Scammers from Africa are preying on US businesses, a drug dealer makes a mistake when hiding his Bitcoin fortune, and the Coronavirus pandemic is causing scams to soar and raising questions about facial recognition.
All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Naked Security's Anna Brading.
Visit https://www.smashingsecurity.com/167 to check out this episode’s show notes and episode links.
Follow the show on Twitter at @SmashinSecurity, or on the Smashing Security subreddit, or visit our website for more episodes.
Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!
Warning: This podcast may contain nuts, adult themes, and rude language.
Theme tune: "Vinyl Memories" by Mikael Manvelyan.
Assorted sound effects: AudioBlocks.
Special Guest: Anna Brading.
Sponsored By:
- LastPass: LastPass Enterprise simplifies password management for companies of every size, with the right tools to secure your business with centralized control of employee passwords and apps.
- But, LastPass isn’t just for enterprises, it’s an equally great solution for business teams, families and single users.
- Go to lastpass.com/smashing to see why LastPass is the trusted enterprise password manager of over 33 thousand businesses.
Links:
- Business Email Compromise (BEC) and G Suite: How the Exaggerated Lion Cybercrime Group Cashes Out — Agari.
- A weed dealer’s $59M lesson: Don’t hide Bitcoin keys with a fishing rod — Ars Technica.
- Chance encounter with gardaí unmasked bitcoin millionaire drug dealer — Irish Times.
- Man who ‘threw away’ bitcoin haul now worth over $80m wants to dig up landfill site — The Independent.
- Novel Coronavirus Update — RSA Conference.
- The Coronavirus Is Swiftly Breaching Defenses Across The World — Peak Prosperity.
- Scores of Hongkongers hit by mask scam on Facebook, hundreds more could be fraud victims since coronavirus outbreak — South China Morning Post.
- How Big of a Scam Are 'Coronavirus Protection Kits?' — Vice.
- Wearing a mask won’t stop facial recognition anymore — Abacus News.
- Coronavirus phishing scam targets victims with false information — Business Insider.
- This Cat Does Not Exist.
- These Cats Do Not Exist.
- Intelligence — Sky.
- This Country — BBC Three.
- Farkle — Wikipedia.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
Privacy & Opt-Out: https://redcircle.com/privacy
Transcript +
This transcript was generated automatically, and has not been manually verified. It may contain errors and omissions. In particular, speaker labels, proper nouns, and attributions may be incorrect. Treat it as a helpful guide rather than a verbatim record — for the real thing, give the episode a listen.
ANNA BRADING. Do you know what my first impression of Graham was? I joined, I was sat on my own next to a printer.
GRAHAM CLULEY. You were in quarantine, we were deciding, shall we accept her or not?
ANNA BRADING. And Graham was this guy sat behind a desk, and behind him was a giant cardboard cutout of himself. Enough said. I thought, hmm. Interesting.
UNKNOWN. I wonder whatever happened to that. Smashing Security, Episode 167: Coronavirus Scams and an Exaggerated Line with Carole Theriault and Graham Cluley. Hello, hello, and welcome to Smashing Security, Episode 167. My name's Graham Cluley.
CAROLE THERIAULT. And I'm Carole Theriault.
GRAHAM CLULEY. And we're joined today by a special guest, A very special guest. Never been on the show before. It's Naked Security's Anna Brading. Hello, Anna.
ANNA BRADING. Hello. It's like the old gang back together again, isn't it?
GRAHAM CLULEY. We should explain. How do we all know each other?
CAROLE THERIAULT. Uh, Naked Security?
ANNA BRADING. Yeah. You two birthed Naked Security, and when you left, I adopted it.
GRAHAM CLULEY. And now it's become an unruly teenager.
ANNA BRADING. Oh, it has.
CAROLE THERIAULT. I think I did most of the birthing of that, actually. I think Graham just sat there.
ANNA BRADING. Yeah.
CAROLE THERIAULT. And said, you're doing a great job. Although he did write a lot once it was created, because he didn't like it at first, right? Because he had his own blog and he had to share with people.
GRAHAM CLULEY. What do you like? I was very much behind the idea. I thought it'd be good.
CAROLE THERIAULT. Oh, I guess I misremember.
ANNA BRADING. Do you know what my first impression of Graham was? I joined and I got put in this weird island thing. And it was like I was sat on my own next to a printer in the room. It wasn't like, shall we accept her or not? No, it was a different team. And Graham was this guy sat behind a desk and behind him was a giant cardboard cutout of himself. Enough said. I think that's perfect. Interesting.
GRAHAM CLULEY. I wonder whatever happened to that.
ANNA BRADING. Have you not got it?
GRAHAM CLULEY. No, it got kidnapped once by the McAfee crew.
ANNA BRADING. Oh.
GRAHAM CLULEY. Yes, held it ransomware, but then eventually it came back. I don't know what happened to it in the end. Anyway, Carole Theriault, what's coming up on the show this week?
CAROLE THERIAULT. I thought you'd never ask. First, thanks to this week's sponsor, LastPass. Its support helps us give you this show for free. Now, Graham introduces us to the dubious exaggerated lion group. Anna tells us of a fisherman who lost a bitcoin fortune, literally. And someone around here had to cover the coronavirus scams. All this and oh so much more coming up on this episode of Smashing Security.
GRAHAM CLULEY. Now, chums, chums, I've got a very important question for you, which is this. What would you do to promote your podcast? How far would you be prepared to go to promote it? Anna, obviously you'd be happy to come on Competing Podcast to promote yours, but what would you, what else would you be prepared to do?
CAROLE THERIAULT. Well, I'd partner with you, Graham. That's what I'd do.
GRAHAM CLULEY. Okay, okay, great.
ANNA BRADING. Have you not already done that?
CAROLE THERIAULT. Graham loves talking about himself and talking about what he does, right? So I figured he's— yeah, so he naturally is the loudspeaker from, you know, how our promotion goes.
GRAHAM CLULEY. It's going to be that kind of show, is it? I've got two former colleagues on the podcast who are going to criticise me. Anna, what about you? What have you tried to do to promote the Naked Security podcast?
ANNA BRADING. Well, I started a podcast on an established site that already had a lot of Twitter followers, so that was helpful.
GRAHAM CLULEY. Have you ever thought of getting your guests actually naked as a little bit of a That is what we do. Oh, you just record it naked?
CAROLE THERIAULT. He's obviously not listening to the latest podcast, is he?
ANNA BRADING. Well, he's not. I mean, we haven't yet recorded it on video, but that's the plan. So Naked Security Later, it's going to be called.
GRAHAM CLULEY. I see. Well, there is a cybercrime gang called Exaggerated Lion, and they are taking advantage not so much of people who want to promote their podcasts, but another method of promotion. They've been scamming people since at least 2013. They operate out of multiple countries in Africa, including Nigeria, Kenya, and Ghana. And in the early days, they scammed people via Craigslist. But one of their most common scams they've used recently has involved car wrapping. Do you know what car wrapping is?
ANNA BRADING. Oh no.
GRAHAM CLULEY. No. Car wrapping. Well, you don't wrap up a car in a bow or something like that. But what you do is if you want to promote something, you pay people to have their car embellished or emblazoned with your logo.
CAROLE THERIAULT. Oh, I've seen this. I think I've seen this on Channel 5 before, where they bling up a car, right? They sass it up with some flames and stuff.
ANNA BRADING. Pimp My Ride. Yeah, pimp.
CAROLE THERIAULT. Yeah, yeah, Pimp Your Ride.
GRAHAM CLULEY. It's not quite that. This is something where it would say on the side, you know, drink Iron Brew or something like that. Or, you know, such and such a vodka. Some sort of promotion. And the idea is that you get paid so much per week or per month that your car is effectively a moving advertising billboard. And this gang, they have adverts online or they might email you saying, look, we would love for you to join up our scheme, have your car decorated with marketing messages for drinks companies. Okay. And we will pay you each week, right? Because there's no skin off your nose, right? You're driving around anyway.
