Listen early, and ad-free!

109: Grinches target Amazon and Reddit, stealing Christmas from the poor

With , ,
December 19, 2018
Read the transcript

Join us for our special Christmas episode as we tell tales of printer hacking, website defacement, Grinches, and how Google is snooping on your private YouTube videos.

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Dave Bittner from The Cyberwire.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Dave Bittner.

Sponsored By:

Support Smashing Security

Links:

Privacy & Opt-Out: https://redcircle.com/privacy

Transcript +

This transcript was generated automatically, and has not been manually verified. It may contain errors and omissions. In particular, speaker labels, proper nouns, and attributions may be incorrect. Treat it as a helpful guide rather than a verbatim record — for the real thing, give the episode a listen.

GRAHAM CLULEY. Some have bought physical ads above urinals. So when people go for a wee— Above what? Urinals.

DAVE BITTNER. What?

GRAHAM CLULEY. Urinals.

DAVE BITTNER. What is a urinal?

GRAHAM CLULEY. What do you call them?

DAVE BITTNER. Urinals. Urinal, that sounds like a creature next to the elephants at the zoo.

UNKNOWN. Smashing Security, episode 109. Phishing, Grinches Target Amazon and Reddit, Stealing Christmas from the Poor with Carole Theriault and Graham Cluley. Hello, hello, and welcome to Smashing Security episode 109. My name is Graham Cluley.

CAROLE THERIAULT. Ho, ho, ho, Graham. I'm Carole Theriault.

GRAHAM CLULEY. Is that how you introduce yourself now?

DAVE BITTNER. Yeah.

GRAHAM CLULEY. From now on. You got two sisters.

DAVE BITTNER. It's on our business card.

GRAHAM CLULEY. Yeah. We're joined by our special seasonal guest, Dave Bittner from the CyberWire podcast. Hello, Dave.

CAROLE THERIAULT. Hello. Welcome back, Dave.

DAVE BITTNER. Thank you. Thank you. I'm everyone's second favorite recurring guest.

CAROLE THERIAULT. Oh, certainly not first, right?

DAVE BITTNER. No, no, no.

GRAHAM CLULEY. Don't get too confident there.

DAVE BITTNER. Always a bridesmaid.

GRAHAM CLULEY. That's true.

DAVE BITTNER. I might not even be second. I could be way down the list.

GRAHAM CLULEY. Probably in the top 4. Top 4, I think. On a good day. Anyway, on today's show, we've got coming up for you, YouTube channels at war with each other and it's spilling out into internet warfare. We have the strange mystery of what Google are doing with YouTube videos which might surprise you, and Christmas Grinches as well. All coming up on today's Smashing Security. Well, ladies and gentlemen, I have some bad news. I have to announce that there is war on the internet. Conflict is going on. It's not between Russia and America this time. It's not the Chinese stealing our intellectual property. It is much more serious than that. For the last two months, two YouTube channels have been at war for the title of the most popular channel. In one corner we have the Swedish YouTuber PewDiePie.

DAVE BITTNER. How's it going, bros? My name is PewDiePie!

GRAHAM CLULEY. And in the other corner we have the Bollywood Indian music label channel T-Series. And they both want to be the first to get to 80 million subscribers.

CAROLE THERIAULT. So that would make them the biggest channel on YouTube if they had 80 million.

GRAHAM CLULEY. Yep. And PewDiePie has been the most popular for quite some time, but T-Series has been zooming up and growing much, much faster. And so the fight is on who can get to 80 million first. Now, I don't know who started this fight, but both sides are participating, encouraging their fans to get new subscribers and putting up messages. And things have got a little bit out of hand. Can you believe?

CAROLE THERIAULT. Sorry, before you start, how many YouTubers were they kind of starting with? Are we talking like that they have like 30 million and they have to get to 80, or is it—

GRAHAM CLULEY. Well, they started with zero, Carole. Everyone starts with zero.

CAROLE THERIAULT. When they started this competition, Graham? Well, well, we don't know. Okay.

GRAHAM CLULEY. That is something which hasn't specifically been researched.

CAROLE THERIAULT. Okay, I'm sorry, I exposed your little Achilles heel.

GRAHAM CLULEY. That's fine, that's fine. Not a problem. And some of the guerrilla marketing which has been taking place on behalf of the two YouTube channels has taken a distinctly criminal turn, in particular in the case of PewDiePie's supporters.

CAROLE THERIAULT. Okay.

GRAHAM CLULEY. For the past couple of months, someone calling themselves the Hacker Giraffe has— what's funny about that?

CAROLE THERIAULT. Wind your neck in.

GRAHAM CLULEY. It's like being a cracking tortoise, I guess, or a penetration testing porpoise, or, you know, anyway, the hacking giraffe has been—

CAROLE THERIAULT. Hacker Giraffe.

GRAHAM CLULEY. Oh, sorry, the Hacker Giraffe. I hate to get my giraffes mixed up. He has used a tool called PRET, the Printer Exploitation Toolkit.

CAROLE THERIAULT. Not the sandwich people.

GRAHAM CLULEY. No, not Pret à Manger. He's been using the Printer Exploitation Toolkit to hijack over 150,000 printers. He scanned with Shodan, which, as you probably know, is the search engine for finding insecure things on the internet, things which are connected to the internet. He found over 800,000 printers connected to the internet. 150,000 of these devices he has now accessed via port 9100 and told them to spew out flyers and messages urging users to subscribe to PewDiePie's channel.

CAROLE THERIAULT. So is this someone from PewDiePie?

GRAHAM CLULEY. No, I don't think so. I think this is just a fan. I think this is just someone who thought, oh, this would be really easy to do, let me do it. Because this kind of remote hijacking of printers isn't new. In fact, we've spoken about this I think in one of the early episodes of Smashing Security when someone did it before, spreading a sort of an awareness message telling people to close and secure their printers better.

CAROLE THERIAULT. A bit 1990s though, come on.

