Listen early, and ad-free!

234: Cozy Bear, dildo scams, and robo hires and fires

With , ,
June 30, 2021
Read the transcript

Microsoft warns about a hacking gang that is far from cuddly, algorithms rather than managers are firing people, and our guest receives a surprising email from "Amazon"...

And you will NOT want to miss checking out a very special "Pick of the week"!

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by David Bisson.

Visit https://www.smashingsecurity.com/234 to check out this episode’s show notes and episode links.

Follow the show on Twitter at @SmashinSecurity, or on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Follow us on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: David Bisson.

Sponsored By:

Support Smashing Security

Links:

Privacy & Opt-Out: https://redcircle.com/privacy

Transcript +

This transcript was generated automatically, and has not been manually verified. It may contain errors and omissions. In particular, speaker labels, proper nouns, and attributions may be incorrect. Treat it as a helpful guide rather than a verbatim record — for the real thing, give the episode a listen.

DAVID BISSON. This is something then that's like outside the normal realm of normal Amazon-type dildo stuff. Like maybe you could find like a used seller that's like price gouging it, offering it for like $1,000.

GRAHAM CLULEY. But like, David, I don't think you buy used dildos on Amazon. Or maybe you can. I'm not sure.

DAVID BISSON. I did not look into that.

GRAHAM CLULEY. I wouldn't recommend it.

CAROLE THERIAULT. Well, pretty good condition. Few scrapes and bumps, but still works.

GRAHAM CLULEY. Often bought with antiseptic. I don't get it quite.

CAROLE THERIAULT. There's just some things you don't want to share, you know.

UNKNOWN. Smashing Security, episode 234: Cozy Bear, Dildo Scams, and Robo Hires and Fires with Carole Theriault and Graham Cluley. Hello, hello, and welcome to Smashing Security, episode 234. My name is Graham Cluley.

CAROLE THERIAULT. And I'm Carole Theriault.

GRAHAM CLULEY. And we're joined this week by returning guest, a chap who hasn't been on the show for far too long. It's David Bisson. Hello, David.

DAVID BISSON. Hey guys, how's it going?

CAROLE THERIAULT. Good. Am I right in remembering that the last time you came on, we tried to record in like the worst storm ever?

GRAHAM CLULEY. Yes.

DAVID BISSON. Sure did. Sure did. And then, yeah, it like cut out like halfway before the end of the episode.

CAROLE THERIAULT. And I think we have it live, but we have you just having disappeared and we carried on.

DAVID BISSON. Yeah.

CAROLE THERIAULT. We haven't done that with anybody else. So, you know, that gives you a unique quality, David.

DAVID BISSON. I gotta say, I feel real special about that.

CAROLE THERIAULT. Come on up, it's funny.

GRAHAM CLULEY. Well, let's hope lightning doesn't strike twice, eh?

DAVID BISSON. Boo!

CAROLE THERIAULT. Boo! So how's it going, David? What's going on in your life?

DAVID BISSON. Just, you know, writing and doing all kinds of stuff, you know, always looking for new opportunities. So if anyone knows of any writing stuff, send it my way.

CAROLE THERIAULT. Okay.

DAVID BISSON. Always looking.

CAROLE THERIAULT. Yeah, yeah. You and Graham worked together for a bit, right?

DAVID BISSON. Yes, we did. We did. We were very chummy those days.

GRAHAM CLULEY. In those days.

CAROLE THERIAULT. Graham, is he any good? Is he any good?

GRAHAM CLULEY. David's terrific.

DAVID BISSON. Graham is one of the best people that I've actually had the experience of working for. That was a lot of fun. A lot of fun. I miss it. I miss it.

CAROLE THERIAULT. I can't say I share that feeling all the time.

GRAHAM CLULEY. Yikes.

CAROLE THERIAULT. Yikes.

DAVID BISSON. All right, I guess this is 234, the last episode.

GRAHAM CLULEY. Moving on.

CAROLE THERIAULT. Thanks to this week's sponsor, 1Password. Its support helps us give you this show for free. So coming up on today's show, Graham, what do you got?

GRAHAM CLULEY. I'm going to be cozying up to some bears who aren't that cuddly.

CAROLE THERIAULT. Oh, okay. David, what about you?

DAVID BISSON. I've got a story about dildos. Whoa!

CAROLE THERIAULT. And I have to follow with, should we care that robots are firing people? All this and much more coming up on this episode of Smashing Security.

GRAHAM CLULEY. Now, chums, chums, allow me to get theatrical for a moment. What's Montague? It is nor hand, nor foot, nor arm, nor face, nor any other part. Belonging to a man. Oh, be some other name. What's in a name? That which we call a rose by any other name would smell as sweet.

CAROLE THERIAULT. Is this Macbeth?

GRAHAM CLULEY. No, Romeo and Juliet.

CAROLE THERIAULT. Oh, is it Juliet?

GRAHAM CLULEY. Oh, that's my impression of Juliet.

CAROLE THERIAULT. I should know that from Montague, actually. You're right.

DAVID BISSON. That's pretty good, I gotta say.

GRAHAM CLULEY. Thank you very much.

DAVID BISSON. The dramatic pauses and everything. You seem like you've, like, read that before.

GRAHAM CLULEY. Well, you see, in my day—

CAROLE THERIAULT. I thought he was having trouble with the three-syllable words.

GRAHAM CLULEY. The female parts were taken by men back then, you see, so I didn't think Is that out of character for me to do it?

CAROLE THERIAULT. Yeah, times haven't changed. You're right.

GRAHAM CLULEY. They haven't really. The reason why I bring this up is it's all about names. 'Cause I don't know about you, but I find it somewhat confusing, the naming of hacking groups.

CAROLE THERIAULT. Yeah.

GRAHAM CLULEY. And how every security company seems to call hacking groups by different names. I'm trying to keep track.

CAROLE THERIAULT. Oh, they should be all called the same name.

GRAHAM CLULEY. Well, wouldn't that be handy? If we all knew they were talking about the same one?

CAROLE THERIAULT. Hacker 234.

DAVID BISSON. And is that just like, is that just like a branding thing for like the company? Like, is that just saying, oh, look at what we've done?

GRAHAM CLULEY. I think sometimes it is, because sometimes I feel like that the headline goes to the one with the grooviest name. So what I thought I would do is I would talk about a hacking group called Cozy Bear, and I am going to give you some other names used by other security companies for Cozy Bear, right? You can tell me if this is really a name used by another security company for Cozy Bear, or one that I've added. Okay?

CAROLE THERIAULT. I'm not sure I'm following you at all. Are you saying that different companies are referring to this hacking group by different names?

GRAHAM CLULEY. Correct.

CAROLE THERIAULT. And they are doing this because—

GRAHAM CLULEY. Because... who knows why, but they are. Maybe for convenience, maybe for marketing. Maybe just because shits and giggles. I'm not sure.

CAROLE THERIAULT. Are these security companies that are doing it?

GRAHAM CLULEY. Yes, they're doing this 'cause they can't agree on the name.

DAVID BISSON. Wouldn't that be fun if every journalist gave it a different name? It's like Schmuggledorf.

GRAHAM CLULEY. And what then happens is that the journalists They will say Cozy Bear, brackets, also known as blah blah, or blah blah, or sometimes blah blah blah blah blah. And you end up listing umpteen names. Partly for the search engine optimization. Alright, so this is what we're going to do, guys. I'm going to read you an alternative name for Cozy Bear. And you have to tell me if it is an alternative name for Cozy Bear or one that I've made up. Alright?

DAVID BISSON. Gosh, okay.

