1 00:00:00,080 --> 00:00:03,800 This week, AUS General gets drunk in Kiev, falls over three 2 00:00:03,800 --> 00:00:07,120 times and then has a meeting with the Secretary of State. 3 00:00:07,720 --> 00:00:11,840 Classified maps go missing on a train. 8 million anonymous crime 4 00:00:11,840 --> 00:00:14,440 tips turn out to be not that anonymous. 5 00:00:15,000 --> 00:00:18,280 The FBI seizes A hackers group's website, but the hackers were 6 00:00:18,280 --> 00:00:21,480 already building new ones. And a Chrome extension you 7 00:00:21,480 --> 00:00:25,880 probably use this week I did has been quietly stealing money from 8 00:00:25,880 --> 00:00:28,160 you for months. Not me, I don't think. 9 00:00:28,160 --> 00:00:32,119 Maybe I don't know, and company's house here in the UK 10 00:00:32,439 --> 00:00:35,360 left the front door open for five months. 11 00:00:35,680 --> 00:00:38,840 You could get in just by pressing back a few times. 12 00:00:39,360 --> 00:00:41,800 It's been a week. Let's get into that and a whole 13 00:00:41,800 --> 00:00:44,520 bunch more on this week's The Awareness angle. 14 00:00:56,430 --> 00:01:00,240 With me, as always, is my partner in cybercrime 15 00:01:00,240 --> 00:01:02,280 prevention. It is of course, Mr Luke 16 00:01:02,280 --> 00:01:03,520 Pettigrew. How you doing, Luke? 17 00:01:04,160 --> 00:01:05,519 Hey, I'm, yeah, I'm Tim off. Thank you. 18 00:01:05,960 --> 00:01:07,920 How are you? I'm good. 19 00:01:08,000 --> 00:01:09,800 Yeah. It's, it's been a week. 20 00:01:09,840 --> 00:01:12,640 Lots of planning and scheduling and conversations. 21 00:01:12,640 --> 00:01:15,200 It's great. Things are growing, but not 22 00:01:15,200 --> 00:01:18,040 ready to announce any of it yet. So yeah, what about you? 23 00:01:18,320 --> 00:01:21,680 Just all good. Yeah, I've been pretty, pretty 24 00:01:21,800 --> 00:01:26,640 quiet one for me, thankfully. Nice, right? 25 00:01:26,960 --> 00:01:28,720 Should we get into it? Should we get on with it? 26 00:01:29,320 --> 00:01:31,880 Yeah, let's go for. It OK, Don't forget all views 27 00:01:31,880 --> 00:01:34,680 and opinions expressed by me or Luke on the show. 28 00:01:34,680 --> 00:01:38,400 I own it and do not represent those of our employers. 29 00:01:38,800 --> 00:01:43,200 So let's get into this week's breach of the week. 30 00:01:47,840 --> 00:01:51,360 And this week's breach of the week is the former US general 31 00:01:51,360 --> 00:01:54,520 who got drunk in Kiev, suffered concussion. 32 00:01:55,040 --> 00:01:58,080 And then they've classified maps on a train. 33 00:01:58,600 --> 00:02:01,600 A watchdog finds. This is a story. 34 00:02:01,600 --> 00:02:06,400 I saw this posted on Reddit and it's one of those that, like, it 35 00:02:06,400 --> 00:02:10,280 sounds made-up, but it's too unbelievable to be made-up. 36 00:02:10,280 --> 00:02:13,520 So a Department of Defence Inspector General report has 37 00:02:13,520 --> 00:02:18,680 found that Major General Antonio Aguto junior, who led U.S. 38 00:02:18,680 --> 00:02:22,480 military assistant efforts in Ukraine from Germany, committed 39 00:02:22,480 --> 00:02:25,520 2 serious security breaches in 2024. 40 00:02:26,280 --> 00:02:32,000 In March, he left classified maps on Auk Ukraine train after 41 00:02:32,000 --> 00:02:35,200 bypassing required career protocols. 42 00:02:35,880 --> 00:02:38,880 The documents were only recovered the following day. 43 00:02:39,080 --> 00:02:42,360 And then two months later, he consumed up to a litre of 44 00:02:42,360 --> 00:02:45,680 alcohol at a Kiev dinner, suffered A concussion from 45 00:02:45,680 --> 00:02:49,520 subsequent falls and appeared visibly impaired at a meeting 46 00:02:49,840 --> 00:02:52,720 with Secretary of State Blinken the next morning. 47 00:02:52,800 --> 00:02:54,280 We don't really care about the drinking. 48 00:02:54,280 --> 00:02:56,760 He's allowed to. Where's the, you know, this 49 00:02:56,760 --> 00:03:00,440 isn't the alcohol awareness angle, although, you know, 50 00:03:00,440 --> 00:03:03,240 drinking moderation, folks. This is the awareness angle 51 00:03:03,240 --> 00:03:07,400 focusing on cybersecurity. It's that one leaving the maps, 52 00:03:07,400 --> 00:03:10,400 leaving stuff on a train. That's like, wow. 53 00:03:10,400 --> 00:03:14,160 Skipping the official process, the official protocol. 54 00:03:14,360 --> 00:03:17,240 That's the scary 1, isn't it? Yeah. 55 00:03:18,000 --> 00:03:21,160 And no, I was going to say it's, that's the reason I brought it 56 00:03:21,160 --> 00:03:24,120 because it's just, it's unique. It's you know, that's the, 57 00:03:24,240 --> 00:03:26,880 that's the angle on this. You know, it's not, again, not a 58 00:03:26,880 --> 00:03:28,680 massive breach. You could have had serious 59 00:03:29,280 --> 00:03:31,800 implications, but it's not a massive breach. 60 00:03:31,800 --> 00:03:33,720 But it's just another, it's, it's different. 61 00:03:33,720 --> 00:03:38,120 This is another case of someone not following process, not 62 00:03:38,120 --> 00:03:41,200 following procedure. And then data has been leaked. 63 00:03:41,200 --> 00:03:45,440 And I remember in the news all the time there used to be the UK 64 00:03:45,440 --> 00:03:49,720 government have left CDs on trains and floppy discs on 65 00:03:49,720 --> 00:03:52,240 trains. This isn't the first time 66 00:03:52,240 --> 00:03:54,120 something like this has happened at all. 67 00:03:54,160 --> 00:03:58,680 No, but yeah, it's just going to say it's quite unusual these 68 00:03:58,680 --> 00:04:01,080 days to really hear about stuff like that. 69 00:04:02,320 --> 00:04:05,160 Physical. Media, yeah, the focus is 70 00:04:05,160 --> 00:04:08,000 obviously always online and breach is happening that way, 71 00:04:09,400 --> 00:04:13,360 but maybe remember of the story many episodes ago about the 72 00:04:13,520 --> 00:04:17,560 sensitive military documents found on the streets of the UK? 73 00:04:18,200 --> 00:04:20,519 It's very similar. That was the one where the bin 74 00:04:20,519 --> 00:04:23,560 bags where someone had put them out in the trash and they were 75 00:04:23,560 --> 00:04:25,840 just blowing in the street, Yeah. 76 00:04:25,840 --> 00:04:30,880 I think that's for for people like us, and I guess maybe more 77 00:04:30,880 --> 00:04:34,280 so like the privacy kind of side of things is we don't really 78 00:04:34,280 --> 00:04:38,760 talk about documents and hard paperwork, what to do with them 79 00:04:38,760 --> 00:04:42,600 and best practises and stuff is sort of everything's digital 80 00:04:42,600 --> 00:04:47,280 these days, isn't it? But yeah, makes you think it's 81 00:04:47,280 --> 00:04:50,040 about similar sort of thing where you used to see in the 82 00:04:50,040 --> 00:04:55,000 news about like new iPhones or new games consoles or whatever 83 00:04:55,000 --> 00:04:58,680 being left somewhere and like, yeah, just left in the pub or 84 00:04:58,680 --> 00:05:00,480 something. Like one of the new phones 85 00:05:00,480 --> 00:05:04,040 that's someone's prototype. Yeah, yeah, yeah. 86 00:05:05,520 --> 00:05:08,320 I think, I'm sure that happened to one of the iPhones. 87 00:05:08,440 --> 00:05:12,040 There was a one of the iPhones. I'm sure someone left it in the 88 00:05:12,040 --> 00:05:15,400 pub or something and it was a proper prototype, like brand new 89 00:05:15,400 --> 00:05:17,080 design. It was one of those where they 90 00:05:17,080 --> 00:05:19,120 changed the physical design of it. 91 00:05:19,120 --> 00:05:25,120 I'm sure this this story comes from the Kiev Independent. 92 00:05:25,920 --> 00:05:30,040 The websites just asked me to allow notifications, which you 93 00:05:30,040 --> 00:05:32,280 can do if you want, but I probably wouldn't recommend it. 94 00:05:32,320 --> 00:05:36,120 There's a 50 page report on this saying he violated policy and 95 00:05:36,120 --> 00:05:40,120 his handling of classified maps while on State department chart 96 00:05:40,120 --> 00:05:41,920 trains. I'm just looking. 97 00:05:42,320 --> 00:05:45,640 The report, which was compiled after receiving three anonymous 98 00:05:45,640 --> 00:05:50,360 complaints, notes that Aguto improperly assigned control of 99 00:05:50,360 --> 00:05:53,600 the maps while on route to Kiev, leaving the materials in the 100 00:05:53,600 --> 00:05:58,160 hands of staff instead of a diplomatic career as required 101 00:05:58,880 --> 00:06:01,040 upon the group's return to Germany. 102 00:06:01,440 --> 00:06:05,840 The maps, which were classified as secret, was subsequently 103 00:06:05,840 --> 00:06:10,200 misplaced and left on the train. They were deemed improperly 104 00:06:10,200 --> 00:06:14,560 stored in an unsecured cylindrical tube and were 105 00:06:14,560 --> 00:06:17,200 returned one day after having been found missing. 106 00:06:17,320 --> 00:06:20,160 So it sounds like these were physical maps, not even 107 00:06:20,160 --> 00:06:22,560 software. They were in an unsecured 108 00:06:22,560 --> 00:06:26,680 cylindrical tube. the US Embassy in Ukraine recovered the 109 00:06:26,680 --> 00:06:30,240 unattended classified documents from the train when it returned 110 00:06:30,240 --> 00:06:34,120 to Ukraine one day and later. So they were still on the train 111 00:06:34,120 --> 00:06:37,240 a day later when the US embassy went to get them back. 112 00:06:37,640 --> 00:06:40,160 So. That's surprising, yeah. 113 00:06:40,920 --> 00:06:43,720 Yeah, and then the drink. I mean, we don't need to really 114 00:06:43,720 --> 00:06:46,520 talk about the drinking, but during a six hour dinner he 115 00:06:46,520 --> 00:06:49,880 drunk from 2 bottles of alcohol. Yeah, and it's. 116 00:06:51,440 --> 00:06:55,120 Yeah, very responsible, but does say they've retired now. 117 00:06:55,120 --> 00:07:00,960 So Oh yes, two years ago, yes. I was hoping they'd be gold in 118 00:07:00,960 --> 00:07:03,600 the comments on Reddit, but they all focused on the alcohol and 119 00:07:03,600 --> 00:07:08,000 not really on the data, so as typical security took a back 120 00:07:08,000 --> 00:07:09,720 seat for the more interesting topics. 