1 00:00:00,080 --> 00:00:03,200 This week, on the awareness angle, a dead airline is still 2 00:00:03,200 --> 00:00:05,280 taking bookings for flights that will never. 3 00:00:05,280 --> 00:00:08,000 Exist. Instagram just killed encrypted 4 00:00:08,000 --> 00:00:13,400 DMS Google Chrome secretly installs A4 GB AI model on your 5 00:00:13,400 --> 00:00:16,400 computer. A student stopped 4 high speed 6 00:00:16,400 --> 00:00:19,760 trains with a radio he bought online and a robot. 7 00:00:19,760 --> 00:00:23,360 Lawnmower can be hijacked by anyone on the Internet. 8 00:00:23,360 --> 00:00:26,640 Who'd have thought it? And that includes overriding the 9 00:00:26,640 --> 00:00:29,160 emergency stop. All of that and a whole bunch 10 00:00:29,160 --> 00:00:31,760 more on this week's The Awareness Angle. 11 00:00:43,560 --> 00:00:47,800 And with me, as always is my partner in cybercrime prevention 12 00:00:47,880 --> 00:00:50,840 is of course Mr Luke Pettigrew. How you doing, Luke? 13 00:00:51,320 --> 00:00:52,640 And doing well. Thanks. 14 00:00:52,640 --> 00:00:54,160 How are you? I'm good, I'm good. 15 00:00:54,360 --> 00:00:56,520 I've just realised for the last few weeks I haven't introduced 16 00:00:56,520 --> 00:00:58,280 myself. I've just introduced you. 17 00:00:59,320 --> 00:01:01,760 So I'm Matt Davis and we've been, as always, is my partner 18 00:01:01,760 --> 00:01:06,360 in cyber crime profession. Yeah, don't forget any thoughts, 19 00:01:06,360 --> 00:01:09,520 opinions, anything we talk about on the show are our own and do 20 00:01:09,520 --> 00:01:11,600 not represent those of our employers. 21 00:01:11,880 --> 00:01:14,960 Please don't fire us. Right, So much to get through 22 00:01:14,960 --> 00:01:16,280 this week. It's been a busy week. 23 00:01:16,280 --> 00:01:20,200 We've had to, we've had to be fierce, but it's it's good. 24 00:01:20,200 --> 00:01:22,600 We've got some good stuff so. Should we get straight? 25 00:01:22,600 --> 00:01:26,720 On with some old stories that sound almost made-up, but we'll 26 00:01:26,760 --> 00:01:28,600 get into them. Everything is from a news 27 00:01:28,600 --> 00:01:30,400 source. Don't we haven't made anything 28 00:01:30,400 --> 00:01:32,480 up. There's no we promise there's no 29 00:01:32,680 --> 00:01:35,120 we're not hallucinating. We are not AI. 30 00:01:35,320 --> 00:01:37,720 Look, we're not go. Let's go for it. 31 00:01:37,960 --> 00:01:43,640 Let's go for it, right? This week's breech watch and 32 00:01:43,640 --> 00:01:49,640 kicking us off this week Zara clothing fashion brand Zara data 33 00:01:49,640 --> 00:01:55,520 breach exposes 197,000 customers via a third party analytics 34 00:01:55,520 --> 00:01:58,840 vendor and this is a supply chain breach that we talk about 35 00:01:58,840 --> 00:02:03,560 every week in its both purest form Zara itself wasn't directly 36 00:02:03,560 --> 00:02:06,000 compromised. The attackers went off that 37 00:02:06,040 --> 00:02:10,759 Anodot, an Israeli AI analytics. Company that have processed 38 00:02:10,759 --> 00:02:14,440 Zara's data stole their authentication tokens and then 39 00:02:14,440 --> 00:02:17,640 use those to walk straight into. Zara's cloud infrastructure. 40 00:02:18,040 --> 00:02:21,880 I mean, we've seen this time and time again, you can have the 41 00:02:21,880 --> 00:02:25,200 best security in the world, but if your vendors don't, it 42 00:02:25,200 --> 00:02:27,480 doesn't matter. For customers. 43 00:02:27,480 --> 00:02:31,480 This is being played down saying no passwords or payment details 44 00:02:31,480 --> 00:02:37,720 were taken but 197,000 e-mail. Addresses tied to shopping 45 00:02:37,720 --> 00:02:41,120 behaviours support interactions and geographic markets. 46 00:02:41,120 --> 00:02:43,960 It's still, I mean, that's valuable data for targeted 47 00:02:43,960 --> 00:02:46,680 phishing. So if you've ever contacted Zara 48 00:02:46,680 --> 00:02:51,240 for support or shopped online, you could be in the data set, 49 00:02:51,600 --> 00:02:56,200 which is pretty scary. And it's Shiny Hunters again. 50 00:02:56,240 --> 00:03:00,320 You know they're Shiny Hunters. We're playing hacking group 51 00:03:00,320 --> 00:03:01,960 bingo. Shiny Hunters is like having a 52 00:03:01,960 --> 00:03:04,400 44 on the English lottery. It comes up all the time. 53 00:03:04,600 --> 00:03:08,560 Yeah, it's Zara is of course the flagship. 54 00:03:08,560 --> 00:03:11,240 Brand of the Inditex group, which is one of the largest 55 00:03:11,240 --> 00:03:14,520 fashion distribution groups. They also own Bershka. 56 00:03:15,000 --> 00:03:18,120 Zara Home, we show Pull and Bear everywhere. 57 00:03:18,320 --> 00:03:20,480 My daughter likes to shop essentially. 58 00:03:20,560 --> 00:03:23,160 He's owned by Intertex. Berska and Pull and Bear are 59 00:03:23,160 --> 00:03:27,400 like really popular so. Yes, I mean, it's, it's a data 60 00:03:27,400 --> 00:03:29,040 breach. Data's been leaked. 61 00:03:29,040 --> 00:03:30,480 Lots of details have been leaked. 62 00:03:30,840 --> 00:03:33,480 If you're a Zara. Customer watch out for fishing I 63 00:03:33,480 --> 00:03:35,720 think is what we're what we're talking about on this. 64 00:03:36,760 --> 00:03:38,600 Yeah, and if you have third parties? 65 00:03:39,480 --> 00:03:42,200 Make sure you you know, hold them to account. 66 00:03:42,240 --> 00:03:45,280 In some ways. Yeah, right. 67 00:03:45,280 --> 00:03:47,400 I think that's it for that one. So you can move straight on to 68 00:03:47,400 --> 00:03:50,320 the next one. Oh yes, the next one we've got 69 00:03:50,600 --> 00:03:54,960 Kushwin and Wakefield breached via fishing and two ransomware 70 00:03:54,960 --> 00:03:57,680 gangs claim responsibility for this one says the day of breach 71 00:03:57,920 --> 00:03:59,600 stemming from a voice phishing attack. 72 00:03:59,880 --> 00:04:03,400 And no surprises here, the cyber crime groups involved, the shiny 73 00:04:03,400 --> 00:04:06,720 hunters and chilling, they claimed responsibility worked 74 00:04:06,720 --> 00:04:10,240 together on this and such. But I guess maybe they've done 75 00:04:10,360 --> 00:04:14,360 sort of separate things there, sort of one side getting in and 76 00:04:14,360 --> 00:04:17,360 then sold that access or gave access to the other group. 77 00:04:17,360 --> 00:04:21,360 But yeah, so this one, they say the registered article on the 78 00:04:21,360 --> 00:04:24,960 spokesperson told them that it was limited in scope and 79 00:04:24,960 --> 00:04:27,360 suggested that boy, he was socially engineered. 80 00:04:28,760 --> 00:04:32,640 And so they came aware of a limited data security incident 81 00:04:32,640 --> 00:04:36,880 due to phishing, activated voice activated response protocols to 82 00:04:36,880 --> 00:04:41,160 contain on on a price access and engaged a third party expert to 83 00:04:41,160 --> 00:04:43,800 support their response to it. So they've sort of mentioned 84 00:04:43,800 --> 00:04:48,240 that systems and operations continue to run normally and 85 00:04:48,240 --> 00:04:51,560 they're investigating the incident and idea obviously take 86 00:04:51,560 --> 00:04:55,560 it very seriously. Obviously, obviously they've 87 00:04:56,920 --> 00:04:59,960 yes, they didn't address the sort of cyber groups involved, 88 00:04:59,960 --> 00:05:03,920 but this this article goes on to say that obviously as targeted 89 00:05:03,920 --> 00:05:07,840 by Shanny Hunters, who operates a pay or league model and 90 00:05:07,840 --> 00:05:11,640 chilling who one of the world's most prolific ransomware groups 91 00:05:11,640 --> 00:05:14,680 to go on to say there's no established coalition between 92 00:05:14,680 --> 00:05:17,520 the two groups, which suggests that they're separate but 93 00:05:17,520 --> 00:05:23,760 coincidentally timed. Who knows what happens in the 94 00:05:23,760 --> 00:05:24,920 shadows? No one. 95 00:05:25,200 --> 00:05:26,960 What happens on a forum in the dark? 96 00:05:27,160 --> 00:05:30,200 Web. No one knows, you know Signal 97 00:05:30,200 --> 00:05:33,720 chat. Yeah, it carries on to say that 98 00:05:34,360 --> 00:05:39,360 Shane Hunters attacked them on the May 1st and Chilean listed 99 00:05:40,400 --> 00:05:42,800 information on the data leak site on May 4th. 100 00:05:45,640 --> 00:05:52,280 Shiny Hunters claims it's stolen over 500,000 Salesforce records 101 00:05:52,280 --> 00:05:56,040 containing PII and other corporate data and they've set 102 00:05:56,040 --> 00:06:00,440 deadline of May 6th for them to contact them but that hasn't 103 00:06:00,440 --> 00:06:03,680 happened and assuming they've probably shed the data that. 104 00:06:04,080 --> 00:06:05,760 I think that's why we're talking about it now. 105 00:06:06,360 --> 00:06:08,400 Yeah, Probably. Yeah. 106 00:06:08,640 --> 00:06:12,760 I'm I. Yeah, 5 GB, 50 gigabytes. 107 00:06:12,800 --> 00:06:15,840 After the ransom negotiation, negotiations failed. 108 00:06:16,080 --> 00:06:19,200 So they don't waste any time. They're very headline boom. 109 00:06:19,600 --> 00:06:21,520 Truck deadline. Yeah, yeah. 110 00:06:23,040 --> 00:06:25,040 But yeah, voice fishing in this case. 111 00:06:25,560 --> 00:06:28,880 It's exactly the same as we talked about last week with ADT. 112 00:06:29,840 --> 00:06:33,440 It's their, you know, it's the modus operandi and This is why 113 00:06:33,440 --> 00:06:36,280 we see. Security awareness vendors now 114 00:06:36,280 --> 00:06:39,280 like all running to bring out voice phishing. 115 00:06:39,280 --> 00:06:42,240 And I know there's been some queries around the legality of 116 00:06:42,240 --> 00:06:45,960 doing voice phishing, but you know, This is why companies now 117 00:06:46,560 --> 00:06:48,920 we can't, we can't just send phishing emails anymore. 118 00:06:48,920 --> 00:06:51,400 We need to start. Thinking that a lot more than 119 00:06:51,400 --> 00:06:53,720 that, isn't it? Let's not forget phishing emails 120 00:06:53,720 --> 00:06:57,120 are still an important part of protection. 121 00:06:57,120 --> 00:07:01,200 Like 80. 5% of all attacks start with some kind of phishing, so 122 00:07:01,200 --> 00:07:03,600 phishing emails are still dangerous. 123 00:07:05,040 --> 00:07:08,720 But we need to look wider and like you said last week, we 124 00:07:08,720 --> 00:07:11,880 shouldn't be focusing voice fishing just on those high risk 125 00:07:11,880 --> 00:07:14,040 areas like. Help desks and. 126 00:07:14,080 --> 00:07:17,840 Stuff like that. Anybody, anybody is vulnerable 127 00:07:17,920 --> 00:07:20,600 to voice fishing. So it's really, I know 128 00:07:20,600 --> 00:07:23,280 businesses that have done it just to those high risk 129 00:07:23,560 --> 00:07:26,000 frontline kind of technical stuff. 130 00:07:26,360 --> 00:07:28,040 You need to go wider than that. You need to. 131 00:07:28,040 --> 00:07:29,760 You need to do your whole workforce really. 132 00:07:30,200 --> 00:07:32,600 And talk about it. Make people aware it happens. 133 00:07:32,600 --> 00:07:36,360 This is a great example. Not a lot of people outside like 134 00:07:36,720 --> 00:07:39,640 Cushman and Wakefield. Massive real estate company. 135 00:07:40,200 --> 00:07:43,200 I've not heard of them before. I might be naive. 136 00:07:43,200 --> 00:07:45,880 Had you heard of them before? No, I haven't. 137 00:07:46,160 --> 00:07:48,120 They're not house, they're not household. 138 00:07:48,600 --> 00:07:51,080 Yeah, they're an American company. 