GRAHAM CLULEY. It is rather. Yeah. And he sent a little bit of ASCII art and—

CAROLE THERIAULT. Oh, I love ASCII art.

GRAHAM CLULEY. Oh, now it's all right.

CAROLE THERIAULT. I like them now.

GRAHAM CLULEY. Now you can do anything you want these days, right? You can mug an old lady, but leave a piece of paper with some ASCII art and Carole's happy about that. Great.

DAVE BITTNER. Now, Graham, has this, has this affected you? Because you're sort of the poster child for printer security.

GRAHAM CLULEY. I think you're referring to when my wife began to print out a long document.

DAVE BITTNER. I see, so it's her fault.

GRAHAM CLULEY. Yeah, well, no, my printer—

CAROLE THERIAULT. It's never Graham's fault. It's usually your wife, Dave.

GRAHAM CLULEY. I do not believe, although I'm prepared to be found out wrong, I don't believe my printer is connected to the internet, so I think I'm safe.

DAVE BITTNER. Have at it, listeners.

GRAHAM CLULEY. Yeah, thank you. But anyway, the messages which are being printed out tell people to unsubscribe from T-Series, subscribe to PewDiePie instead, and share awareness with the hashtag #SavePewDiePie.

CAROLE THERIAULT. How do you know it's PewDiePie and not PewDiePie?

GRAHAM CLULEY. Because this guy is a social media star, Carole. Anyone who's—

CAROLE THERIAULT. I live under a rock.

DAVE BITTNER. Yeah, I know it because I have kids, and so I hear his name thrown around every now and then.

GRAHAM CLULEY. Do you have any opinions on him? Do your kids watch him or anything like that? Do you know?

DAVE BITTNER. Uh, well, no, I'm not a fan. I think I think they find him annoying.

GRAHAM CLULEY. Yes, tick.

DAVE BITTNER. And he certainly had lots of controversy. He was the one who did the whole thing with the suicide forest. That was him, wasn't it?

GRAHAM CLULEY. No, that was another YouTuber, I think. Yeah, the guy who found the— it was really grisly, wasn't he? Found a body hanging in the forest. I think that was a different YouTuber. But certainly PewDiePie has had his share of controversy, which we will be coming to.

CAROLE THERIAULT. Now, the Hacker Giraffe This fan who apparently is trying to get everyone to subscribe to PewDiePie, right?

GRAHAM CLULEY. Yeah, the Hacker Giraffe has been able to generate some cash for his printer hijacking exploits. He set up his own Patreon page, and at the moment he's earning $470 per month for doing this. So I imagine these are other PewDiePie fans who are keen for him to carry on spreading the message. He says, by the way, that he will, quote, shit my pants Well, sorry, he says he will shit my pants.

CAROLE THERIAULT. I thought you were trying to do the ad, ship my pants.

GRAHAM CLULEY. No, no.

CAROLE THERIAULT. Are you sure you didn't misunderstand it?

GRAHAM CLULEY. Shit my pants if he gets to $500 per month. That's his pants, I think, rather than my pants.

CAROLE THERIAULT. Who would want to do that?

DAVE BITTNER. Will he do it on YouTube?

CAROLE THERIAULT. Will he take a picture?

GRAHAM CLULEY. I don't think he's being literal.

DAVE BITTNER. I mean, I think maybe he found what's going to put him over the top here, right?

GRAHAM CLULEY. I mean, anyway, the point is PewDiePie fans are going out of their way to promote their YouTube hero. Some have bought physical ads above urinals. So when people go for a wee— Above what? Urinals. What? Urinals.

DAVE BITTNER. What is a urinal?

GRAHAM CLULEY. What do you call them?

DAVE BITTNER. Urinals.

GRAHAM CLULEY. Oh.

CAROLE THERIAULT. Yeah, I don't like the word either.

DAVE BITTNER. Urinal, that sounds like a creature next to the elephants at the zoo. Urinals. Anyway, those.

GRAHAM CLULEY. So some have bought ads there. Another guy called MrBeast, he's another YouTuber, he's bought local TV spots and billboard space in New York's Times Square.

CAROLE THERIAULT. Are you kidding?

GRAHAM CLULEY. No, I'm not.

DAVE BITTNER. This is the most famous billboard in all of Times Square, and it's the biggest one, the biggest advertising billboard in all of Times Square.

CAROLE THERIAULT. It's about to say subscribe to PewDiePie on it. This is going—

GRAHAM CLULEY. we're about to break the internet.

DAVE BITTNER. There! Oh my gosh, it's up there! There it is! We did it! We did it! It's up there! Subscribe to PewDiePie right now, guys!

GRAHAM CLULEY. He did this!

DAVE BITTNER. Oh my gosh!

GRAHAM CLULEY. Another guy has done the same in Mumbai. So he's bought ads. So, you know, you have to think, why are these people doing this? Why are these people spending all this money?

CAROLE THERIAULT. Well, there's going to be a huge amount of money. It's got to be money.

GRAHAM CLULEY. Well, the reason why they're doing it is PewDiePie then features their activities in his videos. That's their incentive. They get their fame. Millions of people see that they bought ads in Times Square or in Mumbai or above the Urinal.

DAVE BITTNER. And it's a virtuous circle.

GRAHAM CLULEY. And that encourages other people to think, oh, I wish I was in a PewDiePie video as well. What should I do? Oh, maybe I'll tattoo my forehead with a message telling people to subscribe to PewDiePie. They haven't done that yet, but it's only a matter of time, Carole.

CAROLE THERIAULT. OK, so it must cost a ton of money to have an ad in Times Square.

GRAHAM CLULEY. You would think so, wouldn't you?

DAVE BITTNER. I don't think it does, actually. I think there's one of the video screens that just shuffles through different content. I think they have a way you can buy basically a 10-second happy birthday kind of— put any kind of message up there. And so the idea is you schedule that and then you stand in front of it and you take your picture in front of it and it says, happy birthday, Graham and Carole. Congratulations on your 80 millionth YouTube subscriber, whatever.

