Welcome back to the awareness angle, our breach of the week.
Suspected Chinese hackers broke into the FB is own wiretap
system, while we also look at the White House's new app being
called a privacy nightmare by the people that took it apart.
And my Google Drive just became a much better defence against
ransomware. Attackers are using WhatsApp to
deliver malware to Windows PCs, and Apple has quietly added a
safety net for one of the cleverest scams doing the
rounds. And LinkedIn, We've got the
platform secretly scanning your browser for thousands of
extensions without telling you. A campaign calling out the AI
generated slop that's quietly making all of us easier to scam.
And a professor that says app labels are basically the
nutrition labels of the Internet.
And we all know how well that works because.
I still eat stuff that I probably shouldn't.
All of that and a whole bunch more on this week's.
The Awareness Act. With me, as always, is my
partner in cybercrime prevention, Mr Luke Pettigrew.
How you doing, Luke? And and doing alright.
Thank you. How are you?
Good. Yeah, I'm good.
I'm good. See, Easter Sunday.
We're releasing this a day later than normal so this morning's
been kids and chocolate and everything and I had the week
off this week so it was lovely. Bit of fresh air.
And stuff. So that was nice.
Yeah, right. Don't forget, all views and
opinions expressed by Luke and I are our own and do not represent
loads of our employers. But right now, let's get into it
with this week's breach of the week.
We had a bunch of stuff to choose from this week for breach
of the week. An abundance of breaches.
Hasbro have been hacked. The toy company Adobe, There's
claims that Adobe have been significantly breached.
They're denying it. So didn't choose that one
because, you know, it's all suspect at the moment.
A art gallery in Italy, the fizzy galleries say they've been
breached. Sorry, say they've been attacked
but say there's no breach. So there wasn't really a story
there. So the one I'm bringing this
week is one that I I read just a day or two ago, Chinese hackers
breached the system that the FBI uses to watch people.
So this is the watchers have been watched.
Essentially, which I thought was quite an interesting angle on
this, Suspected Chinese linked hackers have broken into the FBI
system that stalls surveillance data like exposing phone numbers
of people that the Bureau was actively monitoring.
The FBI has officially classed this as a major incident and
notified Congress, confirming that access was obtained through
a third party. The system at the centre of the
breach is part. Of the FBI's internal
infrastructure used to manage court authorised wiretaps, which
is essentially the database that tells investigators who they're
watching and who those targets are talking to.
This means whoever actually got in could potentially work out
who the US is performing surveillance on, giving
whoever's got this information a chance to tip off their assets,
cut ties, or stay one step ahead of investigators.
So this isn't, it's not just a breach.
This effects who they can surveil, essentially so.
Yeah, Yeah. A lot of money involved there
potentially selling that data to people.
You know, in this country there's been the odd news story
about like MPs being Chinese spies and stuff like that.
I wonder if, like the Mission Impossible in me wants to think
that this is somewhat related to that.
Like there's a spy network there that's about to be outed.
They want to know who's being watched, so they go and get the
surveillance system and then they can go right we.
Know that the FBI is watching this one, this one and this one.
Burn them. They're they're no longer a
contact, but we know these ones are safe.
It's kind of, it's got Hollywood.
Written all over it, hasn't it? Really.
Yes, I guess they're after the the Intel rather than the doing
anything else with it. Yeah.
It feels like it doesn't feel like this is a money orientated
one or even a damaged like wiper like we spoke about with
striker. This isn't a wiper.
This isn't someone trying to get data to sell.
This is literally like, what do they know?
How exposed are we almost? Very Hollywood.
What a great one to tell you people like this is.
It's a good Hollywood story. There'll be a film.
This would be like Born Born, Reborn.
Why haven't they done that yet? This would be like some spy
movie. Yeah, anyway, that that was it
really. There's not a lot of info out
there that I've found that basically he says the FBI access
came for a third party vendor. So as is pretty common these
days, find a weak link down the chain and get away in SO.
And this isn't related to Kash Patel emails being breached,
although the FBI are now. Offering a $10 million reward
for information on that. But yeah, I thought it was good
because they offered a, because they declared it a major
incident. And that's any incident that is
likely to result in demonstrable harm to the national security
interests, Foreign Relations or economy of the United States.
So they've deemed this a significant incident.
That's probably it for this week's breach of the week.
There was loads to choose from, but I thought that one was the
most Hollywood, so the others might bubble to the top.
If more information is about like the Adobe one, I'm watching
that. Because if that is, if that's
true, then there's a lot of information going to come out
about that. Just for anyone listening, Mr
Raccoon. It's just got to be one of the
nicest name. Mr Raccoon doesn't sound very
scary, but a threat actor called Mr Raccoon has alleged to have
performed a massive data breach ran through a third party.
Indian Business Processing Outsourcing or BPO firm. 13
million support tickets, 15,000 employee records and bug bounty
submissions pulled directly from Hacker.
One SO. Adobe haven't confirmed, Yeah.
So. We'll we'll talk about that
maybe next week. There's lots of info.
Out there but I just wanted to didn't want to speculate.
Yeah. Like.
We're interesting to see, yeah, yeah, a lot of Fed party stuff
going on. Just no surprise.
No. Yeah.
Be interested to see if this FBI one comes out any further, but
we might not hear about it given the.
Nature of it might get buried. It's really tough out there at
the moment with all the cyber news.
We try to, we try not to be political on this podcast.
But it's really, really difficult at.
The moment because most of the news is really politically
steered, not only because of what's going on in America, but
what's going on in the Middle East as well.
And it's there's always a political angle to many of these
stories. So, yeah.
But we, we, you know, we don't take sides here.
We have those opinions. We keep to ourselves.
But there we go. Move on to the news.
I'll take the first one then. Yeah, yeah.
So this is a continuation from the last episode for a security
tool that we talked about last week just helped reach the
European Commission. So, yeah, those that listened to
last week's episode, remember we spoke about the trivia supply
chain attack, which was a security scanner tool that was
backdoor to effect Light LLM. And obviously this is now
advanced to a bigger story where the European Commission, a cloud
infrastructure has been briefed using the same compromised
version of trivia says in this story that the initial access
was obtained on March 19th through normal software updates.
And yes, allowed the attackers to take stolen AWSAPI key that
gave them access to the European Commission's cloud accounts,
which they then used to still still various pieces of data,
emails, personal details. And then it was published on the
talk web by shiny hunters, according to this.
And this effects up to 71 clients across the EU
institutions. So quite a quite a big one here.
So it says there's over 300 gigabytes of data.
And yeah, so they've says here that they've said here that team
PCP wasted no time validating stolen credentials, launching
discovery operations, exfiltrating more data and
attempting lateral movement. On March 28th, Shiny Hunters
added it to their Tor based leak website. 340 give us the phone,
compressed data, personal information, names, emails,
usernames. Says here that 52,000 well
nearly two 52,000 files represents automated
notifications including bounce back messages containing user
submit content, which could include personal information.