139 00:07:51,640 --> 00:07:54,480 Yeah. 53,000 employees according to YEAH. 140 00:07:55,760 --> 00:08:00,200 So they're not the best example to tell everyone about, but if 141 00:08:00,200 --> 00:08:03,840 you've got a real estate department that deals with 142 00:08:03,840 --> 00:08:05,600 offices and. Facilities and rents, They've 143 00:08:05,600 --> 00:08:08,000 probably heard of them. So it's relatable to them. 144 00:08:08,360 --> 00:08:11,560 ADT we spoke about last week, massive household brand 145 00:08:11,840 --> 00:08:15,120 everybody's heard of ADTI would imagine and they're a security 146 00:08:15,120 --> 00:08:17,920 company. So there's a great piece of news 147 00:08:17,920 --> 00:08:20,200 to make it relatable to those individuals. 148 00:08:20,240 --> 00:08:24,120 Yes, like we said, no one wants to appear on no one wants a 149 00:08:24,120 --> 00:08:26,480 Google alert telling them that they've appeared on Shiny 150 00:08:26,480 --> 00:08:32,000 Hunters League site. So no, right, that's it for this 151 00:08:32,000 --> 00:08:34,840 week's breaches. Let's get on with the news. 152 00:08:37,840 --> 00:08:40,919 So this week I'll kick off the first one and I'm going to keep 153 00:08:40,919 --> 00:08:43,840 this brief because this we could go down a technical rabbit hole 154 00:08:43,880 --> 00:08:48,240 here, but we're not going to consent fix version 3. 155 00:08:48,720 --> 00:08:50,720 So we've spoken about consent fix before. 156 00:08:51,040 --> 00:08:54,560 This is the phishing attack that bypasses multi factor 157 00:08:54,560 --> 00:08:59,040 authentication by using Microsoft's own award flow. 158 00:08:59,280 --> 00:09:02,120 So this is a new automated phishing technique that's 159 00:09:02,120 --> 00:09:06,360 circulating around on hacker forums and it hijacks Microsoft 160 00:09:06,400 --> 00:09:10,000 Azure accounts through legitimate authentication flows. 161 00:09:10,000 --> 00:09:13,120 So if you're not technical, Azure account is the account 162 00:09:13,120 --> 00:09:16,360 that you sign into your computer with if your computer has user 163 00:09:16,360 --> 00:09:18,440 accounts. That are managed by Microsoft. 164 00:09:18,440 --> 00:09:22,560 So if you use Microsoft A365, Microsoft Office, if your e-mail 165 00:09:22,560 --> 00:09:25,280 is Outlook, you've probably got a Microsoft Azure account. 166 00:09:25,320 --> 00:09:29,640 And this attack basically bypasses the authentication that 167 00:09:29,640 --> 00:09:31,560 you have for that account. So it tricks. 168 00:09:31,560 --> 00:09:34,960 It's a bit like click fix. It tricks you into pasting and 169 00:09:34,960 --> 00:09:38,600 dragging a URL into a page that looks like a normal Microsoft 170 00:09:38,600 --> 00:09:41,520 login page, but isn't. But because you're doing it, 171 00:09:42,440 --> 00:09:44,600 you're basically opening the door for the. 172 00:09:44,600 --> 00:09:45,680 Attackers. The attackers. 173 00:09:45,680 --> 00:09:48,720 Aren't hacking, they're socially engineering you to kind of. 174 00:09:48,880 --> 00:09:51,480 They're tricking you into opening the door. 175 00:09:51,960 --> 00:09:56,280 For them and it can be done within 30 seconds and all you 176 00:09:56,280 --> 00:09:58,720 see is a verification successful message. 177 00:09:58,720 --> 00:10:01,320 So yeah, it doesn't try and steal your password, it doesn't 178 00:10:01,320 --> 00:10:04,040 intercept your MFA code. It lets you complete a 179 00:10:04,040 --> 00:10:07,400 completely legitimate Microsoft login, but captures the 180 00:10:07,400 --> 00:10:10,880 handshake, the access tokens after you've authenticated. 181 00:10:11,280 --> 00:10:13,520 So you do everything right, You use your password. 182 00:10:13,520 --> 00:10:16,560 You approve the MFA prompt, but you still get compromised. 183 00:10:18,720 --> 00:10:21,320 Where this is different. So version one this is version 184 00:10:21,320 --> 00:10:23,160 3. Version 1 was a manual copy and 185 00:10:23,160 --> 00:10:25,560 paste. You had to copy some stuff and 186 00:10:25,560 --> 00:10:29,360 paste it in. Version 2 added drag and drops. 187 00:10:29,360 --> 00:10:32,600 You just had to drag something. And this version 3 is fully 188 00:10:32,600 --> 00:10:36,480 automated. So fake cloud, fair pages, a 189 00:10:36,480 --> 00:10:40,640 pipe dream web hook back end that exchanges codes for tokens 190 00:10:40,640 --> 00:10:43,280 in seconds. So this is like the industry. 191 00:10:43,360 --> 00:10:46,280 This is like someone's actually built something now that works. 192 00:10:46,280 --> 00:10:50,240 It's industrialisation of it. Yeah. 193 00:10:50,240 --> 00:10:52,240 So this targets first party Microsoft. 194 00:10:52,240 --> 00:10:54,640 Apps that are. Trusted in every Azure tenant 195 00:10:55,200 --> 00:10:58,360 and can't be deleted or restricted by default. 196 00:10:58,920 --> 00:11:02,160 There's no patch for this. That's the scariest thing 197 00:11:02,680 --> 00:11:05,720 because it is architecturally vulnerable. 198 00:11:06,240 --> 00:11:08,600 The way it is built. It's been built in a vulnerable 199 00:11:08,600 --> 00:11:12,680 fashion, so it's almost like you've built a house that has a 200 00:11:12,720 --> 00:11:15,640 foundational floor in its design. 201 00:11:16,480 --> 00:11:20,160 And then everything you can patch is the people, which is 202 00:11:20,160 --> 00:11:23,360 just like a nice piece of merch. I was going to say we've got 203 00:11:23,360 --> 00:11:25,760 some stickers with people Patcher on and Submerge with 204 00:11:25,760 --> 00:11:28,320 people Patcher on. If you're a people patcher, what 205 00:11:28,320 --> 00:11:31,200 great segue into If you're a people patcher and you want 206 00:11:31,200 --> 00:11:33,800 submerge all you want our newsletter, get yourself to 207 00:11:33,800 --> 00:11:36,840 risky creative. Dot com there's a shop with some 208 00:11:36,840 --> 00:11:40,480 people patch a merch, some click happens merch is on there as 209 00:11:40,480 --> 00:11:42,720 well. I'm wearing today and some 210 00:11:42,720 --> 00:11:44,960 control. Alt human stuff that you can see 211 00:11:45,160 --> 00:11:46,600 on the mic as well. I'm covered in it. 212 00:11:46,800 --> 00:11:48,680 It's amazing. And if you want our newsletter, 213 00:11:48,680 --> 00:11:50,440 you can sign up for it there via e-mail. 214 00:11:51,040 --> 00:11:53,960 Over 1200 people. Receive our e-mail, our 215 00:11:53,960 --> 00:11:57,600 newsletter every single week and it appears in your inbox on a 216 00:11:57,600 --> 00:12:00,160 Monday morning and covers everything we talk about on the 217 00:12:00,160 --> 00:12:01,840 show. We'll put a link to this story. 218 00:12:01,840 --> 00:12:03,720 We won't go into this anymore because it can get quite 219 00:12:03,720 --> 00:12:07,000 technical, but if you if that's picture interesting, you want to 220 00:12:07,000 --> 00:12:10,240 find out more about Consent Fix version 3. 221 00:12:10,640 --> 00:12:12,840 There'll be a link to that in this week's newsletter, So you. 222 00:12:12,840 --> 00:12:15,360 Can find out. Right. 223 00:12:15,400 --> 00:12:16,880 Awesome. Move on to the next one. 224 00:12:18,160 --> 00:12:21,480 Yeah, so next one we've got Spirit Airlines liquidization 225 00:12:21,480 --> 00:12:26,120 equals zombie infrastructure, open payment systems and $11.48 226 00:12:26,600 --> 00:12:29,600 fishing domains. It's what an interesting and 227 00:12:29,600 --> 00:12:37,080 crazy story, this one. So son Guy Braden has state tech 228 00:12:37,080 --> 00:12:44,320 blog basically talks about sort of looked into the Spirit 229 00:12:44,320 --> 00:12:47,680 Airlines liquidisation and how they ceased operations on May 230 00:12:47,680 --> 00:12:52,360 2nd and they they sort of said that multibillion dollar 231 00:12:52,560 --> 00:12:55,160 corporate tech infrastructure was abandoned in real time. 232 00:12:55,960 --> 00:12:58,000 That's insane. Literally like they just went 233 00:12:58,000 --> 00:13:01,440 home. Yeah, they, yeah, everybody left 234 00:13:01,440 --> 00:13:03,560 the office and didn't turn anything off apparently. 235 00:13:05,240 --> 00:13:08,040 So yes, security researcher discovered that the booking flow 236 00:13:08,240 --> 00:13:11,600 on spirit.com was was it may still be fully functional. 237 00:13:11,680 --> 00:13:14,240 You could search flights, select seats and see your personal 238 00:13:14,240 --> 00:13:17,960 information and even reach the payment screen for flights that 239 00:13:17,960 --> 00:13:21,360 will never exist. They have. 240 00:13:21,360 --> 00:13:23,440 To they have. They have fixed this now. 241 00:13:23,840 --> 00:13:28,160 So at the time this was written that was the case, but now if 242 00:13:28,160 --> 00:13:32,080 you go to spirit.com, it does go to a winding down page with an 243 00:13:32,080 --> 00:13:33,720 announcement. It actually redirects. 244 00:13:33,720 --> 00:13:35,360 To a completely different. Domain. 245 00:13:36,880 --> 00:13:40,680 So yeah, they've kind of patched it, but this was not the case. 246 00:13:40,840 --> 00:13:43,280 At the time of, you know, escalating this. 247 00:13:44,880 --> 00:13:47,960 So yeah, it doesn't says so there was like a booking API 248 00:13:48,160 --> 00:13:51,680 that was selective issuing, issuing valid records, 249 00:13:51,680 --> 00:13:54,200 processing payments against a live payment gateway. 250 00:13:56,000 --> 00:13:59,600 The system did return payment authorization declined rather 251 00:13:59,600 --> 00:14:02,520 than provider unavailable, but it sort of proved that the 252 00:14:02,520 --> 00:14:07,720 payment processor was still connected spirits full telemetry 253 00:14:07,720 --> 00:14:10,320 stack was still running. So the back end was probably 254 00:14:10,320 --> 00:14:14,040 performing deep packet inspection and performance 255 00:14:14,040 --> 00:14:17,800 logging on transactions. But obviously it continues to 256 00:14:17,800 --> 00:14:21,280 say that it was processing data that it really obviously should 257 00:14:21,280 --> 00:14:25,040 have been. And then one of those sort of 258 00:14:26,200 --> 00:14:31,520 lots of things to look out for and it was fishing domains were 259 00:14:31,520 --> 00:14:36,520 popping up around Spirit. So there was Spirit refunds.com 260 00:14:37,520 --> 00:14:42,360 and they're available for 12/12. He defensively registered three 261 00:14:42,360 --> 00:14:46,360 of them they found available and redirected them to the official 262 00:14:47,640 --> 00:14:51,880 page of information. And then it says within like a 263 00:14:51,880 --> 00:14:55,480 pretty short window, maybe like 3 hours, Spirit liquidization 264 00:14:55,480 --> 00:15:01,960 received 43 visits from a wide range of devices and potentially 265 00:15:01,960 --> 00:15:04,680 people we had desperately searching for refund information 266 00:15:04,920 --> 00:15:07,520 on Spirit Airlines. And yeah, continues on to say 267 00:15:07,520 --> 00:15:10,560 that Spirit never sent cancellation emails to account 268 00:15:10,560 --> 00:15:12,840 holders. Flights were never cancelled. 