ANNA BRADING. Yeah.
GRAHAM CLULEY. Bopping along, listening to Taylor Swift or whoever.
CAROLE THERIAULT. No, there's a lot of brands that would be pretty embarrassing to have on your car though.
GRAHAM CLULEY. Do you think?
ANNA BRADING. Yeah. Don't you think?
CAROLE THERIAULT. Hooters?
GRAHAM CLULEY. Lillets? What are you thinking? I mean, it's—
ANNA BRADING. I'm thinking this is a good idea for the Naked Security podcast. I might do this on my car.
GRAHAM CLULEY. Right, there you go. So, and you might think, well, what can I lose if I sign up for something like this? What happens is the bad guys send you a check and it covers your first month's pay, $1,850.
ANNA BRADING. Great. All right. So you get it.
CAROLE THERIAULT. You get a cheque in the mail.
GRAHAM CLULEY. Yes.
CAROLE THERIAULT. Before you've even wrapped your car. Is this to wrap— you get your car wrapped?
GRAHAM CLULEY. This is for £1,850. And what they say is that we are going to send a specialist round to your house who will artfully decorate your car, put all the logos all over it. And they promise no damage will be done to your car. Just a little bit of the money you will need to pass on to the specialist to do this. But this is basically 4 weeks' pay before anything has happened. And they also say, you know, we'll remove it at the end of the promotion. So any time you want to to opt out 'cause you're too embarrassed because you're advertising Ovaltine or whatever it is. Yeah, all you've gotta do, send us a photograph to prove it's been decorated and wire the fee to the specialist and off you go.
CAROLE THERIAULT. Aha, I think I've spotted the hole here.
ANNA BRADING. An advance fee.
GRAHAM CLULEY. Right, because these are of course fake checks. And this scam has added up to millions and millions of dollars, which have been sent out by this gang called Exaggerated Lion. I don't know where they come up with these names, for hacking groups from it. Lion, I guess, is because of the African connection. I don't know why exaggerated in particular.
CAROLE THERIAULT. Maybe it's a loose translation of, you know, like—
GRAHAM CLULEY. I don't know.
CAROLE THERIAULT. Megalion or like—
GRAHAM CLULEY. Maybe, I have no idea. But the thing is, what happens is you get the check, you pay the check into your bank, and the way in which banks operate is they get your check and they sort of add that amount to your balance. But it can take a few days for the check to actually clear. And in the meantime, You have transferred so much of your own money from that float to the specialist, right? And that's the scam, is that you've paid money which actually isn't really in your account. So you've ended out of pocket.
CAROLE THERIAULT. So tell me, you're paying— you're paying for the guy to come and decorate your car? Is that the fee?
GRAHAM CLULEY. Yes, yes, that's the fee. So you wire some of this money which you think you've received from the agency as an advance to the specialist.
CAROLE THERIAULT. Right. And then the specialist does indeed show up.
GRAHAM CLULEY. No.
CAROLE THERIAULT. Oh.
GRAHAM CLULEY. No, none of that happens, Cruel.
CAROLE THERIAULT. Nothing happens.
GRAHAM CLULEY. Nothing happens other than money's lost.
CAROLE THERIAULT. I don't think I follow.
ANNA BRADING. So they get— they receive the cheque, and then the victim sends on some of the money to the person that's going to come and decorate the car, but they don't.
GRAHAM CLULEY. That's correct.
CAROLE THERIAULT. Okay, I understand. Alright, okay, so they're asking you— they're saying, here's £1,850, and I'm gonna give this guy £500 to do the work.
GRAHAM CLULEY. Right, but—
CAROLE THERIAULT. Right, but the £500 comes out of your pocket.
GRAHAM CLULEY. Yes, because the $18.50, the check doesn't go through.
CAROLE THERIAULT. Yeah, it looks like it goes through.
GRAHAM CLULEY. It's a fake check. Exactly.
CAROLE THERIAULT. So surely that's— is that not the bank's issue? That's your issue? Or does the bank cover that?
GRAHAM CLULEY. No, well, no, no. The bank will say that check you paid in bounced, effectively.
ANNA BRADING. But they don't tell you that straight away.
GRAHAM CLULEY. Well, look, they've since moved on. That was the scam which they used to be doing. They would prey upon people who wanted to advertise alcohol drinking or whatever on the side of their car to emblazon it. Now they have moved on to a different, slightly different twist on business email compromise, which of course we're all familiar with, the scam of BEC. And in this particular case, what they do is they send a brief email to a company's accounts payable department claiming to come from the CEO. Nothing unusual about that. But what is unusual is the email asks for a check to be sent to a vendor today rather than for money to be wired. And normally with these scams, it's all about money being wired, right? But this isn't about electronic transfer. Instead, it's about checks being sent. Now, the And the reason for that might be that organizations have put policies in place regarding electronic transfers of money, but maybe not for writing out a check. Now, there's a couple of things—
CAROLE THERIAULT. Or maybe a number of companies I've worked with in America, and many of them like to use checks. So I think whilst they're kind of RIP in the EU, I mean, I haven't received a check in the EU in, I don't know, 5 years.
GRAHAM CLULEY. Yeah. You're absolutely right. America, clearly the most advanced and wonderful country in the entire universe, is still using checks a great deal.
CAROLE THERIAULT. Yeah, it's a nightmare.
GRAHAM CLULEY. But certainly I've had situations where I've done some work for an American company and, you know, despite my invoice saying, please transfer the money electronically, you get a check through the post. And I can't remember the last time I paid a check in. You know, it's like, what on earth am I supposed to do this? I wouldn't know where my checkbook is, even if I have a checkbook.
CAROLE THERIAULT. Yeah, I'm just thinking with your first scam though, I would probably, if I were to fall for such a scam, right, where someone gives me a check and I pay out of that money, I just wouldn't bring the check in forever because I'm so bad at going into a bank, right? So I have actually lost money because I haven't got to the bank in the 6 months allocated time to clear the check.
ANNA BRADING. Who has time to go into a bank?
CAROLE THERIAULT. It's awful though.
ANNA BRADING. But you would, if you were considering wrapping your car in advertising, I presume that that's—
GRAHAM CLULEY. As a weekly payment, yeah.
ANNA BRADING. Yeah, I presume that's because you need some money. So if they're sending you £1,800, whatever it was.
CAROLE THERIAULT. Yeah.
GRAHAM CLULEY. Yeah. $1,850. Yeah. Yeah.
ANNA BRADING. So you probably need that money. So you might go to the bank. It's because you're so rich, Kirill.
GRAHAM CLULEY. So overloaded. So let's look a bit more at what this particular scam is doing. So it asks the victim to send a check, first of all. Now, there's no attempt. This is unusual as well. There's no attempt to spoof the CEO's email address.
ANNA BRADING. Right.
GRAHAM CLULEY. So they don't pretend to come from yourcompany.com. Instead, the domain name is one which comes from what tends to be insecure infrastructure. So the chaps at Agari, who are a security firm— I don't know if it's Agari or Agari, I'm not sure which one it is.
ANNA BRADING. I think the latter.
GRAHAM CLULEY. You think Agari? So they say that they've seen domain names like this. Ready for this? Office-secure-ssl-sl-mail71521- apps-server-portal-apps-mail.management.
CAROLE THERIAULT. Wow.
GRAHAM CLULEY. So they nearly always come from.management addresses, and they've got all these words which suggest security and an official email in the body of the domain name as well. I didn't even know.management email addresses existed, that you could buy a.management address. Apparently the Exaggerated Lion Group, they have used more than 1,400 management domains since July 2017. And it appears that round about 10% of all.management domains have been created by this group. So if you ever get an email from a.management, there's a 1 in 10 chance that it's one of these bad guys' scams. Yeah, report it.
ANNA BRADING. And so all the time we were worried about spoofing email addresses from the CEO.
GRAHAM CLULEY. Right.
ANNA BRADING. It turns out we didn't need to worry about that at all.
CAROLE THERIAULT. No.