121 00:07:10,120 --> 00:07:11,680 So there's something in that as well. 122 00:07:12,560 --> 00:07:16,760 Yeah, right. That is this week's breach of 123 00:07:16,960 --> 00:07:19,680 the week. So now let's get on with some 124 00:07:19,680 --> 00:07:25,920 news. And the first news story this 125 00:07:25,920 --> 00:07:29,840 week comes from cyber news. And this is it's also a leak. 126 00:07:29,840 --> 00:07:31,640 But this is not the breach of the week. 127 00:07:32,600 --> 00:07:38,280 A hacktivist group has breached P3 Global Intel, which is a 128 00:07:38,280 --> 00:07:40,800 Texas based company behind Crime Stoppers. 129 00:07:42,000 --> 00:07:45,920 They're tip platforms which are used by thousands of U.S. law 130 00:07:45,920 --> 00:07:51,520 enforcement agencies, federal bodies and over 30,000 schools. 131 00:07:52,440 --> 00:08:00,560 So the 91.5 very specific there. The 91.5 GB data set, which has 132 00:08:00,560 --> 00:08:05,840 been dubbed Blue Leaks 2 Point O, contains more than 8.3 133 00:08:05,840 --> 00:08:11,320 million submissions spanning nearly 4 decades, including 134 00:08:11,320 --> 00:08:14,280 names, addresses, Social Security numbers, phone numbers, 135 00:08:14,880 --> 00:08:19,400 criminal histories of both the tipsters and those they reported 136 00:08:19,440 --> 00:08:21,320 on. Despite P3's promise that 137 00:08:21,320 --> 00:08:24,880 tipster identities are protected at all times, personal 138 00:08:24,880 --> 00:08:27,560 information from those who shared it appeared throughout 139 00:08:27,560 --> 00:08:30,080 the leak. P3's parent company, Navigate 140 00:08:30,080 --> 00:08:36,440 360, has not responded publicly at the time of the article being 141 00:08:36,440 --> 00:08:40,720 written. So that's an interesting 1 isn't 142 00:08:40,720 --> 00:08:43,760 it? It's blue leaks 2 point O. 143 00:08:44,720 --> 00:08:50,600 Love data again. 9191.53 I've I've got an extra decimal in a 144 00:08:50,600 --> 00:08:56,720 different article 91.53 that's eight point. 3,000,000 145 00:08:56,720 --> 00:08:58,960 submissions. Crazy, it's. 146 00:08:58,960 --> 00:09:00,200 Crazy, isn't it? Yeah. 147 00:09:00,320 --> 00:09:02,400 Do you know what Blue leaks one point O was? 148 00:09:02,400 --> 00:09:03,920 Do you know what the original Blue Leaks was? 149 00:09:03,960 --> 00:09:06,840 I didn't know. For a bit of cyber history this 150 00:09:06,960 --> 00:09:10,440 Blue leaks sometimes referred to by the Twitter hashtag Hashtag 151 00:09:10,440 --> 00:09:17,680 Blue leaks refers to the 269.21 gigabytes of U.S. law 152 00:09:17,680 --> 00:09:21,040 enforcement data that was released by Anonymous in June 153 00:09:21,040 --> 00:09:26,080 2020 and that was by activist group Distributed Denial of 154 00:09:26,080 --> 00:09:29,880 Secrets. It called it the largest public 155 00:09:29,880 --> 00:09:33,400 app on American law enforcement agencies and included 156 00:09:33,400 --> 00:09:38,440 intelligence bulletins, emails, reports from 1996 to 2020. 157 00:09:38,440 --> 00:09:42,200 So very similar like big time frame, lots of data. 158 00:09:42,760 --> 00:09:51,280 That's the original blue leaks. So yeah, it's if you tell people 159 00:09:51,280 --> 00:09:56,840 that they're reporting data and it's anonymous, surely it should 160 00:09:56,840 --> 00:10:02,000 be anonymous. The website reads, I'm just 161 00:10:02,000 --> 00:10:06,160 looking is this the actual so distributed denial of secrets 162 00:10:06,160 --> 00:10:10,040 have got a release website which I've just landed on Cybernews 163 00:10:10,040 --> 00:10:12,400 here. Claim that your anonymity, your 164 00:10:12,400 --> 00:10:15,080 anonymity is protected at all times. 165 00:10:15,360 --> 00:10:19,120 In many cases, your information may be eligible for a reward 166 00:10:19,400 --> 00:10:22,640 offered by a local programme. Clearly not, because they've all 167 00:10:22,640 --> 00:10:24,800 been leaked so. Yeah. 168 00:10:25,520 --> 00:10:30,400 Yeah, it said and yeah, it says that on the P3 Intel website. 169 00:10:31,120 --> 00:10:33,800 If your information relates to students or campus safety, 170 00:10:33,800 --> 00:10:39,080 please visit p3campus.com. So yeah, I think we really need 171 00:10:39,080 --> 00:10:41,560 to be careful. It it does, it's the same group 172 00:10:41,560 --> 00:10:47,400 DD DOS secrets, DDO Secrets, they were provided with the 173 00:10:47,400 --> 00:10:49,560 data. They attribute the breach to a 174 00:10:49,560 --> 00:10:53,720 group calling itself the Internet if Machine, but that 175 00:10:53,720 --> 00:10:57,520 that threat has got no prior public record apparently, so 176 00:10:58,160 --> 00:11:00,440 could be someone new or someone dragging up something. 177 00:11:00,440 --> 00:11:04,160 So yeah, be careful. You should be able to Crime 178 00:11:04,160 --> 00:11:06,120 Stoppers. You should be able to report a 179 00:11:06,120 --> 00:11:09,440 crime anonymously. Surely that should be a thing 180 00:11:10,480 --> 00:11:13,480 you should be able to trust. If you're coming forward, you're 181 00:11:13,480 --> 00:11:14,720 putting yourself on the line there. 182 00:11:14,720 --> 00:11:17,320 You should be able to trust those that you're reporting to. 183 00:11:18,760 --> 00:11:23,160 Now and move to the next one. Yeah, I'm just looking actually 184 00:11:23,160 --> 00:11:28,600 I think there I said there was no, no statement from 360 And 185 00:11:28,600 --> 00:11:31,040 then I've just read at the bottom article, OK, there is a 186 00:11:31,040 --> 00:11:32,600 statement. It's been added. 187 00:11:33,160 --> 00:11:35,000 We're currently working to determine whether we have 188 00:11:35,000 --> 00:11:37,840 experienced an incident involving our computer network 189 00:11:38,320 --> 00:11:42,040 and if so, the extensiveness of the incident and the information 190 00:11:42,040 --> 00:11:44,360 involved. We've hired an independent third 191 00:11:44,360 --> 00:11:47,400 party to conduct a full forensic investigation to determine what 192 00:11:47,400 --> 00:11:52,560 happened, said JP Gilbolt, CEO of Navigate 360. 193 00:11:53,280 --> 00:11:55,560 To this point, we've not confirmed that any sensitive 194 00:11:55,800 --> 00:11:57,880 information has been accessed or misused. 195 00:11:57,880 --> 00:12:00,320 We're determined to learn what happened here, and depending on 196 00:12:00,320 --> 00:12:02,160 what we find, we'll take appropriate action. 197 00:12:02,720 --> 00:12:06,000 So there you go. Yeah, they, they're kind of 198 00:12:06,000 --> 00:12:09,720 saying we're investigating. Someone else is saying the data 199 00:12:09,720 --> 00:12:12,480 is out there. I'm wondering why this data has 200 00:12:12,480 --> 00:12:17,480 been kept for 40 years. That's yeah, yeah. 201 00:12:18,600 --> 00:12:21,680 That's a great one. Right, move on to the next one. 202 00:12:22,800 --> 00:12:24,960 Cool. So this one is new Android 203 00:12:24,960 --> 00:12:27,720 malware. It's hiding in streaming apps to 204 00:12:27,720 --> 00:12:29,640 spy on users. Personal notes. 205 00:12:29,680 --> 00:12:33,720 This one is a researchers Fabric have identified a new Android 206 00:12:33,720 --> 00:12:38,320 malware called Perseus, and it's hiding inside apps that appear 207 00:12:38,320 --> 00:12:45,080 to offer IPTV streaming services, which quite often 208 00:12:45,120 --> 00:12:47,200 stream television content over the Internet. 209 00:12:47,200 --> 00:12:50,920 But they're obviously often for privatised content and you often 210 00:12:51,160 --> 00:12:54,120 get them outside of official marketplaces like Google Play, 211 00:12:54,120 --> 00:12:58,080 so sort of side loading or destroy a different App Store. 212 00:12:58,080 --> 00:13:01,800 And obviously then they're a lot more vulnerable to being 213 00:13:02,080 --> 00:13:06,160 malicious. And they, yeah, they're not 214 00:13:06,200 --> 00:13:09,680 particularly, I guess they're not really reviewed, although 215 00:13:09,680 --> 00:13:13,040 maybe the OS potentially monitors these days. 216 00:13:13,040 --> 00:13:15,440 So yeah, this one as obviously, yeah, Android, once you 217 00:13:15,440 --> 00:13:19,200 installed a malicious application, it captures your 218 00:13:19,960 --> 00:13:23,440 credentials using fake login screens and also does key 219 00:13:23,440 --> 00:13:25,920 logging. But this one targets your note 220 00:13:25,920 --> 00:13:30,000 taking apps like Google Keep and Evernote is 2 that I mentioned. 221 00:13:31,520 --> 00:13:34,280 And ever see extracts the content within those. 222 00:13:34,280 --> 00:13:39,520 And they're commonly used for storing passwords and sensitive 223 00:13:39,520 --> 00:13:42,520 information, financial information and various other 224 00:13:42,520 --> 00:13:45,760 things. So yeah, let's want to be wary 225 00:13:45,760 --> 00:13:49,240 of this one talks about. I've seen credit card details 226 00:13:49,240 --> 00:13:53,640 stored on the Notes app and, you know, banking details and 227 00:13:53,640 --> 00:13:55,560 accounts and sort codes and all sorts. 228 00:13:55,560 --> 00:13:59,080 You know, I don't use passwords. People do though I would imagine 229 00:13:59,160 --> 00:14:03,440 have passwords on note apps. Yeah, it says here that. 230 00:14:04,440 --> 00:14:08,800 So it's primarily, it was actively distributed in the 231 00:14:08,800 --> 00:14:11,440 wild, but it says here that it's primarily targeting users in 232 00:14:11,440 --> 00:14:15,800 Turkey and Italy, according to a report, which was by Fret 233 00:14:15,920 --> 00:14:19,840 Fabric. And it says that Perseus bills 234 00:14:19,840 --> 00:14:22,840 on the leaked code of an older Android banking Trojan, 235 00:14:23,200 --> 00:14:28,320 including Cerberus, which is a prolific malware family. 236 00:14:28,640 --> 00:14:31,280 And the source code of that was exposed in 2020. 