And there's a lot of stuff in this but not too much clarity
that looks at this. But the European Commissions
have revoked the compromised accounts involved, deactivated
and protected credentials and also have notified relevant data
protection bodies. And it says as well that they've
confirmed it's not affected internal systems.
So shows I guess how various yeah, breaches leading to to
further breaches, right? Yeah, yeah.
They don't just stop, do they? Like one leads to another leads
to another leads to another. So it's yes, it's, and it's
originally when we spoke about team PCP, like now shiny hunters
are involved. I don't know what the connection
is there. Shiny hunters have leaked it,
and we all know who shiny hunters are.
Shiny hunters. Are the one that you know,
threat actor group that have been behind everything
significant for the past. Two years from MGM to M&S to
Co-op to lots of a conference I was at, I'm pretty sure Joe
Tidy, like displayed a Joe Tidy BBC cyber correspondent had a
PowerPoint slide that had just all the company names on and
that have had cyber incidents over the last like couple of
years. Lots of household names, and a
large, large percentage of those have been attributed to Shiny.
Hunters, so that's. Yeah, the fact they're involved
really doesn't surprise me. Yeah, I'm not sure what the
affiliation is, but it says yeah, that team PCP breached
them and then Shiny Hunters published it online.
I mean, we've seen before, I don't know whether, I mean, it
could just be simply, you know, one threat actor will gain
access to a system and then they'll sell that access to
another threat actor that will then deploy ransomware to that
system. And we've seen, that's the tale
as old as time, you know, different and again, different
threat actors. It's like business models,
different businesses specialised in different things.
Some groups who specialised in gaining access.
And some groups will specialised in ransom ransoming companies
and getting the money. So some people just want to get
the access, others want to like recap, Yeah.
So yeah, I think that's it for that one.
Right, The next news story, the White House released an app and
security researchers aren't happy about it.
So we'll try and keep the politics out of this.
This like if they want to release an app, they can release
an app they're entitled to. This has been widely reported by
multiple sources now. But I first saw it on Instagram
and I knew that an app had been revealed and it they were taught
that teased the way the app was revealed, kind of teased
something was coming. Everybody thought it was aliens.
They bought aliens.gov apparently as a domain, but then
the tease was that the White House is releasing its own app,
which is essentially a news app. So the White House are releasing
their own news. But let me just play you this
video, which kind of brought it to my attention.
Don't think this, I think I've skipped the political parts of
it, but let me just explain this.
When people started downloading the app, they quickly realised
that they made a mistake. Permissions on the app allow the
White House to see the user's precise location, modify and
delete the contents of shared storage if you Wi-Fi
connections, use fingerprint and other biometric hardware, and
more. This guy was like look, if you
have downloaded and installed the White House app and don't
know by now, delete it and factory reset your phone and
tablet immediately and change your credentials as well.
But in general, I mean, this opens the box for the most
Orwellian future that I could ever imagine.
A declassified report came out in 2022 that outlines how the US
government gets around the Foreign Intelligence
Surveillance Act. We won't get into all of that,
but I thought it was quite interesting.
People have rushed to download this app, and I remember like,
this isn't just the White House and the US government, OK?
Pokémon were at it many moons ago when Pokémon Go first came
out. Like when you make an app, I
think the default was just asked for permission to everything and
that's what they did. And there was news at the time
Pokémon Go must have been out. Oh God, it must be nearly 10
years now and everyone. Was like, Oh my God, it can see.
Everything. And then they updated the
permissions and rolled back a load of permissions.
It is true, apparently, if we look at some other articles, I
think this White House app can actually, it actually pings your
exact location via GPS every 4 1/2 minutes back to the servers
so they can sell exactly where you are.
And this might not have been done intentionally.
This might have just been, you know, let's just leave those
boxes ticked and roll it out. It might not have been playing
devil's advocate, the White House might not have done this,
but the White House app has one signals full GPS pipeline
compiled in, polling your location every 4 1/2 minutes,
syncing your exact coordinates to a third party server.
That's what I've just read from 1 Sweet by the Real Real Load
1026. So yeah, if you have downloaded
the White House app, you might want to look at the permissions.
And something to consider before downloading any app is what
level of access you're giving. That app I think is.
Is what we want to just because it's official doesn't
necessarily mean it's safe because it's a third party
again, that third party service is getting your location so that
makes that third party service a target like we've just explained
with the FBI so. It's yeah, sounds like even just
with the GPS location is probably going to drain you a
battery that's having that app installed.
Oh yeah, yeah, Lots to get into on this one.
I guess with the specific data there's a lot of stuff it can.
I mean, seen it, seen it, respected news, you know,
technology news source, you know claim.
I downloaded and deleted the White House app.
You don't have to, it's the Hotmail.
The app is a nightmare of a historically dangerous cyber
attack waiting. So I basically say this is this
has the potential to be absolutely.
Help. Yeah, there's some some mentions
in there as well about inside the app, there's some YouTube
embeds and they're linked to a personal GitHub account.
So, so yes, so we said if that GitHub account gets compromised,
yeah, things could get changed on the.
Obviously there's also stuff about removal of privacy,
consent banners, minimal security.
Protections A source of removal of privacy consent banners.
So they just don't display the consent banners for you to
consent to privacy notices? That's interesting.
Yeah, I saw something as well about mentioned about some of
the baked into the app that exposed something, but.
I can see Atomic Dock computer did a dive on this app and they
said the GPS tracking infrastructure is dormant but
remotely activatable. So it's there and it's not
working. But it can be turned on
remotely, yeah. Yeah, that doesn't sound great.
It doesn't. And do you know what in in any
other in any other cycle, this would be scandalous, but it's
not right now. Like if this came out in the UK,
there would be uproar. But it's kind of we've we've
kind of become sanitised to it a little bit now.
Yeah. I mean, even the app's got
minimal security, hard hardening, full behavioural
intelligence pipeline. You've said about the YouTube
embeds. Yeah.
Yeah, yeah. We'll put links to all of that
and a whole lot more so you can make your own judgement calls
and form your own opinions. We'll put the links to all of
that in the newsletter. If you want to get the
newsletter, it's available at riskycreative.com or you can
search for the awareness angle on LinkedIn and get it where the
majority of people get it on LinkedIn over 1100.
Subscribers now to the weekly newsletter that comes out every
Monday. Tuesday this week to align with
every episode. Everything we discuss on every
episode is in the newsletter. So let's move on from that
before we dig ourselves a hole and end up being being having
the FBI watching us. So yeah, right, move on to the
next one. So this one is Apple Story.
They've added a safety net for one of the cleverest scams
around just so the new macOS version 26.4 essentially blocks
pasting and executing potentially harmful commands
into terminal windows and alerts about the possible risks.