ANNA BRADING. Because they're pretty successful without it.
CAROLE THERIAULT. Just put in.management and SSL and you're through.
GRAHAM CLULEY. Really secure email,.management.
ANNA BRADING. That did, yeah, it's pretty scary that.
CAROLE THERIAULT. Surely at a business though, you'd have, you know, you'd have security that would block this in most companies.
GRAHAM CLULEY. Well, I don't know about in most companies.
ANNA BRADING. It depends on the size.
GRAHAM CLULEY. I think more and more companies are putting little systems in place. So for instance, they might have a system whereby they mark an email as coming from an external address. But then if it looks like it might be a service which the company is itself using, then maybe people will think, well, yeah, it did come from an outside organization.
CAROLE THERIAULT. That's why I think technology needs to be here to kind of go, whoa, that doesn't— that's not— you know, the links don't match, or I suppose they do match.
GRAHAM CLULEY. Well, it's kind of social engineering, really, I think, because it claims to come from Barry the CEO or whoever, and you think, oh, Barry must be using some system to email me about this thing. Anyway, I want to move on to what happens with the money once it's sent out.
CAROLE THERIAULT. Yeah, please, because we've been talking forever.
GRAHAM CLULEY. Go. So where do these cheques end up? They end up with lonely middle-aged women.
ANNA BRADING. Oh.
GRAHAM CLULEY. The exaggerated line scammers, they haven't just been doing business email compromise. They've also been building up a network of romance scam victims.
CAROLE THERIAULT. Oh no.
GRAHAM CLULEY. They've been telling their romantic partners that they have a large inheritance. It's all tied up in red tape. It's only trickling out. But these women, and it does always seem to be women as far as I've been able to read, are utterly invested in these relationships, not realizing they're speaking to African scammers.
CAROLE THERIAULT. And women come forward and admit that they've been duped. Yeah, I would hide it forever.
GRAHAM CLULEY. And maybe men are just rubbish, because if someone comes on to them and says, hey, you know, need to move some money into your account, I'm going to send you a big check, they're just thinking, well, sod the relationship, I'll keep the check. So maybe they're not as easy to scam. They think, oh, the relationship doesn't matter. But anyway, so the money is sent to them in the form of a check, and they can't see that they're being scammed, and they are effectively operating as money mules for the gang. And they then forward the money to their handler. In some cases, they've even had meetings with law enforcement when they've tried to pay the check in, or if there's been any suspicion. But normally there isn't suspicion because these checks are completely legitimate. They have come from real companies who've been scammed, and so no alarm bells are ringing at the bank.
CAROLE THERIAULT. I know, but if some guy calls you and says, hey, look, I'll send you a check.
ANNA BRADING. I know, but I don't think they just call them out of the blue though, do they?
GRAHAM CLULEY. No, no, no, no. That may be how romance works around your part of Oxford, Carole, but we're a little bit more sophisticated.
ANNA BRADING. I prefer a bit of investment.
GRAHAM CLULEY. Anna, I imagine you live somewhere quite romantic.
ANNA BRADING. Yeah, I mean, I do. It's very romantic. It's sort of in the middle of the city.
CAROLE THERIAULT. She walks in, there's always, there's always, yeah, there's always like rose petals everywhere she walks.
ANNA BRADING. Oh, absolutely.
GRAHAM CLULEY. It's like that.
ANNA BRADING. It's hard to move for the rose petals. I prefer, I think I'd be after a bit more wooing. Bag of chips. Well, I mean, yeah, I'd do anything for a bag of chips.
GRAHAM CLULEY. You prefer a little bit of wooing. Well, they have been wooing, of course. They've been wooing for months and months.
ANNA BRADING. And these people are lonely, aren't they? Let's face it. Yeah. Carole, you've just got too many people in your life.
CAROLE THERIAULT. Maybe I'm just lucky, I guess. I don't know.
GRAHAM CLULEY. So the mule has received the money. Sometimes they're tricked into forwarding the money to another mule. Sometimes they're told that that's an inheritance attorney. Sometimes they're told to keep a little bit of it for themselves, but eventually ends up with the scammer.
CAROLE THERIAULT. Yeah, the upshot is exaggerated lion do lots of bad shit scamming people.
GRAHAM CLULEY. Do you think it's exaggerated lying rather than lion? Maybe it's because they're telling really big fibs. So they could have been called the Massive Fibber Gang. I think you're onto something there, Carole.
CAROLE THERIAULT. Yeah, exactly.
ANNA BRADING. What I want to know is when these middle-aged women fall for these scams, they always send so much money and I think, well, what, where am I going wrong? I don't have that money to send.
GRAHAM CLULEY. Yes, but you've just received it, haven't you? You received it in a cheque. From this company.
ANNA BRADING. Yeah, okay, so in general, I mean, in romance scams, they often—
GRAHAM CLULEY. generally, yes.
CAROLE THERIAULT. Yeah.
GRAHAM CLULEY. Oh well, well, a great deal of effort has been put into scamming businesses out of money. You need to put serious effort into helping your staff detect when they are being scammed as well, because this social engineering, it seems it's not always very sophisticated in terms of faking domain names, as we've seen. So watch out for.management emails and other domains as well, and don't be too quick to write a check.
CAROLE THERIAULT. And Anna, maybe you should sound— you should feel lucky, actually. If you don't have cash, you're not going to get targeted, right?
ANNA BRADING. That's true.
CAROLE THERIAULT. No love, but a lot of money.
ANNA BRADING. Yeah, I don't live in a romantic place, but—
GRAHAM CLULEY. If you want to give me some of your money to make yourself feel more comfortable.
CAROLE THERIAULT. Graham needs it as well. I don't know if you know that. He's very hard up these days.
ANNA BRADING. I'm sorry, Graham.
GRAHAM CLULEY. It's all right. Anna, what's your story for us this week?
ANNA BRADING. Let me introduce you to Clifton Collins. So he's a beekeeper from Dublin. And not only is he a beekeeper, but he's won awards for his honey. So he's pretty good. And he also works as a security guard to make ends meet. But he's also a drug dealer and a bitcoin millionaire.
CAROLE THERIAULT. What? What?
GRAHAM CLULEY. Hey, what?
ANNA BRADING. Or at least he was a bitcoin millionaire. So for 12 years, he grew cannabis and then he sold it on for a tidy sum.
CAROLE THERIAULT. This isn't legal in Ireland.
ANNA BRADING. No, no, no, it's not illegal.
GRAHAM CLULEY. He's a very naughty boy.
ANNA BRADING. He's a very naughty boy, but he made a lot of money. So he bought a two-seater plane because he could and learned to fly it. But he still had some money kicking about. So he decided to invest his money in bitcoin, which in 2011 was quite a good idea. According to my Wikipedia ring, it was worth at the time between $1 and $31. So a little bit cheaper than it is now.
CAROLE THERIAULT. Oh, wow.
GRAHAM CLULEY. Yeah.
ANNA BRADING. So he's an entrepreneur and he's not stupid. So he was a bit worried about having all his bitcoins in one basket. So he created 12 different wallets and evenly distributed 6,000 bitcoins across them all. So that's 500 bitcoins in each.
GRAHAM CLULEY. Wow.
CAROLE THERIAULT. Okay.
ANNA BRADING. Right. So by today's calculations, that's about £45.5 million or $58 million. So it's a lot of money. So he's got 12 different wallets, which means 12 different keys or access codes, because obviously—
CAROLE THERIAULT. So these are like tiny little things. All the information's on a tiny little piece of a device, a hardware device that he has in possession.
ANNA BRADING. Well, it doesn't have to be hardware. No, so he's just got these wallets and he downloads them. Oh, they're like digital wallets. Yeah. Okay, right, right. And so he's got his access codes. So where does he store them? Where does he store the codes?
GRAHAM CLULEY. Hmm.
CAROLE THERIAULT. Aha.
ANNA BRADING. So he could have stored the bitcoins on the computer. Obviously.