CAROLE THERIAULT. Well, if you want to make it to number one spot, Dave. I have an idea.

DAVE BITTNER. Yes, don't tell Maria.

GRAHAM CLULEY. She's probably—

DAVE BITTNER. she's logged on right now.

CAROLE THERIAULT. She might be listening.

DAVE BITTNER. She might be.

GRAHAM CLULEY. Anyway, so PewDiePie is featuring them in his own videos, and that's of course encouraging even more craziness. And now the latest thing: earlier this week, part of the Wall Street Journal website was defaced with a message in support of PewDiePie. And the message said, Wall Street Journal would like to apologize to PewDiePie. We have now fired some of our journalists. We're now sponsoring PewDiePie to reach his maximum subscribers and beat T-Series to 80 million. We'd also like your credit card number, expiry date, the lucky 3 digits on the back to win the chicken dinner in Fortnite, they say. And they have a link to PewDiePie's YouTube channel. Now that obviously wasn't a real story posted by the Wall Street Journal's news journalists. This was a case of a hacker who'd managed to breach part of the WSJ website where they post sponsored content. In this case, it was placed in Oracle's section, and so plenty of people have seen this. They've now fixed the page, but there must have been some security issue which allowed the hacker in. Now, why did they target the WSJ? Well, my suspicion is because the WSJ and PewDiePie have something of a checkered history. Back in January 2017, millions of people saw a video by PewDiePie that included some images of two men laughing as they held up a banner that read "Death to all Jews." Now, yes, exactly. Now, surprise, surprise, that didn't go down very well with some of the brands like Disney who were supporting PewDiePie. They severed their links and PewDiePie got in some trouble with YouTube as well. But a lot of PewDiePie's rabid followers didn't like how the Wall Street Journal reported that story. And that's probably why they've been targeted. And the very latest is that the Hacker Giraffe, the guy who's breaking into all of these printers in order to post this message, he apparently disapproves of the defacement of the Wall Street Journal website. He says he doesn't think it was cool, doesn't think it was awesome. It was plain illegal, he says, and did nothing except cause media outrage. Whereas going around wasting paper Getting some innocent people's printers to churn out all of this garbage, that apparently is completely acceptable.

DAVE BITTNER. Mm-hmm.

GRAHAM CLULEY. I'm being sarcastic. I don't think that is acceptable at all.

CAROLE THERIAULT. This whole thing is just a pile of stink. It is, right? The whole idea, the 80 million subscribers. Who cares? Who cares?

DAVE BITTNER. Right.

GRAHAM CLULEY. Yeah.

DAVE BITTNER. Right.

GRAHAM CLULEY. Yeah, exactly. Who cares?

DAVE BITTNER. What a strange celebrity they enjoy.

GRAHAM CLULEY. Yeah, well, maybe. I mean, imagine, you know, if you're If you haven't got very much great going on in your life, if PewDiePie gives you a shout out in one of his videos, that might make you sort of, you know, feel like you're cooler in your little social vacuum.

CAROLE THERIAULT. Can I just say it wouldn't? It wouldn't.

GRAHAM CLULEY. It wouldn't to you?

CAROLE THERIAULT. No.

GRAHAM CLULEY. I'll tell you what really annoys me. The Hacker Giraffe doing this thing, right? This isn't a new technique. This isn't exploiting any new flaws. There is a problem, as we all recognize, of people leaving their printers open. But I don't think what he was doing was very cool, and I don't think it's very cool that he's now getting paid to do it, $500 a month, when all these bug bounties for much more complex things sometimes don't offer even that much money.

CAROLE THERIAULT. How is it not breaking the law?

DAVE BITTNER. Right, that's what I was gonna say. Does it run afoul of the Computer Fraud and Abuse Act? If you're— if you have unauthorized access— yeah, unauthorized access to someone's computing device, that's Not cool.

GRAHAM CLULEY. It would seem like that to me. You could say theft of ink, theft of paper, couldn't you, as well?

DAVE BITTNER. Right.

CAROLE THERIAULT. Just taking control. It's like, you know, it's taking control of a device that doesn't belong to you.

DAVE BITTNER. Correct.

CAROLE THERIAULT. End of.

GRAHAM CLULEY. So yes, hacking giraffes, we don't like you.

CAROLE THERIAULT. Yeah. Next.

GRAHAM CLULEY. Clear off. Dave, what's your story for us this week?

DAVE BITTNER. Well, before I get to my story this week, I have a question for you, Graham.

GRAHAM CLULEY. Oh, yes.

DAVE BITTNER. Yesterday I was over in the linguistics building on the Cyberwire campus.

CAROLE THERIAULT. Were you mangering a little sandwich of avocado and roasted eggplant?

DAVE BITTNER. Yeah, well—

GRAHAM CLULEY. You traveled over there on your Segway?

DAVE BITTNER. No, actually I took the monorail. And this is a long walk and it's cold out there this time of year. And the poor sap who was manning the foreign idiom desk pulled me aside and He wanted me to ask you what the term cockwomble means. Evidently you used that in some of your writing in the past few days and it left us here on our side of the pond, besides not knowing what a urinal is, we are puzzled as to what a cockwomble is. So what is a cockwomble, Graham?

GRAHAM CLULEY. So you can probably guess half of it. Are you familiar in the United States with—

CAROLE THERIAULT. Half chicken.

GRAHAM CLULEY. Are you familiar with the residents of Wimbledon Common in London? Over in the United States?

DAVE BITTNER. I'm sorry, what? No.

GRAHAM CLULEY. So you aren't familiar with Wombles? Wombles are a British institution. Okay. They are the creatures who live— well, they work underground and overground, and they come out and they clean up all the mess that humans leave behind.

CAROLE THERIAULT. You guys need a few of those in the States right now.

GRAHAM CLULEY. This is a series of children's books and a wonderful TV show way back in the '70s. My favorite Womble was, of course, Orinoco.