CAROLE THERIAULT. Every time it's a bloody quiz.

GRAHAM CLULEY. Carole, I'm going to start with you. Dark Halo. Is that a name for—

CAROLE THERIAULT. Yes.

GRAHAM CLULEY. Yes, absolutely correct. David, Cozy Duke. Is that a name for Cozy Bear? Cozy Duke?

DAVID BISSON. Yes.

GRAHAM CLULEY. Absolutely correct.

CAROLE THERIAULT. Okay.

GRAHAM CLULEY. Carole, Daisy Duke.

CAROLE THERIAULT. Yes.

GRAHAM CLULEY. Daisy Duke, is that a—

CAROLE THERIAULT. Yes. No, what? Yes.

GRAHAM CLULEY. No, I'm afraid it's a character from The Dukes of Hazzard. David, the Dukes, the Dukes. Is that another name for Cozy Bear?

DAVID BISSON. I'm gonna say no.

GRAHAM CLULEY. Do you wanna have a second guess? Yes? Absolutely right. Carole?

DAVID BISSON. Yes.

GRAHAM CLULEY. Grizzly Steppe. Grizzly Steppe.

CAROLE THERIAULT. Yes.

GRAHAM CLULEY. Absolutely correct. David, Office Monkeys. Office Monkeys.

DAVID BISSON. You know, I wanna say yes, but I'm gonna go no.

GRAHAM CLULEY. I'm afraid it is another name for Cozy Bear. It is, man.

DAVID BISSON. Carole?

GRAHAM CLULEY. Carole, Stellar Particle.

CAROLE THERIAULT. I don't wanna play anymore.

GRAHAM CLULEY. We're very nearly finished. Stellar Particle.

CAROLE THERIAULT. No.

GRAHAM CLULEY. I'm afraid it is a name for Cozy Bear.

CAROLE THERIAULT. Good.

GRAHAM CLULEY. David, Stella McCartney. Stella McCartney.

DAVID BISSON. Is that another one?

GRAHAM CLULEY. No.

DAVID BISSON. Absolutely correct.

GRAHAM CLULEY. Carole, APT24. APT24.

CAROLE THERIAULT. Well, you wrote 29 in your document, so—

DAVID BISSON. Behind the scenes, folks.

GRAHAM CLULEY. I'm trying to catch you out. APT29 is absolutely correct. And David, nobelium. Nobelium.

DAVID BISSON. Ugh, that's— yes.

GRAHAM CLULEY. You're absolutely right. It's not just a— what is it? It's an element, isn't nobelium? I think it's named after Nobel, but is another name for Cozy Bear. Now, Cozy Bear, all of those crazy names, that's who we're talking about today, right? Not Daisy Duke, we're talking about Cozy Bear by one of those previous names, not Stella McCartney. Cozy Bear is one of the most notorious hacking gangs in the world. They are known for compromising organizations, political think tanks, and governments since at least 2010. They've stolen data from Germany, Uzbekistan, South Korea. They've attacked the Netherlands, the United States. They were the gang who were accused of the hack of the US Democratic Party a few years ago.

CAROLE THERIAULT. Oh yes, where they lost millions, millions, millions, millions. Yeah, yeah, yeah.

GRAHAM CLULEY. And the UK's own NCSC, National Computer Security Centre.

CAROLE THERIAULT. My buddies.

GRAHAM CLULEY. They have accused Cozy Bear of trying to steal research into coronavirus vaccines. From Britain, the United States, Canada. So, you know, they're quite, you know, you think—

CAROLE THERIAULT. Not that cozy.

GRAHAM CLULEY. You don't want to cozy up to them. Why are they— where is this gang based? Where do they come from? And the clue, the clue is in the name Cozy Bear, because one of the things security companies do is they try to group hacking groups which come from the same part of the world with similar names. So if it's a Chinese hacking group, they will often call it something dragon or influential panda or something like that. And if it's Russian, then it's the bears. That works. So if you, if you see a hacking group with bear in the name. In the UK, we just call them GCHQ. And that's how you work out what the name of the hacking group is. So Cozy Bear is a Russian hacking gang, and its work appears— this is the curious thing— it appears to support the aims of the Russian regime and the people in charge in Moscow and those of its allies as well. So it's strongly believed to be tied up with the folks at the Russian intelligence agencies. Would I go so far as to say working for the Russian intelligence agencies?

CAROLE THERIAULT. No, no, you would not.

GRAHAM CLULEY. Yes, I probably would. I probably would. I probably would. Yeah, yeah, I probably would.

CAROLE THERIAULT. Note, I didn't do that. I said nothing.

GRAHAM CLULEY. Carole didn't, but I think probably. And there's good reason for that, because a few years ago it was revealed that the Dutch security and intelligence services, they actually hacked into the computer systems of the Cozy Bear hacking gang.

CAROLE THERIAULT. Oh yeah, yeah, yeah.

GRAHAM CLULEY. Do you remember this?

CAROLE THERIAULT. Yes, didn't you cover it?

GRAHAM CLULEY. I think we might have mentioned it. I mean, we've been doing this podcast for so long. Anyway, so they spied, they spied on the hackers there for at least a year, and they even managed to catch the hackers on CCTV cameras going about their work, going to get a coffee, going along the corridor, because they were in these offices. And I think they sort of got hold of CCTV cameras outside the office so they could see when people were checking in.

CAROLE THERIAULT. Going for a smoke and stuff.

GRAHAM CLULEY. Right. And the time of day, and they'd begin to assess—

CAROLE THERIAULT. Picking their nose.

GRAHAM CLULEY. All these kinds of things. So quite extraordinary. And it's widely understood that the Dutch intelligence services, they helped America oust Crazy Bear. Sorry, not Crazy Bear. That's the name of a pub near where I live.

DAVID BISSON. You hit that pub a little early today, huh, Graham?

GRAHAM CLULEY. The Crazy Bear is— Have you been to the Crazy Bear, haven't you, Carole?

CAROLE THERIAULT. Of course, yes.

GRAHAM CLULEY. They've got like a double-decker bus park.

CAROLE THERIAULT. It's for swank people.

GRAHAM CLULEY. It is a bit swanky, isn't it? Yeah. It's a little bit over-swanky.

CAROLE THERIAULT. Too swanky for me.

GRAHAM CLULEY. Yeah, yeah, yeah. Anyway, they managed to oust Cozy Bear. I don't know if the Crazy Bear pub is run by Russian hackers or not.

CAROLE THERIAULT. Doubt it, baby.

GRAHAM CLULEY. Yeah, I wouldn't go so far as to say that. That would be dangerous. But anyway, the Dutch spies managed to help America ousted these Cozy Bear hackers from computers at the US State Department back in 2014. And according to reports, the US spies were so grateful for this that they sent their Dutch colleagues cake, cookies, flowers, which is—

CAROLE THERIAULT. What? So the US were like, oh, thanks so much. Here's some cake.

GRAHAM CLULEY. Yeah, exactly. Imagine sending cookies to Dutch people. You know, they're going to be disappointed, aren't they, when they nibble on them?

DAVID BISSON. Seriously?

GRAHAM CLULEY. Sending flowers to Dutch people. It's like tulips to Amsterdam, isn't it? It's not really.

CAROLE THERIAULT. It's like sending a Canadian maple syrup.