237 00:14:31,520 --> 00:14:36,240 But yeah, fun to be wary of, I guess and educate people on the 238 00:14:36,240 --> 00:14:39,720 risks of downloading these kind of apps even just not on 239 00:14:39,720 --> 00:14:42,480 Android, but really on any platform trying to pirate 240 00:14:42,480 --> 00:14:44,720 content you're opening. So you serve up to a lot of 241 00:14:45,320 --> 00:14:47,480 risks there. But to start on this one, it 242 00:14:47,480 --> 00:14:50,240 says that earlier in October, there was a research has 243 00:14:50,240 --> 00:14:54,280 identified another and Contragion Herodotus capable of 244 00:14:54,280 --> 00:14:57,360 mimicking human behaviour to avoid detection during remote 245 00:14:57,360 --> 00:14:59,960 device control. And another malware known as 246 00:14:59,960 --> 00:15:04,640 crocodiles can manipulate victims contacts, allowing you 247 00:15:04,640 --> 00:15:08,240 to allow allowing attackers to impersonate trusted entities 248 00:15:08,240 --> 00:15:13,000 such as banks. So yeah, lots of Andrew and 249 00:15:13,000 --> 00:15:16,000 Malward to be wary of and yeah, that. 250 00:15:17,320 --> 00:15:20,120 Crocodilus one's a really interesting one because last 251 00:15:20,120 --> 00:15:23,080 week we spoke about SMS Blasters because you've received the fake 252 00:15:23,080 --> 00:15:28,440 e-mail from Google, the fake SMS from Google and something like 253 00:15:28,440 --> 00:15:31,680 that, Matt, that Croc dealers malware would also enable that. 254 00:15:31,680 --> 00:15:34,760 I'm not suggesting you've got like one of the latest Android 255 00:15:34,760 --> 00:15:37,040 phones. It's probably patched tightly. 256 00:15:37,160 --> 00:15:41,080 You know, it's not suspecting that you're infected. 257 00:15:41,080 --> 00:15:44,760 I mean, you could be, but I'm not, I'm not suggesting that. 258 00:15:45,160 --> 00:15:50,280 But it's, you know, there's more than more than one way to skin a 259 00:15:50,280 --> 00:15:51,880 rabbit or whatever the saying is. 260 00:15:51,880 --> 00:15:54,560 Do you know what I mean? Like there's multiple threats 261 00:15:54,560 --> 00:15:56,640 that can cause many different things. 262 00:15:56,960 --> 00:16:01,600 Yeah, this was that crocodile. This one was distributed through 263 00:16:01,640 --> 00:16:03,760 malicious adverts primarily on Facebook. 264 00:16:03,760 --> 00:16:05,960 There's, there's guys there. Good old Met. 265 00:16:07,120 --> 00:16:10,840 I saw him as a complete aside, Metro paying influencers 266 00:16:11,680 --> 00:16:14,560 through, I think they're offering them $3000 to come back 267 00:16:14,560 --> 00:16:16,880 to Facebook. They want to like because 268 00:16:17,000 --> 00:16:19,840 Facebook's dying like the average age of a Facebook user 269 00:16:19,840 --> 00:16:22,440 is quite old. So they're paying influencers 270 00:16:22,440 --> 00:16:25,080 from other platforms to come back to Facebook to encourage 271 00:16:25,640 --> 00:16:27,720 the younger generation to come back to Facebook. 272 00:16:27,960 --> 00:16:31,720 The IPTV thing, just to touch on that quickly, there's a reason 273 00:16:31,720 --> 00:16:35,080 IPTV is typically blocked by solutions like Cloudflare, 274 00:16:35,360 --> 00:16:39,560 because illegal streaming. The last two organisations I've 275 00:16:39,560 --> 00:16:42,280 worked at, illegal streaming has been called out specifically in 276 00:16:42,280 --> 00:16:44,880 policies and, you know, is not being allowed. 277 00:16:44,880 --> 00:16:47,360 And it's been something that's actively been pursued should 278 00:16:47,360 --> 00:16:50,240 anyone do it. And it's sports, it's films, 279 00:16:50,240 --> 00:16:54,720 it's TV series, you know, and it's, it's, it's a dangerous 280 00:16:54,720 --> 00:16:57,840 space. There's so many rogue websites 281 00:16:57,840 --> 00:17:01,760 full of adverts. Lots of, you know, you, you are 282 00:17:01,760 --> 00:17:06,720 really taking a real risk when you go and stream a football 283 00:17:06,720 --> 00:17:10,640 match or a boxing match or the latest movie from a site that 284 00:17:10,640 --> 00:17:16,240 might look really professional, but it's illegal content, which 285 00:17:16,240 --> 00:17:18,760 means they're making money somehow, and they'll be making 286 00:17:18,760 --> 00:17:22,119 money from your credit card details that they're taking 287 00:17:22,119 --> 00:17:25,240 secretly. Yeah, it's, it's it's not worth 288 00:17:25,240 --> 00:17:26,800 the risk. It's definitely not worth the 289 00:17:26,800 --> 00:17:28,119 risk. No. 290 00:17:29,520 --> 00:17:31,680 Yeah, right. I'll move on to the next one. 291 00:17:31,720 --> 00:17:35,080 And this is an update on the Stryker incident we spoke about 292 00:17:35,080 --> 00:17:38,640 last week. It was reported today at the 293 00:17:38,640 --> 00:17:42,960 time time we're recording this and that the FBI has seized the 294 00:17:42,960 --> 00:17:47,320 Handala data leak site after the Striker cyber attack. 295 00:17:47,720 --> 00:17:51,840 So 2 websites that belong to Handala which was the Iranian 296 00:17:51,840 --> 00:17:55,360 linked hacktivist group have been seized and this is 297 00:17:55,360 --> 00:17:58,440 following the attack on medical device giant Striker. 298 00:17:58,480 --> 00:18:01,200 Obviously Striker was compromised the attackers. 299 00:18:01,200 --> 00:18:04,440 Some details came out on this this week and someone commented 300 00:18:04,440 --> 00:18:07,280 on a TikTok video I recorded actually to confirm that all of 301 00:18:07,280 --> 00:18:09,160 my information was completely true. 302 00:18:09,400 --> 00:18:12,040 I work for striker they said and everything you've said is 303 00:18:12,040 --> 00:18:15,960 completely true. I think it's reported that they 304 00:18:15,960 --> 00:18:21,520 found old credentials in data breaches of admin accounts that 305 00:18:21,520 --> 00:18:24,040 then gave them access to the Microsoft estate. 306 00:18:24,040 --> 00:18:26,720 And then they used Microsoft Intune, which they had admin 307 00:18:26,720 --> 00:18:30,680 access to, which obviously is a legitimate device management 308 00:18:30,680 --> 00:18:33,520 tool owned by Microsoft. And they pushed factory reset 309 00:18:33,520 --> 00:18:38,240 commands to 80,000 devices. A lot of the devices from 310 00:18:38,240 --> 00:18:41,240 Striker, a lot of the medical devices weren't affected. 311 00:18:41,240 --> 00:18:44,000 We did report last week about there wasn't. 312 00:18:44,000 --> 00:18:47,600 Some weren't communicating back. So I think some are impacted, 313 00:18:48,040 --> 00:18:50,560 but I think the ones that actually save lives, keep people 314 00:18:50,560 --> 00:18:54,560 alive, help people remain alive, I think they're still working 315 00:18:54,560 --> 00:18:57,680 fundamentally. Yeah. 316 00:18:57,720 --> 00:19:00,280 So actually just on the back of that, there's a follow on, 317 00:19:00,720 --> 00:19:06,040 follow up to that. CISA has since issued guidance. 318 00:19:06,040 --> 00:19:10,720 Obviously, CISA is, jeez, what does CISA stand for? 319 00:19:11,800 --> 00:19:16,120 Completely forgotten. An infrastructure Security 320 00:19:16,120 --> 00:19:17,560 Agency. That's the one. 321 00:19:17,560 --> 00:19:19,720 You can tell I'm not an American because otherwise I'll probably 322 00:19:19,720 --> 00:19:23,240 know that they are. America's cyber defence agency 323 00:19:23,680 --> 00:19:28,520 cease to have issued guidance urging all US organisations to 324 00:19:28,520 --> 00:19:33,080 harden their Microsoft Intune environments in response to the 325 00:19:33,080 --> 00:19:36,120 Stryker attack. I think essentially this, this 326 00:19:36,120 --> 00:19:40,320 attack could have been avoided. This is an administrative, it's 327 00:19:40,320 --> 00:19:44,320 an, it's a they, they've left the door open somewhat. 328 00:19:44,320 --> 00:19:48,240 So it wasn't as sophisticated. As that malware involves. 329 00:19:48,760 --> 00:19:51,840 No, no, this is a human. That's why we're talking about 330 00:19:51,840 --> 00:19:52,640 it. It's a human. 331 00:19:53,200 --> 00:19:55,840 There's, there's been some human decisions which have led to this 332 00:19:55,840 --> 00:19:58,600 attack. So, and this is a great one for 333 00:19:58,600 --> 00:20:00,280 us. This is really important. 334 00:20:00,280 --> 00:20:03,840 Why patching and installing your updates and keeping everything 335 00:20:03,840 --> 00:20:07,520 up to date is really important, but also access control. 336 00:20:07,520 --> 00:20:11,840 Microsoft has published hardening advice this week as 337 00:20:11,840 --> 00:20:15,920 well. So if you use Intune to manage 338 00:20:16,080 --> 00:20:19,360 devices. Speak to your tech teams, 339 00:20:19,360 --> 00:20:23,560 they're probably aware of this. But if you're a CSO or you're an 340 00:20:23,560 --> 00:20:26,760 awareness person, just have a word with those that manage your 341 00:20:26,760 --> 00:20:29,280 windows and stay and go. Have you seen this? 342 00:20:29,400 --> 00:20:32,360 And because they might, they don't want to be remediating 343 00:20:32,840 --> 00:20:34,160 this. You don't want to be on the 344 00:20:34,160 --> 00:20:37,600 fixing side of this problem. You want to be on the prevention 345 00:20:37,600 --> 00:20:40,200 side of this problem. Yeah. 346 00:20:40,200 --> 00:20:43,800 So there's there's an update on Handala right next. 347 00:20:44,960 --> 00:20:48,960 So the next one we have is Marquee Texas based fintech 348 00:20:48,960 --> 00:20:53,760 company says over 672,000 people had personal and financial data 349 00:20:53,760 --> 00:20:58,120 stolen in a ransomware attack. So this was something that 350 00:20:58,120 --> 00:21:02,240 happened back in August 2025. And you mentioned to be earlier 351 00:21:02,240 --> 00:21:05,640 that we previously spoke about this one quite a while ago. 352 00:21:05,640 --> 00:21:06,720 Yeah. Yeah, we did. 353 00:21:06,720 --> 00:21:08,840 We covered this on an episode a while ago. 354 00:21:09,760 --> 00:21:12,760 So this one is, yeah, a bit of an update I guess on this one, 355 00:21:14,760 --> 00:21:21,680 basically notified 680,000 people and the hackers stole 356 00:21:21,760 --> 00:21:23,600 their information during the cyber attack. 