CAROLE THERIAULT. I hope you can put it in a jazz cigarette. This is Graham's word for marijuana. I love it so much.
ANNA BRADING. A jazz cigarette.
CAROLE THERIAULT. It would go up in smoke.
ANNA BRADING. It would, exactly. No, so he didn't store it anywhere like that. So he decided to store them online, but he could have stored them on his computer. But obviously there's a risk if you store it on your computer, because if you lose the codes and you haven't backed it up, like, do you remember there was that IT guy in the UK who threw away his old hard drive?
CAROLE THERIAULT. Yes.
ANNA BRADING. And there was 7,500 bitcoins on it. And he applied to the council and said, do you mind if I pop to the landfill site? And they were like, that was 4 years ago.
GRAHAM CLULEY. You're not going to find it.
CAROLE THERIAULT. He was in Wales, wasn't he? He was in Wales, I think. Yeah, yeah. Because I remember that story. He offered 7.4 million to dig it up.
ANNA BRADING. Well, I'm not surprised. That's nothing if you've got 7,500 bitcoins.
GRAHAM CLULEY. As if things weren't going badly enough, he was also in Wales, I think is the point Carole is making.
ANNA BRADING. Terrible, terrible. It's a lovely country. I think it's gorgeous.
GRAHAM CLULEY. Sorry, Wales.
ANNA BRADING. So Graham Cluley, I imagine you're making quite a lot of money from Smashing Security, millions. And a good place to invest your money would be cryptocurrency, right? So where do you store all your bitcoins? Oh.
CAROLE THERIAULT. Well, I have none, so I don't store them anywhere.
GRAHAM CLULEY. Where would you do it? I have a hardware wallet.
ANNA BRADING. Okay.
GRAHAM CLULEY. I have a little cryptocurrency investment because I don't trust people online. Do you know where your wallet is? Yes, I do. I don't really want to say—
ANNA BRADING. You hesitated.
GRAHAM CLULEY. No, I don't really want to say on the podcast in case—
CAROLE THERIAULT. Do you keep it somewhere where the sun don't shine?
GRAHAM CLULEY. Especially as I'm currently at RSA in San Francisco, far away from my hardware wallet. It just made me a bit paranoid, actually. My God, why didn't I bring it with me?
CAROLE THERIAULT. You'll be home when the time this airs.
ANNA BRADING. So what Clifton decided to do, which actually isn't a bad idea, is to make a paper copy of the codes.
GRAHAM CLULEY. Yes.
ANNA BRADING. So he printed them out and he folded the piece of paper up nicely and he tucked it inside the aluminium cap of his fishing rod case, which he kept at home.
GRAHAM CLULEY. Okay.
ANNA BRADING. That's part one of the story.
CAROLE THERIAULT. Because he loves fishing. So he fishes a lot. So it's near and near.
ANNA BRADING. Even drug dealers need a break. Maybe it's, you know, some calm time.
CAROLE THERIAULT. He goes for a jazz cigarette by the river.
ANNA BRADING. Exactly.
CAROLE THERIAULT. Do a bit of fishing. Right.
ANNA BRADING. Maybe he doesn't use, he might not use them. He might just grow it. And so, right, that's how he got rich. Yeah, of course.
GRAHAM CLULEY. So I don't think he needs to sell it anymore, does he, if he's made this much money?
ANNA BRADING. And let's not listen to the story.
CAROLE THERIAULT. Let's, let's, let's carry on.
GRAHAM CLULEY. Maybe he does.
ANNA BRADING. I think he might have still been dealing. So part 2 of the story is fast forward to 3 years ago, and in the early hours of the morning, Clifton was out driving in his fancy Lexus 4x4, and he was in the middle of nowhere. And I'm a criminal. Exactly. Don't look at me, guys. Don't look.
CAROLE THERIAULT. Cherry red or appealing white.
ANNA BRADING. Just as an aside, why do drug dealers drive fancy cars? Why don't they just drive like rubbish cars? Yeah, well, I don't know.
GRAHAM CLULEY. It's to suggest they have a better quality of drugs, surely. If they—
CAROLE THERIAULT. oh, they drove up like Columbo and rather shambolic, surely it's suggesting they're fleecing everyone.
GRAHAM CLULEY. I have no idea.
CAROLE THERIAULT. Anyway, okay, so he's put in the codes inside his fishing rod.
ANNA BRADING. So that was in 2011. So fast forward to 3 years ago, and he's driving around, um, in the early hours of the morning in the middle of nowhere. So the police— I wonder if they were following him. Anyway, they thought he was acting suspiciously, and they stopped him, and they searched his car. No fishing rod, but he had, unfortunately for him, cannabis on him worth about £1,600 or $2,000.
CAROLE THERIAULT. So he's obviously still dealing, or he has a very, very expensive jazz cigarette habit.
ANNA BRADING. Clifton can't get enough of the dealing.
CAROLE THERIAULT. He's like an AB Fab, right? He's got 15 at once.
ANNA BRADING. Exactly. And so they arrested him, unsurprisingly. So then they searched his house and they found more than 500 cannabis plants with a combined value of £330,000.
CAROLE THERIAULT. Whoa.
ANNA BRADING. And a pellet gun and a stun gun for protection.
CAROLE THERIAULT. Lots of things that are not considered very kosher in Ireland. Well, there's a mix of—
ANNA BRADING. Exactly, I'm not sure.
GRAHAM CLULEY. The Irish Jewish contingent.
ANNA BRADING. Exactly. So, and they also, as part of that, they seized the bitcoin wallets.
CAROLE THERIAULT. Right.
ANNA BRADING. But there was a problem. They couldn't be unlocked. Oh my goodness. Guess what has happened? The phishing rod case had gone missing.
GRAHAM CLULEY. Oh my goodness. Oh.
CAROLE THERIAULT. Oh, he taken it. He's hidden it.
ANNA BRADING. Well, apparently after he was arrested, there was a burglary at his house.
CAROLE THERIAULT. Uh-huh.
ANNA BRADING. Suspicious.
CAROLE THERIAULT. Seamus! Seamus! I've got to do something for me right away, Seamus!
ANNA BRADING. That's exactly what happened. No, so either that happened or Clifton said perhaps it was that the house was cleared on behalf of the landlord after he was jailed. And so many of his belongings were just taken to a dump in nearby County Galway. Bizarrely, workers at the dump said they remembered seeing discarded fishing gear, which I think is a bit weird.
GRAHAM CLULEY. Maybe because it smelt so much of weed. Maybe that's why they remember it. Or because they found inside it some bitcoin passphrases.
CAROLE THERIAULT. This smells really fishy to me.
GRAHAM CLULEY. Very good, Trion.
ANNA BRADING. I see, I see. I missed that.
CAROLE THERIAULT. It was so subtle.
ANNA BRADING. So, Lauren Forsberg.
GRAHAM CLULEY. So do we believe this? So just to summarize, he's been arrested. They could tell he's a drug dealer and they thought, oh, you've got all these cryptocurrency funds, we're going to take that as well. But they haven't got the keys in order to unlock it. And he claims that he stored them inside his fishing rod case and his fishing rod case has mysteriously disappeared.
ANNA BRADING. In a burglary that happened just after he was arrested.
GRAHAM CLULEY. How terribly convenient.
ANNA BRADING. Well, so law enforcement have said they believe he genuinely lost the codes, which apparently hadn't been accessed for a year, but who knows? So anyway, they couldn't go to this dump because not only— it's not like the IT worker in the UK, because what happens with, uh, in County Galway is that waste from the dump is sent to Germany and China to be incinerated. So we could only assume the codes have gone up in a puff of smoke, like with the Jap cigarette.
GRAHAM CLULEY. Yeah, very good.
CAROLE THERIAULT. You see, he should— maybe this is a lesson learned. You know, you shouldn't be dealing with fake monies and bad cigarettes.
ANNA BRADING. Well, I think the lesson learned is it's a reasonably wise thing to print out the codes. You've got it at your house. You're much more likely to get hacked than burgled unless you're Clifton, probably. But I would say if it was me, I probably wouldn't be storing it in something as removable as a fishing rod case unless I wanted it to be burgled.