GRAHAM CLULEY. Yeah, it didn't really make sense, did it, for them to do that? But anyway, anyway. So you're wondering, what is the latest with Cozy Bear, also known as Nobelium, which is the name which Microsoft gave them? Well, they have been fingered for the SolarWinds hack that targeted governments and other agencies earlier this year. We spoke about that in episode 214. With Professor Alan Woodward. Let's not go into that again. But most recently, news has reached us from the chaps and chapesses at Microsoft. And Microsoft says that it has been tracking new activity by the Nobelium or Cozy Bear gang. They say IT companies and government departments, mostly in the US and UK, are being targeted. But in all, something like 36 different countries. And according to Microsoft, most of these attacks have been unsuccessful, but— excuse me.

CAROLE THERIAULT. Oh, they got you already. Biohack.

GRAHAM CLULEY. For most—

CAROLE THERIAULT. they COVID your ass.

GRAHAM CLULEY. According to Microsoft, most of the attacks have been unsuccessful. They've taken the form of password spray and brute force attacks, but Microsoft says they are aware of, quote, "three compromised entities." Entities. Yes. Now, this is where it gets interesting, right? Because I'm reading, I'm reading this Microsoft blog post, blah, blah, Nibelium, blah, blah, hackers, password spraying, brute force, yadda, yadda, yadda. I was about two-thirds of the way through the blog post before I came to something juicy, because there, nestled all amongst all the yadda, yadda, you know, meh, meh, meh, and all this, was this tiny little detail from Microsoft, right? Two-thirds of the way down.

CAROLE THERIAULT. Was it written in superscript?

GRAHAM CLULEY. No, no, no. It was written in white text on a white background. You have to select it with your mouse. No, it's not quite that. Not quite that. But, but they said, they said, well, during our investigation, they said, we found evidence that data stealing malware had been found on one of our own computers.

DAVID BISSON. Is that one of the entities? It's like, we're aware that we've been one of those entities.

GRAHAM CLULEY. Yeah. So could you say a bit quicker, please? Could you say a bit quicker? Doxing malware was found on one of our computers. So what Microsoft said was, oh yeah, we found some malware on the computer of one of our customer support staff, which was stealing data, basic account information. 'on a small number of our customers.' In other words, the headline should have been, 'Holy fuck, we screwed up again.' I mean, way to bury the lead. If you've been hit, it's possible—

CAROLE THERIAULT. like the story you're telling—

GRAHAM CLULEY. it's possible because we got hacked. So Microsoft, they say that the— by the way, I hate the way hackers are sometimes called actors. You know, they call them bad actors, don't they?

CAROLE THERIAULT. Oh, I don't have any problem with that.

GRAHAM CLULEY. I don't really like that. I find it confusing.

CAROLE THERIAULT. Oh, well, I understand, honey. It's maybe a word that the kids use.

GRAHAM CLULEY. I just always think of like Nicolas Cage or something like that. And I just think of—

DAVID BISSON. Oh, whoa, whoa, whoa.

GRAHAM CLULEY. Hang on, hang on. Nicolas Cage fan club on the line right now.

DAVID BISSON. The Rock is like a cinematic masterpiece. I mean, Nic Cage, Sean Connery, one of the best movies ever. Face/Off? Come on.

CAROLE THERIAULT. Oh my God. I think I walked out in Face/Off.

GRAHAM CLULEY. Off.

DAVID BISSON. Oh, but it's so good because it's so over the top. That fight scene at the end, it's like 15 minutes long. There are doves, there are boats exploding. I mean, spoiler, but you know.

GRAHAM CLULEY. That's the one where Nicolas Cage and John Travolta swap places or something. Literally. In order to pretend to be the other person, or?

CAROLE THERIAULT. It would be very useful now in this land of deepfakes and, you know, and streaming.

DAVID BISSON. Oh my gosh.

CAROLE THERIAULT. You know? Hey Graham, let's swap faces. I just wanna go to Sainsbury's, not be noticed.

GRAHAM CLULEY. So Microsoft, or maybe it wasn't Microsoft, right? Maybe it was Oracle. Maybe Oracle swapped faces with Microsoft and maybe this isn't a blog post. Who knows? Who knows what we can trust anymore?

CAROLE THERIAULT. Maybe it was a typo.

DAVID BISSON. Maybe.

GRAHAM CLULEY. Microsnot, they said. Never heard that funny sentence. They say that the bad actor used the information to launch highly targeted attacks against some of their customers. And they said, we responded quickly and we've been in contact with those customers to explain what happened. Can you imagine that call where they ring up?

CAROLE THERIAULT. I'm sure companies do it all the time.

DAVID BISSON. Yeah.

GRAHAM CLULEY. Hello? Yes, this is the— what should we be? Should we be the Dutch government? Yes, Dutch government here. Oh, hello, it's Microsoft.

DAVID BISSON. Why are we Sean Connery? You started.

CAROLE THERIAULT. Don't, I just, I just, yeah, I've given up. I don't even know anymore.

GRAHAM CLULEY. Kind of embarrassing, isn't it?

CAROLE THERIAULT. What, you?

GRAHAM CLULEY. Anyway, finally, Microsoft goes on to tell everyone about the importance of best practice safety precautions to keep the bad guys out of your network, which is certainly good advice coming from them. So no complaints there. So well done, Microsoft, for that. But yeah, way to hide the story, I thought. Yeah.

DAVID BISSON. Which—

CAROLE THERIAULT. No offense, Graham, but you kind of buried the lead two-thirds down your story on this show reporting this. You did exactly the same thing. So pot kettle, dude. Don't know what else to say, but—

GRAHAM CLULEY. I'd like to say thank you for that input, Carole, and I'll send you some flowers, cake, and cookies to make up for it. David, what have you got for us this week?

DAVID BISSON. I have something that affected me personally that happened to me a few weeks ago. So I get the spam email talking about a shipping confirmation. It looks like something that you would get from Amazon.

GRAHAM CLULEY. Okay.

DAVID BISSON. And I look down and it looks like it's for a dildo. So I was like, okay, well, you know, that's, that's interesting. I look at it, comes with this picture, you know, and Just straight away.

GRAHAM CLULEY. Could you describe it for us, David?

DAVID BISSON. Well, yeah, okay. So, I mean, it has various shapes. And there's a remote controller involved, so I—

CAROLE THERIAULT. If you can't reach?

DAVID BISSON. I guess for vibration.

GRAHAM CLULEY. It looks painfully purple to me. It's very purple.

DAVID BISSON. I don't think you need to look at it whilst it's in use. Very purple. Very purple. But the interesting thing is that the way that it's marketed in the image It looks like it's sort of superimposed on top of a sanitary napkin.

CAROLE THERIAULT. Oh yeah.

DAVID BISSON. Which is like really weird. Like, is that part of the design or like, are they showing where it's supposed to go?

CAROLE THERIAULT. Yeah, it looks like a cartoon character.

DAVID BISSON. The sanitary napkin?

CAROLE THERIAULT. No, the whole thing.

GRAHAM CLULEY. It does. It looks a bit like—

CAROLE THERIAULT. It has like ears and like eyes.

DAVID BISSON. I'm not going to name it.

CAROLE THERIAULT. And then a big nose.

DAVID BISSON. One of you can name it. I'm not naming that character.

GRAHAM CLULEY. I don't know if the connotation is right. It looks a bit to me like Droopy. But you don't really want a droopy dildo, do you? But remember the—

CAROLE THERIAULT. It's not that big a nose.

GRAHAM CLULEY. What's his name, Droopy? The dog?

DAVID BISSON. Are you talking about Dumbo?

GRAHAM CLULEY. No, Droopy. You know.

DAVID BISSON. Now that's the name for a dildo.

GRAHAM CLULEY. Yes!

CAROLE THERIAULT. TM it, TM it, Dave.

GRAHAM CLULEY. I really hoped we'd raise the tone this week.

CAROLE THERIAULT. Oh, really?