CAROLE THERIAULT. "Edmondson!" That's woke an Orinoco up. "What's that? What's that? It's a wild animal roaring. Oh, it must have been a dream. Oh dear." But he—

GRAHAM CLULEY. yeah, they're lovable creatures, and somehow this is a portmanteau word which is used in Britain to suggest a person may be of dubious character. Someone who we don't have a very high opinion of is a cockwomble.

CAROLE THERIAULT. And you would say it like, Graham, you're such a cockwomble.

GRAHAM CLULEY. Yeah, exactly.

CAROLE THERIAULT. Exactly like that.

GRAHAM CLULEY. Yes. We do have that explicit tag, don't we? Yes. Right. Good.

DAVE BITTNER. Okay. Well, next time I'm over on that side of the Cyberware campus, I'll be sure to check in and let them know.

GRAHAM CLULEY. Don't use it at passport control at Heathrow, though. Try not to use cockwomble. Don't greet.

CAROLE THERIAULT. Don't greet.

GRAHAM CLULEY. Don't pretend you're Dick Van Dyke. Oh, right, mate. Oh, blimey, governor, you cockwomble.

DAVE BITTNER. Good morning all you cockwombles, how are you all doing today? Right, got my cockney rhyming slang at the ready. Yeah, very good. Shall I move on to my story, Dave?

GRAHAM CLULEY. Yes, what's your story for us? Please.

CAROLE THERIAULT. Please.

DAVE BITTNER. So this story comes courtesy of Danny Bradbury from the Sophos Naked Security blog. This is about a programmer who found an interesting behavior in the way that YouTube analyzes Smashing Security's uploaded videos. Now this gentleman, his name is Austin Burke, and he had uploaded a video that was demonstrating a cross-site scripting vulnerability that he discovered. So it sounds like basically he was doing a screen capture of a process that he was demonstrating. He wanted to disclose this cross-site scripting vulnerability, so he made this video.

GRAHAM CLULEY. And that's not unusual, is it?

DAVE BITTNER. No, no.

GRAHAM CLULEY. Demonstrating vulnerabilities, you'll do a simple little —video showing it off. Right, okay.

DAVE BITTNER. Now he had marked this video as unlisted, which means it doesn't come up in search results. But he discovered that moments after he uploaded the video, that there was a URL that appeared on screen in the video. The URL didn't appear in any of the metadata. It wasn't in the file name. This URL got crawled within minutes of the video being uploaded. Wow. So this got Austin's attention, and he decided to do another test. So he created another unique URL. This time he uploaded a video and set it to private, which means only someone else who has the password to see the video should be able to see it. Yeah. And sure enough, within minutes, this brand new unique URL was also scanned and crawled.

GRAHAM CLULEY. Well, this is fascinating, isn't it? Yeah.

DAVE BITTNER. So it seems as though YouTube is performing OCR on the video. and whenever they see a URL, they go out and crawl it. So what's the problem here, right? So Austin, in his, he did a blog describing this, and he said, imagine a security researcher has found a critical vulnerability in a site and has crafted a URL that will trigger it, causing harmful effects to the website. So during a video that was uploaded to YouTube, if YouTube sees this URL, They go and crawl the site, trigger the SQL injection, and break the site. So what's interesting, I think, about this is that evidently private on YouTube doesn't mean private from YouTube. Quelle surprise. Yeah.

GRAHAM CLULEY. So who would be guilty of the exploitation then? It sounds like Google has just basically exploited a vulnerability on somebody else's site. They trip the bear trap.

CAROLE THERIAULT. Yeah, isn't it? I don't think I'm following. Okay, so on my video, I display a URL. Correct. That's a private video. Google, through OCR, grabs that URL and tags it in what?

GRAHAM CLULEY. The URL isn't for the private video crawl. The URL is the SQL injection vulnerability. So it'll be a URL to a particular web server which demonstrates a vulnerability. Right. Google is watching the video just like a human would, and it converts it into a URL, and it then tells its search engine, ooh, look, here's a URL we haven't been to before. Let's go and check it out. Right.

DAVE BITTNER. And when they do, that triggers the SQL injection. Gotcha. And breaks the site. It's clever. Now, you can understand why Google may want to do this. I've seen plenty of examples where people have uploaded things to YouTube where they have, here's a link to this pirated software, right? And they just have the link in the video. So you can imagine that Google would want to look for those sorts of things. You could imagine child pornography, things like that. They want to make sure that people aren't posting those links. So I think there's a reasonable explanation for why Google is doing this, but you also have to wonder, is Google reading things like license plates? Or protest signs or t-shirts. If they're automatically OCRing everything in the videos, that's just sort of an interesting thing to know about, isn't it?

GRAHAM CLULEY. Or what, Dave, if I was sending you a private message and it was like burn on receipt, so you only get one chance to look at it. And so I'm sending you—

CAROLE THERIAULT. What would it say? I hate Crawl. Want to replace her. Yes, exactly.

GRAHAM CLULEY. A secure message and say, look, you've just got one time to read this. And before you even get to look at it, I don't know why I would have included this URL in the video, but anyway, Google would have gone to it and it would have been zapped.

DAVE BITTNER. Yes, chances are they would have gotten to it first.

CAROLE THERIAULT. But from a security standpoint, there is some advantages to trying to stop misinformation from being spread.

DAVE BITTNER. And I suppose the lesson is, if you're going to share a video, don't do it on YouTube. The YouTube private on YouTube doesn't mean private from YouTube.

GRAHAM CLULEY. Exactly. Exactly, yes.

CAROLE THERIAULT. Though I think many people who are doing anything on the Google platform must understand that privacy is, you know—

GRAHAM CLULEY. And that's true of so many sites, Facebook or LinkedIn or any of these things. Potentially, if you say something is private, you mean private from other people on the internet. You don't necessarily mean private from the service which you're actually using.