269 00:15:12,840 --> 00:15:14,960 It was still bookable. And yeah, so there's obviously 270 00:15:14,960 --> 00:15:19,360 that left to a window of time where potentially no one was 271 00:15:19,360 --> 00:15:22,720 monitoring what was going on and the people were potentially 272 00:15:23,240 --> 00:15:26,040 booking flights still and entering their personal 273 00:15:26,040 --> 00:15:27,560 information. So yeah, it's quite a crazy 274 00:15:27,560 --> 00:15:31,000 story. Yeah. 275 00:15:31,080 --> 00:15:36,840 They essentially, yeah. A company collapsed and nothing 276 00:15:36,840 --> 00:15:40,560 got turned off, No. It's, it's mad, isn't it? 277 00:15:40,560 --> 00:15:42,560 I think it's the problem is there's so many. 278 00:15:42,680 --> 00:15:44,960 I mean, it was in the news. We heard about it over here. 279 00:15:44,960 --> 00:15:46,760 It was big news. Donald Trump said he was going 280 00:15:46,760 --> 00:15:47,720 to. Buy it and bail them. 281 00:15:47,720 --> 00:15:52,560 Out and then that didn't happen. But it's so many people are left 282 00:15:52,560 --> 00:15:55,640 unknown and want answers and so many people are going to jump on 283 00:15:55,640 --> 00:15:58,240 that bandwagon of like registering when you go to 284 00:15:58,240 --> 00:16:01,720 spirit.com, there's you can still find, you can still find 285 00:16:01,720 --> 00:16:05,600 ways into the website like it's they've done a really bad job of 286 00:16:05,600 --> 00:16:08,040 shutting this down. If you go to spirit.com, it 287 00:16:08,040 --> 00:16:10,640 redirects to spiritrestructuring.com. 288 00:16:10,640 --> 00:16:13,480 Like that could be not legitimate. 289 00:16:13,720 --> 00:16:15,920 And then there's bits about guests and lenders. 290 00:16:16,360 --> 00:16:18,200 But if you actually. Didn't redirect. 291 00:16:18,680 --> 00:16:21,680 Did it not but then if you actually go, if you Google like 292 00:16:21,680 --> 00:16:25,120 spirit booking, you can still kind of find ways into the 293 00:16:25,120 --> 00:16:28,440 flights page. So it is still there's still 294 00:16:28,440 --> 00:16:32,680 elements of this up and running and this they don't exist 295 00:16:32,680 --> 00:16:36,120 anymore like this. They've they've shut up shop, 296 00:16:36,560 --> 00:16:41,520 but here I am still able to go. I want to go from New York. 297 00:16:41,520 --> 00:16:46,120 Let's go from Newark to Aruba. There's search flights. 298 00:16:46,200 --> 00:16:50,040 There's no seats available. OK, so there are parts of it not 299 00:16:50,040 --> 00:16:53,320 working, but you can still browse the infrastructure. 300 00:16:53,320 --> 00:16:56,280 And it's mad that this hasn't just been shut down. 301 00:16:56,280 --> 00:16:59,600 Main web page spirit.com. Put up a holding page. 302 00:16:59,600 --> 00:17:01,640 Put up a. Page saying we've ceased 303 00:17:01,640 --> 00:17:05,839 operations for any queries contact this just don't leave 304 00:17:05,839 --> 00:17:09,280 people in the unknown people. This is the worst part of it 305 00:17:09,280 --> 00:17:11,920 because this is a this is a cyber criminals. 306 00:17:12,240 --> 00:17:14,400 Social engineers dream right now. 307 00:17:15,200 --> 00:17:18,520 Especially if someone, yeah, broke into the system and 308 00:17:18,800 --> 00:17:21,480 hijacked it and people are putting in their genuine 309 00:17:21,480 --> 00:17:23,880 information and payment trying to pay for things, yeah. 310 00:17:24,960 --> 00:17:27,040 I mean the example. Fishing domains as well. 311 00:17:27,400 --> 00:17:31,160 The example for us would be like Ryanair going bust, like Spirit 312 00:17:31,160 --> 00:17:33,960 or the budget airline. So it would be the equivalent of 313 00:17:33,960 --> 00:17:37,640 an EasyJet or a Ryanair going disappearing overnight, but 314 00:17:37,640 --> 00:17:39,000 their website is still being open. 315 00:17:39,840 --> 00:17:42,240 Think about the amount of questions that would leave the 316 00:17:42,240 --> 00:17:43,640 amount of queries they they like. 317 00:17:43,640 --> 00:17:45,520 It's. Yeah, it's crazy. 318 00:17:46,080 --> 00:17:49,680 It's I wonder if there's, I wonder if Spirit had a playbook, 319 00:17:49,680 --> 00:17:52,200 like do companies have playbooks for like what happens if we 320 00:17:52,200 --> 00:17:54,280 liquidate? What? 321 00:17:54,280 --> 00:17:56,280 Like do you have a liquidation playbook? 322 00:17:56,520 --> 00:17:59,120 Before, before you leave, turn the lights off, like a little 323 00:17:59,120 --> 00:18:01,840 sign next to the door. Last one out switches off the 324 00:18:01,840 --> 00:18:03,400 lights. Maybe it should have been last 325 00:18:03,400 --> 00:18:04,960 one out switches off the website. 326 00:18:05,200 --> 00:18:07,800 That's what they needed. Yeah. 327 00:18:09,120 --> 00:18:11,520 The problem is as well though, you're dealing with people now, 328 00:18:12,160 --> 00:18:14,640 but thinking of the people involved in that people's lives, 329 00:18:14,640 --> 00:18:17,080 they've just lost their jobs. They they don't know if they're 330 00:18:17,080 --> 00:18:19,640 going to get paid. I think they don't give a. 331 00:18:19,640 --> 00:18:22,200 Monkeys, you know, they're, they're like, I'm going home. 332 00:18:22,480 --> 00:18:24,080 Like they don't want to. They don't want to. 333 00:18:24,080 --> 00:18:27,480 No, not everyone's. Some people will, but not 334 00:18:27,480 --> 00:18:30,560 everyone, and probably not the people in power will think, you 335 00:18:30,560 --> 00:18:33,000 know, we need to tie up our loose ends. 336 00:18:33,000 --> 00:18:36,520 Before we leave anyway that's. Spirit Airlines. 337 00:18:37,000 --> 00:18:39,680 Yeah, I it's a, it's an interesting one. 338 00:18:39,680 --> 00:18:42,640 And that that angle wasn't picked up like on the news that 339 00:18:42,640 --> 00:18:45,760 I saw. It was just in a researcher's 340 00:18:45,760 --> 00:18:48,360 blog, which is like. OK, that's interesting. 341 00:18:48,720 --> 00:18:52,280 Now we can obviously share the link and the news there for 342 00:18:52,840 --> 00:18:55,320 people that want to read in, yes, detail on the stories. 343 00:18:55,320 --> 00:18:59,600 A lot of research got into it. Yeah, yeah, we'll put that in 344 00:18:59,600 --> 00:19:03,280 the in the newsletter, right? I'll move on to the next one. 345 00:19:03,280 --> 00:19:08,600 Now the next story, Google Chrome silently installs A4 GB 346 00:19:08,640 --> 00:19:12,600 AI model on your device without consent. 347 00:19:13,720 --> 00:19:17,760 So security researcher Alex Hamph discovered that Google 348 00:19:17,760 --> 00:19:23,760 Chrome silently downloads A4 GB AI model Gemini Nano to devices 349 00:19:23,760 --> 00:19:26,240 without notification and without consent. 350 00:19:26,880 --> 00:19:29,480 And this is different because it's potentially happening to 351 00:19:29,480 --> 00:19:33,120 billions of people. Right now, Google Chrome, 352 00:19:33,200 --> 00:19:37,600 world's most popular browser, A4 GB AI model, is coming down. 353 00:19:37,600 --> 00:19:40,560 No prompt, no notification, no consent check box. 354 00:19:41,320 --> 00:19:44,440 And if you find it and delete it, it comes back. 355 00:19:45,240 --> 00:19:47,560 This sounds familiar. We had this with Claude a few 356 00:19:47,560 --> 00:19:52,000 weeks ago. The researcher who caught it was 357 00:19:52,000 --> 00:19:56,560 only running an automated audit. No human ever touched a browser 358 00:19:56,680 --> 00:19:59,880 and the model still appeared. And so the under GPR, 359 00:20:00,000 --> 00:20:03,720 downloading 4 gigabyte of data to someone device, profiling 360 00:20:03,720 --> 00:20:08,040 hardware to decide if it's eligible, and doing all of this 361 00:20:08,040 --> 00:20:10,520 without consent is potentially illegal. 362 00:20:10,520 --> 00:20:15,680 So many people raised the GDPR question around the Claude that 363 00:20:15,680 --> 00:20:18,800 we spoke about a few weeks ago as well, surely, but it's like. 364 00:20:19,920 --> 00:20:21,960 This is the challenge for GDPR, isn't it? 365 00:20:21,960 --> 00:20:25,600 I think these American based companies are flirting with the 366 00:20:25,600 --> 00:20:29,840 edges of legitimacy. But this is a there's a 367 00:20:29,840 --> 00:20:33,040 principle here. So like your browser, which is a 368 00:20:33,040 --> 00:20:35,960 tool we all use to people in the comments on socials will go 369 00:20:35,960 --> 00:20:39,280 should be using this should be using that people use Chrome 370 00:20:39,280 --> 00:20:42,280 like Chrome's just an embedded part of people's lives. 371 00:20:42,960 --> 00:20:47,840 But so millions of us are using it every day and here it is just 372 00:20:47,840 --> 00:20:50,440 downloading some stuff that. A lot of stuff. 373 00:20:50,920 --> 00:20:57,080 That we don't know about. And do you know what's 374 00:20:57,080 --> 00:20:59,800 interesting about this? The model they're downloading 375 00:21:00,600 --> 00:21:02,640 isn't even used for the AI features. 376 00:21:02,640 --> 00:21:06,080 Most people would notice the AI mode button. 377 00:21:06,240 --> 00:21:09,160 In the address bar, which I've not noticed yet, actually sends 378 00:21:09,160 --> 00:21:13,520 queries to Google servers. So it doesn't even do stuff 379 00:21:13,840 --> 00:21:16,680 locally. That 4 gig that this research 380 00:21:16,680 --> 00:21:21,280 has found powers minor writing assistant features that most 381 00:21:21,280 --> 00:21:24,160 people have never enabled. So if you actually use Google's 382 00:21:24,240 --> 00:21:26,520 AI tools like Gemini or anything like that, they're all going off 383 00:21:26,520 --> 00:21:28,520 to Google. They're not happening in this 4. 384 00:21:28,520 --> 00:21:31,520 Gigabyte data set. I don't get why it's so big. 385 00:21:32,240 --> 00:21:35,000 I don't get it. Again, this was reported on 386 00:21:35,000 --> 00:21:39,080 cybernews.com, which, if you haven't got some kind of ad 387 00:21:39,080 --> 00:21:42,080 blocker, isn't the most pleasant site to visit. 388 00:21:42,080 --> 00:21:44,760 But cyber, cyber news have got to make money, right? 389 00:21:44,760 --> 00:21:46,360 There's some ads and pop ups and stuff. 390 00:21:46,440 --> 00:21:49,760 Which is ironic for a cyber news site, but yeah, this is it's an 391 00:21:49,760 --> 00:21:51,800 interesting one. There's lots of details here 392 00:21:51,800 --> 00:21:57,760 again, but just I think browser we trust browsers, browsers 393 00:21:57,760 --> 00:21:59,840 sitting at every computer has a browser. 394 00:22:00,000 --> 00:22:02,840 I've long been an advocate for more people in businesses using 395 00:22:02,960 --> 00:22:06,400 Chromos rather than. Having a full computer, it's 396 00:22:06,400 --> 00:22:10,560 like a think lion. Like do people need a big 397 00:22:10,560 --> 00:22:12,360 windows device that can be hacked? 398 00:22:12,360 --> 00:22:15,920 You know, is would businesses be safer if more people used 399 00:22:16,040 --> 00:22:16,880 Chromos? But. 400 00:22:16,960 --> 00:22:20,520 Who do you trust? Firefox popped up in our 401 00:22:20,520 --> 00:22:22,200 comments last week. Firefox. 402 00:22:22,200 --> 00:22:23,840 We'd love to know what you think about this. 403 00:22:23,960 --> 00:22:26,440 Firefox. Are you downloading A4 GB file 404 00:22:26,440 --> 00:22:29,560 in the background? For your AI services that. 405 00:22:29,840 --> 00:22:33,760 'D be an interesting thing. Yeah, I'll find out. 406 00:22:34,040 --> 00:22:39,920 Hopefully, yeah, just looking into the story a bit, it doesn't 407 00:22:39,960 --> 00:22:42,840 they mentioned that the I did an opt out setting, but that was 408 00:22:42,840 --> 00:22:44,920 months after the downloads started happening. 409 00:22:44,920 --> 00:22:47,920 But I can't find that saying. But I think it's like in a like 410 00:22:48,040 --> 00:22:51,080 you have to go into like, you know, the the cradle flags back 411 00:22:51,080 --> 00:22:53,400 in yeah. So to to do that. 412 00:22:53,640 --> 00:22:56,520 You know when you go into that space in Firefox, it says like 413 00:22:56,520 --> 00:22:58,600 something like Here be Dragons or something like that. 414 00:22:58,640 --> 00:23:02,680 Like you're going, you need to go into, not the nice UI for 415 00:23:02,680 --> 00:23:06,080 settings, but you have to type a special thing into the. 416 00:23:07,000 --> 00:23:10,160 Address bar and then that's where you can break stuff which. 