GRAHAM CLULEY. David, according to this email you've received, you've paid £790 $100 for this. And yeah, you've also agreed to pay $100 worth of shipping. How heavy is this thing?

CAROLE THERIAULT. I mean, I don't think it goes by weight.

DAVID BISSON. I'm really hoping that I can like incorporate it into my workout routine, maybe do some like shoulder presses or something with this thing. And that's really— the cost was really the thing that got me. I was like, really? Wait a second.

CAROLE THERIAULT. Like, that's like a month's rent.

DAVID BISSON. It's like, hold on, sanitary napkin. We got to look into this price. Thing.

GRAHAM CLULEY. So your advice to people is to sign up for Amazon Prime, I imagine, because you'd save an awful lot on the shipping if you did that.

DAVID BISSON. Why $100? Like, that is insane for you to spend.

GRAHAM CLULEY. You're the one who ordered it, David. I don't know why you brought it to our podcast like this. I mean, it's just—

DAVID BISSON. you know, I mean, Prime Day, man, comes around. It's like, ooh, got a jump on it. So yeah, I looked at the price and I said, okay, I want to know more about this dildo. So first I want to know, like, is this even a thing that I could buy on Amazon? So I said, let me, let me go, let me go into Amazon, let me search dildos.

GRAHAM CLULEY. And what, you've entered that into Amazon?

DAVID BISSON. I was logged out in an incognito window, so it has not affected my search results.

GRAHAM CLULEY. Oh, okay. Yeah, I was expecting you're going to get so many recommendations if you do that. Yeah.

DAVID BISSON. Okay. Nope, nope.

GRAHAM CLULEY. Sensible.

DAVID BISSON. So I, I searched it, I filtered it by high price first, and that the most expensive dildos were about like $150. So it's like, okay, this is, this is something then that's like outside the normal realm of normal Amazon-type dildo stuff. Like maybe you could find like a used seller that's like, you know, price gouging it, offering it for like $1,000.

GRAHAM CLULEY. But like, David, I don't think you buy used dildos on Amazon. Or maybe you can, I'm not sure.

DAVID BISSON. I did not look into that.

GRAHAM CLULEY. I wouldn't recommend it.

CAROLE THERIAULT. Well, pretty good condition. A few scrapes and bumps, but still works.

GRAHAM CLULEY. Often bought with antiseptic wipes.

CAROLE THERIAULT. There's just some things you don't want to share, you know?

DAVID BISSON. Yep. So, okay, when I found that out, it's like, okay, so I can't buy this on Amazon. So let's actually look up the name of the company. It's referenced in the email. So I tried searching the, the model of the dildo. And while I couldn't find the exact model, I did find something similar. I ended up on this like bulk purchasing website. I'm not going to say which one. And I found that I could basically buy— I think I could buy like about 100 of them for about like $16, $18 per unit. So, oh, a far cry from $890 for just one, you know. If like I—

CAROLE THERIAULT. it's a healthy markup. It's a healthy markup, to say the least.

DAVID BISSON. So I said, okay, well then there's, there's kind of like a model. Let's, let's get back to the email. Let's see what I can find out more about it. So I said like, let's, let's look at the customer support number. I mean, that's the, that's sort of the main crux about the email It's saying, if you haven't placed this order, call this number. So it's like, okay, what, what can I learn about this number? And as it turned out, you know, I just Googled it. I came up with several different reports about scams, including one regarding a fake amazon.com order, um, from someone named Mark Angel. So, you know, it's like, okay, well, let's look at the sender address for this email, see if anything comes up. Yeah, sure enough, it comes from someone named Mark Angel. It's, uh, I'm not going to give the full email address, but it's kind sketchy domain name. And I looked up that email address and there were also various spam reports using that same email address. So, you know, I didn't call the customer support number. I know lots of other people do that and have fun.

CAROLE THERIAULT. Yeah, I got enough for a story here. Yeah.

DAVID BISSON. Yeah.

GRAHAM CLULEY. You've got better ways to have fun than ringing them up, right?

DAVID BISSON. Yeah.

CAROLE THERIAULT. You want to play around with your new toys.

DAVID BISSON. Exactly. It's already on all these bulk websites. It's like, ah, you know, I've had my fun. So I mean, this came out before— I got this email before Prime Day. So I'm guessing it was probably like part of like a campaign to try and say, oh, you know, call these probably like tech support scammers or something like that. Maybe someone posing as an Amazon representative to try and like steal your account credentials or maybe your financial information and all that stuff. But just as a last like, hmm, Interesting. I said, is there a dildo out there that's worth $890? So I went, went to the interwebs to try and find out. And as it turns out, not only can you spend that much money on a dildo, you can spend much more. I found one, the Crème of the crème of dildos, to use a phrase, you can buy for $1.3 million.

CAROLE THERIAULT. Shut up.

GRAHAM CLULEY. Oh, for goodness sake.

DAVID BISSON. It's diamond studded. Ow. Ow.

GRAHAM CLULEY. That sounds uncomfortable.

DAVID BISSON. And it's just, you know, like finding that type of thing, you know, I just couldn't sit back like and just wonder, what would my life look like if I could spend $1.3 million on a dildo? Well, if you shoved it up your butt, you'd probably have a ripped butthole.

GRAHAM CLULEY. That's what would happen.

CAROLE THERIAULT. Oh.

GRAHAM CLULEY. We can bleep that out.

CAROLE THERIAULT. But diamond encrusted.

DAVID BISSON. Yeah, I know. I mean, that's fancy living.

CAROLE THERIAULT. That is fancy living. Kim Kardashian, get in touch. We want to know.

GRAHAM CLULEY. So you've never— so you still haven't received this. Is that why you're complaining? Is that the scam?

CAROLE THERIAULT. They charged you but not sent it through.

GRAHAM CLULEY. You really wanted electric blue.

DAVID BISSON. This is, you know, purple-ish.

CAROLE THERIAULT. Just putting you off. You know, you got to wonder whether this works, right? Because if they're sending something to you, like, you know, this is obviously a fake invoice, but it's a, it's a, it's basically, it's a dildo. And then they want you to call to complain. But you've got to complain about receiving this thing for a dildo. And maybe that works. Maybe that kind of sends a message.

GRAHAM CLULEY. Oh no, I think it does, because you ring up and say, there is no way I would have ordered something like this, at least not for $790.

DAVID BISSON. Exactly. Like if it was like, you know, a shipping confirmation thing for like, oh, I ordered some like, I don't know, cat food for like $60. It's like, ah, probably not.

CAROLE THERIAULT. But like 600 rolls of toilet paper or something like that.

GRAHAM CLULEY. I guess the person on the other end of the line, they say, oh, you know, let me sort this out for you. I'm Amazon customer support. All I need is your password or all I need is—

DAVID BISSON. Yes.

CAROLE THERIAULT. This is a delicate matter. Let me just handle it for you.

DAVID BISSON. It's like, oh, we'll refund it. Just give us your payment account number.

CAROLE THERIAULT. Yeah. So the advice is don't call the number, folks.

DAVID BISSON. Don't.

GRAHAM CLULEY. I guess log into the real Amazon and you can see there if you've ordered something or not. Yeah.

DAVID BISSON. Yeah. That also helps in, you know, just in general, maybe consider getting dildos elsewhere.

GRAHAM CLULEY. Yeah.

DAVID BISSON. So.

GRAHAM CLULEY. And now to our sponsors. Oh no.

CAROLE THERIAULT. No, thank God you have me as a buffer first.

DAVID BISSON. Oh yes.

CAROLE THERIAULT. Carole Theriault. Yes, Graham.