357 00:21:24,440 --> 00:21:27,360 And yet more than half of those lived in Texas. 358 00:21:28,120 --> 00:21:32,040 Yeah, basically said the most, most information that this sort 359 00:21:32,040 --> 00:21:34,920 of story had so far on the number which was previously not 360 00:21:34,920 --> 00:21:36,520 reported. I mean, this breach allowed 361 00:21:36,840 --> 00:21:40,800 attackers to still banking names, dates of birth, postal 362 00:21:40,800 --> 00:21:42,880 addresses, financial information, their bank 363 00:21:42,880 --> 00:21:46,160 accounts, credit card numbers and also took Social Security 364 00:21:46,160 --> 00:21:48,400 numbers as well. Everything you need for a good 365 00:21:48,400 --> 00:21:51,560 fishing pack campaign, Yeah. And yeah, one of the interesting 366 00:21:51,560 --> 00:21:55,520 points on this one is that Marquee themselves sued its 367 00:21:55,680 --> 00:22:00,160 firewall provider Sonic Wall, in February because they accused 368 00:22:00,240 --> 00:22:03,640 the company of security failings that allowed the hackers to 369 00:22:03,640 --> 00:22:06,680 steal critical information about its firewalls and which then the 370 00:22:06,680 --> 00:22:11,040 hackers used to compromise Marquis network and steal data 371 00:22:11,040 --> 00:22:15,480 and deploy ransomware to it. So in the lawsuit, they said 372 00:22:15,480 --> 00:22:19,680 that Marquis said that Sonic will create a vulnerability that 373 00:22:19,680 --> 00:22:23,880 allowed hackers to steal the configuration backup files, 374 00:22:23,880 --> 00:22:27,240 including their own. Obviously Marquis, but yeah, 375 00:22:27,240 --> 00:22:30,600 that's quite a wild story in itself. 376 00:22:30,600 --> 00:22:33,200 I don't know if he spoke about that one last minute when it 377 00:22:33,200 --> 00:22:36,520 happened in February. I don't remember hearing about 378 00:22:36,520 --> 00:22:39,040 that. No, that's news to me. 379 00:22:39,040 --> 00:22:41,120 It's interesting. Then there's two things that 380 00:22:41,120 --> 00:22:42,960 interest me on this. It's number one, they've 381 00:22:42,960 --> 00:22:45,520 obviously done enough analysis to work out where the 382 00:22:45,520 --> 00:22:49,120 information came from, therefore pointing the finger at Sonic 383 00:22:49,120 --> 00:22:52,960 Wall to the case, to the amount that they're confident they've 384 00:22:52,960 --> 00:22:54,960 got a legal claim against Sonic Wall. 385 00:22:56,120 --> 00:23:00,320 So they've obviously got a good track record, but also this 386 00:23:00,320 --> 00:23:03,440 happened in August and they've only just notified users. 387 00:23:03,960 --> 00:23:09,400 I mean, surely in a breach you assume the worst and then it's 388 00:23:09,400 --> 00:23:12,320 weird that this is where there's different approaches and I'm not 389 00:23:12,320 --> 00:23:15,800 see so and I'm not PR. So then maybe they sorry, maybe 390 00:23:15,800 --> 00:23:20,280 they I think they did notify them in February. 391 00:23:20,440 --> 00:23:25,560 Yeah, I'm not really sure why this It says here that date of 392 00:23:25,560 --> 00:23:29,600 breach occurred August right now if they the reading that the 393 00:23:29,600 --> 00:23:31,680 American dates is month first isn't. 394 00:23:32,080 --> 00:23:34,600 It. So it's December 2nd was when 395 00:23:34,600 --> 00:23:38,480 they notified consumers, right? OK. 396 00:23:39,160 --> 00:23:42,280 So it did take four months for that. 397 00:23:42,880 --> 00:23:49,360 And I think even then they just maybe didn't specify publicly 398 00:23:49,360 --> 00:23:52,640 what was never involved. It's quite interesting, that 399 00:23:52,640 --> 00:23:56,000 article that we, we've got this story in on TechCrunch. 400 00:23:56,720 --> 00:24:02,120 They've listed, there's a link on that that goes to a data 401 00:24:02,120 --> 00:24:09,160 breach notice filed in Texas. So yeah, on oag.my.site.com, 402 00:24:09,160 --> 00:24:12,760 which is an awful, awful domain. Office of the 403 00:24:12,760 --> 00:24:16,640 attorneygeneral.my.site.com. Yeah. 404 00:24:16,840 --> 00:24:19,720 Ken Paxton, Attorney general of Texas data security breach 405 00:24:19,720 --> 00:24:23,960 reports and there's a list of all data breach reports so I can 406 00:24:23,960 --> 00:24:27,360 see at the time of recording yesterday, Kaplan North America, 407 00:24:27,440 --> 00:24:32,000 Open Loop Health, William Hart and Bound US LLP. 408 00:24:32,040 --> 00:24:36,080 You know, there's and capital store oil and gas. 409 00:24:36,080 --> 00:24:38,680 There's three that happened just yet that were reported just 410 00:24:38,680 --> 00:24:41,720 yesterday and then there's four more from the day before. 411 00:24:42,080 --> 00:24:45,200 So this is obviously, you know, Texas is big, the UK is smaller 412 00:24:45,200 --> 00:24:48,560 than Texas and Texas is just one state in the whole of America. 413 00:24:48,560 --> 00:24:52,080 So I think it's really good that you get that kind of visibility 414 00:24:52,080 --> 00:24:54,560 really good. And then I can't remember, we 415 00:24:54,560 --> 00:24:56,480 spoke about this. I'm just, it tells you what type 416 00:24:56,480 --> 00:24:58,200 of information is it affected as well? 417 00:24:58,560 --> 00:25:00,520 It's a conduent business services. 418 00:25:00,960 --> 00:25:04,120 I can't remember if we spoke about this, but we must have 2nd 419 00:25:04,160 --> 00:25:08,160 of February, 15,000,000 records, number of Texans affected, 420 00:25:08,240 --> 00:25:11,280 15,000,000 Social Security number, medical information, 421 00:25:11,280 --> 00:25:13,440 health insurance. We must have spoken about that. 422 00:25:13,720 --> 00:25:16,040 But it's really good that that's, I mean, it's probably 423 00:25:16,040 --> 00:25:19,240 published publicly elsewhere. I'm probably being really naive 424 00:25:19,240 --> 00:25:25,120 pretending that it isn't. Yeah, that's you can't find any 425 00:25:25,120 --> 00:25:30,200 more information out just the address, the zip code, type of 426 00:25:30,200 --> 00:25:34,360 information, number affected, notice provided to consumers. 427 00:25:34,360 --> 00:25:37,360 Yes or no? That's an interesting one, 428 00:25:38,800 --> 00:25:40,200 Marquee. So here we go. 429 00:25:40,400 --> 00:25:44,040 Marquee Software solutions number affected this 12th of 430 00:25:44,040 --> 00:25:46,120 February. This was filed 12th of February 431 00:25:46,120 --> 00:25:48,480 2025. Yeah. 432 00:25:48,880 --> 00:25:53,080 Marquee Software solutions 354,000 Texans affected. 433 00:25:53,480 --> 00:25:57,200 Notice provided to consumers. No, Right. 434 00:25:58,320 --> 00:25:58,960 Yeah. There you go. 435 00:25:59,680 --> 00:26:03,960 Yeah, have they got there's a search functionality here? 436 00:26:04,320 --> 00:26:08,560 Yeah, that's the only one here. 12th of February or is that the 437 00:26:08,560 --> 00:26:10,400 2nd? 2nd of December, isn't it? 438 00:26:10,400 --> 00:26:15,600 I've just done the same thing. 2nd of December 2020, five, 354. 439 00:26:15,600 --> 00:26:17,880 So that's less than the figure we've just spoken about. 440 00:26:18,240 --> 00:26:20,960 It's half of the figure we've just spoken about. 441 00:26:20,960 --> 00:26:25,440 And it says notice provided to consumers, No, So yeah, yeah. 442 00:26:25,760 --> 00:26:28,680 OK. So third party vendors suing 443 00:26:28,680 --> 00:26:31,400 Sonicwall is an interesting one. Be interesting to see how that 444 00:26:31,400 --> 00:26:32,880 lands. Yeah, I don't know if there's 445 00:26:32,880 --> 00:26:36,160 any news on that one, but maybe we'll talk about it in a future 446 00:26:36,160 --> 00:26:39,520 episode. Yeah, yeah, right. 447 00:26:39,680 --> 00:26:41,840 I'll move on to the next one. I nearly brought this as a 448 00:26:41,840 --> 00:26:44,800 topic, but it made the news so I don't need to. 449 00:26:45,320 --> 00:26:47,680 I received an e-mail related to this this week. 450 00:26:47,720 --> 00:26:50,520 Company's house. In the UK, when you have a 451 00:26:50,840 --> 00:26:53,960 business or a limited company or something, you haven't 452 00:26:53,960 --> 00:26:56,800 registered with Companies House. Companies House is the house 453 00:26:56,800 --> 00:26:59,320 that manages all the companies. It's a government entity. 454 00:26:59,320 --> 00:27:03,440 Company's house suspends filing service after five months. 455 00:27:03,440 --> 00:27:07,880 Security glitch exposed directors details? 456 00:27:08,600 --> 00:27:12,120 So I got an e-mail telling me about this and my immediate 457 00:27:12,120 --> 00:27:13,920 thought was it was a security incident. 458 00:27:13,920 --> 00:27:17,240 It wasn't. It's a bug glitch that they 459 00:27:17,240 --> 00:27:22,000 claim hasn't led to any data breaches, but a routine IT 460 00:27:22,000 --> 00:27:26,840 update in October 2025 left a vulnerability in Companies House 461 00:27:26,840 --> 00:27:30,920 web filing service that was undetected until now. 462 00:27:31,000 --> 00:27:37,800 So since October, any logged in user could access another 463 00:27:37,800 --> 00:27:43,200 company's private dashboard, including directors, home 464 00:27:43,200 --> 00:27:47,200 addresses, e-mail addresses and dates of birth. 465 00:27:47,200 --> 00:27:50,760 And that information is not publicly available on Companies 466 00:27:50,760 --> 00:27:53,800 House. And all you had to do was press 467 00:27:53,800 --> 00:27:58,920 the browser back button a few times, Back, back, back, back, 468 00:27:58,920 --> 00:28:01,000 back. I mean, it's like a seat. 469 00:28:01,000 --> 00:28:04,200 It's like a cheat code. It's like up, down, it's like 470 00:28:04,200 --> 00:28:07,120 the Capcom code, up, down, left, right, yeah, press the back 471 00:28:07,120 --> 00:28:10,160 button a few times. The floor was accidentally 472 00:28:10,160 --> 00:28:14,760 discovered by business services provider, who then alerted a tax 473 00:28:14,760 --> 00:28:19,000 campaigner, Dan Needle, who in turn then contacted Company's 474 00:28:19,000 --> 00:28:21,680 House. So the service was suspended on 475 00:28:21,680 --> 00:28:25,240 the 13th of March and restored on the 16th of March. 