CAROLE THERIAULT. So I've been thinking while you've been talking, I think I know what I'd do. I would tattoo it on my body. I think I would probably— yeah, I think I would. I would do it on my— because I'm unlikely to lose all my hair, so I'd probably put it on my skull under my hair. And I would do it in code.
ANNA BRADING. Right?
CAROLE THERIAULT. I'd try and make it pretty clever code.
GRAHAM CLULEY. How would you read it? If you got a mirror, it would all be backwards.
CAROLE THERIAULT. I'm sure I could figure it out. I'm pretty bright.
GRAHAM CLULEY. How are you going to stop someone else spotting it and getting into trouble?
CAROLE THERIAULT. I have a lot of hair.
ANNA BRADING. Also, you've just advertised this. I mean, are you worried now that someone's going to kidnap you and shave your head? Because I would be. I have not tattooed mine on the top of my head.
CAROLE THERIAULT. I live in Oxford, darling. I live in Oxford. So things don't happen over here.
ANNA BRADING. They live in Reading.
CAROLE THERIAULT. The romantic city.
ANNA BRADING. Everyone's having their heads shaved in the romantic city of Reading.
CAROLE THERIAULT. This is where they should do a lie detector test of, you know, ask him with a lie detector machine and actually stream it live.
ANNA BRADING. Like Jeremy Kyle.
CAROLE THERIAULT. And then we could all watch him while he's doing the test to see if we think he's lying or not lying. And we could click buttons and say yes, yes, yes, no, no, no. Truth, truth, truth, lie, lie, lie.
ANNA BRADING. I think it's a great idea.
CAROLE THERIAULT. Okay, let's do it. We'll work on it.
GRAHAM CLULEY. Crow, what's your story for us this week?
CAROLE THERIAULT. Okay, I know we've all been hearing about the coronavirus every day, but someone had to do it. Now, I bet some of the stuff in your individual echo chambers is misleading BS. It certainly is in mine. I'm seeing all kinds of stuff that seems crazy. Like there was one guy online spouting that China deliberately released it to gain an economic foothold during the US election cycle. Wow.
GRAHAM CLULEY. I heard it was Bernie Sanders. Bernie Sanders created coronavirus. I'm sure we'll be hearing that soon.
CAROLE THERIAULT. Don't diss the front-runner, come on. Now, and some people are getting the message that this is all a teeny tiny storm in a little baby teacup. And other people, of course, are hearing that the world is going into total meltdown, Lord of the Flies style. Did you ever read that?
GRAHAM CLULEY. Lord of the Flies?
CAROLE THERIAULT. Yeah, yeah, yeah. Yeah, did you ever feel a kinship with any of the characters?
GRAHAM CLULEY. Oh, you're gonna make the comment about Piggy? Is seriously you're gonna say about Piggy?
CAROLE THERIAULT. No, I wasn't gonna say that at all. I was gonna say Ralph the protagonist, or there is the whingy character. There is one. He does end up dead. Piggy does die, and he dies because the boys went primal, right? But you, Mr. Cluley, meanwhile, decide to risk everything to get on a plane to go to RSA this week.
ANNA BRADING. Yeah, didn't you? That is risky during a pandemic.
GRAHAM CLULEY. Every week I appear on this podcast, I just get insulted. I just get abuse, and I'm always charming to you. It's—
CAROLE THERIAULT. I mean, you, you wouldn't have been alone, Graham, had you decided not to go to RSA. Loads of big spenders pulled out the last minute.
ANNA BRADING. They cancelled Mobile World Congress, didn't they?
GRAHAM CLULEY. They did, in Barcelona. Yes, they completely cancelled. Yes.
CAROLE THERIAULT. Yeah, IBM decided to break away as a platinum sponsor for RSA. AT&T Cybersecurity pulled out its gold sponsorship. And why have they pulled it out?
ANNA BRADING. Because they don't think there's going to be enough attendees.
GRAHAM CLULEY. No, I don't think it's about the attendees. There seem to be plenty of people on my plane who are going there. No, I think, I think, I think they're just worried about what might happen to their staff if they're there. They just think it's, it's not worth it.
CAROLE THERIAULT. No, but this is also sponsorship. This is not exhibitors, right?
ANNA BRADING. There's different—
CAROLE THERIAULT. yeah, so there are, there are 14 in all sponsors and exhibitors, okay, that have gone, but those 3 are sponsorships. So I wouldn't decide how much this would maybe hurt RSA So how much does the sponsorship cost? And you, for the diamond package of sponsorship, it's a whopping $400,000.
GRAHAM CLULEY. Wow.
ANNA BRADING. Yeah.
CAROLE THERIAULT. And platinum, which is what IBM broke away from, was $215,000.
ANNA BRADING. So they've just lost that.
CAROLE THERIAULT. They've lost all that. Well, I mean, there must have been a penalty.
GRAHAM CLULEY. Hang on. Yeah. Are you sure you can just pull out? Presumably that's already been paid for.
ANNA BRADING. Yeah.
CAROLE THERIAULT. I don't know if it'd be paid in full, but maybe it is. Maybe, maybe. And if that were the case, maybe, maybe it was about—
GRAHAM CLULEY. I I think if a contract's been signed to sponsor RSA, then you can't just a couple of days beforehand say, oh, I see a few people sniffing around San Francisco, therefore we need all that money back.
ANNA BRADING. Yeah, that's what I mean. They've lost the money. Yeah, the companies.
GRAHAM CLULEY. Yeah, the companies. Yeah.
CAROLE THERIAULT. And the exhibitors probably were touting out going half-price exhibition sponsors. So we're recording this on Monday the 24th, and some info between now and publishing date, of course, will change in this because this baby's moving pretty fast. And this is despite incredible restrictions put on people's movements. As of last week, 10% of the population were in lockdown. So not quarantine, but these are people whose movements are being restricted by others.
GRAHAM CLULEY. 10% of what population?
CAROLE THERIAULT. Of the world population.
ANNA BRADING. What?
CAROLE THERIAULT. Yeah.
GRAHAM CLULEY. No, this is nonsense.
CAROLE THERIAULT. It's not nonsense.
ANNA BRADING. Are you sure?
GRAHAM CLULEY. 1 in 10 people on planet Earth are not able to move because of this coronavirus. Are you going to put this out as a podcast? On our podcast?
CAROLE THERIAULT. Yes.
GRAHAM CLULEY. 1 in 10? No, I don't believe it. I do not believe it.
CAROLE THERIAULT. Oh, you don't believe the New York Times?
GRAHAM CLULEY. I do not believe it.
CAROLE THERIAULT. Oh, okay.
GRAHAM CLULEY. What have they actually said? What have they actually said?
CAROLE THERIAULT. No, come on, let's say what they've actually said.
GRAHAM CLULEY. 1 in 10 people on planet Earth are not able to— do not have free movement because of coronavirus is what you're saying?
CAROLE THERIAULT. That is what I am contesting, yes.
ANNA BRADING. I mean, China is a big country.
GRAHAM CLULEY. I know China's big. So how many people live in China? How much of the world population?
CAROLE THERIAULT. Oh, about a billion.
ANNA BRADING. Yeah, more than that, isn't it?
CAROLE THERIAULT. Yeah, so it's actually probably about 15% of the world.
ANNA BRADING. Oh, I see.
CAROLE THERIAULT. Just in China. Oh, did you not think about that? And then of course you've got all the countries around there with loads of like Thailand, Cambodia, South Korea.
ANNA BRADING. All right, maybe.
CAROLE THERIAULT. And on Sunday, my listeners believe me, they can go check my links. And on Sunday, we just heard that Italy is suddenly now in big trouble. They've called in the military to enforce city quarantines. And Monday we hear that South Korea is worse hit than they thought. So as of today, as of Monday, 79,000 reported cases and the death toll's at 2,600. And of course there's economic concerns, right? China's responsible for 30% of the world's manufacturing. 10% of people in the world are in lockdown.