GRAHAM CLULEY. What have you got for us this week?

CAROLE THERIAULT. Well, Graham, we've done hundreds and hundreds and hundreds of these shows, have we not? Like, I've paid my dues, right? You've paid your dues.

GRAHAM CLULEY. Definitely.

CAROLE THERIAULT. And we've proven to be reliable, right? We get a quality show out every week.

GRAHAM CLULEY. Yeah, well, they say.

CAROLE THERIAULT. Now, imagine if today you showed up 10 minutes late to our recording. Let's say you got tangled up in your curtains or something.

GRAHAM CLULEY. Okay, yes. I thought you were going to say caught short on the loo. Yeah.

CAROLE THERIAULT. Right? And then you finally connect with David and I, right? And you're like, hi, hi, hi, hi.

GRAHAM CLULEY. Yeah.

CAROLE THERIAULT. What would you say? You'd go like, sorry, curtain trouble.

GRAHAM CLULEY. Yeah, exactly. I'd say, yeah.

DAVID BISSON. And we're supposed to know what that means.

CAROLE THERIAULT. Yeah.

GRAHAM CLULEY. Yeah. I locked myself in the loo or something like that. Couldn't get out. Yeah. Something like that.

CAROLE THERIAULT. Yeah. And then what would you expect us to say? Go, oh, no problem.

GRAHAM CLULEY. Yeah.

CAROLE THERIAULT. Fine. Glad you're here.

GRAHAM CLULEY. Yeah. Glad you're not dead.

CAROLE THERIAULT. What if I labeled you instead of being at risk of losing your job on the Smashing Security show? Whoa.

GRAHAM CLULEY. Oh, Graham Cluley.

CAROLE THERIAULT. Right?

GRAHAM CLULEY. I thought we were bud buds.

CAROLE THERIAULT. Well, let me introduce you to Amazon Flex. OK? So this is a delivery service that has been in the news this week thanks to a Bloomberg kind of reportage that basically says that Amazon Flex uses imperfect algorithms to fire its employees. And there's little to no recourse. Now, before I kick off, I know this is not a brand new topic, right? People have been writing about algorithmic hiring and firing, I don't know, almost a decade, I bet. But this is 10 years on. And David, you're a millennial, if I'm correct. I think I'm allowed to say that.

DAVID BISSON. Yeah. Yeah.

CAROLE THERIAULT. And Graham, you're practically a grandpa. So, but you both have been, you've both hustled in your time, right? You've both hustled. You've both, you know.

GRAHAM CLULEY. What does that mean, hustle?

DAVID BISSON. Yeah, I don't know.

CAROLE THERIAULT. You've worked, you've worked, you've worked, right? You've gone out and, you know, got jobs and done your jobs and then got paid for those jobs.

GRAHAM CLULEY. Oh, okay.

CAROLE THERIAULT. Right? In a kind of gig economy. And I'd be interested to know what your thoughts are on this. Like if this is the future of work, are you glad, Graham, you're checking out soon? Or are you looking forward to a day that basically— She knows something about me I don't know.

GRAHAM CLULEY. I'm gonna be checking out soon.

CAROLE THERIAULT. Graham, can we stay on the topic? It's my story time.

DAVID BISSON. The great podcast in the sky.

CAROLE THERIAULT. Okay, so Amazon Flex, okay, this delivery service started in 2015 and its strapline is adjust your work, not your life, okay? Do it your way, drive your car, listen to your music and get paid. And so the big sales pitch around here is that you can work when you want to in your own car, et cetera, et cetera.

GRAHAM CLULEY. Oh, I think I've got a mate who does this.

CAROLE THERIAULT. Oh yeah?

GRAHAM CLULEY. Because the other day I had an Amazon delivery and he came to the door and he handed over the thing and all the rest of it and I said thank you very much and he went off. And then 30 seconds later he knocked on the door and he went, Graham Cluley.

CAROLE THERIAULT. Oh yeah, I remember you telling me. Yeah, yeah, tell me.

GRAHAM CLULEY. And it was some guy who I used to know like 20 or 30 years ago.

CAROLE THERIAULT. Oh wow.

GRAHAM CLULEY. I haven't seen him since.

CAROLE THERIAULT. You did not remember his name?

GRAHAM CLULEY. No, I did remember his name. Oh wow. Steve. I knew his surname as well, but I won't say it here. But yeah, it was Steve and so we had a little chat.

DAVID BISSON. Jeez.

GRAHAM CLULEY. And I don't even live where I used to— where he used to live and where I used to live ages ago. So it was, it was a bit of a surprise. But this is what he does. He drives his car and he does Amazon deliveries. Yeah.

CAROLE THERIAULT. Okay. Well, did he meet this criteria? Because this is the criteria you need to meet to work as an Amazon Flex worker. Okay. You need a car. Okay. And it needs to be a 4-door midsize car or larger. Okay. No motorbikes, no scooters, no, no 2 doors. You need to be at least 18. They'll do a background and criminal record check on you potentially. And you need to have Business Class 3 insurance, which I looked up in the UK is about, looks like the average is £550. So I would be not surprised if people were paying about a grand a year for that. And you need to have an Android phone or an iOS phone. And you will maybe make between £13 and £15 an hour, or in the States, $18 to $25 an hour. And the reason there's like this spread of money is whether you get tips or not, you might make more, right? If someone tips. Do people tip Amazon drivers? Do you tip?

GRAHAM CLULEY. No, I've never, I've never even thought of it.

CAROLE THERIAULT. People do. People do.

GRAHAM CLULEY. Do they?

CAROLE THERIAULT. Yeah. Wow.

DAVID BISSON. But what's the criterion that you use?

CAROLE THERIAULT. I know, like, because you don't know what you're getting off of the half the time. Right.

DAVID BISSON. You don't know how long it's taken. I mean, I don't know.

CAROLE THERIAULT. I don't know. We should maybe just offer cookies.

DAVID BISSON. Cookies and cake and flowers.

GRAHAM CLULEY. Quite often I receive parcels which are actually intended for my neighbor, and so I have to complete the last bit of the delivery on the behalf of the Amazon driver who appears to be too—

CAROLE THERIAULT. yeah, you don't want to be out 10 quid.

DAVID BISSON. It's your neighbor tip you thinking that you're the Amazon driver.

GRAHAM CLULEY. I'm wondering if I can make money from Amazon Flex for doing the final part of the—

DAVID BISSON. just get like an Amazon hat and just walk over. It's like, here you go.

CAROLE THERIAULT. Okay, now something else you need to note is, uh, they have no trouble finding contractors. That's what they call them. These are not employees, they're contractors, right? So globally, 4 million drivers have downloaded the app. So who knows if they're all on the roads, but they're active on the app, including about 3 million in the States. This is according to App Annie. Okay, so let's say you wanted to be one of these drivers, right? You passed all these checks, you have an insured car, you got the app, and you basically use it like Tinder, okay? You peruse the offerings, like, and they're done in blocks. So like, let's say maybe it's 4 square blocks of a city or 1 square block of city, depending on where you are.

GRAHAM CLULEY. When you say Are you sort of swiping through to see the attractiveness of the recipient and think, oh yes, I'll deliver something for her?

CAROLE THERIAULT. Oh gosh. You're looking at where you have to pick up these packages and where you need to deliver them to. And you might go and you might see how much Amazon is offering to pay you. So they might say, here's 5 deliveries within this area of the city, about 2 miles from where you are right now, and we'll give you $30 minimum. Them if you get them all delivered in time.