476 00:28:25,480 --> 00:28:28,320 Company's House says it does not believe data was extracted 477 00:28:28,320 --> 00:28:33,000 systematically, but has reported itself to the ICO and in the 478 00:28:33,000 --> 00:28:36,480 NCSC and has asked all UK companies to check their 479 00:28:36,480 --> 00:28:40,480 details. So if you are a director of AUK 480 00:28:40,480 --> 00:28:43,440 business, you need to go and check your company's house 481 00:28:43,440 --> 00:28:45,920 records. Or if you have minions that do 482 00:28:45,920 --> 00:28:49,680 that stuff for you, tell them to go and check your company's 483 00:28:49,680 --> 00:28:51,520 house records. I'll be checking my own. 484 00:28:51,640 --> 00:28:55,320 I, I think it's amazing. It's yeah. 485 00:28:56,000 --> 00:28:57,520 Back, back, back, back, back, back, back. 486 00:28:57,520 --> 00:29:01,720 Oh, I mean, that's amazing. That's about coding bug or 487 00:29:01,720 --> 00:29:05,720 something there, isn't it? Yeah, it's one of those things. 488 00:29:05,880 --> 00:29:10,000 Not browser buggers it is. Tommy has something in their 489 00:29:10,280 --> 00:29:13,480 website that's, yeah, pretty poor, but I wonder how someone 490 00:29:13,480 --> 00:29:14,600 found that out. I don't know. 491 00:29:16,640 --> 00:29:19,320 No, it's mad, isn't it? It's really, really funny. 492 00:29:19,960 --> 00:29:22,840 Yeah. It's how would you even? 493 00:29:22,840 --> 00:29:24,120 Yeah. I mean, it's really. 494 00:29:24,160 --> 00:29:27,320 Accidental, right, But. I guess it is accidental. 495 00:29:27,560 --> 00:29:32,320 Yeah, I guess it is. It's, I just find it funny that 496 00:29:32,320 --> 00:29:36,360 that's that's done that. Worrying. 497 00:29:37,240 --> 00:29:39,960 So the vulnerability was discovered on the 12th of March 498 00:29:39,960 --> 00:29:44,200 by John Hewitt at Ghost Mail, who's a corporate services 499 00:29:44,200 --> 00:29:46,240 provider. He tried to contact Companies 500 00:29:46,240 --> 00:29:50,400 House, we didn't get response. Well that's even worse. 501 00:29:51,840 --> 00:29:53,920 And there's a video here, obviously amazing. 502 00:29:53,960 --> 00:29:57,040 So Tax Policy Associates is Dan's website. 503 00:29:57,760 --> 00:29:59,280 There's a video here trying. To explain. 504 00:29:59,280 --> 00:30:03,160 Once the company number is, yeah, So what he's doing, he's 505 00:30:03,160 --> 00:30:09,680 in company's house and he's basically got got the companies 506 00:30:09,680 --> 00:30:12,720 in front of him. And then very, very familiar. 507 00:30:12,960 --> 00:30:16,360 One of the options is he goes to file for a different company, 508 00:30:16,360 --> 00:30:18,640 which is an option. And then it's asking him to put 509 00:30:18,640 --> 00:30:24,920 in a company number, these 8 characters long, and there it 510 00:30:24,920 --> 00:30:29,680 looks like he's typing in a company number. 2296. 511 00:30:34,360 --> 00:30:37,680 He's pressed continue and it's showing a company, Yeah, OK, 512 00:30:37,680 --> 00:30:39,680 which is all. This is all public record. 513 00:30:40,520 --> 00:30:42,960 He's pressed confirm and continue, and now it's asked for 514 00:30:42,960 --> 00:30:46,480 company authentication code. So the authentication code is 515 00:30:46,480 --> 00:30:51,280 what you need to access the actual specific data that's like 516 00:30:51,280 --> 00:30:54,280 private to you. Now he's going and he's pressing 517 00:30:54,280 --> 00:30:59,880 back and back again and back again, and it's taken him back 518 00:30:59,880 --> 00:31:02,560 through the pages he's been, but rather than taking him back to 519 00:31:02,560 --> 00:31:06,400 the company that he would have was originally at, it's taken 520 00:31:06,400 --> 00:31:08,520 him back to the company he's tried to access. 521 00:31:08,600 --> 00:31:10,880 So it's bypassed that hidden access code. 522 00:31:10,880 --> 00:31:13,200 That's incredible. Yeah, that's a. 523 00:31:13,360 --> 00:31:14,600 That's a bug and a half, isn't it? 524 00:31:15,760 --> 00:31:18,200 Yeah, that's terrible. Yeah. 525 00:31:19,320 --> 00:31:23,120 So yes, there we go. If you have a limited company in 526 00:31:23,120 --> 00:31:26,560 the UK or you've got a company registered company's house, you 527 00:31:26,560 --> 00:31:29,760 should go and check your company's house records now that 528 00:31:29,760 --> 00:31:31,800 problem has been fixed, apparently. 529 00:31:32,360 --> 00:31:33,760 That's an interesting one. Yeah. 530 00:31:33,760 --> 00:31:34,960 Do you? Want to move on to the next one? 531 00:31:35,400 --> 00:31:38,160 Yeah, yeah. So this one is popular crime 532 00:31:38,160 --> 00:31:42,680 extension Save images type has been removed after hijacking 533 00:31:42,680 --> 00:31:45,360 affiliate links for months. So this one looks like from a 534 00:31:45,360 --> 00:31:49,320 Reddit post. Yeah, I couldn't find any news 535 00:31:49,320 --> 00:31:50,880 on this. Yeah. 536 00:31:51,680 --> 00:31:53,360 But I found a couple of Reddit posts. 537 00:31:53,960 --> 00:31:57,640 So yeah, Google removed the Chrome extension save images 538 00:31:57,640 --> 00:32:01,320 type which had over 1,000,000 users and a featured badge from 539 00:32:01,320 --> 00:32:05,280 Google which has been no means. It's all safe and good to go. 540 00:32:05,520 --> 00:32:07,280 That's got to be good. Google have featured it. 541 00:32:07,680 --> 00:32:11,080 Yeah and yeah, after it was found to be silently hijacking 542 00:32:11,080 --> 00:32:17,640 affiliate links since November 2025, the extension change 543 00:32:17,640 --> 00:32:21,280 ownership and was updated with malicious code that injected 544 00:32:21,280 --> 00:32:24,520 hidden iframes into pages to redirect shopping shopping 545 00:32:24,520 --> 00:32:29,320 commissions from retailers like Amazon, Adidas, Sheehan to the 546 00:32:29,320 --> 00:32:31,480 no owners. Malicious behaviour was designed 547 00:32:31,480 --> 00:32:34,320 to evade detection, only activating after a user had 548 00:32:34,320 --> 00:32:38,920 saved at least 10 images. Microsoft Edge also removed the 549 00:32:38,920 --> 00:32:42,520 same extension, but they did it a year earlier, which is 550 00:32:42,920 --> 00:32:46,240 interesting. I wonder if that was same 551 00:32:46,240 --> 00:32:47,360 reasons or not. But. 552 00:32:50,400 --> 00:32:56,360 And yeah, I think as we know it's been removed, but it still 553 00:32:56,360 --> 00:32:57,800 could be in your in your browser. 554 00:32:58,200 --> 00:32:59,680 So. Is that sort of thing? 555 00:33:00,000 --> 00:33:03,760 No, Google have removed it now. So I used to, I had this, I had 556 00:33:03,760 --> 00:33:05,640 this installed. I used to use it quite 557 00:33:05,640 --> 00:33:07,720 frequently. I may have used it more than 10 558 00:33:07,720 --> 00:33:11,960 times since November. And the reason I used it is 559 00:33:11,960 --> 00:33:14,000 because when you're trying to get images, I recently built a 560 00:33:14,000 --> 00:33:16,360 slide deck and I needed some like logos. 561 00:33:16,360 --> 00:33:19,720 So Google image search, you download images from Google 562 00:33:19,720 --> 00:33:26,000 image search and they're web P files, webp files and Canva and 563 00:33:26,000 --> 00:33:32,560 stuff don't support webp files. So you use this save image as 564 00:33:32,560 --> 00:33:36,920 type, right click on the image, save images, type PNG and it 565 00:33:36,920 --> 00:33:41,000 saves it as a PNG. So I opened up Chrome and I can 566 00:33:41,000 --> 00:33:44,320 share my screen quickly to explain the experience. 567 00:33:44,320 --> 00:33:48,200 Here I'm going to show you what extensions I've got installed. 568 00:33:50,520 --> 00:33:53,840 So here we can see review one extension that may be unsafe. 569 00:33:53,840 --> 00:33:55,520 Chrome recommends that you use it. 570 00:33:56,160 --> 00:34:00,920 Save image as type. This extension contains malware. 571 00:34:01,240 --> 00:34:05,640 So I can keep the extension or I can remove it. 572 00:34:06,840 --> 00:34:08,719 Chrome recommends review this extension. 573 00:34:09,159 --> 00:34:11,320 So it's great that they put the remove it underneath. 574 00:34:11,320 --> 00:34:15,159 See more details. Yeah, not just like you can keep 575 00:34:15,159 --> 00:34:16,600 it. That's the easy option. 576 00:34:17,040 --> 00:34:21,080 Yeah, I mean it is off and I can't turn it back on. 577 00:34:21,760 --> 00:34:22,920 But you could. But you could keep it. 578 00:34:23,639 --> 00:34:26,280 But I can keep it but it's. It's but it work. 579 00:34:26,440 --> 00:34:29,120 Maybe, maybe it won't. No, it won't because it's off 580 00:34:29,120 --> 00:34:32,880 and I can't turn it on. Which, yeah. 581 00:34:34,520 --> 00:34:37,719 So yeah, that's gone just. Remove it just just. 582 00:34:38,080 --> 00:34:41,000 Take it away and notify users? That's crazy. 583 00:34:41,480 --> 00:34:46,600 Yeah, it's quite, it's quite. Yeah. 584 00:34:46,600 --> 00:34:49,800 I've had, this was like one of the, this is like one of the 585 00:34:49,800 --> 00:34:52,719 three extensions that I've had for years. 586 00:34:53,400 --> 00:34:56,440 You know, it used to be there's like four that I've always had 587 00:34:56,440 --> 00:35:00,200 for years. There's this, there's you block 588 00:35:00,200 --> 00:35:03,640 origin that obviously got retired when Google Chrome 589 00:35:03,640 --> 00:35:07,040 decided they hated app blockers. Go full page, which takes full 590 00:35:07,040 --> 00:35:09,160 page screenshots and a colour dropper. 