CAROLE THERIAULT. Yeah, that's probably true 99.9999% of the time.

GRAHAM CLULEY. So has there been any word from Google as to exactly why they are— have they given any explanation? I mean, you've some interesting theories you've come forward with. No, they haven't.

DAVE BITTNER. And in his blog, Austin Burke goes and looks into it and basically says that Google has said very little about this. I'm sure it's probably buried somewhere in their terms of use, you know, in the EULA, that they can do this. Yeah. And, you know— Well, they clearly have the ability to.

GRAHAM CLULEY. I wonder if you were, for instance, to be going down the street just videoing stuff out of your car window and you passed by a shop or you passed by a poster which had a URL on it as well, whether Google has the ability to pick that up, scrape it, and visit it.

CAROLE THERIAULT. I'm sure they do. Yeah.

GRAHAM CLULEY. Yeah, why not? It's kind of spooky the way the world's going, isn't it? Incredible how they can gather so much information.

CAROLE THERIAULT. Isn't it just, Granddad?

DAVE BITTNER. I think of things like if you upload a video that has metadata, that has location metadata, let's say you upload, like we see all these Russian dashcam videos and there's dashcam videos from all over the world. Well, if they have location metadata, and you can cross-reference that with license plate data, suddenly here's another way for you to gather data about where people are when.

GRAHAM CLULEY. It's a bit like that TV show from America, isn't it? Is it Person of Interest? Yes. Mm-hmm. Lots of people. People all over the world.

DAVE BITTNER. You are being watched. The government has a secret system, a machine that spies on you every hour of every day. I know because I built it. I designed the machine to detect that.

CAROLE THERIAULT. Best intro ever.

DAVE BITTNER. Zoom in, magnify, enhance.

CAROLE THERIAULT. Turn, yeah, enhance. That's my favorite.

GRAHAM CLULEY. Enhance. Yeah. I saw one once where I can't remember what the show was. It might have been Spooks or something, one of the BBC shows where they, they had a satellite image of two people meeting. And unfortunately, the bad guy had his sort of back turned to the satellite. So you couldn't see his face, but you could see, but you could see the sunglasses of the person he was speaking to. So they went glasses and sunglasses, and then they got the reflect—

CAROLE THERIAULT. was it CSI? Yeah, CSI Miami.

GRAHAM CLULEY. I remember the episode, and they got the reflection from the—

DAVE BITTNER. yeah, there was one image. Yeah, I remember this was years ago, and it's a shame Maria's not here because she'd enjoy this.

GRAHAM CLULEY. I think it's a shame she's not here as well, Dave.

CAROLE THERIAULT. Yeah, she's number one, remember that.

GRAHAM CLULEY. Our listeners wish she was here.

DAVE BITTNER. Every episode that she's not on, all the listeners say it's really a shame Maria's not here. Shame. How do you hold a moon beam in your hand. So ask Maria. Yeah, they— someone said every episode of Star Trek: The Next Generation, someone would alert them that there was a ship nearby, and Captain Picard would say, "On screen," and this little tiny dot would show up on the screen, and he'd say, "Magnify," and then the thing would show up. But this is just once they wanted him to say, "On screen so I can see it, damn it!" Like, if he had to say "magnify" every single time, you think Commander Data would know? No, that's okay. Anyway, I digress.

GRAHAM CLULEY. Carole, what's your story for us this week?

CAROLE THERIAULT. Well, okay, to start this story, Dave, I want you to imagine that you have fallen on hard times. I'm there. Okay, you've drunk bleach. Ooh! Thinking it was elderflower cordial or something, thereby losing your voice. Bye-bye radio career. Rather than the dulcet-toned singer and podcaster, you sound more like Gollum gargling gummy bears. Really not pleasant. And your family, of course, are very sad. Very sad. Right? They miss their papa belting out the show tunes in the shower. That is true. But they know it's also Christmas time and the big day's just around the corner. And little Ricky so wanted a Sudoku book. You know, little toddler Frank will go crazy for glow-in-the-dark stars. It's like you're in my house. And even these tiny little presents are out of your financial reach because Cyberwire and the campus have outed you, right? Because you can't work anymore. So yes, it's all boo-hoo-hoo in the Bittner household.

DAVE BITTNER. As you all would say, I've been sacked. Exactly.

CAROLE THERIAULT. And there's not a twig of hope. But wait, wait, Dead Voice Dave. There's this little thing on Reddit called Santa's Little Helpers. Yes. Now Santa's Little Helpers is a kind of Reddit wiki dedicated to helping out others with non-monetary gifts during the holiday season. Reddit coordinators called mods volunteer to help coordinate people who request gifts and people who want to donate gifts. So as an idea, it's pretty sweet, right? Okay. So here's how it works. Okay, so you would create an Amazon wishlist with the Christmas items you're hoping for, and you'd make it public. You would then register register this wishlist with Santa's Little Helpers, and once approved, you can make your appeal on their wiki. So you would write about your bleach problem, your Gollum voice, you might showcase your kids and say how great they are, and then you'd provide finally a link to your kids' Amazon wishlist. And the game plan will be that someone might feel for your story and want to help you out. Everyone with me? Yeah, yeah, I understand.

GRAHAM CLULEY. Okay, sounds, sounds like a nice idea.

CAROLE THERIAULT. Right? Yeah. So Dead Voice Dave, you would publish your request and then you would check in on your wish list to see if any items had been hopefully purchased by a secret Santa of sorts. And then, of course, you can woohoo rather than boohoo, right? Because some kind stranger has bought your prezzies if you see that they're missing from your wish list. So every few hours you're checking your list, Dead Voice Dave, and then one day The presents for your kids are listed as purchased. Boom. Sudoku book and glow stars on the way. Happy days. And you can't believe how effing great the world is. Like, good people exist. You go to the subreddit, Santa's Little Helpers, and you publicly thank the giver. And that giver could be anonymous or not, but still, you might do a public shout out for the presents, and Christmas is back on, baby.