417 00:23:10,400 --> 00:23:13,080 Which if you're comfortable doing is fine, but my mum's not 418 00:23:13,080 --> 00:23:15,520 going to do that. You know, she's not going to 419 00:23:15,520 --> 00:23:18,120 know what she's doing. So you shouldn't have it 420 00:23:18,120 --> 00:23:21,280 shouldn't be in there. Also, you mentioned it's opt out 421 00:23:21,560 --> 00:23:24,600 and we spoke about this just recently, opt out versus opt in. 422 00:23:24,640 --> 00:23:28,120 Why is it opt out? Why is it not opt in like if 423 00:23:28,120 --> 00:23:30,120 they were really user? 1st. 424 00:23:30,640 --> 00:23:33,320 If they really cared about giving users consent to. 425 00:23:33,320 --> 00:23:35,120 Stuff. Make it opt in. 426 00:23:35,120 --> 00:23:38,960 I'm still, I'm still sure you'd get so many people doing it. 427 00:23:39,440 --> 00:23:42,400 I'm sure you would. But yeah, especially if it had a 428 00:23:42,400 --> 00:23:45,480 nice pop up splash screen to say that this is a new feature and 429 00:23:45,480 --> 00:23:48,400 all the benefits. Give me a reason, give me a why 430 00:23:48,400 --> 00:23:49,720 do? Why do you want 4 gig? 431 00:23:49,720 --> 00:23:52,520 Of my hard drive, I don't have lots of hard drive. 432 00:23:52,520 --> 00:23:54,240 Space. We do a lot of video work. 433 00:23:54,240 --> 00:23:55,400 I run out of hard. Drive space all. 434 00:23:55,480 --> 00:23:58,320 The time Why do I want? Why should Chrome take? 435 00:23:58,560 --> 00:24:01,040 Chrome already takes all the RAM now it wants. 436 00:24:01,040 --> 00:24:04,000 All the hard drive space as well, yeah. 437 00:24:04,440 --> 00:24:08,600 It's at some point I can't. I love Chrome, I use Chrome. 438 00:24:08,840 --> 00:24:12,080 But I have to admit, you get to a point, don't you, where 439 00:24:12,080 --> 00:24:15,000 enough's kind of enough in sometimes. 440 00:24:15,560 --> 00:24:18,560 Anyway, we'll put details to that and a link to the story in 441 00:24:18,560 --> 00:24:20,600 the newsletter. And if so, if you want to find 442 00:24:20,600 --> 00:24:24,200 out more about Chrome's secret. Little AI stash on your on your 443 00:24:24,200 --> 00:24:27,480 computer. Go to riskycreative.com and sign 444 00:24:27,480 --> 00:24:28,520 up. Right. 445 00:24:28,600 --> 00:24:33,000 OK, next one's yours. Cool, yeah this one. 446 00:24:33,000 --> 00:24:39,200 Instagram has dropped end to end encryptions on DMS. So Meta have 447 00:24:39,240 --> 00:24:42,920 removed end to end to end encryption from Instagram Direct 448 00:24:42,920 --> 00:24:48,000 messages on May the 8th. The feature was optional since 449 00:24:48,400 --> 00:24:51,720 2023. Message adoption was just too 450 00:24:51,720 --> 00:24:56,440 low to justify keeping it. I mean, I personally didn't know 451 00:24:56,880 --> 00:24:59,200 that was a thing. I don't use Instagram DMS in 452 00:24:59,200 --> 00:25:01,600 that way anyway, but. Again, opt in. 453 00:25:02,080 --> 00:25:03,200 Yeah. Why was it opt in? 454 00:25:03,200 --> 00:25:04,760 It should. Have been on by default and then 455 00:25:04,760 --> 00:25:08,120 opt out. Yeah, that's, that's, yeah, this 456 00:25:08,120 --> 00:25:10,240 is how there's things that should be opt in that thinks 457 00:25:10,240 --> 00:25:11,560 that shouldn't be right. Yeah. 458 00:25:12,520 --> 00:25:16,480 Now we've gone Mac rumours, story talks about it. 459 00:25:17,360 --> 00:25:21,840 And yeah, Mexicans now access all of Instagram's DMS, 460 00:25:23,480 --> 00:25:26,200 including text, images, videos and voice notes. 461 00:25:27,360 --> 00:25:30,680 And they're directing users who want encrypted messaging to use 462 00:25:30,680 --> 00:25:33,400 WhatsApp instead. And they've, yeah, previously 463 00:25:33,400 --> 00:25:36,760 promoted to encryption under the slogan of The Future is Private 464 00:25:36,760 --> 00:25:40,520 all the way back in 2019. There is a let me just show you 465 00:25:40,880 --> 00:25:43,280 Joe Tidy did a write up. On the BBC about this. 466 00:25:44,320 --> 00:25:50,480 And there is a screenshot of. Stood in front of a massive 467 00:25:50,480 --> 00:25:52,480 screen. Pointing up to a. 468 00:25:52,480 --> 00:25:55,920 Sign that says the future is private at a keynote and it's 469 00:25:55,920 --> 00:25:57,480 like. If it moves. 470 00:25:57,480 --> 00:25:59,880 To. Privacy on Instagram now? 471 00:25:59,880 --> 00:26:02,120 Not anymore, it isn't. Yeah. 472 00:26:02,120 --> 00:26:05,520 So I mean, for anybody using Instagram, you maybe want to. 473 00:26:05,920 --> 00:26:09,360 And yet if you're concerned about your conversations being 474 00:26:09,440 --> 00:26:12,720 not private anymore, yeah, move to WhatsApp or some other 475 00:26:13,240 --> 00:26:16,960 encrypted messaging. Yeah, it's probably about if I 476 00:26:16,960 --> 00:26:21,040 am, it's an audience, I guess that Instagram users maybe, 477 00:26:21,120 --> 00:26:22,520 maybe they wouldn't want to use WhatsApp. 478 00:26:23,000 --> 00:26:26,320 I mean, you can't, I mean you just share like if you're using 479 00:26:26,320 --> 00:26:28,600 Instagram posts and Reels and stuff, obviously you can share 480 00:26:28,600 --> 00:26:30,480 those via WhatsApp. But it's where the licence 481 00:26:30,480 --> 00:26:32,080 experience having to go between apps. 482 00:26:32,440 --> 00:26:34,880 It's different though. Different audiences, like we 483 00:26:34,880 --> 00:26:40,440 have people message us on Instagram, comments about the 484 00:26:40,440 --> 00:26:42,120 posts we make. They're not going to WhatsApp. 485 00:26:42,120 --> 00:26:44,680 Me because I'm not giving them my e-mail address or my phone 486 00:26:44,680 --> 00:26:45,840 number. Do you know what I mean? 487 00:26:45,840 --> 00:26:47,480 So. It is a different. 488 00:26:47,480 --> 00:26:52,160 Audience like the arguments for this, the arguments for I I read 489 00:26:52,160 --> 00:26:56,240 a couple of things someone said they want to see your messages 490 00:26:56,240 --> 00:26:59,880 so they can train their AI on your conversations, which they 491 00:26:59,880 --> 00:27:02,280 can't do if they're encrypted, but also. 492 00:27:02,280 --> 00:27:06,680 Because. FBI, you know it the. 493 00:27:07,320 --> 00:27:10,560 You know, crime, the enforcement agencies want to be able to 494 00:27:10,560 --> 00:27:12,960 access these messages. So rather than dealing with any 495 00:27:12,960 --> 00:27:16,360 of that difficulty. Like it's in, it's in their 496 00:27:16,360 --> 00:27:19,280 interest as a business to not encrypt these messages. 497 00:27:20,080 --> 00:27:22,200 And yeah, the. Way they they didn't even 498 00:27:22,200 --> 00:27:25,240 announce that this was turning off they just change the terms 499 00:27:25,240 --> 00:27:29,760 and conditions is like really awful yeah it's. 500 00:27:30,080 --> 00:27:34,200 Out of curiosity looked about like if TikTok uses it and they 501 00:27:34,200 --> 00:27:36,880 don't have Internet encryption and this sort of mentions that 502 00:27:37,720 --> 00:27:40,080 potentially and does their ability to prevent harmful 503 00:27:40,080 --> 00:27:45,760 content scams and potentially can protect children easier. 504 00:27:46,400 --> 00:27:49,480 Yeah, anyone in general, I mean, that is. 505 00:27:49,600 --> 00:27:56,120 That is a thing like where we post on Instagram and Tiktok the 506 00:27:56,120 --> 00:27:58,960 creator care mode that they have in the comments, which I 507 00:27:58,960 --> 00:28:01,080 imagine. Carries through to the actual 508 00:28:01,080 --> 00:28:02,960 messages as well. Is. 509 00:28:02,960 --> 00:28:07,760 Actually. Quite good, like you don't see. 510 00:28:08,240 --> 00:28:10,880 I've actually got no idea if anyone says anything bad about 511 00:28:10,880 --> 00:28:13,920 us because I've never seen I've been in this dream state where 512 00:28:13,920 --> 00:28:15,640 everyone's only talking positively. 513 00:28:15,880 --> 00:28:18,320 Maybe they do, but create a caremode hiding it from me, 514 00:28:18,320 --> 00:28:20,160 which I'm happy with like I'm not. 515 00:28:20,840 --> 00:28:22,760 I don't need to look under. The carpet, it's fine. 516 00:28:22,760 --> 00:28:25,240 It's I don't need. To look under the bed, no one 517 00:28:25,240 --> 00:28:29,120 needs to see that. So yeah, I get that as well. 518 00:28:29,120 --> 00:28:35,160 The problem is making it optic. Yeah, IT people need to know 519 00:28:35,160 --> 00:28:38,040 that this has been turned off and need to know that their 520 00:28:38,040 --> 00:28:42,840 messages may be accessed by X. Or Y, and that's something that 521 00:28:42,840 --> 00:28:44,960 I think more transparency needs to be done on. 522 00:28:46,280 --> 00:28:49,440 Like just sent just put. A little notification once every 523 00:28:49,440 --> 00:28:51,360 couple of weeks. In someone's messages, if they 524 00:28:51,360 --> 00:28:55,120 use messages that says, meta has access to your messages and may 525 00:28:55,120 --> 00:28:58,760 share them with their. Eyes or something? 526 00:28:59,000 --> 00:29:03,520 Yeah, don't go sending intimate pictures via messages on 527 00:29:03,520 --> 00:29:08,000 Instagram encrypted messaging. Platforms are available. 528 00:29:08,200 --> 00:29:09,760 I think that's what that boils down to. 529 00:29:10,640 --> 00:29:11,480 Yeah, I do. I mean. 530 00:29:11,840 --> 00:29:14,960 Just quickly, I do wonder if you had it enabled if it's now told 531 00:29:14,960 --> 00:29:17,600 you that it's gone. Probably not. 532 00:29:18,040 --> 00:29:20,000 Maybe not, probably not. No. 533 00:29:20,120 --> 00:29:21,960 Next one, yeah. Next. 534 00:29:21,960 --> 00:29:24,600 One anthropic. I love saying that word. 535 00:29:24,600 --> 00:29:29,920 It's such a good word to say. Anthropic CEO Anthropic CEO 536 00:29:29,920 --> 00:29:35,000 warns of moment of danger as Mythos exposes thousands of 537 00:29:35,000 --> 00:29:38,120 software vulnerabilities. So this is Anthropic is 538 00:29:38,120 --> 00:29:41,280 obviously clawed and this is, I think this is quite big, but 539 00:29:41,280 --> 00:29:43,680 it's a bit terrifying as well when you think about the bigger 540 00:29:43,680 --> 00:29:49,120 picture. So Anthropic CEO Dario Amodi has 541 00:29:49,120 --> 00:29:53,720 said there's a 6 to 12 month window to patch 10s of thousands 542 00:29:53,720 --> 00:29:57,360 of software vulnerabilities found by Mythos AI, which is 543 00:29:57,440 --> 00:30:00,600 Anthropic clawed Mythos. Mythos is the massive 544 00:30:00,600 --> 00:30:03,120 vulnerability scanning engine that they locked down, they were 545 00:30:03,120 --> 00:30:06,880 strict in access to because it was just going to wreak too much 546 00:30:06,880 --> 00:30:09,640 havoc. So they gave access to only a 547 00:30:09,640 --> 00:30:12,840 limited number of trusted partners because basically it 548 00:30:12,840 --> 00:30:14,960 was too good at finding broken stuff. 