So yeah, obviously this is aimed at blocking a click fix type
attacks, which were obviously pretty easy for people to to be
socially engineered into pasting previously, and it would just
run commands without any sort of problem or any notification.
So now they've updated it and I'll try and put the screenshot
up on the screen. We've talked about click fix
near enough every other week on this, on this podcast.
And I think we, we've always said that there needs to be an
OS level kind of interception on this.
It needs to be I I remember saying weeks ago, Microsoft
should tell you what it does before it allows you to run it.
You know, or. That kind of thing.
So. You see on a Mac you now get
this window in a pop up that says possible malware paste
blocked your Mac has not been harmed.
Scammers often encourage pasting and texting terminal to try and
harm you, your Mac or compromise your privacy.
These instructions are commonly offered by websites, chat
agents, apps, files or phone call.
And then you have a don't paste button as the primary option and
then a paste anyway below, which I thought maybe they shouldn't
just not have that bit, but maybe some false positives
happening with this. But I mean, it's a good step to
see. Yeah, on on that.
I think it's. Brilliant.
It's a long needed, long needed step and I hope Windows follow,
I really do. Yeah, it does say here Apple has
not published official support. Document about the new warning
system, Yeah. One user concluded that these
warnings are only delivered once per session.
Yeah. So it talks about copy commands
from Safari, but maybe it covers other web browsers as we've
discussed last episode of think that they're kind of all based
on that fundamentally. So you'd be interested to know
more about this? There's a comment here on
Reddit. So this was discussed on Mac OS
Beta 16 days ago, and there's a comment here that says it
doesn't blindly flag everything copied from the Internet and
pasted into terminal Terminal. I had Claude generate a bunch of
innocuous commands so that I had something to.
Copy and paste. And none of them triggered A
malware warning when pasted, so there is some sort of analysis
or blacklisting going on. Even redirecting curl to bash
and decoding basics before and redirecting to bash doesn't
automatically. Trigger the warning, so yeah.
Yeah, it'd be interesting to sort of see a bit more into it
once it's maybe they'll release some official guidance on it.
There's another comment on this Reddit.
I swear people are so gullible. It's kind of crazy to me how
people will do things like this without a second thought.
It's good people don't like, like that's a real, I'm
technical person and I don't get why people would fall for this.
It's like, I bet your mum would or your dad, you know what I
mean? Like, like just because you know
the risks, lots of people never venture there and don't know
what it does. It's a reply to that says it's
not just targeting dumb people. There have been various high
quality efforts to get unsuspecting or inattentive
people to run their commands in the past.
Yeah. And so.
Yeah, this is an interesting one and maybe one for people to
share with their business. If they have Mac devices and
they're up to date, they can sort of talk about the feature
and click fix a bit more. Maybe just remind you people to.
You probably never want to pay something into that you found
off the Internet unless you really know what it is.
You're right though, this is a good opportunity, any
opportunity to talk about the risk of click fix.
This is a positive angle to talk about and this change was fair
as well. Yeah, especially for Windows
users as well, Like making them aware that this doesn't happen
on Windows. Maybe just yet.
Maybe they will follow suit. I also wonder from a tech, from
a technical perspective, I wonder if they're if every time
that warning is logged, that's logs every every time that
warning is displayed. I wonder if the way that's
interacted with is logged somewhere.
Like there's a really nice behavioural metric there.
If you can, someone presses paste anyway, Can you be
informed of that? If someone presses don't paste,
can you be informed of that? Because, you know, Thank you for
not pasting on this occasion. You press paste Anyway, I'm now
watching you to make sure your device isn't infected.
That kind of, yeah. Like it'd be nice if that the
the intelligence data behind that choice can be extracted and
chucked into a human risk management system.
That would be cool. Yeah, yeah, right.
Well done, Apple for beating Microsoft to helping us defend
against click fix. So that's cool, right?
I'll move on the next story. This episode is from
darkreading.com. And I thought this was just,
again, I thought it was really, really reliable and good to tell
your people. So app privacy labels are like
food nutrition labels, and we all know how that's going.
So, you know, the little like nutrition information on the
side of a packet of crisps that has the calories, the salt
content, the fat content. Well, Laurie Craner, director of
Carlin Carnegie Mellon's University Cylab Security and
Privacy Institute, Wow that's a Mouthful, makes exactly that
comparison when it comes to app privacy labels, the data
disclosures on the App Store and the Google Play Store.
So when you go to an app on Google Play or the App Store on
Apple, it tells you what information the app collects and
why. And in theory, just like food
labels, these help you make an informed choice.
But Laurie Craner from Carnegie Mellon and says that current
versions are not at all useful. And what's worse is they create
the impression that something meaningful is being done for
your privacy when it actually isn't.
Studies have found widespread inaccuracies in the labels.
Apple and Google don't even use the same definitions for what
counts as data collection, meaning the same app can look
very different depending on which store you're buying it
from. And there was a live example of
that this week with the White House app.
This is why it all comes round. The White House app declared it
collected nothing whilst quietly sending device data to multiple
third parties. On every single launch.
So that's that's why this kind of flew into my attention
because the the inaccuracies with the White House app and
what it declared versus, you know, yeah.
So I thought it was really, really interesting.
This it just just it's a good example of like you can't
necessarily you have to make your own judgement call.
And it's the same with, you know, foods, food labels.
We kind of in the UK at least you kind of, it feels like
they're standardised and I would imagine they, I don't know if.
They are. I probably should have
researched. But I would imagine that they
are standardised. But here it's, I mean, I think
that's shocking. The White House app that we've
just spoken about, if that declared that it didn't share
any personal data, that's definitely a flaw in Google and
Apple systems. They should standardise.
There's some things that these companies should work together
on. Other other app stores are
available. But yeah, Apple and Google use
different methodologies in their labels.
Google defines data collection as any data transmitted from a
user's device. Apple only considers data
collected if it's transmitted from a user device and stored
so. There's there's a difference,
yeah. Yeah, I thought that was
interesting. There's not really loads to say
on that, but that's an opportunity and a recent example
to highlight how users need to make these little micro risk
assessments to make sure that they understand what they're
actually sharing. And it says it like some of the
some of the notes I've got here. Compliance isn't the same as
protection. Companies post these labels for
information purposes, and they don't necessarily have to prove
it just because a label exists. Doesn't mean your data is safe.
There was a time when there was a time when everybody said
smoking was good for me. Look at it now.
Do you know what I mean? Yeah, So that's that app privacy
labels linked to that story will be in the newsletter as well.
So I had let me just check, hang on.
I had something else that was really I meant to bring and I
forgot last week we there was a story we covered last week that
I think was kind of similar to this.
I don't know what it was. Michael from the cyber Escape
room code sent me some stuff after we spoke about the Ajax
Football Club breach in last week's episode.
And apparently the Premier League teams have come together
and actually worked to build secure solutions.