GRAHAM CLULEY. I think my way is better. I think if all Amazon customers uploaded photographs of themselves looking sexy, and then we could get deliveries more quickly, nothing would go wrong.

CAROLE THERIAULT. Yeah, it would be great.

DAVID BISSON. Yeah, next week's episode.

CAROLE THERIAULT. Yeah, all women right now are thinking it's fantastic.

GRAHAM CLULEY. TM, TM, it's trademarked.

CAROLE THERIAULT. Yeah, it's all yours. Okay, so Graham, stay with me. You've passed all the checks, you, you're looking at the app and you're going, hey, there's some packages I can deliver and this is how much I'm going to get, and I have Got an hour free, let's go. And you go off and deliver these things and on it goes. From the moment you sign on, this is according to Bloomberg, okay? Quote, flex drivers discover algorithms are monitoring their every move. Did they get to the delivery station when they said they would? Did they complete their route in the prescribed window? Did they leave the package in full view of porch pirates instead of hidden behind the planter as requested? And Amazon algorithms scan the gusher of incoming data for performance patterns and decide which drivers get more routes and which are deactivated. By deactivated, fired. Okay. It's a kind of weird—

DAVID BISSON. Terminator or something?

CAROLE THERIAULT. Yeah.

DAVID BISSON. It's like, you are deactivated.

CAROLE THERIAULT. Yes. You have imploded as far as I'm concerned.

DAVID BISSON. That's really threatening language.

CAROLE THERIAULT. What's even worse is like human feedback. So any communications with any team leader or anything is super rare. Okay, so you get these automated emails, but most of the time you have this rating system, which basically says whether you're doing good or bad. And there's 4 categories: fantastic, great, fair, at risk. And so every day, you're basically obsessed with these staying at the fantastic level.

GRAHAM CLULEY. Yeah.

CAROLE THERIAULT. And we know this from Uber and Lyft and all these kinds of things.

DAVID BISSON. Black Mirror.

CAROLE THERIAULT. Right? So one of the arguments is like Uber and Lyft. If you're the customer and you're in the car and there's a traffic jam, you're kind of aware that it's not the driver's fault, that there's just shit tons of traffic. So you're less likely to go, one star, it took me 4 minutes longer than I expected. But if you're waiting for a package and it happens to be late and you decide to give a shitty rating or complain, you can get someone fired. You know how I was saying, Graham, if I just got rid of you after 10, a little fuck-up of being 10 minutes late, right, on the show? So one of the stories Bloomberg talks about is this woman, Nedra, 42-year-old bus driver, school bus driver, mom of 3, right, lives in Texas. And then she was making deliveries through the Amazon Flex app from 2017, you know, just to make a bit of extra money to pay for kids' activities. Pandemic hits, schools close, she doesn't have any work and has no money. But thanks for Amazon Flex, this becomes her primary income. She estimates she's delivered about 8,000 packages in that time. 8,000. So all's great, but one day while flexing, she spots a nail in her tire. She's already picked up the packages and she calls them and goes, "I don't know what to do." And they say, "You have to come and bring them back to the delivery station." And she was really afraid that it would blow her tire because guess what? That's her money, right? That's her responsibility if she fucks the whole tire. She has to pay to get that fixed to carry on working. Working. But she goes because she doesn't want to lose her rating. And, uh, despite explaining the situation, her rating dropped from great to at risk. So from the top level to the bottom level, just like that. She— and it was for abandoning the route. That's why she got that, that thing, right? So then, you know, she gets an email to say that she violated Flex's terms of service, and that's all she gets. She goes, as a result, you are no longer eligible to participate in Amazon Flex program, and you won't be able to sign into the Amazon Flex That's it. So then you're like, okay, well, how do you say, whoa, you guys got something wrong. I did what you told me to do, right? Like, how do you? And apparently the support is just abysmal. So if you have a complaint, there's no real useful way to get an answer. So you can appeal a termination if within the 10 days, but then you send an email, no one answers. You follow up, no one answers.

GRAHAM CLULEY. Yeah, there's no money they're gonna make, is there, from green?

CAROLE THERIAULT. Exactly. And after doing loads and loads of follow-up, she finally gets a message saying, we're still reviewing your appeal. Then a week later, we reviewed the information, take another look at your history. Our position has not changed and we won't be reinstating your access to the Amazon Flex program. We wish you success in the future endeavors.

DAVID BISSON. Wow.

CAROLE THERIAULT. And this woman almost lost her house, right? This was during the pandemic. So I don't know, don't you think it's a bit like me getting rid of you for being late 10 minutes for a recording on episode 234? Like, it's that shitty. 8,000 packages.

GRAHAM CLULEY. Well, I, I don't disagree with you, but if they have— what did you say, 4 million people signed up to this Flex thing worldwide?

CAROLE THERIAULT. Yeah.

GRAHAM CLULEY. How much resource would they have to put in to, to manage that manually? I don't know. And Amazon is all about algorithms, isn't it? This is how they've become such a goliath.

CAROLE THERIAULT. And you, if you want to appeal, take it to arbitration, you can pay $200 to do that. But few do because people say it's a complete waste of time.

GRAHAM CLULEY. It's no secret to anyone that Amazon is a very curious company, because in some ways it's incredible and amazing because you can buy anything there and it gets delivered really, really quickly. But I think it's no secret that they're a ghastly and horrible company to work for or work with. You know, it's—

CAROLE THERIAULT. There was a number of these. I went to Reddit to look around, right? And people were saying like, I went and the roads were flooded, you know, and I couldn't get through and I've now just been dropped. Dropped in one hour. I was dropped from fabulous to shit. And some other guy in the notes said, I don't know why you just didn't take your shoes off and walk it over. I've done that before. Wow. Right? Just to keep their fantastic rating.

GRAHAM CLULEY. Yeah. Wow. Yeah.

CAROLE THERIAULT. Um, anyway, so it just seems to me the way they're suckering people into these gigs is by the high money at the beginning, the $20 at the beginning. But I think people are forgetting that, that you have to have a car, you have to have insurance, you have to keep your phone up to date, you've got, you know, and you can be dinged by factors way outside your control. And there's no real appeals process or anyone you can complain to when shit hits the fan. And like, why are people taking these jobs instead of working at a supermarket where maybe you get paid a little less and you don't have the flex hours? So those are the two things. You've got to, you know, you've got to be at your job at particular times if you're working in a restaurant or a supermarket or a store.

DAVID BISSON. Well, I mean, I guess the advantage sometimes, like especially, you know, if you're a single parent and it's the pandemic and stuff like that, you can try and work around, like, you know, if you're doing like homeschooling with your kids. So, you know, like a sitter or something like that. I mean, like, maybe doing a 9 to 5 at a supermarket just is outside what's possible.

CAROLE THERIAULT. Yeah, and you need to have that flexibility because you don't know. Maybe you're looking after someone who's ill, right? And you're like, oh, they're finally going to sleep, I've got 3 hours to go make some cash. Yeah, the thing that pisses me off the most about this is I went and checked Amazon's money because I was thinking, oh, maybe they're hurting, right?

GRAHAM CLULEY. Maybe they're a bit hard up.

CAROLE THERIAULT. Maybe they're hard up and they're not able to pay people better, and they can't, you know. So net sales increased 44% to $108.5 billion— get this— in the first quarter.

DAVID BISSON. That little in the first quarter?

GRAHAM CLULEY. They are hurting. They are hurting.