549 00:30:16,640 --> 00:30:19,840 So they've said there's a 6 to 12 month window to patch all the 550 00:30:19,840 --> 00:30:23,720 bad stuff it's found before Chinese AI catches up. 551 00:30:25,360 --> 00:30:28,720 So for example, an earlier Anthropic model found roughly 20 552 00:30:28,720 --> 00:30:34,880 vulnerabilities in Firefox. Mythos found nearly 300 with 553 00:30:34,880 --> 00:30:35,720 the. Total across all. 554 00:30:35,720 --> 00:30:40,520 Software now in the 10s of thousands and over 99% of these 555 00:30:40,520 --> 00:30:43,480 remain unpatched. Mythos has been restricted to 40 556 00:30:43,480 --> 00:30:48,920 partner organisations including Apple, Amazon, Microsoft, JP 557 00:30:48,920 --> 00:30:53,080 Morgan, Palo Alto under what they call Project Glass Wing. 558 00:30:53,080 --> 00:30:57,920 So Mythos was able to chain 40 day vulnerabilities into a 559 00:30:57,920 --> 00:31:03,720 single browser exploit that escaped both but will escaped 560 00:31:03,720 --> 00:31:06,800 all kinds of protection. So they say that similar 561 00:31:06,800 --> 00:31:09,680 capabilities that essentially you could do the work of Mythos 562 00:31:09,680 --> 00:31:13,600 by chaining together a load of. AI models and being really 563 00:31:13,600 --> 00:31:17,160 clever, but Mythos makes it really easy so. 564 00:31:17,400 --> 00:31:19,680 The state. Of this is the Federal Reserve 565 00:31:19,680 --> 00:31:23,360 Chair and the Treasury Secretary in America have convened bank 566 00:31:23,360 --> 00:31:26,520 CEOs to discuss the implications like straight away. 567 00:31:26,960 --> 00:31:29,920 Is the money safe? That's like that's obviously the 568 00:31:29,920 --> 00:31:31,680 number. One thing for the people in 569 00:31:31,680 --> 00:31:35,840 power, because money is power and power is money, but this is 570 00:31:35,840 --> 00:31:38,960 massive. I think organisations, these 571 00:31:38,960 --> 00:31:43,880 tooling, this tells us why patching is so important and I 572 00:31:43,880 --> 00:31:46,200 think we need, we're going to need to tell our people that 573 00:31:46,720 --> 00:31:50,240 because over the next year there's going to be a load of 574 00:31:50,240 --> 00:31:53,480 patches coming down the pipe, so many systems that haven't been 575 00:31:53,480 --> 00:31:55,440 patched before. And some key. 576 00:31:55,960 --> 00:31:59,360 There's going to be infrastructure, hardware and 577 00:31:59,360 --> 00:32:02,160 software that's going to need patching that maybe you haven't 578 00:32:02,160 --> 00:32:06,280 got patching Windows for. That's going to mean rebooting 579 00:32:06,280 --> 00:32:09,160 systems that haven't been rebooted for years. 580 00:32:09,480 --> 00:32:11,240 And years and people are going to. 581 00:32:11,240 --> 00:32:13,640 Go. What happens if we reboot that 582 00:32:13,720 --> 00:32:16,240 and someone's going to go. I don't know. 583 00:32:16,400 --> 00:32:17,960 It might start up again, it might not. 584 00:32:19,480 --> 00:32:23,080 And this goes far and. Wide like we think about we. 585 00:32:23,080 --> 00:32:25,360 Think about the windows. Systems in the business we used 586 00:32:25,360 --> 00:32:27,720 to work at, there was a time they didn't have a patching 587 00:32:27,720 --> 00:32:31,160 window and then all of that got brought in and then we can think 588 00:32:31,160 --> 00:32:34,440 about like you used to look after some really old CCTV 589 00:32:34,440 --> 00:32:36,520 systems that were running Microsoft XP. 590 00:32:36,760 --> 00:32:40,000 Like 6-7 years ago you know that they should have long been 591 00:32:40,000 --> 00:32:42,960 retired. And this. 592 00:32:42,960 --> 00:32:44,760 Is the type of. Stuff this is going to try and 593 00:32:44,760 --> 00:32:47,600 mop up. It's yeah, it's quite. 594 00:32:47,600 --> 00:32:51,400 Scary to think about mythos. Found a 27 year old 595 00:32:51,400 --> 00:32:55,360 vulnerability in open BSD which is one of the most security 596 00:32:55,360 --> 00:32:57,240 hardened operating systems on the planet. 597 00:33:00,040 --> 00:33:02,720 And and my notes. Here is basically saying if if 598 00:33:02,840 --> 00:33:06,760 you know if decades of expert human review misses that. 599 00:33:07,960 --> 00:33:10,720 Then we kind. Of need AI on the defensive side 600 00:33:10,720 --> 00:33:14,280 as well before they get it on the attacking. 601 00:33:14,280 --> 00:33:16,880 Side yeah, and it's going to. Happen at a. 602 00:33:16,880 --> 00:33:19,640 Nation state level, someone's going to say this in the 603 00:33:19,640 --> 00:33:21,400 comments. In a nation state level, we're 604 00:33:21,400 --> 00:33:23,400 already there, right? Because what they've got behind 605 00:33:23,760 --> 00:33:28,360 closed doors, it's probably 567 generations ahead of what we've 606 00:33:28,360 --> 00:33:29,600 got publicly. What's? 607 00:33:29,600 --> 00:33:35,120 Publicly disclosed is probably. A carefully PR D mission. 608 00:33:35,720 --> 00:33:40,520 So China, whoever, China, Russia, Korea, you know, let's 609 00:33:40,520 --> 00:33:44,160 not discriminate anyone, OK? We have listeners around the 610 00:33:44,160 --> 00:33:45,760 world more than ever, which is amazing. 611 00:33:46,280 --> 00:33:47,120 But. Nation. 612 00:33:47,120 --> 00:33:49,880 States are already going to have access to some of these powerful 613 00:33:49,880 --> 00:33:52,640 tools, you know. People in the East will be. 614 00:33:52,640 --> 00:33:54,520 Poking at people at the West. People in the West will be 615 00:33:54,520 --> 00:33:55,960 poking at people in the East. So patch. 616 00:33:56,640 --> 00:33:57,560 Patch. Patch. 617 00:33:57,560 --> 00:34:00,000 Patch, patch, patch, patch. Yeah, it. 618 00:34:00,680 --> 00:34:05,280 Does make you wonder with the partner organisations who have 619 00:34:05,280 --> 00:34:09,400 access to it, is it locked down to their environment and like 620 00:34:09,600 --> 00:34:13,120 linked to their software or can it be used on like in any way? 621 00:34:13,159 --> 00:34:18,040 Like I said there, I'd hope that it's locked down in some form to 622 00:34:18,239 --> 00:34:22,480 only work on Google, only works on their software. 623 00:34:22,960 --> 00:34:24,880 Who knows? You know, you know. 624 00:34:24,880 --> 00:34:27,960 Who's just become the biggest targets in the world? 625 00:34:28,040 --> 00:34:31,239 Cybersecurity attackers? Anyone who's got access to 626 00:34:31,239 --> 00:34:34,199 project last week? They they are. 627 00:34:34,199 --> 00:34:40,239 Now you know. Yeah, companies like AWS, 628 00:34:40,239 --> 00:34:43,080 Anthropic, Apple, Broadcom, Cisco, Crowdstrike. 629 00:34:43,080 --> 00:34:46,960 Google, JP Morgan Chase, Linux Foundation, Microsoft, NVIDIA, 630 00:34:46,960 --> 00:34:50,639 Palo Alto, they are all now like. 631 00:34:51,360 --> 00:34:53,280 Being poked at. In ways that they've not been 632 00:34:53,280 --> 00:34:56,199 poked before because if someone get access, gets access to them, 633 00:34:57,120 --> 00:35:00,040 it's amazing. Yeah, yeah, yeah, there's a 634 00:35:00,040 --> 00:35:01,560 really nice. Video actually, when you go to 635 00:35:01,560 --> 00:35:04,640 anthropic.com, Glasswing, there's some details about 636 00:35:04,640 --> 00:35:08,160 Mythos and it's a really nice website that kind of explains 637 00:35:08,160 --> 00:35:11,280 explains it all. It's clear it's crystal and kind 638 00:35:11,280 --> 00:35:14,040 of goes through it. It is fairly technical, but if 639 00:35:14,040 --> 00:35:16,160 you want to dive. In that go to anthropic dot 640 00:35:16,160 --> 00:35:20,800 forward slash glasswing and it's yeah, explains a little bit 641 00:35:20,800 --> 00:35:23,200 about it, right let's. Move on to the next one. 642 00:35:24,320 --> 00:35:24,840 Cool. Yeah. 643 00:35:24,920 --> 00:35:27,240 And. Next one, we've got open AI 644 00:35:27,680 --> 00:35:32,320 that's a trusted contact feature to Jack GPT after self harm 645 00:35:32,320 --> 00:35:35,160 lawsuits. So this is a feature that lets 646 00:35:35,160 --> 00:35:38,840 adult users nominate someone who they may want to be notified if 647 00:35:38,840 --> 00:35:41,760 the system detects signs of serious self harm risk. 648 00:35:41,760 --> 00:35:46,880 Gets a bunch of information on on how it works, but it also 649 00:35:46,880 --> 00:35:50,440 says that notifications are reviewed by a small team of 650 00:35:50,440 --> 00:35:53,920 trained humans before being sent with a target review time of 651 00:35:53,920 --> 00:35:56,880 under one hour. So that's almost sounds like 652 00:35:57,520 --> 00:36:01,640 ironically something that an AI could potentially do instead of 653 00:36:02,120 --> 00:36:06,880 a small team of humans. It says that no transcripts or 654 00:36:06,880 --> 00:36:09,320 conversation details are shared with Trusted Contacts. 655 00:36:10,520 --> 00:36:12,600 I guess it's a scan notification that this person's in a 656 00:36:13,080 --> 00:36:15,320 vulnerable position. But yet follows a wave of 657 00:36:15,320 --> 00:36:18,160 lawsuits from families that allege that tractability 658 00:36:18,160 --> 00:36:19,880 encouraged or assisted self harm. 659 00:36:19,880 --> 00:36:22,360 Some critics have argued yet that this feature creates 660 00:36:22,360 --> 00:36:26,000 privacy concerns around who interprets mental States and 661 00:36:26,240 --> 00:36:29,560 escalates sensitive, sensitive information to untrained third 662 00:36:29,560 --> 00:36:31,800 parties. Goes on The vibe and AI reported 663 00:36:31,800 --> 00:36:35,480 that less than 0.1% of its weekly users showed signs of 664 00:36:35,480 --> 00:36:39,440 mental health emergencies. Says quite a sort of tricky 665 00:36:39,880 --> 00:36:41,600 situation. This one, I mean, people use 666 00:36:42,120 --> 00:36:47,240 chat pity for therapy and health, but I feel that that was 667 00:36:47,240 --> 00:36:51,440 something that was sort of they turned off like it matters like. 668 00:36:51,640 --> 00:36:56,040 No Oh it's OK less than nought .1% show signs of self harm or 669 00:36:56,120 --> 00:36:57,520 like. That doesn't matter. 670 00:36:57,520 --> 00:37:01,840 When you've got billions of users, yeah, like nought .1%. 671 00:37:01,840 --> 00:37:03,880 Still a pretty significant number, isn't it? 672 00:37:05,240 --> 00:37:08,040 Yeah, yeah. I've got Trusted Contacts 673 00:37:08,040 --> 00:37:11,160 available on mine and they've said it's a new feature rolling 674 00:37:11,160 --> 00:37:13,160 out. I haven't been notified about it 675 00:37:13,520 --> 00:37:14,640 at all. So. 676 00:37:15,560 --> 00:37:17,480 But it says having. A trusted contact can make it 677 00:37:17,480 --> 00:37:20,920 easier to get support from someone who knows you well in 678 00:37:20,920 --> 00:37:23,000 the future if you discuss suicide. 679 00:37:23,000 --> 00:37:25,800 With ChatGPT in a way that indicates serious safety 680 00:37:25,800 --> 00:37:29,080 concern, we may automatically notify your Trusted Contacts so 681 00:37:29,080 --> 00:37:33,480 they can check in with you. It's not the best. 682 00:37:33,480 --> 00:37:36,320 Way to dress it up. Is it in the future if you 683 00:37:36,320 --> 00:37:39,600 discuss ending your we've ChatGPT in a way that indicates 684 00:37:39,600 --> 00:37:42,840 serious safety concern? I'm sorry, there's there's a 685 00:37:42,840 --> 00:37:47,840 better wording, more sensitive. Like if anyone is thinking about 686 00:37:47,840 --> 00:37:51,120 doing that, one of the last things you do, I think is 687 00:37:51,120 --> 00:37:53,240 admitting that you're thinking about doing that. 688 00:37:54,560 --> 00:37:57,680 Yeah, the. AI should be able to pick up if 689 00:37:57,680 --> 00:38:00,280 you're if you're if you're going down a dark path. 690 00:38:00,400 --> 00:38:03,280 Surely they can pick it up before like asking me. 691 00:38:03,400 --> 00:38:04,720 Oh, if you do discuss. This. 692 00:38:05,760 --> 00:38:07,120 Yeah. Well, maybe as well I. 693 00:38:07,120 --> 00:38:12,760 Can sort of maybe not discuss how to do things. 