01:04:19,560 Are they on like a starlink? Does Starlink go round the moon? 1132 01:04:19,560 --> 01:04:22,280 I I think they. Weren't maybe using that, but 1133 01:04:22,280 --> 01:04:24,520 yeah. It's this mission is sponsored. 1134 01:04:24,640 --> 01:04:29,400 I mean, it's SpaceX. Isn't it so this one, but with 1135 01:04:29,400 --> 01:04:32,120 SpaceX I maybe? I'm not sure. 1136 01:04:32,120 --> 01:04:34,480 It amazes me they're not. Using the lightest. 1137 01:04:34,480 --> 01:04:38,120 Weight clients available and I wouldn't have imagined 0365 is 1138 01:04:38,120 --> 01:04:41,320 the light option there, but. Who knows, maybe they're 1139 01:04:41,320 --> 01:04:43,720 remoting into a device somewhere, I don't know. 1140 01:04:44,320 --> 01:04:47,480 Yeah, I'll quickly share my. Stories. 1141 01:04:48,480 --> 01:04:52,720 Yeah, a topic. So this one was following on 1142 01:04:52,720 --> 01:04:56,400 from the Artemis Two thing. Just basically have one of the 1143 01:04:56,400 --> 01:05:01,080 astronauts entering their password on live stream, which 1144 01:05:01,080 --> 01:05:04,520 was quite a funny one. I play the video, I don't find 1145 01:05:04,520 --> 01:05:07,800 as much audio inside of 20 minutes. 1146 01:05:07,840 --> 01:05:10,960 From the opening of our launch window and right now we are 1147 01:05:10,960 --> 01:05:13,480 targeting, but yeah, you can see they're just about to launch. 1148 01:05:14,720 --> 01:05:17,480 And then yeah, he's the centering his pin code into the 1149 01:05:17,960 --> 01:05:22,400 on board the computer, the top of that launch window, so we 1150 01:05:22,400 --> 01:05:25,480 could be launching. Here in about 19 minutes ago. 1151 01:05:25,880 --> 01:05:27,640 Wow. I Yeah. 1152 01:05:27,640 --> 01:05:29,400 So we now know. What his pin code is, but I'm 1153 01:05:29,400 --> 01:05:32,120 also. Surprised that they need a pin 1154 01:05:32,120 --> 01:05:35,120 code. There's four people on board and 1155 01:05:35,120 --> 01:05:36,760 you should be able to trust all of them with their. 1156 01:05:36,760 --> 01:05:40,840 Lives explicitly. I'm really surprised some. 1157 01:05:41,080 --> 01:05:45,240 Sort of policy thing, right? The device got built on there 1158 01:05:45,280 --> 01:05:48,480 and it made it. Surely you could give? 1159 01:05:49,120 --> 01:05:52,720 Them a policy exception? Well, I forget the passcode. 1160 01:05:53,880 --> 01:05:58,480 It's him that's funny, similar to the we've. 1161 01:05:58,760 --> 01:06:01,440 Seen it before it was because. It Kanye West or someone else 1162 01:06:01,440 --> 01:06:04,280 entering the password Trump maybe, I can't remember. 1163 01:06:04,400 --> 01:06:07,840 Yeah, various occasions where? People have had passcodes on the 1164 01:06:07,840 --> 01:06:10,040 councillor. Last week, once he's yeah. 1165 01:06:10,760 --> 01:06:13,480 Yeah. Yeah, it's, yeah. 1166 01:06:13,480 --> 01:06:14,760 This is more of a funny one than anything. 1167 01:06:14,760 --> 01:06:17,360 I can't imagine there's much of a problem there being on a 1168 01:06:17,600 --> 01:06:20,400 shuttle in space right now with a leaked passcode. 1169 01:06:21,320 --> 01:06:24,200 I wonder maybe if that device. Could be compromised so that 1170 01:06:24,320 --> 01:06:26,280 that. Device looked like say again, 1171 01:06:26,280 --> 01:06:27,920 that looked like a tablet running Windows. 