And he sent me a link to a case study from a company called
Cyber 4. Cyber 4 enabled a top tier
Premier League football club to enhance its cybersecurity and
data privacy capabilities. So they've worked on stakeholder
engagement, data journey mapping, asset and risk
management. So apparently there is a wider
thing here in the UK that helps bring, helps make sure football
clubs do protect their data. Well, I don't know if the same
exists in Holland, but yeah, he sent me that after we spoke
about that in last week's episode.
So, yeah, slight interesting, slight divert there.
But this made me think of that. I don't know why this all of a
sudden made me think of that. But thanks, Michael, for
sending, sending that over. Right.
Move on to the next story, which is yours.
Cool, yeah, yes, this one Google Drive, I can now detect
ransomware and help get your files back.
I think we spoke about this briefly before, you know, got
done a website quite a while ago.
But obviously ransomware is still a thing that happens a
lot. And obviously you end up with
encrypted files that you can no longer access.
And then typically you demanded money to unlock them, which
could really obviously effects companies in a massive way.
But thankfully those who are using Google Drive, so Google
Workspace businesses now have a feature specifically designed to
take away the attacker's biggest bargaining chip.
So now Google Drive for desktop, so it seems that you need to
have that installed, but that detects for ransomware activity
and pauses files syncing. So crypto files grant can't
overwrite your clean cloud copies and also alerts you to
what's happening. So this is a story by Android
authority. So this is here, that this was
previously a bit of availability, but it's now being
rolled out widely and that Google have said that they've
improved detection significantly.
I've read that, yeah. So they've improved the AI
system behind it to spot malicious encryption.
And it claims that the latest model can detect it 14 * 14
times more infections than before.
Not huge on detail what exactly what that means, but there is a
video here that can maybe play. So yeah, it's only a minute
long. Could you bring it up?
This just sort of shows how it looks to the video by Google.
Ransomware is one of the most damaging threats facing
organisations and individuals alike.
It is malicious software that blocks access to your data by
encrypting files and making them unusable.
With Google Drive, we've built an entirely new layer of defence
that helps to stop ransomware from being effective once it
bypasses antivirus controls. Let's see it in action.
Imagine you're working on your Windows device.
A notification appears on your desktop letting you know Drive
has to. So you can see this new pop up.
This is syncing pause ransomware detected on the e-mail address
that your Google Drive synced with.
If this talks about what time it was paused and if you don't
recognise it, action needs to be taken to prevent further
corruption and you have an option for take action or I
recognise it, which again is similar to that Mac Terminal 1.
You kind of feel like maybe don't in this scenario, don't
give the end user the ability to recognise it, but we'll carry on
the video. Yeah.
Detected A ransomware attack thanks to the new AI model that
was trained on millions of real world ransomware samples with
threat intelligence from Virus. Total Drive automatically pauses
syncing of your files to the cloud to prevent data corruption
and help stop the attack before it gets too far.
To start the recovery, Drive guides you to the Restore UI,
where you can easily select previous uninfected versions of
your files and undo the damage. Unlike traditional solutions
that require complex reimaging or costly third party tools, the
intuitive web interface allows you to easily restore multiple
files with a few clicks. This can help you minimise
disruption and data loss even when using traditional software
such as Microsoft Windows and Office.
When the restoration completes, you and your collaborators Get
full access to your files again. To recap, Google Drive stores
copies. It's interesting.
It seems like maybe something that Odie works.
I said this should have maybe for a business, but.
It'd be great for. Certainly use his hands, pretty
much. Yeah, Yeah.
I think there definitely should be a different admin level on
that. I think, I mean, was it last
week or the week before I think we were talking about, I think I
mentioned how more people in organisations could run
Chromebooks. Getting people to store stuff in
the cloud is difficult when there's an abundance of local
storage because it's still seen as inconvenient.
Google Drive kind of deals with that.
Google Drive for desktop does anyway.
And a Chromebook also works brilliantly like that.
My mum just this week, her Chromebook's years old.
She was like, should I get a new laptop?
And I was like, no, you should get a new Chromebook.
And she's like, oh, Chromebook's still haven't.
Like in education, they're everywhere, but they still kind
of haven't for me. I don't feel like they've really
broken through in the consumer market as a viable alternative
to a new HP or Lenovo or Dell laptop, whereas they should
because everything saves to the cloud natively.
And yeah, you might have to pay for some storage at some point,
but it just makes sense when you've got this kind of safety
net, this kind of backup. I I, yeah, I think this is
brilliant. Personal use as well, just
having everything saved. Obviously make sure you have
cloud accounts secure, but it's all there.
I won't, I won't support my mum if she gets a new Windows laptop
because the Windows laptop and this again, we spoke a couple of
few weeks ago about the new MacBook Neo.
It's almost tempting to try and talk her into getting one of
them because again, the quality of the hardware, the operating
system and stuff, you just know it's going to like a MacBook Neo
is probably still going to be working fine in six years,
whereas A6 year old £500 laptop is probably going to be creaking
the battery is going to. Die.
The keys will probably stop. You know, the build quality
isn't quite there. Yeah.
And also that's without the security layers that you need to
add on top. So I think this is brilliant.
Like this is great for Google. This is really, really good.
And I think this should encourage more people to enter
that Google ecosystem. We're not sponsored.
If you want a sponsor as Google, please do.
But I, I think this is great. I don't know if Microsoft has
something similar. I really don't know if Microsoft
has has a similar functionality for OneDrive.
I don't. Feel like they do if they have
they definitely haven't something about it but.
Yeah. Yeah, it's an interesting one.
There's a pop up post we can include an image there that
talks about the Google Admin side of it, but it doesn't seem
perhaps as customizable as it maybe should be.
And yeah, I'm not sure. If I was running a business I'd
want my employees to be restoring files whilst the
ransomware attack is going on and stuff.
That seems a bit messy. You kind of want to know about
it, don't you? You don't want a user trying to
deal with this isolated ransomware incident because it
could spread somewhere else. You kind of want to know about
it. If it's going to, yeah, it does
say that the admins receive an e-mail in in the alert centre.
But yeah, I don't know how it fully looks, but it's a good
yeah, sort of yeah. Feature to to definitely have.
Yeah, this yeah. Interesting the way that they've
rolled out for the use users to be able to start restoring files
and stuff. Yeah, absolutely.
And that's the next one. OK yeah, next one hyped up right
at the beginning of the show. LinkedIn has been secretly
scanning your browser extensions and you weren't told.
Now, I heard about this story and I saw this story posted on
Reddit and then when I went back, the post had been removed
and tagged as misleading. I and and at that point I was
like, do I bring this or not? Like let's form the opinion
ourselves. OK, so this is reported in
Bleeping Computer. A new report dubbed Browsergate
warns that Microsoft's LinkedIn. So let's remember Microsoft owns
LinkedIn. Microsoft's LinkedIn is using.