GRAHAM CLULEY. Can I say, Crow, it's so refreshing to get a happy, positive, heartwarming story. Here we are just before Crimbo, and I think this is nice. Nice. I like this. What a great incentive. What a great— so you're going to include the link on the show notes, are you? So we can all donate or put up our messages or what's the—

CAROLE THERIAULT. or is it?

GRAHAM CLULEY. Dun dun dun! What? What plot twist? It turns—

DAVE BITTNER. I did not see that coming.

CAROLE THERIAULT. It turns out that rather than purchasing your items, someone, quote unquote, visited your wish list and tagged the items as purchased by another seller. Graham, will you help me demonstrate what I mean here? We had a little exercise this morning. So here I am opening up Graham's wish list. And I can see that he wants a personal massager. Sorry. It's on your list. Is it? And so I, well, if you wanna share your list with everyone, go ahead. But I see it right here.

DAVE BITTNER. Is that a cockwomble?

CAROLE THERIAULT. And so I could go ahead and buy this for him and get it sent over to him. Or maybe instead, to mess with him, I could click the buy this gift elsewhere button, which opens up a pop-up and says, yes, cancel this request, mark this item as purchased.

GRAHAM CLULEY. Oh, so you haven't bought it from Amazon. You've said you've bought it down the local personal massage shop where you have an account already. And so it gets taken off my wishlist. So no one else purchases me one because I'd obviously only need one.

CAROLE THERIAULT. Exactly. You go in, dead voice Dave or Graham, you know, and you're thinking, wow, someone's answered my Prezi prayers. But then after a bit of digging, you realize that someone has just, and here's the word du jour, Grinched you.

GRAHAM CLULEY. You're a mean one, Mr. Grinch.

CAROLE THERIAULT. Effectively canceling Christmas, stealing dead voice Dave's Christmas. So the Grinch is stealing Christmas from the poor needy.

DAVE BITTNER. Oh, you're a monster.

GRAHAM CLULEY. Why would people do this?

CAROLE THERIAULT. Because the Grinch Who Stole Christmas is— I think it's just a meme.

DAVE BITTNER. Your brain is full of spiders. By the way, that voice, Dave, how nicknames get started.

CAROLE THERIAULT. Now this Grinching has caused no end of problems, so people are having to repost their items, they have to retract preemptive thank-yous, they have to re-register with the Santa Little Helper program because they were ticked off as done, and you know fulfilled and it's getting very close to Christmas now. So the chances of getting the goods delivered in time is fast disappearing.

GRAHAM CLULEY. So you don't have to do this via Reddit. If you had an arch enemy, you can search for their wishlists. You can search for public wishlists on Amazon. Yeah, go check yours out now.

CAROLE THERIAULT. Hehehe.

GRAHAM CLULEY. And you can mark everything as already bought and then their auntie or their grandmother or whoever doesn't buy it for them for Christmas and they end up with socks and pants and things they don't want.

DAVE BITTNER. Well, and the other thing is, I could imagine someone having fallen on hard times trying to reassure the children. Well, kids, I know there's no food to eat, but good news. Yeah. Christmas presents are on their way. So, and then they're not.

GRAHAM CLULEY. This is rather heartless, Crow. Oh, yeah, it is.

CAROLE THERIAULT. And it's causing a huge storm on Reddit, right? So there's people writing things like this Redditor called SeagoingCook wrote, whoever did this, I hope you're aware that you've destroyed the hopes and dreams of innocent children. Children have done nothing to you. You might think by doing this you're hurting the parents who have no other way to provide Christmas, but you're wrong. You hurt the children. This makes you scum of the lowest degree. I'd like nothing better than to take you out to sea and throw you overboard. And then he gets supportive replies like, I'll wrap the anchor, drive the boat.

GRAHAM CLULEY. Um, I've got another theory.

CAROLE THERIAULT. Yes, well, that's what I wanted to go into. I wanted to go into theories. Why are people doing Business. So go ahead.

GRAHAM CLULEY. Number 1. Can I be terribly cynical and say that if I was competing with lots of other people on this Reddit forum to get a Santa's Little Helpers, maybe I would get more sympathy and get people more likely to buy Tiny Tim his cartoon book or whatever it is. If I said, oh, people have been removing them and all the rest of it, my Christmas is ruined. I mean, that's really cynical of me. And I hate to think like that. But that surely is a possibility. Yeah.

CAROLE THERIAULT. I mean, I think, I think the most likely one for me is it's a LOLs thing. It's riffing off The Grinch Who Stole Christmas. And it's going to be bored kids just being douchey.

GRAHAM CLULEY. But it's not that funny, is it? It's not. It's not like you go, look what I've done. You know, it's not that— sorry for the laugh, but it's not that amusing, is it?

CAROLE THERIAULT. Well, what if you're miserable, miserable, miserable, and you want to share your misery because, you know, misery loves company, right? Right, so spread the hate.

DAVE BITTNER. I don't know, never underestimate the destructive impulse of a teenage boy. Exactly.

CAROLE THERIAULT. The subs mods are desperately trying to sort out the problem. Registered givers need to tell Reddit when a gift has been purchased so they can cross-check everything, and they're also telling people to contact Amazon support, I guess, to try and stop the culprits that are doing it, because presumably there's going to be a record of who actually canceled the, the gift, right? Oh yeah.

GRAHAM CLULEY. And Amazon support are definitely going to follow up on those. They're going to handle that and say, well, let's find out who's friends with who. Did you— I'm assuming a present. Which— who's it? It's like a worldwide Secret Santa competition, Karl. No one's going to know if it was a legitimate purchase. They bought it somewhere else or not. And even if this idea of registering your gift giving on Reddit, that's irrelevant. You can still go to Amazon and cause the chaos, surely.

CAROLE THERIAULT. Well, I got to say, Dave, at least this Grinchy tale of life and woes has not fallen on you yet, right? Or your family. And you can still shout out and belt out Christmas show tunes.