1172 01:06:28,560 --> 01:06:31,840 Which means you'd argue that it could probably be compromised. 1173 01:06:31,840 --> 01:06:33,720 Maybe the pin code gives admin rights. 1174 01:06:34,120 --> 01:06:36,520 I don't know, Maybe I don't. Let's not get into that. 1175 01:06:36,960 --> 01:06:39,400 Yeah, please do not compromise Artemis 2. 1176 01:06:40,000 --> 01:06:42,160 Yeah, it's quickly. The other one I wanted to share 1177 01:06:42,160 --> 01:06:46,840 was. Another of Apple's adverts, they 1178 01:06:46,840 --> 01:06:50,800 seem to be doing a lot of these marketing for sort of I guess 1179 01:06:51,080 --> 01:06:55,240 aimed at Gen Z, but with the map with the Earth, and this one's 1180 01:06:55,240 --> 01:07:00,440 about possum and it just go into the device 2020, whatever. 1181 01:07:00,440 --> 01:07:02,480 Who's still trying to remember? Passwords. 1182 01:07:03,000 --> 01:07:05,920 You don't have to on Mac because it has the Passwords app. 1183 01:07:07,000 --> 01:07:08,520 It remembers all your passwords. It's. 1184 01:07:08,520 --> 01:07:10,680 Super. Secure and it goes across your 1185 01:07:10,680 --> 01:07:13,240 devices. It'll even help you come up with 1186 01:07:13,240 --> 01:07:16,520 one of those weird really long ones that's definitely stronger 1187 01:07:16,520 --> 01:07:20,920 than 123 ABC. And if an old password gets 1188 01:07:20,920 --> 01:07:23,680 leaked, the app will let you know so you can change it. 1189 01:07:25,640 --> 01:07:29,480 It's actually really easy. It's. 1190 01:07:30,560 --> 01:07:32,760 Yeah, that's quite nice. I love this little character. 1191 01:07:32,760 --> 01:07:37,240 They've got which? Is the old Finder, Yeah, yeah. 1192 01:07:37,800 --> 01:07:41,920 This is, yeah, it's kind of positive sort of thing. 1193 01:07:41,960 --> 01:07:44,240 Educate people on personal managers and stuff. 1194 01:07:46,400 --> 01:07:52,000 It not terribly produced how they put down passwords in the 1195 01:07:52,000 --> 01:07:53,240 last. Video we shared. 1196 01:07:53,480 --> 01:07:56,120 This is kind of a good recovery for them because it is 1197 01:07:56,120 --> 01:07:59,600 encouraging password RE. Yeah, I mean, again, their 1198 01:07:59,600 --> 01:08:02,120 password solution isn't available on Android, I don't 1199 01:08:02,120 --> 01:08:04,960 think, or Windows. So it does keep you locked into 1200 01:08:04,960 --> 01:08:08,000 the Apple ecosystem. You can use it across devices as 1201 01:08:08,000 --> 01:08:11,720 long as they're made by Apple. Yeah, but that's. 1202 01:08:12,320 --> 01:08:13,760 Yeah, that's what I've always wanted to share. 1203 01:08:13,760 --> 01:08:17,640 Maybe for more of obviously awareness people, but I thought 1204 01:08:17,640 --> 01:08:19,479 it was a bit ironic as well though it says like oh you don't 1205 01:08:19,479 --> 01:08:23,120 need to remember passwords but the type 2020 whatever password 1206 01:08:23,120 --> 01:08:26,520 I'm still trying. To to get into the app. 1207 01:08:28,319 --> 01:08:30,200 Yeah, it shows. You typing in the master 1208 01:08:30,200 --> 01:08:32,080 password? Yeah, yeah. 1209 01:08:33,479 --> 01:08:35,120 I guess this is also an interesting one. 1210 01:08:35,840 --> 01:08:37,359 It's still a password sometimes. Right. 1211 01:08:38,160 --> 01:08:42,120 If they're promoting this. Organisations need to be aware 1212 01:08:42,120 --> 01:08:44,600 that there's now going to be. A password manager on the device 1213 01:08:44,600 --> 01:08:47,200 that your corporate passwords might be being leaked. 