694 00:38:12,840 --> 00:38:14,760 It seems to be possible, at least at one point it was 695 00:38:14,760 --> 00:38:18,960 possible maybe to find out a lot of information in a bad sort of 696 00:38:19,400 --> 00:38:22,480 way. And I mean, you could know where 697 00:38:22,480 --> 00:38:26,920 the user is, it could put point them to various places for help, 698 00:38:26,920 --> 00:38:28,800 right? Does this not feel like lip? 699 00:38:28,800 --> 00:38:30,440 Service does this not oh it's all. 700 00:38:30,440 --> 00:38:31,680 Right. We've done, we've done this. 701 00:38:31,760 --> 00:38:33,720 It's fine. We've sorted this out. 702 00:38:33,920 --> 00:38:35,960 Yeah, it's it feels like this is. 703 00:38:35,960 --> 00:38:40,440 Very much just providing. Yeah, we're, we're dealing with 704 00:38:40,440 --> 00:38:41,920 this. It reminds me of. 705 00:38:44,560 --> 00:38:47,440 Was it a meta thing, a safety feature that we looked at Baul 706 00:38:47,440 --> 00:38:52,320 back and it was pretty poorly integrated and very basic. 707 00:38:54,800 --> 00:38:56,040 This is to. This is to. 708 00:38:56,040 --> 00:38:59,600 Keep keep people like if people complain, oh, we've had the 709 00:38:59,600 --> 00:39:01,040 lawsuits, right? Yeah. 710 00:39:01,600 --> 00:39:05,360 Yeah, completely. I've also just seen Open AI. 711 00:39:05,360 --> 00:39:08,240 ChatGPT has now got parental controls as well, and parents 712 00:39:08,240 --> 00:39:12,400 and teens can link accounts, giving parents tools to adjust 713 00:39:12,400 --> 00:39:15,160 certain features, set limits and add safeguards. 714 00:39:16,080 --> 00:39:16,960 There's other thing as well, right? 715 00:39:16,960 --> 00:39:19,600 If you're not logged in to ChatGPT, this isn't going to 716 00:39:19,600 --> 00:39:21,360 work. You can use it using logging in. 717 00:39:22,720 --> 00:39:24,000 I think so. I mean, maybe. 718 00:39:24,000 --> 00:39:26,800 Not for maybe like says you've got like a certain amount of 719 00:39:27,040 --> 00:39:29,320 usage, but I mean, it's not just tragic petite, right? 720 00:39:29,320 --> 00:39:32,680 You can Gemini, you can or Google Google AI searches now 721 00:39:32,680 --> 00:39:35,720 you can just do anonymous, anonymous thing. 722 00:39:35,920 --> 00:39:41,520 Yeah, yeah, yeah. Yeah. 723 00:39:41,560 --> 00:39:46,160 I do all of this. The fact it's just been added at 724 00:39:46,160 --> 00:39:48,880 the bottom of the settings window that I don't think I've 725 00:39:48,880 --> 00:39:51,880 ever been in, you know, it doesn't even nudge me. 726 00:39:52,080 --> 00:39:54,040 I've just looked. I haven't got MFA configured. 727 00:39:54,040 --> 00:39:57,480 I think I authenticate through. Google, but I don't have MFA. 728 00:39:57,480 --> 00:39:59,560 Configured as well, and I haven't been prompted for that. 729 00:40:00,120 --> 00:40:02,320 It's like they should be prompting for these basic 730 00:40:02,800 --> 00:40:06,320 things. So yeah, yeah, nice try. 731 00:40:06,320 --> 00:40:09,280 Open AI, but I'm not convinced it's good. 732 00:40:09,800 --> 00:40:13,000 I think you're just trying to keep the wolf from the door in 733 00:40:13,000 --> 00:40:15,000 some ways. Yeah, the next one and. 734 00:40:15,000 --> 00:40:17,960 This is kind of hilarious, but also a bit scary. 735 00:40:18,480 --> 00:40:24,200 Student hacks Taiwan high speed rail by exploiting a 19 year old 736 00:40:24,520 --> 00:40:28,280 radio system. So a 23 year old with consumer 737 00:40:28,280 --> 00:40:32,120 electronics he bought in he bought online managed to stop a 738 00:40:32,120 --> 00:40:36,200 National Rail network carrying 80 million passengers a year. 739 00:40:38,360 --> 00:40:42,920 The the Tetra radio system that the entire Taiwan high speed 740 00:40:42,920 --> 00:40:47,440 rail network relies on hadn't had its encryption keys changed 741 00:40:47,440 --> 00:40:53,560 19. Years 1919 years that's not a 742 00:40:53,560 --> 00:40:56,720 failure of technology that's like a failure of support 743 00:40:56,720 --> 00:41:00,840 maintenance of governance and them not thinking of that the. 744 00:41:00,840 --> 00:41:03,600 Student's defence So the student's defence was said it 745 00:41:03,600 --> 00:41:08,400 was accidental and I mean. That's kind of not completely 746 00:41:08,400 --> 00:41:10,440 convincing. He bought specialised equipment, 747 00:41:10,440 --> 00:41:13,040 decoded the system's parameters, programmed. 748 00:41:13,040 --> 00:41:16,680 Them into handheld radios and transmitted fake emergency 749 00:41:16,680 --> 00:41:20,640 signals at 11:23 PMI mean, that's a lot of. 750 00:41:20,640 --> 00:41:23,240 Accidents to happen in a row, but this was a. 751 00:41:23,240 --> 00:41:27,120 Student, right? Just imagine it's like the plot 752 00:41:27,120 --> 00:41:30,440 of a movie, like it's a die hard movie. 753 00:41:31,120 --> 00:41:33,840 Yeah, we're going to. We're going to bring the whole 754 00:41:33,840 --> 00:41:36,760 train system to a halt, you know, just to do. 755 00:41:36,760 --> 00:41:41,200 This is exactly like Ocean's 11 or something like that, only you 756 00:41:41,200 --> 00:41:44,320 don't. Need some whiz kid at a computer 757 00:41:44,360 --> 00:41:47,160 chewing gum to do it? You can get a 23 year old. 758 00:41:47,920 --> 00:41:50,600 University student who probably is a whiz kid and he might have 759 00:41:50,600 --> 00:41:55,240 been chewing gum. But just imagine what could have 760 00:41:55,280 --> 00:41:59,320 happened with this. So, and this is the thing, it's. 761 00:41:59,320 --> 00:42:02,560 An old system, right? 19 years old, probably put in, 762 00:42:02,880 --> 00:42:05,960 probably maintained for a while, Maybe there's still one guy. 763 00:42:06,000 --> 00:42:10,680 Like I've known one guy who has one responsibility and he's the 764 00:42:10,680 --> 00:42:12,960 only guy in the business that can do that kind of thing. 765 00:42:13,240 --> 00:42:16,080 You know, there's in, in businesses, you have these 766 00:42:16,080 --> 00:42:21,880 legacy technologies that have hung around that work that have 767 00:42:21,880 --> 00:42:24,480 never come to the top of the list when it comes to being 768 00:42:24,480 --> 00:42:27,160 replaced because they just function and the business. 769 00:42:27,160 --> 00:42:28,760 Relies on them, and they're baked in. 770 00:42:29,960 --> 00:42:32,280 And this is exactly the. Type of thing that mythos will 771 00:42:32,280 --> 00:42:34,000 take. Advantage of going back to the 772 00:42:34,040 --> 00:42:37,120 earlier conversation around anthropic mythos, it's it's 773 00:42:37,120 --> 00:42:39,680 scary and especially if you. Can do it. 774 00:42:40,320 --> 00:42:43,160 With stuff you can just. Buy online consumer electronics 775 00:42:44,160 --> 00:42:46,200 Sneakers. That's what this reminds me of 776 00:42:46,480 --> 00:42:49,800 sneakers, the old Robert Redford film, which is still one of my 777 00:42:49,800 --> 00:42:53,160 favourite hacking films. It's it's from the 90s, but it 778 00:42:53,160 --> 00:42:56,800 still holds up today. It's still relevant social 779 00:42:56,800 --> 00:43:00,840 engineering and stuff like this. Yeah, yeah. 780 00:43:01,000 --> 00:43:03,440 So that's crazy. From an awareness. 781 00:43:03,520 --> 00:43:07,160 From a human perspective. These news stories. 782 00:43:07,160 --> 00:43:10,000 Are really good to present to the people in your organisation 783 00:43:10,000 --> 00:43:13,520 because they'll get you thinking about stuff that you haven't 784 00:43:13,520 --> 00:43:14,960 thought of. It might be like, oh, we've got 785 00:43:14,960 --> 00:43:19,400 a really old radio system that we haven't touched for years. 786 00:43:20,360 --> 00:43:21,880 Oh. Yeah, maybe we should look in 787 00:43:21,880 --> 00:43:23,760 there without. Imagine if that happened to us, 788 00:43:23,760 --> 00:43:28,000 You know, that's it and it. Yeah, well, you said one of. 789 00:43:28,000 --> 00:43:31,240 Those things that only one person, or maybe that person's 790 00:43:31,240 --> 00:43:33,920 left and this is unsupported thing. 791 00:43:33,920 --> 00:43:36,920 But that's crazy that yeah, Taiwan's system relied on that. 792 00:43:37,400 --> 00:43:40,120 I knew a business. Once that had their phone system 793 00:43:40,160 --> 00:43:45,600 ran on a computer that was at an employee's home that sat under a 794 00:43:45,600 --> 00:43:48,000 desk at home and it was like a really old system. 795 00:43:48,640 --> 00:43:51,080 I also knew a company once that their whole kind of online 796 00:43:51,080 --> 00:43:55,080 shopping operation ran from a spreadsheet on a desk that had a 797 00:43:55,080 --> 00:43:57,080 post it note on it that said. Don't turn off. 798 00:43:58,520 --> 00:44:00,840 But these were a long. Time ago and businesses evolved 799 00:44:00,880 --> 00:44:02,880 since then. You know, every business will 800 00:44:02,880 --> 00:44:07,120 have these somewhere under a desk or something. 801 00:44:07,200 --> 00:44:09,640 Yeah, right. Move on to the next one. 802 00:44:09,960 --> 00:44:12,280 Last one, I think the next one is to this week. 803 00:44:12,360 --> 00:44:15,720 Yeah, to this. 1. Yeah, it's. 804 00:44:15,760 --> 00:44:19,040 Kind of like a similar one to our last episode Around the 805 00:44:19,080 --> 00:44:21,760 Toaster with Internet connected features. 806 00:44:22,480 --> 00:44:24,720 Who needs an Internet? Connected toaster, sorry. 807 00:44:24,720 --> 00:44:28,320 So you can. Now we've got a YABO robot 808 00:44:28,320 --> 00:44:30,760 lawnmower which has hard coded passwords. 809 00:44:31,400 --> 00:44:34,280 Brilliant. Because yeah, that doors and can 810 00:44:34,280 --> 00:44:36,720 be trolled be controlled remotely by anyone. 811 00:44:36,720 --> 00:44:40,760 So this is security researcher Andreas Macris just covered 812 00:44:40,880 --> 00:44:44,000 critical vulnerabilities in every YABO robot lawnmower 813 00:44:44,000 --> 00:44:46,720 worldwide. And that's roughly 11 similar as 814 00:44:46,720 --> 00:44:49,480 well to the the robot vacuum cleaner. 815 00:44:49,560 --> 00:44:56,200 Yeah, it says that every YABO runs a full Linux instance with 816 00:44:56,200 --> 00:45:00,280 the same hard coded root password that resets of every 817 00:45:00,280 --> 00:45:03,360 firmware update. Which, yeah, allows an attacker 818 00:45:03,360 --> 00:45:07,320 to remotely control the mouse blades movement access on board 819 00:45:07,400 --> 00:45:12,840 cameras, still Wi-Fi passwords and read the GPS coordinates as 820 00:45:12,840 --> 00:45:14,280 well as the owner e-mail address. 821 00:45:15,520 --> 00:45:17,560 And also as you. Mentioned in the start of the 822 00:45:17,560 --> 00:45:20,560 episode, Prevent the emergency stop button from being used. 823 00:45:22,160 --> 00:45:24,680 Yeah, there's a lot to this one. The other telemetry is also 824 00:45:24,680 --> 00:45:27,520 rooted free Byte Dance Systems, which is obviously Tik Tok's 825 00:45:27,520 --> 00:45:31,080 parent company. And this is a $5000 which weighs 826 00:45:31,080 --> 00:45:34,040 over 200 lbs and has blades capable of causing serious 827 00:45:34,040 --> 00:45:35,960 injuries. So it's a bit different. 828 00:45:35,960 --> 00:45:39,880 To a robot vacuum that you can probably just pick up and, you 829 00:45:39,880 --> 00:45:42,720 know, yeah, if this is. I'm just looking at them. 830 00:45:42,720 --> 00:45:45,240 These are hefty units. It doesn't look like a. 831 00:45:46,440 --> 00:45:50,120 Kind of futuristic sci-fi thing there. 832 00:45:50,120 --> 00:45:53,360 And there's a. Let's say a nice. 833 00:45:53,360 --> 00:45:56,080 GIF of it running someone over as well. 834 00:45:57,200 --> 00:45:58,480 Quickly. Just bring that up on the 835 00:45:58,480 --> 00:46:01,080 screen. You see that? 836 00:46:02,080 --> 00:46:04,760 Oh, that's brilliant. So it's possible to. 837 00:46:06,120 --> 00:46:11,000 Run someone over. Yeah, this is quite a it's kind 838 00:46:11,000 --> 00:46:15,760 of a movie part in a way, like an AI uprising of it's got cheap 839 00:46:15,760 --> 00:46:17,400 horror. Film written all over it, hasn't 840 00:46:17,400 --> 00:46:19,760 it? Like Oh my God, the mower. 