DAVE BITTNER. I am not planning on drinking any bleach anytime soon.

CAROLE THERIAULT. I think Dave should sing us out. Go on, you want to be number one? Let's go. I'm gonna get it by sitting on the sidelines, sugar face.

DAVE BITTNER. Uh, okay, uh, let's see. You're a mean one, Mr. Grinch. How's that?

GRAHAM CLULEY. And welcome back. Can you join us at our favorite time of the show, the part of the show that we like to call Pick Pick of the Week.

CAROLE THERIAULT. Pick of the Week. Pick of the Week.

GRAHAM CLULEY. Pick of the Week is the part of the show where everyone chooses something they like. Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they like. Doesn't have to be security related necessarily. Let's not be. No, mine is not security related necessarily. This last weekend I was at a rock and roll concert. Held both by Sir James Paul McCartney in London. Oh, and it was fantastic. He's amazing. He's about 76 years old. He was on stage for 3 hours, didn't have a sip of water, belted out about 40 songs. Incredible. And not only was I there, so was Ringo Starr. No. And Ringo Starr got up on the stage and he was in the crowd. There was this flurry of activity in the crowd. Everyone was pointing, looking the same way. And it was Ringo. And then Ronnie Wood from the Rolling Stones, he was there, but who cares about him? Because I'm a Beatles fan. Hey! And they— oh no, he's all right, he's all right. Looks a bit like a crow. But anyway, no, but Ringo— Ringo and Paul McCartney were on stage. Anyway.

CAROLE THERIAULT. Well, you would have been pretty disappointed had McCartney not been there after paying for tickets.

GRAHAM CLULEY. Slightly, yes. I'd have been even more delighted if the other two had been there, but they unfortunately have other commitments.

CAROLE THERIAULT. I would have run the other way.

GRAHAM CLULEY. Anyway, if you get the chance, because chances are he won't still be doing this in 20 years' time, go and see Paul McCartney in concert. The way science is going today. His tour will be resuming in South America in March. So I'm telling our Argentinian listeners about that now before moving on to North America in May. And it was fantastic. And I haven't really got much more to say about that other than it was terrific. Oh, and Ronnie Wood, he caught the tube. Tube on the way home, just like we tried to, but it was all jammed. And then we tried to get an Uber and that failed, and they charged us even though they didn't give us an Uber ride. And me and my 7-year-old child had to walk for about an hour to get back to our hotel. But other than that, a fantastic night. And that's why McCartney is my pick of the week.

DAVE BITTNER. His carpool karaoke was pretty delightful as well. If you haven't seen that, it was—

GRAHAM CLULEY. I, I have to say, I am warming— I'm more of a John Lennon fan, but I am warming more and more to Paul McCartney as he gets older, and I'm thinking he's an all right chap. He's obviously a musical genius. He can't help it that he's the second greatest Beatle. But second greatest. At least he's second, not fourth.

CAROLE THERIAULT. You mean behind Ringo?

GRAHAM CLULEY. Second greatest is still pretty impressive, I have to say. And it was thrilling for me and my young son to see Ringo on stage as well. It's just very, very cool. Love that. There you go. Cool. Dave, what's your pick of the week?

DAVE BITTNER. My pick of the week is a podcast. Must be a podcast too.

GRAHAM CLULEY. How embarrassing. Hopefully they're not the same podcast. Are you really having to plug your podcast? Oh, no.

DAVE BITTNER. That's right. Yeah.

CAROLE THERIAULT. We kindly produce a Christmas special without sponsored ads and you have to go and screw it all up.

DAVE BITTNER. Yeah, no, it's not my podcast.

GRAHAM CLULEY. Let me ask you, what is the name of your podcast, by the way, Dave? It's The Cyberwire.

DAVE BITTNER. Oh, very good. Yeah, TheCyberwire.com. Yeah, yeah. I have to ask, over on your side of the pond, what is the most well-known mythical beast? Oh, Nessie.

GRAHAM CLULEY. Loch Ness Monster. Yeah, yes, Loch Ness. Or the Wombles, of course. Probably, probably Nessie. Probably Nessie. Nessie.

DAVE BITTNER. I, yeah, I think that's probably right. Well, over here in the Pacific Northwest, and that includes Canada, Carole, we have Bigfoot.

CAROLE THERIAULT. Yes, we do, that's true.

DAVE BITTNER. Also known as Sasquatch. Has the Sasquatch been spotted since Carole left Canadian soil? That's interesting, isn't it? Have they ever been seen in the same place? So, this is a podcast called Wild Thing, and it is hosted by a woman who discovered that a distant relative of hers was actually one of the most well-known Sasquatch researchers in the world. Is this Auntie Jean?

CAROLE THERIAULT. That's right.

DAVE BITTNER. Her name is Laura Krantz, and it's a series about the search for this mythical beast, but it's also about our search for mysteries. Why, after all these years, is this still appealing? Why do we find— What drives our desire to look for these things that go bump in the night, these mysterious creatures in the woods or in Loch Ness or other places? It's a good listen. It's got lots of good notice around the web, and I highly recommend it. It's called Wild Thing, and you can find it where all of your— all the best podcasts are hosted.

CAROLE THERIAULT. You know, my husband's uncle quit his life at one point and went and lived to try and spot the Loch Ness Monster for about 10 years. Wow.

GRAHAM CLULEY. He lived in a caravan. Is this weird?

CAROLE THERIAULT. Right on the lake. Yeah, mad. Yeah, I'm gonna cut that bit out.

DAVE BITTNER. How did it work out for him?

CAROLE THERIAULT. Well, he returned home, said, thought it was dead. Oh, oh yeah, yeah. There you go.

GRAHAM CLULEY. Fair enough. Funny story, Crow. His uncle didn't die.

CAROLE THERIAULT. He's still going strong. Okay, good.

GRAHAM CLULEY. It's funny, your husband, I mean, I mean, he's not mistaken for a Sasquatch, but sometimes people have thought he's a bit of a Wookie. He does look like one and sound like one sometimes.