Hidden. JavaScript scripts on its
website to scan visitors browsers for installed
extensions and collect device data.
So, according to a report by Fail Linked, which claims to be
an association of commercial LinkedIn users, Microsoft's
platform injects JavaScript into user sessions that cheques for
thousands of browser extensions and links the results to
identifiable user profiles. So it claims that this behaviour
is used to collect sensitive personal and corporate
information as LinkedIn accounts tied to real identities,
employers and job roles. And it the report says LinkedIn
scans for over 200 products that directly complete compete with
its own sales tools, including Apollo, Lucia and Zoom Info.
Because LinkedIn knows each user's employer, it can then
map. Which companies use which?
Competitor products extracting the customer lists of thousands
of software companies from their users browsers without anyone's
knowledge. Then it uses what it finds.
LinkedIn has already sent enforcement threats to users of
third party tools using data obtained through this covert
scanning to identify its targets.
Yeah. And and the script checked for
and this was the bit that like I think this was reported
previously and it was like 2000 extensions that it was scanning
for. The script now cheques for 6236
browser extensions. By attempting to access files,
resource file resources associated with an extension ID,
which is a common technique. It's got a fingerprinting.
It's fingerprinting. This was previously reported
last year, but it was only detecting 2000 extensions.
A different GitHub repository from two months ago shows 3000
extensions, and now we're talking about 6236 so.
Wow, LinkedIn have LinkedIn doesn't dispute that it detects
browser extensions, saying it's used to protect the platform and
its users. However, the company claims the
report is from someone whose. Account was banned for scraping
content. So I think that's why they'd
yeah, it's, I think essentially what the takeaway on this is.
We all have to accept that when we visit a website, we're doing
it on their terms. There was an angle made on this.
There was an angle made about job searches.
What makes it particularly uncomfortable is what those
extensions can reveal. The scan list includes
extensions, but identify practising Muslims, indicate
political orientation, support neurodivergent users and perhaps
most troublingly, over 500 job search tools, meaning LinkedIn
could know you're secretly looking for a new job while your
current employer is on the same. Platform so.
Maybe if you work for Microsoft and you're looking for a new
job, you might not. Want to install any job search
extensions so it just brings it back to like Chrome extensions
living such a cherished place that this there's such privilege
associated that we don't even think about.
So we need to be really, really considerate about the Chrome
extensions and not just Chrome. This might be Chromium based.
So we might be talking about Brave, We might be talking
about, you know, Opera as well, Edge.
Let's not lay it all on Chrome door.
They're all built on the same backbone, those browsers.
Yeah, I think it's safer these days.
Does not bother with browser extensions.
Yeah, yeah. I mean, would you really miss
them if they were gone? Probably not that much.
I downloaded a new browser extension this week, Save images
PNG, because my save images type, as we spoke about a couple
of episodes ago, it was compromised and I needed some
images from a Google image search and they were web P So
like, yeah, I think that's it on that, like LinkedIn, I don't
know. Well, I've got I've got another
story that we'll touch on LinkedIn a bit later, but just
bear in mind that LinkedIn is seeing every browser and not
just LinkedIn. This will be Many websites are
seeing every single browser extension you've got installed
and tying it to your. The thing with LinkedIn is
you're signed in, so I'm guessing it's assigned it like
they'll assign that to my user ID.
So in the back end they can see my LinkedIn profile, all of the
information I've shared, and all of the browser extensions I've
got installed. It's the collating of that data.
The aggregation of that data, that's.
Yeah. Yeah, right.
Move on to the next one. Cool.
I think this is the last story we've got.
First one. Attackers are now using WhatsApp
to deliver malware to Windows PCs.
And this is a sorry from the Hacker News, Microsoft's scoring
attention to a new campaign that's leveraged WhatsApp
messages to distribute malicious Visual Basic script files or VBS
files. This is talking about activity
beginning in late February 2026. This is quite kind of a
complicated story as such, obviously.
Yeah, people typically you sort of think about phishing emails,
You don't really think about dodgy WhatsApp messages.
I mean, sometimes you might get like a dodgy tracking URL for
delivery or just a random group chat, but delivering sort of
attachments in that way is not really what you think.
And also if your Whatsapp's on mobile, not quite sure what this
does, but I guess if you're running WhatsApp on the on the
web, maybe you're more affected, right?
But it says here that they're sending latest files through
WhatsApp messages that once opened could give them full
access to the victim's Windows computer.
So it says here that the clever part is how hard it is to detect
them. So once it's run, it copies
legitimate built in Windows tools into a hidden folder.
There's some fake names to look harmless, and then uses those
same trusted tools to download the actual malware from well
known cloud services like AWS, making the traffic look normal.
It says that the final payload can include tools like any desk,
which transit tech is for remote control of the machine.
But yeah, a lot of social engineering aspects going on
with this one. Yeah.
There's bits of information everybody want for the
newsletter. To be honest, I don't care.
So she's not talking about WhatsApp for Web at all in this
story, But I don't see how that isn't the case.
But yeah, there's a whole bunch of detail in this.
I think it's one that can probably just maybe want to
share with around this WhatsApp safety in general and presumably
WhatsApp for web is the cause here.
Yeah, or the WhatsApp desktop client.
I like Whatsapp's available on Mac, it's available on browser,
it's available on Windows and obviously Android and.
This is obviously targeting Windows devices because
Microsoft has talked about it and it's running VBS files and.
Yeah, I didn't think about downloading it.
I I wonder, Well, you're not a Windows user heavily, are you?
Not well I am, but I use WhatsApp for web.
Yeah. I don't really like sorting apps
for stuff like that. And, and this is the reason why,
Luke. Yeah, this is the reason why.
Yeah, it's. Yeah.
I remember, like when obviously we used to work together.
You always used the Slack client in the browser as well, didn't
you? You never installed the Slack.
Client, it was easier, yeah, yeah.
I wonder how it note like. I wonder what percentage of
WhatsApp users use it on Windows.
Yeah. I wonder how they're targeting
Windows WhatsApp users like that.
That alone in itself is quite interesting.
Is there a list somewhere? Have they got that data or are
they literally just taking just trying their luck on it?
I don't know. Yeah, doesn't seem to say much
more. I've had it, but yeah, that
seems like kind of interested to know how that works.
Yeah, right. Let's move on now.
That's that's it for this week's news.
So let's move on to the fish of the week.
Right, and this week's Fish of the Week obviously comes from
the Threat Intelligence team at Hawks Hunt.
So thank you Hawks Hunt for sharing this with us as always.
This week's is AQR code in salary increase notification.
So we can see here receive a company.
So it would have your company logo on updated salary and
compensation for all risky creative employees.
It would insert your company name there and it would say dear
Luke. It would probably say Dear Luke
Pettigrew or whatever name, however they'd scrape the name.