841 00:46:20,080 --> 00:46:22,440 And then? It's like and then someone 842 00:46:22,440 --> 00:46:24,800 running away from it and just constantly this mower's 843 00:46:24,800 --> 00:46:27,160 following. Yeah, it's. 844 00:46:27,160 --> 00:46:28,920 Got it's scary moving all over it. 845 00:46:29,840 --> 00:46:32,880 But when it's yeah, not. Even just the physical damage 846 00:46:32,880 --> 00:46:37,440 you could do, right? This can obviously get the 847 00:46:37,640 --> 00:46:41,040 cheapest coordinates still. Yeah, you can get the Wi-Fi 848 00:46:41,040 --> 00:46:45,720 password and there's obviously, yeah, 11,000 devices in the 849 00:46:45,720 --> 00:46:47,920 world that could be affected by it. 850 00:46:50,400 --> 00:46:53,160 It's an interesting. One Yabo's telemetry is routed 851 00:46:53,160 --> 00:46:56,120 through Byte Dance. And byte. 852 00:46:56,120 --> 00:47:00,080 Dance is obviously Tik Tok's parent company and there's in 853 00:47:00,080 --> 00:47:03,480 America they had the whole uproar about Byte Dance getting 854 00:47:03,480 --> 00:47:08,600 all of the algorithm from yeah, here is the same company getting 855 00:47:08,600 --> 00:47:12,600 access to GPS locations and. I wonder if these things cameras 856 00:47:12,600 --> 00:47:14,600 as well. So you can because I have can. 857 00:47:14,600 --> 00:47:16,280 Drive it somewhere. Yeah. 858 00:47:16,680 --> 00:47:18,640 Cut some grass. Yeah. 859 00:47:19,520 --> 00:47:21,920 But then if this. Goes through byte dances, 860 00:47:21,920 --> 00:47:23,920 servers. What else goes through Byte 861 00:47:23,920 --> 00:47:27,800 Dance that's like this in so many ways? 862 00:47:27,800 --> 00:47:31,840 You're you're infiltrated by many different things, yeah. 863 00:47:31,880 --> 00:47:36,040 Yeah, that's quite a. Yeah, wild story. 864 00:47:36,440 --> 00:47:38,520 It's quite intricate. You can get AI mean it's. 865 00:47:38,520 --> 00:47:41,200 Amazing. You're both do like a they don't 866 00:47:41,200 --> 00:47:44,920 eat leaf. A robot leaf blower and a robot. 867 00:47:44,920 --> 00:47:48,600 Snow blower and see. That one, yeah, it's. 868 00:47:48,600 --> 00:47:50,520 Like completely much. I kind of want one. 869 00:47:50,600 --> 00:47:52,440 But don't want one. Do you know what I mean? 870 00:47:52,520 --> 00:47:55,720 Like this is. This is I'm not going to get one 871 00:47:55,960 --> 00:47:57,280 that. Yeah, they've. 872 00:47:57,280 --> 00:48:04,520 Got Yeah, yeah, I mean it's a lot of sort of previous risk and 873 00:48:04,520 --> 00:48:08,600 failings I guess in how they've set this up. 874 00:48:09,120 --> 00:48:13,280 And then their back end with the the root bars have been hard 875 00:48:13,280 --> 00:48:15,720 coded and the same on all of them. 876 00:48:15,760 --> 00:48:18,800 And as this great research obviously goes all into the 877 00:48:18,800 --> 00:48:21,880 details there. And I think so it says that 878 00:48:21,880 --> 00:48:25,720 they've reached out to their company and said that they're 879 00:48:25,720 --> 00:48:31,400 solved there by design, even though it can obviously be used 880 00:48:31,560 --> 00:48:33,880 in. Sort of. 881 00:48:35,160 --> 00:48:37,120 Potentially harmful ways. I'm really fed up. 882 00:48:37,120 --> 00:48:40,240 With the excuse for many of these things being there by 883 00:48:40,240 --> 00:48:43,360 design, we had this last week with Microsoft keeping all their 884 00:48:43,360 --> 00:48:46,280 passwords in plain text. Even though like no other 885 00:48:46,280 --> 00:48:49,640 Chromium based browser does, it's Microsoft saying it's by 886 00:48:49,640 --> 00:48:51,360 design. I think that's a really poor 887 00:48:51,360 --> 00:48:53,960 excuse. Like, Oh yeah, it's by. 888 00:48:53,960 --> 00:49:00,320 Design like when someone finds a security issue or a physical 889 00:49:00,320 --> 00:49:03,200 security issue. That shouldn't be. 890 00:49:03,200 --> 00:49:04,880 Acceptable saying it's by design. 891 00:49:04,880 --> 00:49:07,000 It's like what? Your design is really bad. 892 00:49:07,960 --> 00:49:10,800 Yeah, it does go on actually to say. 893 00:49:10,800 --> 00:49:14,160 So this part, this probably explains why it goes to buy 894 00:49:14,160 --> 00:49:18,200 dances service. So they this research piece goes 895 00:49:18,200 --> 00:49:20,480 on to say that the Arbo said that its corporate headquarters 896 00:49:20,480 --> 00:49:25,040 is needed in New York. It's Kickstarter website has a 897 00:49:25,040 --> 00:49:28,800 photo of a nice office block with the Arbo logo across the 898 00:49:28,800 --> 00:49:33,920 front of it about Google Maps suggest it's just a small 899 00:49:33,920 --> 00:49:37,000 building that they sort of bought in America and claimed 900 00:49:37,000 --> 00:49:40,400 it's their their location. And they've gone to say that 901 00:49:40,400 --> 00:49:44,080 Yabo is another name for hanging out in tech, which is based in 902 00:49:44,200 --> 00:49:48,320 Shenzhen, China. So it claims to be a sort of 903 00:49:48,360 --> 00:49:52,160 U.S. company, but it's actually a Chinese company, which is 904 00:49:52,160 --> 00:49:55,440 obviously why they're using, but that's the servers there. 905 00:49:55,440 --> 00:49:58,040 There's another article that goes on to say that you have a 906 00:49:58,040 --> 00:50:00,560 promise to fix some of these issues, but I can't read it 907 00:50:00,560 --> 00:50:04,440 because it's payroll. But yeah, yeah, this is one of 908 00:50:04,440 --> 00:50:06,560 those things, right? Just another Internet of Things 909 00:50:06,720 --> 00:50:09,880 device that's vulnerable. Do you remember we? 910 00:50:09,880 --> 00:50:14,680 Spoke episodes ago about there being a about all IoT devices 911 00:50:14,680 --> 00:50:16,560 having to meet a certain standard. 912 00:50:18,720 --> 00:50:21,160 That clearly. Hasn't come into force yet. 913 00:50:21,600 --> 00:50:26,120 All this ways around it that is so needed for things like this. 914 00:50:26,120 --> 00:50:29,880 And maybe not even maybe then it needs to be there for software 915 00:50:29,880 --> 00:50:33,520 as well, I mean. Yeah, Microsoft. 916 00:50:33,520 --> 00:50:36,480 Edge is Microsoft running on Microsoft. 917 00:50:36,480 --> 00:50:39,640 So like they're going to like we can do what we want, but 918 00:50:39,640 --> 00:50:41,680 something like this like it should. 919 00:50:42,800 --> 00:50:45,040 I'm sure we covered. That old devices would have to 920 00:50:45,040 --> 00:50:47,000 have unique passwords and stuff like this. 921 00:50:48,120 --> 00:50:51,160 This would fail that, surely. Yeah, yeah. 922 00:50:52,240 --> 00:50:57,680 Yeah, it makes you. Sort of wonder, and maybe this 923 00:50:57,680 --> 00:51:01,880 is just in America, but the fact that they can operate and sell 924 00:51:02,400 --> 00:51:07,560 the device to consumers, but no one's checking that they're 925 00:51:08,400 --> 00:51:12,240 genuine in that way. And as yeah, like I said, 926 00:51:12,240 --> 00:51:15,640 there's no checklist for the safety of their their devices 927 00:51:15,640 --> 00:51:18,640 for the Internet connection sort of aspect of it. 928 00:51:18,720 --> 00:51:22,000 Yeah, that's it. It's pretty poor, pretty poor 929 00:51:22,000 --> 00:51:23,680 details of that. We'll put links to all that 930 00:51:23,680 --> 00:51:27,640 research and everything in the newsletter, which get risky 931 00:51:27,640 --> 00:51:31,400 creative.com or search for the awareness angle on LinkedIn. 932 00:51:31,400 --> 00:51:33,920 Right, that's this week's news. So let's get on with some 933 00:51:33,920 --> 00:51:42,080 security socials. OK, so I had a few things to 934 00:51:42,080 --> 00:51:44,920 share this week. The first one is similar to 935 00:51:44,920 --> 00:51:46,600 something you shared a few weeks ago. 936 00:51:46,640 --> 00:51:49,840 A few weeks ago you shared about free Wi-Fi on a plane in a QR 937 00:51:49,840 --> 00:51:52,120 code, right? Well. 938 00:51:52,240 --> 00:51:55,760 This is Instagram and you can see here someone's it's a 939 00:51:55,760 --> 00:51:59,440 McDonald's, there's a sign McDonald's branded that says 940 00:51:59,440 --> 00:52:03,840 free Wi-Fi and there's a Wi-Fi QR code underneath it and. 941 00:52:03,840 --> 00:52:06,920 There's a guy that comes. Up to it puts it up, someone 942 00:52:06,920 --> 00:52:10,920 goes up and scans it and there's the same monkey giving the 943 00:52:10,920 --> 00:52:15,440 middle finger as you scan it and this poor guy is looking around 944 00:52:15,440 --> 00:52:17,280 like what What's happened? What's happened? 945 00:52:17,440 --> 00:52:21,520 Yeah, just be careful with. I mean, that's a fun little 946 00:52:21,520 --> 00:52:23,720 video, right? Share it with your workforce. 947 00:52:24,200 --> 00:52:27,120 Explain why they need to be careful scanning QR codes. 948 00:52:28,200 --> 00:52:34,440 Yeah, the next one I wanted to share this week was something I 949 00:52:34,440 --> 00:52:38,320 saw on. LinkedIn. 950 00:52:38,320 --> 00:52:42,240 So this was something from Joseph Cox, who is the Co 951 00:52:42,240 --> 00:52:46,240 founder and journalist at 404 media, which was, you know, one 952 00:52:46,240 --> 00:52:48,160 of our. Kind of favourite. 953 00:52:49,680 --> 00:52:53,960 Favourite media Cybersecurity news sites 404. 954 00:52:53,960 --> 00:52:57,960 Media is quite good. So recently I opened up 955 00:52:57,960 --> 00:53:02,160 Microsoft Teams and was greeted with a deep faked version of my 956 00:53:02,160 --> 00:53:04,840 own face. Here's how we got the Chinese 957 00:53:04,840 --> 00:53:08,800 language software from being marketed to scammers and which 958 00:53:08,800 --> 00:53:11,560 can be used on WhatsApp, Zoom or other platforms. 959 00:53:11,920 --> 00:53:15,880 So let me just play a little bit of this live. 960 00:53:16,160 --> 00:53:19,680 Real time deep fake version of myself. 961 00:53:20,080 --> 00:53:24,360 Be clear once again, this guy in the Microsoft Teams call is not 962 00:53:24,360 --> 00:53:29,920 actually me. It's my own face on someone 963 00:53:29,920 --> 00:53:33,600 else's body, this guy's. It was all there. 964 00:53:33,960 --> 00:53:37,520 My deepfake even pinched his cheek, covered his nose, and 965 00:53:37,520 --> 00:53:40,760 stroked his chin, all without the illusion breaking. 966 00:53:41,080 --> 00:53:44,240 It's all thanks to a gaming laptop and a sought after 967 00:53:44,360 --> 00:53:47,560 cutting edge piece of deepfake software that I got access to 968 00:53:47,600 --> 00:53:50,440 after weeks of back and forth with the Chinese language 969 00:53:50,440 --> 00:53:53,720 scammers spelling the tool with how Qin AI. 970 00:53:54,360 --> 00:53:56,440 Oh my God. So yeah, it. 971 00:53:56,440 --> 00:53:58,560 Goes on. Basically we spoke a few weeks 972 00:53:58,560 --> 00:54:01,920 ago about the guy asking the person he was interviewing to 973 00:54:01,920 --> 00:54:04,520 put three fingers over his face and the guy refused. 974 00:54:06,680 --> 00:54:08,320 You can do that with this. I mean it's. 975 00:54:09,800 --> 00:54:12,520 They've gone into. It, I mean, it did look slow, it 976 00:54:12,520 --> 00:54:17,600 did look low quality, very soft tones on the face. 977 00:54:17,600 --> 00:54:19,240 It looked like there was a philtre applied. 978 00:54:19,240 --> 00:54:22,320 So it's only going to get better though. 979 00:54:24,200 --> 00:54:27,120 And yeah, maybe you can't believe everything you see on 980 00:54:27,440 --> 00:54:28,440 camera. Anymore. 981 00:54:28,440 --> 00:54:30,040 Yeah. Especially look. 982 00:54:30,040 --> 00:54:35,040 They've got somewhat trained. I I guess the average person 983 00:54:35,040 --> 00:54:37,960 maybe wouldn't see those signs too easily. 