CAROLE THERIAULT. So my pick of the week— last year, actually, you might remember my pick of the week was Rare Exports, a Finnish Christmas horror film that is just awesome. And for those of you out there who don't like subtitles, it's mostly in English, so don't let that put you off. I actually just watched it again in our friend's movie shed. So shout out to the Carhole Cinema. Now guys, guys, do you remember the Zimbardo Stanford Prison Experiment? Oh gosh, yes. Remember it?

GRAHAM CLULEY. Dave was in it. He's still in it.

DAVE BITTNER. I still have the scars to—

CAROLE THERIAULT. So it was basically the guards got more violent if they were left unchecked? Yes. Right. And then there was the marshmallow effect. Do you remember that one?

GRAHAM CLULEY. Yes. Oh yeah, the kids resisting temptation.

CAROLE THERIAULT. That's right. Yeah. These are fairly well-known results. I certainly learned about them from textbooks in high school and uni and all that. What if I told you that there were huge question marks over the tests and their results and whether they're actually valid? Because when they have tried to replicate some of these tests, the results are radically different. And these two tests are not alone. It seems that many, many, many psychological tests that we have come to trust may not be valid. It seems the problem is that journals tend to want to publish things with flashy titles and equally flashy results. Surely not. So psych researchers who want to succeed can be very tempted to skew results. I know you want to hear more. So basically, you can go check out a podcast called Analysis. It's from the BBC. And this particular episode is called The Replication Crisis. And I've heard many, many of these podcasts and it's great. So it's a total subscribe for the inquisitive mind. So Graham, maybe not bother.

GRAHAM CLULEY. This is interesting though. I mean, there's—

CAROLE THERIAULT. It is.

GRAHAM CLULEY. There is, for instance, a scientific theory that the Loch Ness Monster may actually have died after swallowing bleach and choking on a marshmallow.

DAVE BITTNER. Well, I think it was despair that finally did him in. When other people had clicked on his gifts and there were no gifts in front of the tree for the little baby Loch Ness Monster.

CAROLE THERIAULT. It's kind of cool though because this consortium of psychologists have got together to try and re-replicate the results of famous tests just to make sure that we're actually learning from real stuff rather than potential happenstance or something that might have been a little bit skewed. Really well produced, really well researched, really well covered. Just a great, great podcast. We'll put a link in the show notes. I will, I will do that.

GRAHAM CLULEY. All right, well, that just about wraps it up. And it just about wraps it up for Smashing Security for 2018.

CAROLE THERIAULT. Oh, break it to them gently. Yeah, geez, it's our last show of the year, guys. It's our last show. I know, I know, I know.

GRAHAM CLULEY. We're gonna take a couple of weeks off. But we'll be back in January.

DAVE BITTNER. Shame you couldn't have gotten Maria.

CAROLE THERIAULT. She's opening the show for us in 2019.

GRAHAM CLULEY. She'll be here.

DAVE BITTNER. Of course she is. Of course she is.

GRAHAM CLULEY. Cannot wait. Dave, if people want to find out about— I can't even speak today. Dave, if people want to find out more about you or about the CyberWire, what's the best way to do that?

DAVE BITTNER. You can go to thecyberwire.com and it's all right there.

GRAHAM CLULEY. Fantastic. And you can follow us—

CAROLE THERIAULT. It's a great podcast, guys.

GRAHAM CLULEY. You can follow— well, I've heard some of their guest correspondents are very good. From you, at least, Carole, is what you've told me.

DAVE BITTNER. Not a cockwomble among them. That's right.

GRAHAM CLULEY. You can also follow us on Twitter @SmashingSecurity. Twitter wouldn't allow us to have a G.

CAROLE THERIAULT. Thank you, of course, to all our listeners for your continued support throughout the year. It would be a futile experiment without you guys. We're going to be off the next few weeks, as Graham said. And we have a lot of eating to do, right, Clue? Charming. But if you want to give us a little extra Christmas cheer, submit a few lovely sentences as a review wherever you get your podcasts. It'll take you about a minute, but it'll make the world of difference to us and to our wonderful sponsors who help give us enough pennies so that we can deliver the show to you for free week in, week out. So thank you. You all rock.

GRAHAM CLULEY. Until next time. Cheerio. Bye-bye.

CAROLE THERIAULT. Bye. Bye-bye. Bye, cock wobblers. Not wobbles.

GRAHAM CLULEY. A cock wobble is something else entirely. It normally happens when you're in your mid-50s.

DAVE BITTNER. Yeah, yeah, but there's a pill for that. It's a great time to be alive, isn't it, Jess?

CAROLE THERIAULT. High five. Yeah. Of course we didn't forget. We have a little Christmas present for you too. Check out this little bonus track.

DAVE BITTNER. By the way, I noticed you guys aren't bleeping. You're not bleeping anymore.

GRAHAM CLULEY. We're explicit now. Yeah, we sometimes bleep.

CAROLE THERIAULT. Okay, if we say the C-word, because you Americans don't like it. No, we don't.

DAVE BITTNER. That's the one word that still has some punch over here.

GRAHAM CLULEY. It was, it was more kind of just the themes of what we talk about sometimes. It just became so difficult deciding in is this explicit or not? It's just like, why don't we just label them all as explicit? You know what?

CAROLE THERIAULT. If This American Life can be explicit and use swear words, like, I just think, you know, yeah, why not?

GRAHAM CLULEY. So free rein, Dave. Go crazy ape bonkers with your cocky piss flaps if you want to.

DAVE BITTNER. I just like you reading my mind, Graham. I've been holding on to that exact phrase, waiting to come on this show.

CAROLE THERIAULT. Well, there's our teaser at the end.

DAVE BITTNER. I'm not gonna get that image out of my mind.

CAROLE THERIAULT. Happy holidays, everyone.

-- TRANSCRIPT ENDS --