We're writing to inform you that a new company policy has been
added Salary increase effective Friday, March the 27th, 2026 I
I. I imagine that date may change.
To access and review the update policy documentation, please
scan the. QR code below your.
Attention to this policy is greatly appreciated.
Should. You have any questions or
concerns, please don't hesitate to reach out to policy
department. The policy department.
Yeah, recipient company again, it says risky crave finance
department. So then it says the finance
department and then the nice. Little yellow box at the bottom.
This content is confidential and intended exclusively for its
designated recipient, Luke Pettigrew, or whatever your name
may be. We kindly ask for your
cooperation in safeguarding and security by not sharing this
link or access code with anyone else.
So he's encouraging you to shut up.
It's. Encouraging you to be quiet.
Like, don't tell your friends. So yeah, obviously QR code, it's
asking to scan AQR code. Why does it ask you to scan AQR
code? Because you do that on your
phone and then it gets you off away from the security controls
that you may have on your device and then encourage you to sign
in in an unusual, strange environment.
You know that isn't. Your your work computer.
The subject line is also an interesting one.
If we look at the points Hox hunt the flagged on this, the
phishing message is delivered as an attachment within an
otherwise empty e-mail. So that's that's interesting.
So this actually came as an empty e-mail with a dot EML
attachment and the e-mail file. So everything I've just read was
contained in an e-mail file. So that's unusual straight away
like that's normal. There's a red flag.
I think, I think there was a time when we worked together
that we discussed blocking dot e-mail attachments as an at an
organisation level and I think we may have even done that for a
while. The only time you even really
need to forward a DOT e-mail attachment would be to our SEC
OPS team to to analyse an e-mail I think, because then you get
all the headers attached and stuff.
Obviously. Hoxon also flagged fake salary
increase used as a lure to scan malicious QR codes.
It's playing into the human emotions.
Isn't it all zero increase? Yes.
Please, that's. We all like to.
You know, receive a little more money and stuff like that.
So, yeah, I think that's that was a good one.
Yeah. So.
Oh, there's much more. Steps to this I should have.
Looked at, there's more to it. So leading to device.
Code phishing. So when you log in, so when you
scan the QR code, takes you to a malicious URL, takes you to a
fake DocuSign page, log in to DocuSign with a signing code.
So let's see what that's talking about.
So this is the fake DocuSign website instruct you to use a
signing code. The button directs to a
legitimate. Microsoft website setting up the
next step of the attack. And here is the device.
Code phishing. So this is all
genuinemicrosoftonline.com. Enter a code to allow access.
Pick an account. Are you?
Trying to sign into Microsoft Microsoft Office device.
Authentication. So then that opens a.
Legitimate Microsoft Device authentication window.
And the focus on code entry shifts attention away from the
app permissions and identity. So this attack authorises access
without stealing passwords. So what this is actually doing
is giving someone access to your device.
This is device code phishing, which I think we've spoken about
before, So yeah, yeah. We'll put details of that.
That's just goes to show, I thought that I should have
scrolled down further from the off, so apologies for that.
It's lack of preparation there. But what looks like just a
simple QR code credential capture is actually something
way more complicated with multiple steps.
And why so why so complex? Because it works, right?
Like the DocuSign page gives you a sign in code, you click
continue to Microsoft and then you're actually giving.
Someone access to your device so.
That's this week's Fish of the Week.
Thanks for the team at Hawks on for sharing that with us.
Yeah, thank you. Time is ticking.
This week seems. This this episode seems to be
going on and on and on. There was a lot to talk about.
Yeah, so let me. Just pull up my next one.
I had a couple of topics. Just a couple of topics to talk
about this week. Last week I had loads.
The first thing I wanted to talk to you about this week was I was
influenced. I was looking for some wall
panels for my son's bedroom and I had a Google and then was
browsing social media and a cheap, cheap offer came up on
Instagram. I was like OK, so I did my due.
Diligence I went through. I checked the.
Website checked the company, I felt confident that they were
legit and I'm feeling confident they were legit.
They're due to be delivered Easter Sunday.
They're due. To be I missed.
Delivery Tuesday because I wasn't here.
They're due to be delivered today, Easter Sunday, and
apparently they're like they'll be here in the next hour.
But I received an SMS message this week after I'd missed
delivery the same day, 2 hours after I'd missed delivery at no
an hour. Delivery was attempted at 11 and
then I got this message delivery processing on hold.
We attempted delivery at nine O 3.
No. They didn't because I've got a a
camera doorbell. No one.
Was at my doorbell. Around that time someone was in
the house my my father-in-law. We're unable to complete it as a
signature was required. Parcel remains on hold to
proceed. Please review and update your
delivery details. Wait for this.
This is the interesting part HCTPSDPD dot parcel STAG OK dot
bond forward slash com reply Y. And then reopen the.
Message to continue. If needed, paste the address
into your browser. You may choose a new delivery
slot or redirect the parcel. Now the timing on this really
uncanny. I don't get a message like this
for ages. I'm expecting something
delivered Tuesday. They tried to deliver it at
11:00 and then at 12:19 I get this text message.
This text message is clearly fake and I really, really mean
this is fake the the website address.
So let's let's analyse this the website address itself, DPD dot
parcel STAG OK dot bond forward slash com.
That is not a legitimate website.
We can't, we can't even claim for a second like let's let's
see if it's still. I shouldn't really do this, but
let me, let me open, let me open a brand new browser.
Can I open Firefox? And we're going to go to DPD
dot. PARCELSTAG OK dot bond.
Forward. Slash com Hey Firefox say
deceptive site ahead. So they know.
They know. And if I go to that site, is it
going to even let me? Surf Shark has now blocked it.
Look I went to it on mobile and it was a fake DPD website asking
me to input all details. It probably asked me to ask me
for credit card details or something like that, but it
asked me for full address details so.
Straight away the timing. 'S really weird that I order
something from an unknown brand new company I've never used
before online and then I get this text message and then so I
just ignore this. The interesting thing is the
link doesn't work because Apple added that as a security
protection a short while ago. Until you replied, you need to
reply to it to. Activate that URL, which is why
they tell you reply why and then reopen the message because if I
do. That that is then clickable.
I could then click on that right, but that wasn't the end
of it 2. Days later, I get another
message from a different number. This one's a foreign number.
The first one was at UK Mobile. This one's a foreign number.
Your parcel remains undelivered following an attempt at 9:35
today. Address details are incomplete,
preventing further processing. My wife, I read this to her, she
goes if the address details are incomplete, how did they attempt
delivery your. Parcel remains.
Undelivered following an attempt.
At 9:35, address details are incomplete.
That's a contradiction. Please confirm your details to
proceed. And it's a similar shaped URL,
but it's different. The the last three digits of of
the prefix are different. But again, simply reply with
why? Close the SMS and reopen it to
activate the link. You may arrange.
Delivery and collection retention ends. 3rd of April, so
there's a deadline there. I just it's really.