591 00:35:09,400 --> 00:35:14,240 They're typically the four. Like they're my holy quadrantity 592 00:35:14,240 --> 00:35:17,920 of things. There is, so I'm going to remove 593 00:35:17,920 --> 00:35:19,920 that. Now it's asking me remove images 594 00:35:19,920 --> 00:35:23,080 type by. So yeah, that's gone. 595 00:35:23,760 --> 00:35:27,320 Yeah, on the Reddit post. Yeah, as a success. 596 00:35:27,320 --> 00:35:31,000 Yeah, I see on the Reddit there's a few people talking 597 00:35:31,000 --> 00:35:36,720 about they've like forked the GitHub prepository for that old 598 00:35:36,720 --> 00:35:38,600 extension and cleaned it up and stuff. 599 00:35:38,600 --> 00:35:40,800 But I guess be careful anyway with those. 600 00:35:40,880 --> 00:35:43,160 You never know, yeah. There is a replacement called 601 00:35:43,160 --> 00:35:46,120 Save Images PNG which will be useful. 602 00:35:46,360 --> 00:35:49,120 It's this is a, this is a fundamental problem with 603 00:35:49,960 --> 00:35:52,840 extensions and it's a problem that everybody in every business 604 00:35:52,840 --> 00:35:56,080 has. Extensions live in what is 605 00:35:56,080 --> 00:35:59,520 arguably one of the most privileged places on your 606 00:35:59,520 --> 00:36:02,040 computer. They have the ability to see 607 00:36:02,040 --> 00:36:05,800 everything you do. When we worked together a few 608 00:36:05,800 --> 00:36:09,120 years ago, I tried arguing that, like we were talking about 609 00:36:09,120 --> 00:36:12,000 computers and hardware and they were moaning about the amount 610 00:36:12,000 --> 00:36:14,840 they were spending on laptops and you know, it's stuff. 611 00:36:14,840 --> 00:36:16,920 And I went, all these users, why don't you shove them on 612 00:36:16,920 --> 00:36:18,680 Chromebooks? Because all they need is a 613 00:36:18,680 --> 00:36:22,480 browser. Like so many people, HR and now 614 00:36:22,480 --> 00:36:26,120 even more so HR functions. You know, anyone that doesn't 615 00:36:26,120 --> 00:36:31,920 use Microsoft Office or AutoCAD or Photoshop, any generic kind 616 00:36:31,920 --> 00:36:35,040 of general user could probably just work with a Chromebook. 617 00:36:35,520 --> 00:36:39,080 And then your hardware exposure is reduced, your hardware cost 618 00:36:39,080 --> 00:36:44,520 is probably reduced, and they're more secure typically as well. 619 00:36:44,680 --> 00:36:48,360 But because the browser, everything lives in the browser 620 00:36:48,360 --> 00:36:50,120 now. And that's the problem and 621 00:36:50,120 --> 00:36:54,520 that's why these extensions and it this is exactly what happened 622 00:36:54,520 --> 00:36:58,280 with you block like years ago, the the app blocker God, it must 623 00:36:58,280 --> 00:37:00,360 be years. It's years and years ago you 624 00:37:00,360 --> 00:37:05,400 block trusted app blocker got sold, all of a sudden started 625 00:37:05,400 --> 00:37:08,120 doing dirty stuff, which is why we ended up with you block 626 00:37:08,120 --> 00:37:10,800 origin because the original developer was like, you're 627 00:37:10,800 --> 00:37:14,200 ruining my reputation. I'll recreate it and call it you 628 00:37:14,200 --> 00:37:15,400 block origin. So. 629 00:37:15,480 --> 00:37:17,880 Yeah. You don't know. 630 00:37:18,520 --> 00:37:22,320 You don't know when something changes hands and every update. 631 00:37:22,360 --> 00:37:25,280 You're trusting so many third parties with every single 632 00:37:25,280 --> 00:37:28,320 browser extension you have. Well, yeah, and as well, the 633 00:37:28,800 --> 00:37:31,480 browser extensions update themselves, right? 634 00:37:31,480 --> 00:37:34,000 You don't, Yeah, don't really have to manually do anything 635 00:37:34,000 --> 00:37:36,000 there. And it's just silently do as 636 00:37:36,000 --> 00:37:38,760 we've turned in this one and many other stories we've circled 637 00:37:38,960 --> 00:37:42,840 touchy browser extensions. And I think it's quite funny. 638 00:37:42,840 --> 00:37:47,640 Organisations are so tough about what software you can install on 639 00:37:47,640 --> 00:37:49,520 a computer. You'll have an organisation 640 00:37:49,520 --> 00:37:51,520 that's like, no, you can't install any third party 641 00:37:51,520 --> 00:37:53,320 software, you can't do this, you can't do that. 642 00:37:54,160 --> 00:37:56,600 But they'll have no controls over the extensions all of us 643 00:37:56,600 --> 00:37:59,120 use all of the time. They won't be running a managed 644 00:37:59,120 --> 00:38:01,320 Chrome environment. It's. 645 00:38:01,920 --> 00:38:04,120 Yeah. And our users can use any 646 00:38:04,120 --> 00:38:06,680 browser they want, which means every browser has their own 647 00:38:06,680 --> 00:38:08,160 extensions. It's yeah. 648 00:38:08,760 --> 00:38:12,520 Anyway, if you had save images type installed, you still do 649 00:38:12,520 --> 00:38:14,240 have it installed, but it's permanently off. 650 00:38:14,240 --> 00:38:17,480 You can't turn it back on, I think is the summary of that. 651 00:38:17,560 --> 00:38:24,400 That is this week's news. Now it's time for this week's 652 00:38:24,800 --> 00:38:28,280 fish of the week, which comes from the threat intelligence 653 00:38:28,280 --> 00:38:32,320 team at Hawks Hunt. Let me share this with you. 654 00:38:33,280 --> 00:38:36,880 This week is Emirates airline impersonation. 655 00:38:37,840 --> 00:38:42,000 So this is a loyalty reward notification, and this one 656 00:38:42,000 --> 00:38:46,320 looks, well, you tell me, you look at it and you tell me what 657 00:38:46,320 --> 00:38:50,680 you see. Well, yeah, it's a typical typo 658 00:38:51,360 --> 00:38:59,520 to look like an M and or it's female campaign eventbrite.com 659 00:38:59,520 --> 00:39:04,560 that looks fairly legit. So let's just run through this 660 00:39:04,560 --> 00:39:08,760 really quickly bit by bit. So Eventbrite is a legitimate, 661 00:39:08,800 --> 00:39:14,840 is a legitimate platform and it's used to book events. 662 00:39:15,040 --> 00:39:18,480 We see this all the time. We saw it last week with, I 663 00:39:18,480 --> 00:39:21,240 mean, last week's wasn't the most convincing example, like 664 00:39:22,240 --> 00:39:25,320 not everyone's going to fall for it, but people abuse the mail 665 00:39:25,320 --> 00:39:28,200 capabilities and trust of other platforms to get in. 666 00:39:29,480 --> 00:39:33,920 So I think on this one, someone's book, someone's 667 00:39:33,920 --> 00:39:36,960 planned an event on Eventbrite. The logo for that would be 668 00:39:37,480 --> 00:39:40,800 Emirates. The event name is probably 669 00:39:40,800 --> 00:39:44,600 loyalty reward notification. But before we get to that, 670 00:39:44,600 --> 00:39:49,600 you'll see the sender name is disguised like you said to look 671 00:39:49,600 --> 00:39:52,080 like Emirates, but the R and the N together. 672 00:39:52,400 --> 00:39:54,960 And we've seen that with Microsoft before. 673 00:39:55,960 --> 00:40:00,480 So you know, some fonts, some I think Outlook, it looks quite 674 00:40:00,480 --> 00:40:03,240 convincing as an M some mobile clients as well. 675 00:40:05,320 --> 00:40:07,200 Brand logo. It's got an Emirates logo, 676 00:40:07,200 --> 00:40:10,680 which, you know, automatically reinforces the fact it's from 677 00:40:11,080 --> 00:40:13,320 Emirates. What if I'm really interested in 678 00:40:13,320 --> 00:40:16,000 here is the disguised characters? 679 00:40:16,600 --> 00:40:18,560 So I looked at this and I thought, oh, that's displaying 680 00:40:18,560 --> 00:40:20,800 really weird. Is it like I thought the image 681 00:40:20,800 --> 00:40:24,600 that had been shared with me was of a poor quality, which would 682 00:40:24,600 --> 00:40:29,320 be unusual because I know the person that makes it, but we're 683 00:40:29,320 --> 00:40:32,280 looking at it. No, it's they've disguised some 684 00:40:32,280 --> 00:40:37,320 of the letters specifically to try and bypass security 685 00:40:37,320 --> 00:40:39,760 philtres. So you can see here the value, 686 00:40:39,760 --> 00:40:44,440 the D looks really small and customer, the C looks different 687 00:40:44,440 --> 00:40:47,160 and the M looks different. So I think it's pulling from 688 00:40:47,160 --> 00:40:52,120 different alphabets. Yeah, yeah. 689 00:40:53,240 --> 00:40:55,760 It's quite unusual, that one. Yeah, it is. 690 00:40:56,280 --> 00:40:57,840 And then right at the bottom the link. 691 00:40:59,240 --> 00:41:02,400 If the link doesn't open when clicked, please copy and paste 692 00:41:02,400 --> 00:41:08,240 it in your browser. It purposely doesn't click so it 693 00:41:08,440 --> 00:41:11,160 doesn't look like a link and you're encouraged to copy and 694 00:41:11,160 --> 00:41:16,160 paste it into your browser to try and bypass the security 695 00:41:16,160 --> 00:41:19,160 controls. And when you when you do that 696 00:41:20,680 --> 00:41:26,160 straight there, there's a fake login to Emirates page pretty. 697 00:41:26,240 --> 00:41:27,760 So it's asking you. Convincing looking. 698 00:41:28,400 --> 00:41:31,440 Yeah, and it's credential harvesting. 699 00:41:31,440 --> 00:41:34,160 It's asking you to log in and enter your username and 700 00:41:34,160 --> 00:41:36,640 password, these things. I mean, you can Vibe code that 701 00:41:36,640 --> 00:41:39,120 in seconds. Now with Vibe coded something 702 00:41:39,120 --> 00:41:41,200 this week with Claude and it took no time at all. 703 00:41:41,200 --> 00:41:43,040 I was like, jeez, that's amazing. 704 00:41:43,560 --> 00:41:45,920 But that kind of thing, you know, it's shove an Emirates 705 00:41:45,920 --> 00:41:49,480 logo on Emirates font. That's probably not a font, it's 706 00:41:49,480 --> 00:41:52,960 probably an image. And yeah, so I. 707 00:41:54,240 --> 00:41:58,200 Wonder what got me really do with your Emirates account. 