GRAHAM CLULEY. So I heard. And share prices have really plummeted, haven't they?
CAROLE THERIAULT. Well, exactly. So current estimations point to global trade taking a hit of nearly $600 billion. So this all isn't pretty. This is all awful. But as with awful things that are especially a global phenomenon, it is very attractive to scammers. This is attractive to scammers as poop is to flies.
GRAHAM CLULEY. I think you'll find flies are to poop. Poop is not attracted to flies. You don't do a poo and find it flying around 'After flies.' You've got the direction wrong there.
CAROLE THERIAULT. So we're seeing loads of little and sophisticated scam armies trying their hand and trying to dupe people who are concerned about the virus, right? These are people that are actually trying to get out there and get information. So we've seen emails that purport to be from the World Health Organization. And the whole idea is to use that to build trust and then steal your info and your hard-earned cash. And the dupe that they're doing is they have a link to the CDC in one of the emails I saw, but if you hover over that link, you can see that it goes to a completely different URL. But we're also seeing weird stuff, like in Hong Kong, scammers were advertising boxes of 100 surgical masks for sale at up to 400 Hong Kong dollars each, so that's about $51. And this was on FaceShit. But of course, no products were ever delivered when people actually paid the money. And even in New York, there's these things called pandemic quick kits being sold. And one of the journalists from Motherboard said it looked really quickly assembled with items in the kit being only advisable for people who are going to a costume party. So people are trying their luck here. But it's also brought unexpected challenges like that of facial recognition. So one would assume that if you're wearing a surgical mask, you don't get a virus, you have the added benefit of, well, being unidentifiable by the recognition system. But coronavirus has forced millions of people across China to don these masks. And lo and behold, China's AI champion SenseTime put out a release last week saying it's adapted its algorithms to identify people wearing masks.
GRAHAM CLULEY. But I heard you can also catch— excuse me, Krogg, I may have heard this from my echo chamber. It may not be reliable. But I heard it's not necessarily just inhaled. You could also get it through your eyes as well. So maybe you need to wear both goggles. Yeah, well, exactly. And how is the facial recognition going to work there if you've got your swimming goggles on as well as the mask covering your nose and mouth?
CAROLE THERIAULT. Well, it's interesting because it's not just facial recognition. I think that we all think that. There's a lot of other things that, like the way you walk, for example, can give away. So there's a million different things. I can tell by the way you move your head. I don't think anyone would think that.
ANNA BRADING. Okay, did you hear that someone was trying to— I think they're trying to crowdfund a mask, a facial recognition mask that was like a printout of your face on the bottom half so you could still be recognized? I don't know how reliable.
CAROLE THERIAULT. Of course you do lose accuracy, right, with these things. So if you're wearing a hat, goggles, and a face mask, and you're bouncing on one foot wore shoe lifts to try and change your height, they may not be able to catch you first time round. But they say with masks, some estimates are around 90%.
GRAHAM CLULEY. I think there'll be other clues if you were doing all that, Carole, that you might be a person of interest.
CAROLE THERIAULT. I know, I'd stick out like a sore thumb, like that guy in the Lexus. So I'll leave it to the experts to tell you what you should do to keep healthy. Though an obvious one for me is to try and limit your non-essential outings and interactions with big groups, groups like at airports or conferences or exhibitions, that sort of thing. Right?
ANNA BRADING. Airplanes.
CAROLE THERIAULT. So I'm just sticking to small parties with close friends. Actually, my pick of the week is all about what you can do when you're stuck indoors. But before we get to that, online. So here's my big beef. Many of us are trying to get information from reputable sources, right? And I hate to say it again, but Facebook is not a reputable source. Oh, nor is Twitter. I know the problem here is there's too much BS on them. I'm not talking about those who are trying to dupe the rest of us, like I'm not talking about the scammers. I'm talking about you and me, the average folks that are basically just reading a headline and deciding, oh, I'll pass that on all to my friends.
GRAHAM CLULEY. Yeah, I heard on Smashing Security that poop can fly. Sorry, yes, carry on.
CAROLE THERIAULT. That's so— obviously all the advice you gave earlier, like don't read unsolicited emails. I mean, don't read email at all. That's what I do. But if you—
GRAHAM CLULEY. but don't read the newspapers.
CAROLE THERIAULT. Yeah. And now there's loads of links, so you don't have to take my word for it. Go read your links directly and make your own mind up. And okay, maybe Graham, maybe I've got it all wrong. Maybe you're not an idiot to travel during a viral pandemic. Maybe just If maybe you're a brave, brave hero, you know, going into the melee of people to see what's really going on.
ANNA BRADING. Have you brought a face mask, Graham?
GRAHAM CLULEY. I didn't bring a face mask. There were a lot of people who did have them on, I have to say.
ANNA BRADING. Oh, really?
CAROLE THERIAULT. I offered you a face mask.
GRAHAM CLULEY. There was one guy who looked a bit like— is it Bane from The Dark Knight movie? Remember that with Thom— did you see that movie? The Batman movie where the bad guy had his—
ANNA BRADING. It wasn't Batman.
GRAHAM CLULEY. It was one of the Batman movies. And I was sat through for about 2 and a half hours and I thought, I cannot understand a word he's saying. So there's one who had a mask like that.
CAROLE THERIAULT. It's so funny.
GRAHAM CLULEY. I remember you've worried me actually a bit, Carole, because I obviously have to catch a plane back to old Blighty, the safety of Brexit Britain.
CAROLE THERIAULT. And I've done this story so you feel bad.
GRAHAM CLULEY. Thank you, Carole.
ANNA BRADING. Don't see him for two weeks.
CAROLE THERIAULT. Okay, don't plan to see him until 2021.
GRAHAM CLULEY. I think I might, I might actually not come back by plane. I might come back by pedalo. I think maybe I'll see you in a few years.
ANNA BRADING. It's a good idea.
CAROLE THERIAULT. Okay, so there's two silver linings to this viral nightmare.
ANNA BRADING. Yes.
CAROLE THERIAULT. One, you're going to be gone for a while. Oh, I'm just kidding. And two though, two though, remember those people who'd come into the office all sick and spluttery and gross? And I'd be like, can you just go home? Look at you pathetically and go, no, no, I'm okay. I just have so much work. Well, the coronavirus is gonna put an end to all that BS. So that's one good thing. Hate that.
GRAHAM CLULEY. Wow.
ANNA BRADING. We did get told if someone sneezes, as managers, you have to send them home.
GRAHAM CLULEY. Well, so people need to learn how to sneeze, right? So many people sneeze into their hands, right? Like, what are you doing? So I've been—
CAROLE THERIAULT. we have airbags for sneezers, right? So they could be wearing around their neck, and if they suddenly start, it would just go and blast around their face and contain it.
ANNA BRADING. That is a good idea. I think now's the time to invent that as well, Carole.
GRAHAM CLULEY. One of my conditions of marriage that my wife made me agree to is that I don't sneeze into my hands. I sneeze into my elbow.
CAROLE THERIAULT. And into their hands?
GRAHAM CLULEY. Well, quite a lot of people, you'd be surprised. I saw people wipe their nose between finger and thumb. But yeah, I can't believe you took your wife to show you that though. Well, I didn't even know about it anyway. I'm not gonna be shaking anyone's hand at RSA this week.
CAROLE THERIAULT. Right. No kissing either. And no scratching anyone's butt.
ANNA BRADING. Not even if I see David.
GRAHAM CLULEY. I can't do it to him.
CAROLE THERIAULT. No, just wave, wave, wave from me. Wave. Did you know that LastPass Enterprise gives a vault for every single user? In fact, every user can have both a work vault and a personal vault. If you want to make your organization safer and reduce friction for users, why not check out LastPass Enterprise at smashingsecurity.com/lastpass? Oh, and as part of Digital Transformation Expo, LastPass is throwing a shindig with complimentary drinks and nibbles for fellow security professionals like you and me. This is at the Science and Industry Museum. You'll see me do a keynote, which I promise will be hilarious. Plus you can take part in a hot debate where we can answer the real questions out there. Panel includes Smashing Security guest Lisa Forte. Don't miss it. So check your calendars for Wednesday, March 25th, and sign up at smashingsecurity.com/lastpass. LastPass.