Funny that I don't. Receive a message like this for
months and months and months. Order something from a new
business that I've never ordered from before.
Delivery fails. 2 scammy messages.
I want I. You've got to wonder, is there a
compromise system there? Is there a is this a side
hustle? You can earn more money if you
sell us your delivery detail. And you know I don't I.
Don't know, I'm not going to mention who they are, but.
It all feels a little bit dodgy. But we'll see if it's the.
If I actually get my wall panels shortly this morning, we'll see
I suppose. Did I cover if you said sorry?
Was it DPD? That you were getting it from?
No, no, I've got. I've got no.
Idea. Who this delivery company is?
Because the tracking identity is again some really dodgy URL.
Tracks are dot IO, the word tracks are dot IO.
So it looks like. Some third party.
Tracks are dot IO, it's just even that looks like.
The only. Reason I got that tracking
information was because I emailed them asking that's just
like some third party tracking service.
I emailed them asking where it was on Tuesday and they emailed
me back yesterday saying it'll be delivered tomorrow, Right.
Easter Sunday, the holiest Christmas Day, Easter Sunday.
I wouldn't expect a delivery today, but apparently yeah, fair
enough. One more thing I.
Wanted to mention was I. Saw something in a newsletter.
I subscribed to a newsletter by someone called Laura Olin.
She's kind of talks about pop culture and stuff like this, and
she talked about a something that I think I'd missed
completely. It's called Stop Sloppy Pasta.
Sloppy pasta verbatim LLM output copy pasted at someone unread,
unrefined and unrequested from slop.
And I thought this. Was brilliant because it kind
of. You just got an unread message
notification. Maybe it's on Slack or Teams, a
text message or an e-mail. Maybe you were tagged in Notion
or an Office talk. You open it to find several
paragraphs of text or perhaps a listicle with all the hallmarks
of AI generated writing headings heavy formatting with it's not
X, it's Y&M dashes sprinkle gratuitously throughout the
person who sent it probably spent about 10 seconds on it for
me I just we talked about LinkedIn earlier and I see a lot
of this on LinkedIn and some time ago was probably.
Guilty of this? In some ways myself, you can see
like earlier episodes have been released and there's emojis
sprinkled in LinkedIn articles. Well, there's not anymore
because it just didn't feel we, we talk about humans and the
human side of things. And yeah, you can, you can tell
when something's written by AI. And this is a, this is a kind of
campaign to raise awareness about don't actually like use
AI, but do something. Different, you know.
Do something a little different. It's got three different
characters here. The eager be the like, I want to
be really quick to get involved in a on a in a conversation.
So I just ask a chat pot and the Oracle someone asks a specific
question that someone puts in a chat pot and paste the response.
It's not a security thing, but I think it's an engagement thing
for us. We we talk about engagement.
If we're creating security awareness content that's written
by AI, people can tell. If you're posting stuff on
LinkedIn and it's written by AI, people can tell.
You know, look at your posts from two or three years ago.
Did you litter them with emojis? I don't think you did, but you
do now because the AI puts the emojis in for you.
So it's, you know it. Yeah.
I like half of the emoji usage on LinkedIn.
It's not. It's not convenient to use
emojis. M dashes was the biggest
giveaway. I never used M dashes ever ever.
But good people that used to use M dashes now can't use them
because people automatically assume it's written by AI.
So. If you want.
People to engage with your content.
If you're writing awareness content, you're writing scripts,
you're writing posters, you're writing blog posts.
If you want people to engage, make sure if you're using AI
they humanise it because otherwise people won't engage.
People will think you've put little effort in, which means
they won't. Put any effort in essentially.
Yeah, I think yeah, it's definitely.
Good to use it in the right way, yeah, like come up with your own
sort of things and give it a lot of ingredients, I guess to
generate something rather than just asking it to do everything.
But it's funny when I see all the time on like Facebook, like
you've put that like what they put there and that one about
someone asked a question. And then people will just go and
ask AI for the answer and paste in as if it's like their own or
if it's the truth even. And in some cases it's just
made-up things or it's like we've seen before with Google's
AI summary with focus information.
I see it as well, just, well, going on too much more.
I see randomly on Facebook people ask them to edit my photo
or change this person, blah, blah, blah, blah.
And all the responses are there's people using AI tools to
generate this image for them rather than someone actually
using Photoshop or whatever to do it.
And it's just like, yeah, AI is everywhere.
Yeah. And it's not.
It's not necessarily clever. Because it's so accessible now.
Anyone. Can you remove dear ChatGPT?
I tried it. I tried it yesterday.
My son's got quite long hair and I just uploaded the pictures,
chat TPT and I was like, can you give him a short haircut?
Yeah. And a different person came
back. My 8 year old turned into a 32
year old man with a crop top with a you know, it's like,
that's not the same person, but thank you for your effort.
Like it's yeah, yeah. But anyone like it's not, it's
not clever. Anyone can use AI and I think
yeah, Anyway, yeah, I did have one last thing I saw and I I
know your story is probably going to.
I'm not going to steal your fire on this Artemis.
Obviously the Artemis 2 has gone to the moon or round the moon.
I heard this little clip astronauts calling Houston
because the computer on the spaceship is running two
instances of Microsoft Outlook and they can't figure out why
NASA is about to remote into. We suspect the issue with your
PCD. Maybe.
Optimus software we were able to connect to PCD one on you can
see on the network. So with your go, we can remote
in and take a look directly. Yeah, go for it.
And then I also see that I have two.
Microsoft Outlooks and either one of those are working.
If you want to remote in and check the Optimus on those two
Outlooks, that would be awesome, All right.
We will join in on your PCB. And we'll let you know when
we're done. So we know Artemis 2 is probably
running Windows, and we know that they have two versions of
Outlook installed, and neither of them are working.
Like, I can't believe that we've sent people to the moon and
we're relying on Outlook for e-mail for them.
It just seems mad. Yeah.
Like it makes you wonder. Why?
Why would they need Outlook? Just like live chat stuff these
days. They need to check their emails,
yeah? Can you imagine being?
Fished. Whilst orbiting, like, my God,
you imagine being fished while orbiting like I've just sorry,
we're being ransomwered in space.
There's a Hollywood story. For you orbiting the.
Moon And then you get infected with ransomware because you
scanned the QR code sent in your e-mail because you thought your
salary was increasing. Hey.
Bob, we've got a salary increase.
Oh. Cool.
Let me set, Let me open the e-mail.
Yeah, you can. Yeah, yeah.
Right. Move on to your topics.
Sorry. Wait, that's right.
Yeah, move on to yours. Did this on that topic kind of
thing I did. See the the Artemis 2 was using.
IT Office 365. On some custom computer that was
radiation proof and all sorts of things it's quite interesting.
But Office 365 again, something lighter.
Weight you didn't know. Like 365 offline?
Are they on like a starlink? Does Starlink go round the moon?