CAROLE THERIAULT. They're rolling in it. And despite that, they're basically saying, oh, anyway. So do we need better legislation? So in the States, there's a U.S. Senator, Chris Coons. He introduced the Algorithmic Fairness Act, which would require the FTC to create rules to ensure that these algorithms are being used equitably. So there's no bias, for example, in decisions, and there's an opportunity to reverse mistakes. But apparently his proposal's gone nowhere. But recently, the UK's Trade Union Congress, TUC, warned about what it calls a huge gap in UK employment law over the use of artificial intelligence at work. So literally saying that AI at work could be used to improve productivity in working lives, but it's already being used to make life-changing decisions about people at work who are getting hired and fired. So that's good. I think that's good that they're acknowledging it. We need to think about what to do with these wonderful drivers. Don't you think it's time to be a bit nicer to your drivers and give them the benefit of the doubt if they're 5 minutes late? So if you're going to tip, for example, don't tip, don't tip through the app, just tip in cash, right? So that Amazon algorithms don't get to use these numbers to adjust how much you might make working for them, because that's what they're They're like, on average, people get about 20 quid for, you know, a 4-hour shift. So therefore, that's how much you can make. They add it onto the money they'll give you. It's disgusting.

GRAHAM CLULEY. I don't know, Carole.

DAVID BISSON. Now, I mean, is it something like if you don't tip through the app, will they interpret that as like dissatisfaction on the part of the customer?

CAROLE THERIAULT. Wow, yeah.

GRAHAM CLULEY. Interesting. I like where you're thinking, David. I actually thought of something else, which is, I don't know when an Amazon parcel is meant to be delivered to me, right? But if someone comes to my door, knocks on my door and gives me a brown Amazon parcel. If I could give them money, I suppose I could give them a couple of quid, say thank you very much, whatever. But maybe when I then later open that parcel, I find out, oh, that wasn't an Amazon delivery man. That's just someone who's going door to door with Amazon parcels in order to get tips. Right? Oh yeah.

DAVID BISSON. Right.

GRAHAM CLULEY. Scammers. Am I too cynical to think this? That could happen.

CAROLE THERIAULT. No, I don't think so. I think I'm talking about the story because I think I fucked up actually recently. So I ordered something from TK Maxx the other day, right? An expensive thing and a not so expensive but bulky thing. Box arrives, I'm really nice, great, yay. You know, inside it is a delivery receipt for both items, but only the cheap, big, bulky thing is in there. And I freak out a bit and I email the company. And then an hour later, the guy shows up with the other package. The expensive thing arrives, but it also has an invoice for both items in that box. So I felt like a Muppet because obviously, I emailed them back right away saying, stand down, all's cool. But what if that doesn't matter? It's just an algorithm that goes, oh, complaint by John or whatever. It's too awful to think. Anyway, there you go. Cheery note to end on.

GRAHAM CLULEY. Well done. Ruined someone's life. Well done. Thanks.

CAROLE THERIAULT. I know. It's the worst.

GRAHAM CLULEY. Smashing Security is sponsored this week by the experts at 1Password. Did you know that almost two-thirds of all IT workers admit to reusing enterprise secrets between different projects, creating a potential gateway for attackers? 1Password's new research report, Hiding in Plain Sight, reveals the breadth and depth of mismanaged business secrets like code, passwords, credentials, and keys, and that secrets mismanaged Phishing is the next big cybersecurity threat. Learn more by reading the full report at 1password.com/resources. And thanks to 1Password for supporting the show. And welcome back, and you join us at our favorite part of the show, the part of the show that we like to call Pick of the Week.

CAROLE THERIAULT. Pick of the Week.

GRAHAM CLULEY. Pick of the Week is the part of the show where everyone chooses something they like. Could be a funny story, a book they've read, a TV show, a movie, a record, a podcast, a website, or or an app, whatever they wish. Doesn't have to be security-related necessarily.

CAROLE THERIAULT. Better not be.

GRAHAM CLULEY. Well, my pick of the week this week is not security-related. I don't know if listeners have picked this up, David Crowell, maybe you have, maybe you haven't, but I consider myself very much a Renaissance man. I'm a fine athlete.

CAROLE THERIAULT. I've always thought that about you.

GRAHAM CLULEY. An excellent scholar, I have an ear for music, a talent for art, and a way with the ladies. And I think I'm the all-round package, But then I come across other people with talents as well. People who maybe are even more artistic than me. David, I invite you to visit a website. Type it into your browser right now. And you listening at home—

DAVID BISSON. I feel like this is just social engineering.

CAROLE THERIAULT. Why can't I go visit?

GRAHAM CLULEY. You can as well, Carole, if you wish. If you wish to, you can. Listeners, don't do this if you're driving your car or in charge of heavy machinery. Wait until you're in a safe place, and then go to a website called carole.wtf. Not.com. Carole, so that's Carole with an E on the end. Carole.wtf. I don't know what WTF stands for. Give it a try. I'm wondering what you'll find there. What you will find there is a website of art from our very own Carole— How do you spell— How do you pronounce your second name? Theriault. Theriault. Carole Theriault.

CAROLE THERIAULT. You can find out on the homepage.

GRAHAM CLULEY. Yeah, it tells you how to say it. It doesn't tell you how to say Carole. Oh, wow.

DAVID BISSON. These are incredible.

GRAHAM CLULEY. Oh.

CAROLE THERIAULT. Shut up, Dave.

DAVID BISSON. Keep going.

GRAHAM CLULEY. No, no.

DAVID BISSON. No, looking at the one— Like, I'm looking on the art gallery one like the first one with the field and like the color. Like, it's— this is awesome.

GRAHAM CLULEY. Oh, you see?

DAVID BISSON. Oh, the light, the lighthouse.

GRAHAM CLULEY. Carole, for the last couple of years maybe, has been painting.

DAVID BISSON. Oh, Mindscape! Mindscape! Oh, so cool, Dave!

CAROLE THERIAULT. I love you.

GRAHAM CLULEY. And she sends them to me and some of her other friends, and she's quite clear about Carole Carole is a little bit shy. You wouldn't know that. And, but this website has just been created with amazing artwork. Who could have known she was so talented? Carole.wtf is my pick of the week.

CAROLE THERIAULT. Now I feel like a dick for being a jerk to you the whole show.

GRAHAM CLULEY. I think you should.

CAROLE THERIAULT. I do.

DAVID BISSON. Jeez. This is incredible.

GRAHAM CLULEY. Isn't she clever? I mean, it is amazing because if I tried to paint something, it would look like someone in a straitjacket had painted something with a paintbrush shoved between his teeth. That's how my painting would look. It would look like a two-year-old.

CAROLE THERIAULT. It's really weird seeing them because they're all obviously physical, real paintings, not digital paintings, right? So it's kind of kind of weird seeing them up here and looking at them like this, but it's very exciting. It's just scary as shit.

DAVID BISSON. You know, it'd be cool, like, you know, maybe you could have like prints and stuff, or like people could like order some.

GRAHAM CLULEY. Oh yes.

DAVID BISSON. Yeah, like I would, I would order like Gold Country. I mean, that's like—

GRAHAM CLULEY. yeah, you could put these up on Redbubble maybe, Carole. You could get prints. Maybe some people would like them on the t-shirt.

CAROLE THERIAULT. I'm open to advice on this if there's any artists out there that want to recommend if I this, but I was thinking Society6 is the one I was thinking about.

GRAHAM CLULEY. Oh, I don't know. I think Mindscape, that could be on the COVID of a prog rock album.

CAROLE THERIAULT. It could.

GRAHAM CLULEY. Greg the Goat. Greg the Goat could be on the COVID of maybe a yoghurt or something like that in the supermarket. I mean, some of them are funny. Some of them are spooky. carole.wtf. Have I mentioned the domain name? What made you choose that domain name, Carole?