1214 01:08:47,240 --> 01:08:51,200 And if you don't use managed Apple IDs, then there's going to 1215 01:08:51,200 --> 01:08:54,200 be some passwords exfiltration there. 1216 01:08:54,640 --> 01:08:58,680 So if you run lots of Apple devices in your organisation, 1217 01:08:58,680 --> 01:09:02,240 you might want to look at Jam for policies to block the 1218 01:09:02,240 --> 01:09:04,120 Passwords app if you haven't already. 1219 01:09:04,439 --> 01:09:08,520 Because now there's I. Use one password or bit warden. 1220 01:09:08,920 --> 01:09:11,760 Now I've got another lot of pass somewhere else to keep my 1221 01:09:11,760 --> 01:09:14,840 passwords. It's yeah. 1222 01:09:15,279 --> 01:09:17,120 Yeah. The passwords apps, I mean, 1223 01:09:17,120 --> 01:09:19,120 that's not. New that was launched. 2 now 1224 01:09:19,120 --> 01:09:20,960 four years ago, but it's nice to see. 1225 01:09:20,960 --> 01:09:23,240 Them promoting it. Anyway, especially if there's 1226 01:09:23,240 --> 01:09:27,520 going to be lots of new Mac users buying the new Neo. 1227 01:09:27,760 --> 01:09:31,640 Cheap. Macbooks, yeah, yeah, it would 1228 01:09:31,640 --> 01:09:32,520 be a good. Solution for my. 1229 01:09:32,520 --> 01:09:34,920 Mum if she's got a. MacBook she uses. 1230 01:09:34,920 --> 01:09:37,840 An iPhone and an iPad. That would be a really nice 1231 01:09:37,840 --> 01:09:41,120 solution actually. Yeah, rather than a password 1232 01:09:41,120 --> 01:09:43,399 book, which I haven't got a problem with, she uses a 1233 01:09:43,399 --> 01:09:48,600 password book on the shelf. But this would be a nice easy 1234 01:09:48,600 --> 01:09:52,880 solution to to evolve her password security. 1235 01:09:54,120 --> 01:09:57,520 Yeah, what else have you got I. Have. 1236 01:09:57,520 --> 01:09:59,520 One more but. I'll share it for more. 1237 01:09:59,600 --> 01:10:02,800 Again, for awareness, people on the presentation of the video 1238 01:10:02,840 --> 01:10:04,560 more than anything on the story itself. 1239 01:10:04,560 --> 01:10:06,960 I don't know if we spoke about the story, to be honest. 1240 01:10:07,200 --> 01:10:10,400 The ring up on the screen. So it was talking about Axios 1241 01:10:10,480 --> 01:10:14,440 supply chain attack, which was something recent. 1242 01:10:15,240 --> 01:10:17,520 I don't think we covered it, but we we. 1243 01:10:18,560 --> 01:10:21,280 We didn't cover it because it had been well covered by lots of 1244 01:10:21,560 --> 01:10:24,360 technical security people. I think we might have mentioned 1245 01:10:24,360 --> 01:10:26,720 it. We acknowledged its existence. 1246 01:10:26,760 --> 01:10:28,960 Let's just put it that way. So this is. 1247 01:10:30,360 --> 01:10:33,520 Video by Lewis Mendelos on TikTok. 1248 01:10:33,520 --> 01:10:36,600 He does a lot of them sort of educational videos, but it's 1249 01:10:36,600 --> 01:10:40,200 just nicely presented. So how could he play, well, play 1250 01:10:40,240 --> 01:10:42,600 all of it. Things just happened in the 1251 01:10:42,600 --> 01:10:45,280 world of programming. Axios, the JavaScript package 1252 01:10:45,280 --> 01:10:48,560 that's installed over 300 million times per week, was 1253 01:10:49,000 --> 01:10:52,760 compromised completely by a sophisticated attack. 