708 00:41:58,440 --> 00:42:01,520 I guess you might have saved passport details and stuff in 709 00:42:01,520 --> 00:42:05,920 there, but I guess they maybe could book a flight, change 710 00:42:05,960 --> 00:42:09,400 these details and stuff. Don't know. 711 00:42:09,440 --> 00:42:11,080 Yeah. It's quite a. 712 00:42:11,120 --> 00:42:15,480 Specific thing, if you don't have a Emirates account before, 713 00:42:15,480 --> 00:42:17,680 you're not going to maybe fall for it, but. 714 00:42:18,600 --> 00:42:20,880 No, it does make you wonder if it's targeted. 715 00:42:21,000 --> 00:42:24,960 Maybe there's a list out there of Emirates users? 716 00:42:26,200 --> 00:42:31,760 Maybe in the current climate, Dubai and other areas, Emirates 717 00:42:31,760 --> 00:42:35,000 as the fly there and that they're a Middle Eastern 718 00:42:35,000 --> 00:42:38,440 airline, aren't they Dubai? Yeah, yeah. 719 00:42:38,680 --> 00:42:43,480 That hadn't even dawned on me. Yeah, hadn't even dawned on me 720 00:42:43,480 --> 00:42:46,640 on that. Yeah, That's that's interesting. 721 00:42:47,560 --> 00:42:49,760 Yeah. So that is this week's Fish of 722 00:42:49,760 --> 00:42:51,320 the Week. Thank you very much to the 723 00:42:51,520 --> 00:42:54,920 threat intelligence team at Hawks Hunt for sharing that with 724 00:42:54,920 --> 00:42:56,280 us. Thank you. 725 00:42:57,520 --> 00:43:00,720 Just one bit of admin before we move on this week's awareness 726 00:43:00,800 --> 00:43:07,240 Awareness. The call for presentations for 727 00:43:07,240 --> 00:43:12,640 the SANS Security Awareness and Culture Summit 2026 is open. 728 00:43:12,720 --> 00:43:16,760 If you've got something worth sharing, SANS wants to hear from 729 00:43:16,760 --> 00:43:18,920 you. The call for presentations is 730 00:43:18,920 --> 00:43:21,520 open and the deadline is coming up real soon. 731 00:43:21,520 --> 00:43:26,200 February. Sorry, Friday, April the 3rd at 732 00:43:26,200 --> 00:43:28,960 5:00 Eastern Time. So you've got a couple of weeks. 733 00:43:29,600 --> 00:43:33,680 The summit runs on the 27th and the 28th of August in Las Vegas 734 00:43:33,760 --> 00:43:36,880 and there is a virtual option. So if you can't get to Vegas, 735 00:43:36,880 --> 00:43:38,880 you don't fancy flying at the moment. 736 00:43:38,880 --> 00:43:42,600 You can present remotely and it's encouraged. 737 00:43:43,200 --> 00:43:45,520 They're looking for talks on the human side of security 738 00:43:45,520 --> 00:43:49,800 awareness, culture, behaviour, has change, leadership training, 739 00:43:49,800 --> 00:43:53,720 AI risk, the mistakes you've made and what you've learnt. 740 00:43:54,240 --> 00:43:58,240 So both in person and virtual speaker slots are available and 741 00:43:58,240 --> 00:44:01,800 the formats range from 25 minute lightning talks all the way 742 00:44:01,800 --> 00:44:04,080 through to like 90 minute hands on workshops. 743 00:44:04,080 --> 00:44:07,080 So you might have made awesome AI deep fakes and you want to 744 00:44:07,080 --> 00:44:09,120 show the world this is your chance. 745 00:44:10,400 --> 00:44:13,400 You get a complimentary pass to attend the fall summit as well, 746 00:44:13,720 --> 00:44:17,480 which is worth $125. Plus, you get promotion and you 747 00:44:17,480 --> 00:44:20,160 get to be on stage in front of all your peers. 748 00:44:20,680 --> 00:44:23,320 It's awesome. But you do have to, obviously, 749 00:44:23,320 --> 00:44:26,040 if you want to go to Vegas, you do have to pay to get to Vegas 750 00:44:26,040 --> 00:44:28,360 if you want to do it or you know someone that does. 751 00:44:28,360 --> 00:44:31,880 Submissions are available. The link is in the show notes 752 00:44:31,880 --> 00:44:34,440 and in the newsletter. Have I told you about our 753 00:44:34,440 --> 00:44:39,560 newsletter, Risky creative.com or search for the awareness 754 00:44:39,560 --> 00:44:43,120 angle on LinkedIn. Every Monday morning, along with 755 00:44:43,200 --> 00:44:46,480 the release of every episode, we do release a newsletter that 756 00:44:46,480 --> 00:44:49,400 features everything we talk about on the show, broken down 757 00:44:49,400 --> 00:44:51,960 and links to all the stories and all the topics and all the fun 758 00:44:51,960 --> 00:44:54,320 stuff. So get that in your inbox every 759 00:44:54,320 --> 00:44:57,240 Monday morning to remind you a new show has been released. 760 00:44:57,760 --> 00:45:00,240 You can sign up at riskycreative.com. 761 00:45:00,360 --> 00:45:03,680 Right. Should we do some topics? 762 00:45:04,400 --> 00:45:06,280 Yeah. What did I call these? 763 00:45:06,600 --> 00:45:08,680 I called these. What did I? 764 00:45:08,880 --> 00:45:11,760 I came up with a name for these. I can't remember what it was. 765 00:45:12,400 --> 00:45:13,160 Insert. Yeah. 766 00:45:13,920 --> 00:45:20,120 Now insert called Graphic here. The first thing I wanted to show 767 00:45:20,120 --> 00:45:22,680 you was something I saw on Reddit. 768 00:45:22,680 --> 00:45:26,600 Of course, that's my my weak spot. 769 00:45:26,640 --> 00:45:28,680 So this is Idris Elba. Do we know? 770 00:45:28,680 --> 00:45:31,520 We know Idris Elba, the English actor. 771 00:45:31,880 --> 00:45:33,960 I saw something the other day. I think he's Sir Idris. 772 00:45:33,960 --> 00:45:37,360 Now I don't know. That may have been AII think 773 00:45:37,360 --> 00:45:41,400 he's Sir Idris. Idris Elba's got a wax model at 774 00:45:41,560 --> 00:45:47,160 Madame Tussauds. Guess what his iPhone did 775 00:45:47,160 --> 00:45:49,400 before? Have we covered this before? 776 00:45:49,600 --> 00:45:52,920 Maybe we have here. It's it's great though, yeah. 777 00:45:53,080 --> 00:45:54,560 Hold on, let's see if it I lost my phone. 778 00:45:56,000 --> 00:45:59,000 I did. That's crazy. 779 00:45:59,000 --> 00:46:00,280 Hold on. I've got to call my mum mate. 780 00:46:00,280 --> 00:46:02,800 She's you know, how amazing is that? 781 00:46:02,800 --> 00:46:04,560 I just just that little short bit. 782 00:46:04,560 --> 00:46:09,840 It's like, oh, now either, I don't know, like what can you 783 00:46:09,840 --> 00:46:11,040 do? We've speak about before with 784 00:46:11,560 --> 00:46:14,240 like Sam, there's a Samsung, but looks of isn't it and it's not 785 00:46:14,600 --> 00:46:17,000 as sophisticated was iphone's Face ID. 786 00:46:17,000 --> 00:46:22,880 So, OK, Yeah, OK. Although Even so, like just the 787 00:46:22,880 --> 00:46:26,120 cameras on an iPhone, check for a pulse or blood flowing under 788 00:46:26,120 --> 00:46:28,000 the to check for body temperature. 789 00:46:28,320 --> 00:46:29,760 Yeah, probably get forward by that. 790 00:46:30,320 --> 00:46:34,280 Yeah, I guess you'll just be a celebrity to and you just have 791 00:46:34,280 --> 00:46:36,440 their phone as well. Or Tom Cruise in Mission 792 00:46:36,440 --> 00:46:38,640 Impossible, Right? I'll move on to the next thing. 793 00:46:38,720 --> 00:46:41,200 It's just a little quick thing I saw on Instagram. 794 00:46:41,280 --> 00:46:44,680 And this isn't, it's not a massive cyber story, but I just 795 00:46:44,680 --> 00:46:46,560 thought this, this is like a little flashback. 796 00:46:46,560 --> 00:46:47,800 I just thought this was interesting. 797 00:46:47,800 --> 00:46:50,840 If you work in IT or with computers like we do. 798 00:46:51,800 --> 00:46:56,600 This is Pete Tong on BBC Radio 1 being interviewed. 799 00:46:57,560 --> 00:47:00,360 Just have a listen to this and, and watch this. 800 00:47:00,360 --> 00:47:03,280 It's, it's audible, so you can hear it flustered because we're 801 00:47:03,280 --> 00:47:06,080 getting a lot of people asking for the website address. 802 00:47:06,920 --> 00:47:13,640 The website address from 1995 S that's Greg James, I think, 803 00:47:13,640 --> 00:47:16,040 interviewing Pete Tong. Pete Tong's obviously been on 804 00:47:16,120 --> 00:47:18,560 Radio One in the UK for many, many years. 805 00:47:19,200 --> 00:47:26,000 And the website address from 1995, I don't know. 806 00:47:27,320 --> 00:47:29,120 That timeline doesn't quite work out for me. 807 00:47:29,120 --> 00:47:31,360 Maybe I'm wrong. That hurts my head. 808 00:47:31,360 --> 00:47:34,600 I didn't think the web. Well, yeah, it was. 809 00:47:34,680 --> 00:47:36,040 OK. Listen, anyway, listen. 810 00:47:36,840 --> 00:47:39,640 Oh yeah, I can't, I can't remember that, no, But luckily 811 00:47:40,000 --> 00:47:42,640 HTTP colon forward slash forward slash 812 00:47:43,160 --> 00:47:56,760 www.bbcnc.org.uk/BBCTV/radioone/P/N/index full stop. 813 00:47:57,040 --> 00:48:00,840 HTML just get told to say that by the way. 814 00:48:01,320 --> 00:48:04,560 Yeah, you can tell now they've got everything really, like 815 00:48:04,880 --> 00:48:07,360 short now at Radio One. It's like, you know, BBC Sounds, 816 00:48:07,360 --> 00:48:10,080 that's all. Yeah, P slash pong. 817 00:48:12,520 --> 00:48:14,040 How amazing was that? God. 818 00:48:14,040 --> 00:48:19,240 So you can find us at HTTPS colon forward slash forward 819 00:48:19,240 --> 00:48:23,040 slash www.riskycreative.com/index dot 820 00:48:23,040 --> 00:48:27,920 HTML. That shows you how far times 821 00:48:27,920 --> 00:48:29,320 have changed, right? Like it? 822 00:48:29,520 --> 00:48:31,440 Does. Now you're just like you said, 823 00:48:31,440 --> 00:48:33,920 you just Google BBC Sounds or BBC Radio 1. 