984 00:54:38,360 --> 00:54:41,120 And I guess it's about the education side of things that 985 00:54:41,120 --> 00:54:42,520 need to come in. Yeah. 986 00:54:43,080 --> 00:54:48,000 Yeah, yeah, it's. It's worrying times, this stuff, 987 00:54:48,000 --> 00:54:51,880 so this stuff is available, it's out there. 988 00:54:53,120 --> 00:54:58,240 There's a whole article on. Four O 4 media about it that 989 00:54:58,240 --> 00:55:02,160 explains more details about the software and what they saw, but 990 00:55:02,160 --> 00:55:05,560 you need to be a paid member to. Access it, which is a shame. 991 00:55:06,800 --> 00:55:08,560 I feel like I feel. Like they shouldn't have a 992 00:55:08,560 --> 00:55:11,320 paywall on an article like that but I get why they have because 993 00:55:11,320 --> 00:55:13,800 it probably generates a lot of income but it's a shame that 994 00:55:13,800 --> 00:55:15,640 they've paywalled back. I'll move. 995 00:55:15,640 --> 00:55:19,840 On to the next one and the next one was a post I saw on Reddit 996 00:55:19,840 --> 00:55:24,840 on no stupid questions. There are sometimes stupid 997 00:55:24,840 --> 00:55:27,600 questions or no stupid questions, but this one didn't 998 00:55:27,600 --> 00:55:31,160 feel like a stupid question and you can see here. 999 00:55:31,880 --> 00:55:34,600 Why haven't hackers deleted student loans? 1000 00:55:35,840 --> 00:55:36,640 Why hasn't? A. 1001 00:55:36,640 --> 00:55:39,720 Benevolent hacker gotten into certain websites and deleted 1002 00:55:39,720 --> 00:55:42,480 student loans. Is it their ironclad 1003 00:55:42,480 --> 00:55:44,840 cybersecurity? Are the risks too high? 1004 00:55:45,320 --> 00:55:48,200 Is it just not profitable so it wouldn't be worth it? 1005 00:55:48,200 --> 00:55:50,440 If a hacker could delete my mortgage that'd be amazing. 1006 00:55:52,400 --> 00:55:55,240 Do you think each loan servicer just has a massive spreadsheet 1007 00:55:55,240 --> 00:55:57,600 on file shares somewhere called debt Ledger? 1008 00:55:57,600 --> 00:56:02,040 Please don't delete XLS as their only record some of the 1009 00:56:02,040 --> 00:56:03,800 comments. Because delete in a database 1010 00:56:03,800 --> 00:56:07,280 entry doesn't delete the legally binding promissory note you 1011 00:56:07,280 --> 00:56:09,000 sign. The debt exists on paper in. 1012 00:56:09,000 --> 00:56:12,440 Contracts and in court records. So it's quite. 1013 00:56:12,480 --> 00:56:15,760 I mean this is. Quite an interesting it does 1014 00:56:15,760 --> 00:56:18,720 make you wonder if people in organisations, the people we try 1015 00:56:18,720 --> 00:56:23,080 to protect would have questions like that and maybe that's a 1016 00:56:23,080 --> 00:56:25,120 question that we should be answering. 1017 00:56:25,360 --> 00:56:29,600 You know, maybe if we do newsletters, we should have a no 1018 00:56:29,600 --> 00:56:33,440 stupid questions that we can feed from stuff like that. 1019 00:56:36,240 --> 00:56:40,760 Yeah, I think it's not easy to delete like they say. 1020 00:56:40,760 --> 00:56:44,000 It's not as if you that's just written down in one Ledger and 1021 00:56:44,000 --> 00:56:46,160 not. Anywhere else, it's it's kind of 1022 00:56:46,160 --> 00:56:49,280 everywhere, yeah. I had a. 1023 00:56:49,400 --> 00:56:55,440 The other one I wanted to share this week was a post I saw from. 1024 00:56:55,440 --> 00:56:58,400 It was on LinkedIn again and. Let me just load. 1025 00:56:58,440 --> 00:56:59,480 It up. This is from. 1026 00:56:59,800 --> 00:57:07,240 Jessica Bayless So Jessica basically says it felt fitting. 1027 00:57:07,240 --> 00:57:09,880 I got my first recruitment scam e-mail on Saturday. 1028 00:57:11,920 --> 00:57:13,840 Look, I teach people to recognise scams. 1029 00:57:13,840 --> 00:57:15,440 She does our job right? She did. 1030 00:57:15,440 --> 00:57:18,040 She's a cyber policy and human risk leader. 1031 00:57:18,760 --> 00:57:19,480 I teach. People to. 1032 00:57:19,480 --> 00:57:22,560 Recognise scams and I couldn't help but feel the rise in the 1033 00:57:22,560 --> 00:57:26,040 hope, the excitement that maybe, just maybe, this is a lead that 1034 00:57:26,040 --> 00:57:28,480 could result in a job. But that's what they want you to 1035 00:57:28,480 --> 00:57:30,320 feel, so you let your guard down. 1036 00:57:30,320 --> 00:57:32,920 It's exactly the point. That she's making and if we look 1037 00:57:32,920 --> 00:57:36,200 at this e-mail, we can see here. They've tapped into. 1038 00:57:36,280 --> 00:57:38,600 I saw your profile and it clicked your experience. 1039 00:57:39,080 --> 00:57:41,880 In cybersecurity, communication policy development is perfect 1040 00:57:41,880 --> 00:57:43,240 match for the team I have in mind. 1041 00:57:43,440 --> 00:57:46,160 Your ability to translate technical security concepts into 1042 00:57:46,160 --> 00:57:49,360 clear communication and drive behavioural change is exactly 1043 00:57:49,480 --> 00:57:51,200 what they're looking for in a leader. 1044 00:57:51,400 --> 00:57:54,200 To shape their awareness in human risk programmes. 1045 00:57:54,600 --> 00:57:58,960 The compensation for this role is very tasty, plus a bonus. 1046 00:57:59,360 --> 00:58:02,800 If you're open to a move, reach out to the recruiting team at 1047 00:58:03,120 --> 00:58:06,200 and feel free to CC me so they know I'm the one that's sent you 1048 00:58:06,840 --> 00:58:09,200 like that feels there's so many triggers there. 1049 00:58:09,200 --> 00:58:13,040 There's so many like you're. The perfect match you are the 1050 00:58:13,040 --> 00:58:17,240 person we've been looking for you are you're going to solve 1051 00:58:17,320 --> 00:58:21,520 all of our problems we want you and we're going to pay you a 1052 00:58:21,520 --> 00:58:26,200 really nice sum of money to come to us please come to us e-mail 1053 00:58:26,480 --> 00:58:31,440 and mention me as well like the amount of validation and it's 1054 00:58:31,960 --> 00:58:33,400 yeah in. Itself is. 1055 00:58:33,400 --> 00:58:36,760 Like I think. You can see. 1056 00:58:37,520 --> 00:58:41,200 I reckon that's been written. There's a nice M-IN there and 1057 00:58:41,480 --> 00:58:43,760 it's overflowing with enthusiasm. 1058 00:58:44,240 --> 00:58:47,240 So it's got all the hallmarks have been written by AI as well, 1059 00:58:47,360 --> 00:58:49,240 I think, Yeah. Yeah. 1060 00:58:49,720 --> 00:58:52,520 So these are. Probably just done at scale. 1061 00:58:52,640 --> 00:58:55,960 That's the scary thing. There's probably not a human 1062 00:58:55,960 --> 00:58:58,400 behind that that's delivered that. 1063 00:58:58,640 --> 00:59:01,400 It's probably a system. That's been. 1064 00:59:01,400 --> 00:59:04,080 Written. You know they're sending these. 1065 00:59:04,080 --> 00:59:05,400 Out en masse? Yeah. 1066 00:59:05,560 --> 00:59:07,600 Imagine. That yeah, Gmail account you can 1067 00:59:07,600 --> 00:59:09,600 just set up, right? Yeah. 1068 00:59:12,320 --> 00:59:13,280 Do you? I remember now. 1069 00:59:13,280 --> 00:59:17,680 When I when I went open to work on LinkedIn, within seconds I 1070 00:59:17,680 --> 00:59:22,960 had someone message me. Within seconds there was there 1071 00:59:22,960 --> 00:59:24,600 was a Oh. I see you're open to work, blah 1072 00:59:24,600 --> 00:59:26,840 blah blah. And it's like, yeah, how no 1073 00:59:26,840 --> 00:59:29,680 human recruiter is that quick. They need to validate. 1074 00:59:29,680 --> 00:59:33,880 You they need to check, yeah. Kind of makes you think that. 1075 00:59:34,720 --> 00:59:37,920 In a way, if maybe Linkedin's set up that that's possible to 1076 00:59:38,120 --> 00:59:41,560 be easily monitored or scraped in some way you mean? 1077 00:59:42,240 --> 00:59:45,600 LinkedIn isn't. Absolutely. 1078 00:59:46,120 --> 00:59:49,880 I'm shooketh that you'd even suggest that LinkedIn might be 1079 00:59:49,880 --> 00:59:55,280 used for nefarious purposes. My Lord, LinkedIn is a safe 1080 00:59:55,280 --> 00:59:57,960 sanctuary for everyone. I'm going to get cancelled by 1081 00:59:57,960 --> 00:59:59,440 LinkedIn now. Yeah, I had. 1082 00:59:59,520 --> 01:00:02,160 There was one last thing I just wanted to mention and then we'll 1083 01:00:02,160 --> 01:00:06,160 call it a day. We obviously post our content on 1084 01:00:06,360 --> 01:00:10,480 TikTok and on Instagram and we've had some traffic do really 1085 01:00:10,480 --> 01:00:12,160 well. We get loads of comments now and 1086 01:00:12,160 --> 01:00:13,360 stuff like that, which is amazing. 1087 01:00:13,880 --> 01:00:16,640 I got a come on on TikTok which I thought was really 1088 01:00:16,640 --> 01:00:19,360 interesting. And it was by a user. 1089 01:00:19,360 --> 01:00:24,840 Called Grey for Fury and this was us talking about last week 1090 01:00:24,840 --> 01:00:28,120 we spoke about how all most half of UK businesses have been hit 1091 01:00:28,120 --> 01:00:31,840 by a cyber attack 85% of breaches last year were caused 1092 01:00:31,840 --> 01:00:35,280 by phishing grey fury's comment on here says it's because 1093 01:00:35,280 --> 01:00:38,440 security teams silo themselves from. 1094 01:00:38,440 --> 01:00:41,080 Normal. IT and think they can resolve 1095 01:00:41,080 --> 01:00:44,960 this via technology and not engaging with users, though I 1096 01:00:44,960 --> 01:00:47,560 find that really interesting because I'm not sure it's 1097 01:00:47,560 --> 01:00:50,160 security teams. I wonder what side of the fence 1098 01:00:50,160 --> 01:00:52,760 Grey Fury sat on right. Because he might. 1099 01:00:52,760 --> 01:00:56,320 Be sat in an IT team that feels like security, if siloed 1100 01:00:56,320 --> 01:00:59,560 themselves, someone in that security team may feel like 1101 01:00:59,560 --> 01:01:07,400 they've been siloed by IT. Yeah, and I know I've sat in a 1102 01:01:07,400 --> 01:01:12,720 security team that has been outside of outside of IT because 1103 01:01:12,720 --> 01:01:15,600 strategically it was decided that was probably the best 1104 01:01:15,600 --> 01:01:18,840 choice. So they were kind of operating 1105 01:01:18,840 --> 01:01:22,920 independently, but then you're not working. 1106 01:01:23,120 --> 01:01:26,040 Yeah. The key thing that Grey Fury 1107 01:01:26,040 --> 01:01:29,400 makes there, though, is engaging not just with users, but with 1108 01:01:30,000 --> 01:01:33,680 individuals in different teams. And everyone is what? 1109 01:01:33,680 --> 01:01:35,600 That's what. It's engagement isn't. 1110 01:01:35,600 --> 01:01:39,200 It that's what we all need to work on and focus on, yeah. 1111 01:01:42,080 --> 01:01:44,120 Yeah. Right. 1112 01:01:45,080 --> 01:01:46,480 Let's call it a day then, shall we? 1113 01:01:46,600 --> 01:01:48,960 That's it for this week. Yeah, I think so. 1114 01:01:49,360 --> 01:01:52,800 Cool. OK, don't forget you can find 1115 01:01:52,800 --> 01:01:56,400 us@riskycreative.com. You can find us on LinkedIn at 1116 01:01:56,400 --> 01:01:58,280 the Awareness Angle. You can search for the 1117 01:01:58,280 --> 01:02:00,000 newsletter. Newsletter comes out every 1118 01:02:00,000 --> 01:02:03,640 Monday. Instagram at Risky Creative. 1119 01:02:04,000 --> 01:02:08,200 YouTube at Risky Creative. TikTok at infosecond. 1120 01:02:08,320 --> 01:02:11,680 I probably need to change that at some point at infosec and on 1121 01:02:11,760 --> 01:02:15,760 TikTok and yeah, follow like subscribe and come back next 1122 01:02:15,760 --> 01:02:17,080 week. Cool. 1123 01:02:17,440 --> 01:02:18,960 All right, I'll see you next week. 1124 01:02:19,480 --> 01:02:20,720 Go catch ya. See you later. 1125 01:02:21,040 --> 01:02:21,240 Bye.