CAROLE THERIAULT. Carole? It's very easy to remember.

GRAHAM CLULEY. Okay. Yeah.

CAROLE THERIAULT. So, no, I know—

GRAHAM CLULEY. Sounds appropriate for you as well.

CAROLE THERIAULT. Well, yes. And you won't forget it.

GRAHAM CLULEY. Very cool. Very cool.

CAROLE THERIAULT. Thank you, Kate. That's really sweet.

GRAHAM CLULEY. David, what's your pick of the week?

DAVID BISSON. Alright, well, there is a— there's a new album that came out earlier this year. It's by this artist called Porter Robinson. That's his name.

GRAHAM CLULEY. It's—

DAVID BISSON. It's sort of like— calling it EDM sort of reduces it because there's a lot of other influences that go into it, but it is electronic music. So he came out with this new album this year called Nurture, and it's just incredible. Like, you know, if you're— I mean, especially with it being summer, and if you're just like chilling and stuff like that, like just putting this on and just like sort of losing yourself for an hour while you're like like, you know, just staring absentmindedly outside is an afternoon well spent.

CAROLE THERIAULT. Cool.

DAVID BISSON. I find myself like constantly listening to certain songs, like Look at the Sky, Wind Tempos, something comforting. Like it is truly incredible. So can't recommend that enough, really. Just give it a listen.

CAROLE THERIAULT. He's got a very slick website.

DAVID BISSON. Seriously.

CAROLE THERIAULT. A lot more whiz-bang than me, I tell ya.

GRAHAM CLULEY. So I'm checking, Porter Robinson, I've just been reading about this. He describes the music as quite melancholic. Is that right? A lot of pain and sadness. Is there some of that going on with it?

DAVID BISSON. Yes, a lot of nostalgia in it.

CAROLE THERIAULT. Yeah. What's wrong with— there's nothing— you like sad music, Graham.

GRAHAM CLULEY. Oh no, I'm not saying there's anything wrong with it.

CAROLE THERIAULT. I love this. I'm totally going to turn this on tomorrow when I do my little painting time and check it out. That's how I'll do it. See what happens.

GRAHAM CLULEY. Fantastic. Carole, what's your pick of the week? Is it in fact your website?

CAROLE THERIAULT. No, I wasn't going to do it. I'm too scared. Okay. Mine is a show called Ways of Seeing. This was in 1972. Graham, did you have pubic hair by then? I don't know.

GRAHAM CLULEY. Couldn't I say?

DAVID BISSON. Yikes. That's a question.

CAROLE THERIAULT. Ways of Seeing, 1972 television series, Kate. Four-parter, 30-minute films each. They're created by John Berger and producer Mike Dibb. This was broadcast originally on BBC Two, and it was adapted into a book of the same name. Now, you can find these shows on YouTube. And my advice is run, don't walk to watch this. It is, to me, like quintessential viewing for anyone who is a bit of a creative. It will make you think about what you see, how you see, and how the very act of looking is effectively political. And I can see Graham right now is rolling his eyes.

GRAHAM CLULEY. No, not at all. I've watched this video. I've seen this. Yes, and it's fascinating. He seems an extremely interesting person. He is. I would thoroughly recommend people watch this video.

CAROLE THERIAULT. Cool. Okay, well, so it's a bit like— the best way to explain it is if, say, for example, I wanted to see David by Michelangelo, the statue, and I decided to do a pilgrimage to Florence to see it in person with my own eyes, and, you know, and I I spend the money, plan the trip, all the shit, and that will have an entirely different experience to me seeing a thumbnail image of it in my browser. Right. But both people have seen the image or seen it in some way. So he kind of discusses all this. And the one thing I learned today is this series is said to have introduced the term male gaze during the series, and feminists took hold of it. And yeah, anyway, I just think it is incredible. There's a book as well that talks about the same issues, and there's a few more essays in it. Some of them are just visual essays. So if you love art or know anyone that loves art and you want to support them, this— you can obviously just go to my site and say it's great. Or you can read and watch John Berger's Way of Seeing, and it'll help you communicate and talk with them and support them. So there you go. That's my pick of the week. [Speaker:WILLIAM GREEN] Awesome.

GRAHAM CLULEY. Fantastic. What a cultural clasp of picks of the week we have had this week. I think we've all done Jolly well, and that just about wraps up the Hutch Show for this week. David, I'm sure lots of our listeners would love to follow you online and find out what you're up to. What's the best way for folks to do that?

DAVID BISSON. Uh, yeah, yeah. So you can find me online, um, you know, with, uh, Twitter. Um, I'm @dmbisson. You can find me on LinkedIn. I'm there too and just write regularly for like IBM and, and Zix and all these other companies. So, um, you know, if you, if you want to hit me up and if you have any jobs or anything like that too, I'm always looking working. So, uh, you know, reach out, you know, I'm available.

CAROLE THERIAULT. Do it, people. He's great.

GRAHAM CLULEY. And you can follow us on Twitter at Smashing Security, no G. Twitter wants to have a G. And you can join us as well on our Smashing Security subreddit. And don't forget to ensure you never miss another episode. Please follow Smashing Security in your favorite podcast app, such as Apple Podcasts, Spotify, and Pocket Casts.

CAROLE THERIAULT. And thanks to this week's episode sponsor, 1Password, and to our wonderful Patreon community. It's thanks to them all this show is free. For episodes, show notes, sponsorship information, guest lists, and the entire back catalog of more than 234 episodes, check out smashingsecurity.com.

GRAHAM CLULEY. Until next time, cheerio, bye-bye.

CAROLE THERIAULT. Bye-bye. Excellent, guys. Well done, David. Well done, Graham. I'm sorry you can't hear each other. Okay.

GRAHAM CLULEY. Oh, he can't hear me either.

DAVID BISSON. It's almost like better this way.

CAROLE THERIAULT. Yeah, he can't hear you, you can't hear him, and I'm—

DAVID BISSON. Yeah, I don't have to listen to Graham prattle on.

CAROLE THERIAULT. I mean, Graham, he just said you were amazing. He misses your voice.

GRAHAM CLULEY. David, you are awesome too. Thanks so much.

CAROLE THERIAULT. Uh, Graham says you're a shitbag.

DAVID BISSON. That's amazing.

CAROLE THERIAULT. Hey everybody, Carole Theriault here. This week I thought I would share with you how the sausage is sometimes made at Smashing Security. We had a bit of a snafu, but I think we've hidden it fairly well. I don't know why I'm telling you about it now, but maybe because it's funny. So while we were recording this episode, we just finished up David's Pick of the Week, and suddenly David and Graham could no longer hear each other. Listen to this. Um, you guys can't hear each other.

GRAHAM CLULEY. Oh, David Bisson has left.

DAVID BISSON. Oh no, I can't hear anything with Graham.

CAROLE THERIAULT. Okay, well look, if this is— this will maybe work. Graham, go to my story. Okay, we'll say it's amazing. Go to me. We're gonna crack this on.

GRAHAM CLULEY. We can do this.

CAROLE THERIAULT. We're all recording locally, right?

DAVID BISSON. Yeah.

CAROLE THERIAULT. Okay, should we try? Should we try?

GRAHAM CLULEY. Yeah, but don't we want David on the call, on the recording?

CAROLE THERIAULT. We're so close, David. So basically, we carried on recording the show with me as the proper middle woman.

GRAHAM CLULEY. Fun.

CAROLE THERIAULT. Maybe you want to re-listen and see if you can spot it, but you know, we're pretty professional. As always, thank you to all of you for your support and kind words. It means the world. See you guys next week.

-- TRANSCRIPT ENDS --