GRAHAM CLULEY. And welcome back. Can you join us on our favorite part of the show? The part of the show that we like to call Pick of the Week.
CAROLE THERIAULT. Pick of the Week.
ANNA BRADING. Pick of the Week.
CAROLE THERIAULT. Ah, did you practice?
ANNA BRADING. I'm so excited.
GRAHAM CLULEY. Pick of the Week is the part of the show where everyone chooses something they like. Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish. Doesn't have to be security related necessarily. Necessarily.
CAROLE THERIAULT. Better not be. Not one during RSA week.
GRAHAM CLULEY. My pick of the week is not security related. You may remember a website, I think we actually had covered in a past pick of the week, called This Person Does Not Exist, which is a website which, using artificial intelligence, machine learning, it creates sometimes very believable and other times not believable at all images which scammers can use on their websites to populate their team and about us pages. Well, I've uncovered a very similar web page called thiscatdoesnotexist.com, and I've chosen this in honor of Ms. Anna Brading, who's joined us on the podcast because she's rather crazy about cats.
ANNA BRADING. Oh my god, okay, this is very true.
CAROLE THERIAULT. Okay, I moved ahead and started looking. I was playing while you were talking. I've just seen a really, really bad one, which I'm going to cut and paste for you guys into my document because—
GRAHAM CLULEY. oh my God, that's the thing. Some of these cats are freakishly scary because clearly the algorithm isn't very good. It looks like something from an LSD-fueled nightmare. It's like you've been on a bad trip.
ANNA BRADING. Oh my God.
GRAHAM CLULEY. Oh my God, what's going on with his legs?
CAROLE THERIAULT. It's like a gremlin.
ANNA BRADING. It's disgusting. It's like a devil cat.
CAROLE THERIAULT. This is upsetting.
ANNA BRADING. Where's his leg gone? Graham! Oh dear, Graham, this isn't good. What are you doing?
CAROLE THERIAULT. This one has 4— this one has 15 legs.
GRAHAM CLULEY. Octocat.
ANNA BRADING. Oh my God, I've fucked up. This one's dead.
CAROLE THERIAULT. I can't go back. Graham, this is really upsetting.
GRAHAM CLULEY. Anyway, I thought that was bit of fun. And I think in this era of climate change and biological pandemics, how fantastic that people are putting all of their effort and their knowledge and their skill into producing a web page which basically produces random pictures of mutated cats.
ANNA BRADING. So is it possible that these cats could be used in scams to scam, like a romance scam but for crazy cats?
GRAHAM CLULEY. So what the scammer could do is they could say, "I've got a very ill cat, a sick cat, which needs surgery." Oh no, it's only got 3 legs.
ANNA BRADING. Oh, I don't like this.
CAROLE THERIAULT. I don't like it either.
GRAHAM CLULEY. What about a Siamese cat? A conjoined cat?
CAROLE THERIAULT. Look, you— all 3 of us are fond of cats.
ANNA BRADING. So this is not good. I think I'll stick to Dusty the cat.
GRAHAM CLULEY. Thiscatdoesnotexist.com is my Pick of the Week.
CAROLE THERIAULT. I'm definitely not going to use this to try and draw cats for my art show because they will. Yeah, I think you should call it modern art.
ANNA BRADING. Quirky cats. Oh, so my pick of the week as well. So a bit of background on this. I think you're not going to like this, Graham, because it's kind of a semi pick of the week. So when I realized I was coming on Smashing Security, I was trying to think of a pick of the week. Obviously, you know, I'm a long-term fan. I know the format. Big fan, guys. Big, big fan. It's an honor.
GRAHAM CLULEY. Oh yes.
ANNA BRADING. And so I was looking around and I saw there's going to be a program on Sky One called Intelligence, and it was Nick Mohammed and David Schwimmer, and it was about GCHQ, Centre of Cybersecurity. I'd seen David Schwimmer in a play in London, so I wasn't just relying on one thing. He's very good.
CAROLE THERIAULT. It's security-related.
ANNA BRADING. Oh, sorry, girl. It's a TV program, it's fine, it's a comedy. And so I thought David Schwimmer. I mean, I grew up on Friends, it's good, it's surely it's got to be good. Yeah, but David Schwimmer, I probably would. So really? Oh, I love him.
GRAHAM CLULEY. No way. I knew it, I knew it. As soon as you said you'd seen him in a play and then now you're talking about the TV program, I thought he's a bit, he's a bit sort of dorky.
ANNA BRADING. Like a man with a long No, I like Geoff Goldblum. I know, because I'm a fan of the show. So anyway, so David Schwimmer plays an NSA agent that's a bit of an asshole. Nick Mohammed plays a GCHQ agent that's like trying to— desperately trying to impress. It's not terrible. It's 20 minutes long, so it's kind of like a nice— I know, it's like the olden days when they had short shows.
GRAHAM CLULEY. This is It's a sitcom or something, is it?
ANNA BRADING. Yeah, so it's set at the Centre for Cybersecurity, GCHQ. But the script is just thin, so if you're looking for intelligent humour, that it is not.
CAROLE THERIAULT. Yeah, no, definitely.
ANNA BRADING. But Graham, you might like it. For example, one of the first jokes they say is about terrorism, and they say, oh yeah, terrorism's so bad it could send you to suicide, and you're like, oh God. But it does improve as it goes on. I did laugh at one point.
GRAHAM CLULEY. I get it.
ANNA BRADING. You see what they did?
CAROLE THERIAULT. I don't know. You're not easy to make laugh.
ANNA BRADING. Hard to impress.
CAROLE THERIAULT. I mean, obviously I make you laugh a lot, but you know, professional comedian.
ANNA BRADING. Exactly. I'm quite into sort of gritty dramas. So it's a nice thing to finish off the evening on. But hang on a minute.
GRAHAM CLULEY. Hang on. So your pick of the— you've waited years to come onto this podcast with your good friend. Carole and former colleague.
ANNA BRADING. How many episodes? 167? And I know I've been queuing up.
GRAHAM CLULEY. You're basically recommending this sitcom, which you admit isn't terribly good, because you think that David Schwimmer is a bit hot and you've got, you've got the feelings for him.
ANNA BRADING. That's all right, isn't it?
GRAHAM CLULEY. Yeah, yeah, that is, that is all right.
ANNA BRADING. We all need to relax in the evening, Graham.
GRAHAM CLULEY. And this is how you top off an evening. In with a bit of Schwimmer.
CAROLE THERIAULT. No way!
ANNA BRADING. And that's the end. I would say, I would say, because that's not very highbrow, I would say that on BBC Three, the third series of This Country is out, and that is very good and very funny. So that's a bonus one. Yeah, really good. Yeah, okay. Sort of a mockumentary set in the Cotswolds with— there's two cousins and they've got nothing to do. BBC Three, I think.
CAROLE THERIAULT. Okay, cool.
ANNA BRADING. Yeah, so I'd say go to the start and watch from the beginning.
GRAHAM CLULEY. I don't watch BBC.
ANNA BRADING. Oh, do you not? Too old?
GRAHAM CLULEY. No, no, it's just a little bit—
ANNA BRADING. yeah, yes, it's not my— what's your problem with BBC Three?
GRAHAM CLULEY. It's a bit common, don't you think? BBC Three, it's just a—
ANNA BRADING. this is—
GRAHAM CLULEY. it's, it's— I like BBC Four, I like BBC Two, BBC One. Oh no, BBC Three, it's just a little— it's down with the kids a bit too much. It's just a bit—
ANNA BRADING. it's on, um, it's also on BBC One.
GRAHAM CLULEY. Standards are dropping. That's what I think. I haven't seen this. What's it?