I I think they. Weren't maybe using that, but
yeah. It's this mission is sponsored.
I mean, it's SpaceX. Isn't it so this one, but with
SpaceX I maybe? I'm not sure.
It amazes me they're not. Using the lightest.
Weight clients available and I wouldn't have imagined 0365 is
the light option there, but. Who knows, maybe they're
remoting into a device somewhere, I don't know.
Yeah, I'll quickly share my. Stories.
Yeah, a topic. So this one was following on
from the Artemis Two thing. Just basically have one of the
astronauts entering their password on live stream, which
was quite a funny one. I play the video, I don't find
as much audio inside of 20 minutes.
From the opening of our launch window and right now we are
targeting, but yeah, you can see they're just about to launch.
And then yeah, he's the centering his pin code into the
on board the computer, the top of that launch window, so we
could be launching. Here in about 19 minutes ago.
Wow. I Yeah.
So we now know. What his pin code is, but I'm
also. Surprised that they need a pin
code. There's four people on board and
you should be able to trust all of them with their.
Lives explicitly. I'm really surprised some.
Sort of policy thing, right? The device got built on there
and it made it. Surely you could give?
Them a policy exception? Well, I forget the passcode.
It's him that's funny, similar to the we've.
Seen it before it was because. It Kanye West or someone else
entering the password Trump maybe, I can't remember.
Yeah, various occasions where? People have had passcodes on the
councillor. Last week, once he's yeah.
Yeah. Yeah, it's, yeah.
This is more of a funny one than anything.
I can't imagine there's much of a problem there being on a
shuttle in space right now with a leaked passcode.
I wonder maybe if that device. Could be compromised so that
that. Device looked like say again,
that looked like a tablet running Windows.
Which means you'd argue that it could probably be compromised.
Maybe the pin code gives admin rights.
I don't know, Maybe I don't. Let's not get into that.
Yeah, please do not compromise Artemis 2.
Yeah, it's quickly. The other one I wanted to share
was. Another of Apple's adverts, they
seem to be doing a lot of these marketing for sort of I guess
aimed at Gen Z, but with the map with the Earth, and this one's
about possum and it just go into the device 2020, whatever.
Who's still trying to remember? Passwords.
You don't have to on Mac because it has the Passwords app.
It remembers all your passwords. It's.
Super. Secure and it goes across your
devices. It'll even help you come up with
one of those weird really long ones that's definitely stronger
than 123 ABC. And if an old password gets
leaked, the app will let you know so you can change it.
It's actually really easy. It's.
Yeah, that's quite nice. I love this little character.
They've got which? Is the old Finder, Yeah, yeah.
This is, yeah, it's kind of positive sort of thing.
Educate people on personal managers and stuff.
It not terribly produced how they put down passwords in the
last. Video we shared.
This is kind of a good recovery for them because it is
encouraging password RE. Yeah, I mean, again, their
password solution isn't available on Android, I don't
think, or Windows. So it does keep you locked into
the Apple ecosystem. You can use it across devices as
long as they're made by Apple. Yeah, but that's.
Yeah, that's what I've always wanted to share.
Maybe for more of obviously awareness people, but I thought
it was a bit ironic as well though it says like oh you don't
need to remember passwords but the type 2020 whatever password
I'm still trying. To to get into the app.
Yeah, it shows. You typing in the master
password? Yeah, yeah.
I guess this is also an interesting one.
It's still a password sometimes. Right.
If they're promoting this. Organisations need to be aware
that there's now going to be. A password manager on the device
that your corporate passwords might be being leaked.
And if you don't use managed Apple IDs, then there's going to
be some passwords exfiltration there.
So if you run lots of Apple devices in your organisation,
you might want to look at Jam for policies to block the
Passwords app if you haven't already.
Because now there's I. Use one password or bit warden.
Now I've got another lot of pass somewhere else to keep my
passwords. It's yeah.
Yeah. The passwords apps, I mean,
that's not. New that was launched. 2 now
four years ago, but it's nice to see.
Them promoting it. Anyway, especially if there's
going to be lots of new Mac users buying the new Neo.
Cheap. Macbooks, yeah, yeah, it would
be a good. Solution for my.
Mum if she's got a. MacBook she uses.
An iPhone and an iPad. That would be a really nice
solution actually. Yeah, rather than a password
book, which I haven't got a problem with, she uses a
password book on the shelf. But this would be a nice easy
solution to to evolve her password security.
Yeah, what else have you got I. Have.
One more but. I'll share it for more.
Again, for awareness, people on the presentation of the video
more than anything on the story itself.
I don't know if we spoke about the story, to be honest.
The ring up on the screen. So it was talking about Axios
supply chain attack, which was something recent.
I don't think we covered it, but we we.
We didn't cover it because it had been well covered by lots of
technical security people. I think we might have mentioned
it. We acknowledged its existence.
Let's just put it that way. So this is.
Video by Lewis Mendelos on TikTok.
He does a lot of them sort of educational videos, but it's
just nicely presented. So how could he play, well, play
all of it. Things just happened in the
world of programming. Axios, the JavaScript package
that's installed over 300 million times per week, was
compromised completely by a sophisticated attack.
Someone hijacked a Lead Maintainers MPM account, swapped
e-mail addresses, and then published 2 new versions of the
Axios library. And because they're on the lead
maintainers account, it was able to bypass any continuous
integration or delivery just going straight to production
like any good programmer would. But here's where it actually
gets insane. There was no malicious code that
was directly injected in the package itself.
It was just a dependency added. So when axios is installed
anywhere, AKA 300 million times per week, it installs that
dependency, but then that dependency.
So yeah, hopefully all but fuzz quite nicely.
Presented We're so veggie on a topic feels like the kind of
videos we used to make. And when you look at how that's
made, it doesn't require lots of lots of expensive equipment,
just a little bit of time. The lighting on him is doing all
the work. So just one well placed light
could have been filmed on an iPhone.
Some nice simple graphics really makes it pop.
Do you know what I mean? It's a really, really nicely
produced video that would be really easy for an awareness
person to recreate. And he's not the strongest.
He's clear talks quite fast. It's it's clear communication,
but. He's not like the.
World's best communicator. But it's decent, it's good and
he's engaging. So yeah, that's a great looking
video. That was, that was.
It awesome. I might.
Yeah, you might see me do a video like that.
Right. That's all we've got.
Time for. This week feels like it's gone
on for ages. We had some technical issues
that I will cleverly edit out. So you may not have been aware,
but you may be aware. I don't know.
So it might not actually be that long once I've edited out all
those issues. So I might even edit out this
bit, but who knows, right? Thank you very much.
And don't forget, subscribe on YouTube, LinkedIn, Instagram,
Tiktok newsletter, all of that. All the details are here, there
and everywhere. Yeah, see you next week.
Cool. Catch you later.
Bye. See ya.
Bye.