824 00:48:34,400 --> 00:48:36,400 Yeah, yeah. Whatever your search engine 825 00:48:36,400 --> 00:48:38,440 isn't is there. Search engines weren't a thing 826 00:48:38,440 --> 00:48:41,080 then. That's funny, yeah. 827 00:48:41,840 --> 00:48:44,720 One last thing I wanted to mention and I nearly brought 828 00:48:44,720 --> 00:48:48,480 this as news article, but it's kind of funny and terrifying and 829 00:48:48,640 --> 00:48:52,760 we had lots of news articles. This was something I saw in four 830 00:48:52,760 --> 00:48:55,320 O 4 Media, which is quickly becoming one of my favourite 831 00:48:55,320 --> 00:49:00,320 kind of online news sites. Tinder plans to let AI scan your 832 00:49:00,320 --> 00:49:02,920 camera roll. So Tinder is obviously the 833 00:49:02,920 --> 00:49:06,040 dating app that's made famous The swipe right, swipe left. 834 00:49:06,880 --> 00:49:10,320 The dating app says it's set to roll out in the US later this 835 00:49:10,320 --> 00:49:13,520 spring. Tinder plans to access users 836 00:49:13,520 --> 00:49:18,280 camera rolls to pick photos to determine what you're into. 837 00:49:18,280 --> 00:49:20,600 A slightly, slightly terrifying isn't it? 838 00:49:22,360 --> 00:49:25,440 The AI is going to scan users locally stored photos, 839 00:49:25,440 --> 00:49:27,920 everything from Jim's selfies to pictures of their family, 840 00:49:27,920 --> 00:49:33,040 sensitive documents and intimate pics to help construct profiles 841 00:49:33,040 --> 00:49:36,280 by determining what users interests and values are. 842 00:49:41,680 --> 00:49:43,960 Wow. I'm just wondering, let's have a 843 00:49:43,960 --> 00:49:45,320 look. Hang on, I'm not going to share 844 00:49:45,320 --> 00:49:50,480 my photo Library, Dinosaurs, houses and stuff I'm selling on 845 00:49:50,480 --> 00:49:52,760 eBay and some flooring. Have fun. 846 00:49:52,760 --> 00:49:55,560 Tinder building a dating profile off all of that. 847 00:49:56,680 --> 00:49:57,920 Yeah. Yeah. 848 00:49:58,040 --> 00:50:00,520 I just thought that was AI doesn't need to be going through 849 00:50:00,520 --> 00:50:02,800 people's photo libraries. Not for a dating app. 850 00:50:02,960 --> 00:50:04,400 It's just going to. I mean, that's going to make 851 00:50:04,400 --> 00:50:06,680 Tinder such a massive target as well. 852 00:50:06,800 --> 00:50:08,680 Oh, we're not keeping any of that data. 853 00:50:08,960 --> 00:50:11,240 We don't keep it. OK. 854 00:50:12,520 --> 00:50:16,440 Yeah, right. That's me done with my whatever 855 00:50:16,440 --> 00:50:18,440 they're called. What have you got? 856 00:50:19,160 --> 00:50:26,800 Yeah, so I had an interesting story I saw just earlier today. 857 00:50:27,440 --> 00:50:34,080 This one is about Japan and how they're going to allow proactive 858 00:50:34,080 --> 00:50:38,800 cyber defence from Oktoberfest. And I thought it was interesting 859 00:50:38,800 --> 00:50:43,800 because there's a few sort of, I guess, historical one, like law 860 00:50:43,800 --> 00:50:48,560 reasons why that wasn't a thing. Active cyber defence. 861 00:50:48,720 --> 00:50:53,320 So, yeah, so it has sort of a funny line of description in the 862 00:50:53,320 --> 00:50:55,800 news story, which is in less polite places. 863 00:50:55,800 --> 00:50:59,680 This is called hacking back or offensive cyber OPS, right? 864 00:51:00,480 --> 00:51:03,880 So essentially they're permitting offensive cyber 865 00:51:03,880 --> 00:51:06,840 operations. Under some new framework, 866 00:51:07,480 --> 00:51:11,240 Japan's self Defence forces and the police will be able to 867 00:51:11,240 --> 00:51:14,040 identify and disable infrastructure use to launch 868 00:51:14,040 --> 00:51:18,800 cyber attacks, subject to approval from government cyber 869 00:51:18,800 --> 00:51:25,680 crime management committee. And yes, it's quite an unusual 870 00:51:25,680 --> 00:51:29,760 story here. So like, yes, as it reflects 871 00:51:29,760 --> 00:51:32,280 growing concern about the scaling impacts of cyber threats 872 00:51:32,280 --> 00:51:35,600 on national security, economic everyday life and marks a 873 00:51:35,600 --> 00:51:39,440 significant evolution in Japan's long standing defensive posture 874 00:51:39,600 --> 00:51:43,360 shaped by article nine of his post war constitution, which was 875 00:51:43,360 --> 00:51:47,280 way back in I think I saw 1946 after World War 2. 876 00:51:47,920 --> 00:51:54,600 They basically poised themselves of a defensive sort of military 877 00:51:54,600 --> 00:51:58,560 and other sort of areas. And obviously the cyber crime 878 00:51:58,640 --> 00:52:03,240 fell into this this clause. But now, yeah, they're looking 879 00:52:03,240 --> 00:52:08,040 to change that so that they can disrupt the attackers. 880 00:52:09,200 --> 00:52:13,520 It's up some things from happening and yeah, as far as 881 00:52:14,480 --> 00:52:20,120 quite an unusual thing there. And I looked quickly for some 882 00:52:20,120 --> 00:52:26,520 stats which I guess sort of chose maybe why they may want to 883 00:52:26,520 --> 00:52:28,120 be doing that. As you can see. 884 00:52:28,120 --> 00:52:30,920 I mean, this is just Japan. I've not compared it to the rest 885 00:52:30,920 --> 00:52:32,560 of the world. I imagine it's very similar 886 00:52:32,840 --> 00:52:38,480 trend across the world, right. But since like 2009, you're 887 00:52:38,480 --> 00:52:42,280 looking at like just under 7000 annual crime arrests. 888 00:52:43,360 --> 00:52:47,080 I mean, it's been going up. So I mean, obviously able to to 889 00:52:47,080 --> 00:52:49,880 arrest people for cybercrime, but now they're going to 890 00:52:49,960 --> 00:52:51,800 hopefully go to do a better job of it. 891 00:52:53,800 --> 00:52:56,800 And yeah, another hope that didn't. 892 00:52:57,920 --> 00:52:59,720 There's another image could bring up. 893 00:53:00,040 --> 00:53:05,400 Let's talk, which is a number of daily cyberspace intrusions, 894 00:53:05,400 --> 00:53:11,720 which in 2013 was under 500. And this is Jenny, because it's 895 00:53:11,720 --> 00:53:16,280 2019, but it's almost reaching 4500 daily. 896 00:53:16,840 --> 00:53:18,760 So I was face intrusion. And I imagine that numbers are a 897 00:53:18,760 --> 00:53:21,440 lot bigger now. Yeah, if if you see. 898 00:53:21,440 --> 00:53:23,880 Happen with that path, yeah. Yeah, you can see it's quite 899 00:53:23,880 --> 00:53:28,040 aggressive linear line there going right up. 900 00:53:28,240 --> 00:53:33,680 Yeah, it's quite interesting story really. 901 00:53:33,800 --> 00:53:37,720 I wonder if there's any other countries that are in a similar 902 00:53:38,840 --> 00:53:40,240 phase. I think I did see on the news 903 00:53:40,240 --> 00:53:45,760 story, it talked about some other nations that had a similar 904 00:53:45,760 --> 00:53:48,120 thing. But yeah. 905 00:53:48,600 --> 00:53:51,160 I get the cultural and that's. Quite a big shift, isn't? 906 00:53:51,760 --> 00:53:55,160 It, it is a cultural shift and I've, I've heard it said before 907 00:53:55,160 --> 00:53:57,600 that like war is bad for business, which is why Japan 908 00:53:57,600 --> 00:54:01,520 don't get involved, but also like don't forget Japan, Japan 909 00:54:01,520 --> 00:54:03,000 have some pretty traumatic history. 910 00:54:03,080 --> 00:54:08,160 So it's, you know, pieces pieces good for business and it's good 911 00:54:08,160 --> 00:54:11,960 for Japan. So it's, yeah, I imagine that 912 00:54:11,960 --> 00:54:15,480 Article 9 kind of talks probably about being the aggressor, which 913 00:54:15,480 --> 00:54:18,880 this kind of kind of isn't. But is it's that hacking back. 914 00:54:18,880 --> 00:54:20,720 It's, it's a blurred line, isn't it? 915 00:54:20,720 --> 00:54:23,800 At what point becomes defence and what defence versus attack? 916 00:54:24,360 --> 00:54:27,200 It's like the attack becomes part of the defence. 917 00:54:27,200 --> 00:54:29,600 Yeah. But it's, yeah, that's really 918 00:54:29,600 --> 00:54:31,320 interesting. It's a really different 919 00:54:31,320 --> 00:54:33,800 approach. Yeah, well, it's obviously it's 920 00:54:33,800 --> 00:54:35,240 a different. Approach for Japan. 921 00:54:35,360 --> 00:54:40,480 Anyway, yeah, I mean, it's taken a long time to to get there, 922 00:54:40,480 --> 00:54:43,320 right? Yeah, Yeah, 80 years. 923 00:54:43,320 --> 00:54:46,920 That's the clause of nine has been there. 924 00:54:47,120 --> 00:54:49,520 I mean, yeah. It just goes to show, doesn't 925 00:54:49,520 --> 00:54:51,680 it, the state of the world at the moment. 926 00:54:52,000 --> 00:54:54,800 You know, it's yeah. Well, yes, I mean, yes, 927 00:54:54,800 --> 00:54:59,440 cybercrime that that that chart was 2019 for Japan. 928 00:54:59,440 --> 00:55:03,480 And that's, I don't know if that's so in nineteen, 4500 929 00:55:03,480 --> 00:55:06,120 daily intrusions and you imagine that numbers probably doubled by 930 00:55:06,120 --> 00:55:08,400 now, if not more. And that's just Japan. 931 00:55:08,400 --> 00:55:12,720 So yeah, be interesting to compare. 932 00:55:13,200 --> 00:55:15,880 This must all be they've just had elections in Japan. 933 00:55:15,880 --> 00:55:17,360 Haven't they? And I think there's a new, 934 00:55:18,760 --> 00:55:20,600 there's new leadership, new government. 935 00:55:20,920 --> 00:55:25,240 Yeah, yeah. Yeah, Excellent, brilliant. 936 00:55:26,200 --> 00:55:28,600 What's up, Lovely? OK. 937 00:55:28,600 --> 00:55:30,840 Well, I think that's us. Done for this week. 938 00:55:31,480 --> 00:55:33,520 Get your submissions into the Sand Summit. 939 00:55:33,520 --> 00:55:39,440 Subscribe to the newsletter at riskycreative.com Follow us on 940 00:55:39,440 --> 00:55:43,240 all the socials Instagram, Tiktok, LinkedIn. 941 00:55:43,240 --> 00:55:46,600 We're not on Facebook, although we might be soon. 942 00:55:46,600 --> 00:55:50,640 If they pay us £3000 to to make the jump, they won't. 943 00:55:50,640 --> 00:55:54,640 They won't pay us £3000. Do get in touch with this if 944 00:55:54,640 --> 00:55:56,320 there's anything you'd like us to discuss. 945 00:55:56,320 --> 00:56:01,920 Hello at riskycreative.com and follow us on LinkedIn to stay up 946 00:56:01,920 --> 00:56:04,320 to date with everything that happens with the show. 947 00:56:05,320 --> 00:56:07,120 Got some big announcements coming in the next couple of 948 00:56:07,120 --> 00:56:10,200 weeks. So yeah, don't be going anywhere 949 00:56:11,320 --> 00:56:14,880 and stay tuned. But from me, that's everything. 950 00:56:15,040 --> 00:56:16,240 I think that's everything from you. 951 00:56:16,280 --> 00:56:18,920 Yeah, me. Cool, right? 952 00:56:19,800 --> 00:56:21,920 See you next week. Oh yeah. 953 00:56:21,920 --> 00:56:23,480 Catch you later. See you later. 954 00:56:23,760 --> 00:56:24,040 Bye.