ANNA BRADING. All the good comedies start on BBC.
GRAHAM CLULEY. This Country. This Country, you said?
ANNA BRADING. This Country. Yeah, watch that. Watch that over Intelligence. But both are— both are— yeah.
GRAHAM CLULEY. You've already said your pick of the week is rubbish and you're recommending This Country instead.
ANNA BRADING. Absolutely.
GRAHAM CLULEY. Your first pick of the week.
ANNA BRADING. No one hot in This Country though, right?
CAROLE THERIAULT. Yeah, she nitpicked of the week and then she picked of the week.
GRAHAM CLULEY. Yeah, Carole Carole, what's your pick of the week?
CAROLE THERIAULT. Okay, so in my story, I talked about staying home a bit more, right, Graham? And I was talking about what you can do with that time, especially if you're trying to limit screen time or you're married, so there's less distractions. So, so say it's time for old school fun, something you can play with friends, partners, kids, grandparents, whatever, basically for everybody. So even Graham, you. Okay, it's a dice game called Farkle. Okay, I know the name is the worst.
GRAHAM CLULEY. As in Megan Farkle? And something—
CAROLE THERIAULT. and my mom— hi, Mom— uh, she got into this during a holiday a few years back, and we started playing when I started, you know, when I was visiting them. And then something happened, right, when I was there last time. I brought it back, and I've become a little bit addicted to the game. Okay, so quickly, quickly, quickly.
GRAHAM CLULEY. Okay.
CAROLE THERIAULT. You have 6 dice, you roll them, you count your points as you would Yahtzee. You know, I've got a straight, or I've got 3 triplets, or whatever. But the big difference from Yahtzee is that you can bank the wins of the previous player. So say the 3 of us were playing, and I got an amazing 6-dice straight, right? I get 3,000 points. I then can pass those points over to Anna, and all she has to do, she gets them if she can add to the points, and she can get more points. So, so there's this kind of weird, you know, you're hoping for the person to do well She can kind of steal it off you. No, she doesn't steal it. She doesn't steal it. She just gets it as well. So I have my 3,000 points. She would then go and play, and she'd say she got 500 points. She then have 3,500.
GRAHAM CLULEY. Oh, I see. So you get your points and she gets hers. Oh, I see.
ANNA BRADING. So then, so then what happens? Does it not just accumulate?
CAROLE THERIAULT. You try and build to a score, but there are some pitfalls as well. It's a bit like Snake and Ladders, but dicey. Now I know you guys sound riveted And I know you cannot wait to play. Anna, we are hanging out soon, and I know you can't wait to play.
ANNA BRADING. I'm excited. Actually, I did have a— I had my screen time report today, and I am thoroughly ashamed that it was 6 hours 10 minutes on average last week, which is horrifying.
CAROLE THERIAULT. What, last week?
ANNA BRADING. Yeah, on average. On average a day. A day?
CAROLE THERIAULT. Oh, a day. Okay, I was gonna say— I was gonna say week.
ANNA BRADING. That's not— so I think I need to play a bit of dice games.
GRAHAM CLULEY. So were you at work last week?
CAROLE THERIAULT. Yeah.
GRAHAM CLULEY. 6 hours.
CAROLE THERIAULT. And she works 10 hours. She doesn't have to sleep for 14.
GRAHAM CLULEY. Oh, okay, this isn't during work time. I understand.
ANNA BRADING. Absolutely not. I would never look at my phone when I'm at work.
CAROLE THERIAULT. Come on. Okay, so one last thing about Farkle, because, you know, it's really riveting. Um, what's really, really great about it is it's fun, but it's not so distracting that you can't still yak and gossip and whatever, hang out, right? Unlike with phones, like, you know, someone's on their phone, they just literally— yeah, we had friends come over last night and they have like a young kid who's about 2, and literally because we were there, they both parents went on their phones. Oh no, no, no, but they need—
ANNA BRADING. they did—
CAROLE THERIAULT. they're kind of missing their, their fix, right?
ANNA BRADING. That's what's going to the toilet's fault though, surely. I'm just going for the loo, back half an hour later.
CAROLE THERIAULT. But you know when someone's looking at their phones, they kind of go, hmm, what?
ANNA BRADING. Oh, they never really hear you.
CAROLE THERIAULT. They're really in an intense video game. Same idea. So this this is much more chill, and I think that's what we need in the face of viral epidemic, some chill games. So there you go, Farkle, an unusual—
ANNA BRADING. and Graham can play it when he's, uh, when he's at home for his 14 days when he's got coronavirus.
CAROLE THERIAULT. Actually, you're probably gonna have to go into, uh, quarantine with the 10% else people in the world on the way back, so maybe, maybe you should pop off to an a drugstore and buy yourself some dice. That's all you need.
ANNA BRADING. Or Amazon.
GRAHAM CLULEY. I'll get Amazon to deliver it because you are allowed to deliver it to my hotel room.
ANNA BRADING. Okay.
CAROLE THERIAULT. Well, no, Amazon actually is having trouble fulfilling. That's the big concern right now because most of Amazon stuff comes from China.
ANNA BRADING. The dice are all stuck in China.
CAROLE THERIAULT. So yeah, be careful. A lot of things are going to be stuck there because people can't put them in boxes for you. So maybe you have to get off your little butt, go down to the pharmacy, go to the pharmacy, get yourself a mask if you can. For $500.
GRAHAM CLULEY. Well, on that bombshell, we've just about wrapped up the episode for this week. Anna, thank you so much for joining us. I'm sure lots of our listeners would love to know more about you and what you get up to. What's the best way for folks to do that?
ANNA BRADING. I'm @AnnaBrading on Twitter, and we're @NakedSecurity, and you can also listen to our podcast every week.
GRAHAM CLULEY. And you can follow us on Twitter @SmashingSecurity, no G, Twitter wouldn't allow us to have a G, and on Reddit as well, Join the conversation by joining the Smashing Security subreddit. And don't forget, if you want to be sure never to miss another episode, subscribe in your favorite podcast app, such as Apple Podcasts or Spotify or Pocket Casts. That way you won't miss any of our episodes in the future.
CAROLE THERIAULT. You can hear Graham all the time. Now, shout out to all of you for listening week in and week out, supporting us with a few dollars on Patreon and giving us beautiful reviews. Keep them coming. They keep Graham Graham from whinging, which is a great thing. And also, huge thank you to this week's Smashing Security sponsor, LastPass. Its support helps us give you this show for free. Check out smashingsecurity.com for past episodes, sponsorship details, and information on how to get in touch with us.
GRAHAM CLULEY. Until next time, cheerio, bye-bye.
ANNA BRADING. Bye.
CAROLE THERIAULT. Anna, did you put on a little sexy voice bit on this show?
ANNA BRADING. No. Did I? Was it? Was it kind of sexy?
CAROLE THERIAULT. Yeah, I think you sound— yeah, I think you sound—
GRAHAM CLULEY. it wasn't a deliberate thing, but you know, I was putting on a sexy voice. I don't know if anyone noticed.
ANNA BRADING. Oh, I noticed that.
CAROLE THERIAULT. You just don't do it for me, Graham. Okay, just don't do it for me. I'm sorry.
GRAHAM CLULEY. Just look at a picture of— look at a picture of David Schwimmer while you're listening to my voice.
CAROLE THERIAULT. Oh yeah, Dave Goldblum. I can't believe I mentioned him 3 weeks running. Starting to be an obsession.
GRAHAM CLULEY. I think his name is Geoff Goldblum, not Dave Goldblum.
ANNA BRADING. She doesn't care. She doesn't care what he's called. She just wants to look at him.
CAROLE THERIAULT. He met me. He wouldn't care what I was called either.
ANNA BRADING. Does he not? Does he have a tash? He doesn't have a tash, does he?
CAROLE THERIAULT. He's had tashes. Depends what picture you look at. Um, I'm gonna stop the recording. No.
-- TRANSCRIPT ENDS --