1254 01:10:52,800 --> 01:10:56,160 Someone hijacked a Lead Maintainers MPM account, swapped 1255 01:10:56,160 --> 01:11:00,520 e-mail addresses, and then published 2 new versions of the 1256 01:11:00,520 --> 01:11:02,960 Axios library. And because they're on the lead 1257 01:11:02,960 --> 01:11:06,680 maintainers account, it was able to bypass any continuous 1258 01:11:06,680 --> 01:11:09,560 integration or delivery just going straight to production 1259 01:11:10,280 --> 01:11:13,720 like any good programmer would. But here's where it actually 1260 01:11:13,720 --> 01:11:16,720 gets insane. There was no malicious code that 1261 01:11:16,720 --> 01:11:19,200 was directly injected in the package itself. 1262 01:11:19,560 --> 01:11:23,440 It was just a dependency added. So when axios is installed 1263 01:11:23,720 --> 01:11:27,440 anywhere, AKA 300 million times per week, it installs that 1264 01:11:27,440 --> 01:11:29,360 dependency, but then that dependency. 1265 01:11:29,760 --> 01:11:32,280 So yeah, hopefully all but fuzz quite nicely. 1266 01:11:32,320 --> 01:11:36,760 Presented We're so veggie on a topic feels like the kind of 1267 01:11:36,760 --> 01:11:40,640 videos we used to make. And when you look at how that's 1268 01:11:40,640 --> 01:11:46,040 made, it doesn't require lots of lots of expensive equipment, 1269 01:11:46,320 --> 01:11:49,600 just a little bit of time. The lighting on him is doing all 1270 01:11:49,600 --> 01:11:51,880 the work. So just one well placed light 1271 01:11:52,480 --> 01:11:53,960 could have been filmed on an iPhone. 1272 01:11:54,680 --> 01:11:58,040 Some nice simple graphics really makes it pop. 1273 01:11:58,040 --> 01:12:01,080 Do you know what I mean? It's a really, really nicely 1274 01:12:01,080 --> 01:12:04,840 produced video that would be really easy for an awareness 1275 01:12:04,840 --> 01:12:07,440 person to recreate. And he's not the strongest. 1276 01:12:07,880 --> 01:12:13,560 He's clear talks quite fast. It's it's clear communication, 1277 01:12:13,560 --> 01:12:14,840 but. He's not like the. 1278 01:12:14,840 --> 01:12:18,080 World's best communicator. But it's decent, it's good and 1279 01:12:18,080 --> 01:12:21,440 he's engaging. So yeah, that's a great looking 1280 01:12:21,440 --> 01:12:24,320 video. That was, that was. 1281 01:12:24,320 --> 01:12:26,840 It awesome. I might. 1282 01:12:27,440 --> 01:12:29,360 Yeah, you might see me do a video like that. 1283 01:12:31,320 --> 01:12:32,640 Right. That's all we've got. 1284 01:12:32,640 --> 01:12:34,720 Time for. This week feels like it's gone 1285 01:12:34,720 --> 01:12:36,800 on for ages. We had some technical issues 1286 01:12:36,800 --> 01:12:39,520 that I will cleverly edit out. So you may not have been aware, 1287 01:12:40,040 --> 01:12:41,440 but you may be aware. I don't know. 1288 01:12:41,760 --> 01:12:44,680 So it might not actually be that long once I've edited out all 1289 01:12:44,680 --> 01:12:46,960 those issues. So I might even edit out this 1290 01:12:46,960 --> 01:12:49,800 bit, but who knows, right? Thank you very much. 1291 01:12:50,320 --> 01:12:55,400 And don't forget, subscribe on YouTube, LinkedIn, Instagram, 1292 01:12:55,480 --> 01:12:59,080 Tiktok newsletter, all of that. All the details are here, there 1293 01:12:59,080 --> 01:13:01,080 and everywhere. Yeah, see you next week. 1294 01:13:01,600 --> 01:13:02,320 Cool. Catch you later. 1295 01:13:02,320 --> 01:13:03,520 Bye. See ya. 1296 01:13:03,640 --> 01:13:03,960 Bye.