WEBVTT

1
00:00:03.097 --> 00:00:16.245
<v Graham Cluley>So what should I say?</v>

2
00:00:16.245 --> 00:00:27.797
<v Dave Bittner>Uh, let's say, say, uh, looking</v>

3
00:00:27.797 --> 00:00:39.350
<v Dave Bittner>forward to this week's Smashing Security podcast.</v>

4
00:00:39.350 --> 00:00:52.012
<v Graham Cluley>Yes.</v>

5
00:00:52.012 --> 00:01:01.151
<v Dave Bittner>With my co-host.</v>

6
00:01:01.151 --> 00:01:12.379
<v Graham Cluley>Co-host?</v>

7
00:01:12.379 --> 00:01:19.759
<v Dave Bittner>Or my special guest, Dave Bittner.</v>

8
00:01:19.759 --> 00:01:31.292
<v Graham Cluley>Stand down, Dave.</v>

9
00:01:31.292 --> 00:01:36.760
<v Dave Bittner>Thank you. Sorry.</v>

10
00:01:36.760 --> 00:01:42.227
<v Dave Bittner>I got ahead of myself. Uh, you know.</v>

11
00:01:42.227 --> 00:01:52.227
<v Unknown>Smashing Security, Episode 462: LinkedIn is Spying on You, and You Agreed to Nothing,</v>

12
00:01:52.227 --> 00:02:02.227
<v Unknown>with Graham Cluley and special guest Dave Bittner. Hello, hello, and welcome to Smashing</v>

13
00:02:02.227 --> 00:02:12.227
<v Unknown>Security, Episode 462. My name is Graham Cluley.</v>

14
00:02:07.367 --> 00:02:12.699
<v Graham Cluley>Dave Bittner from the CyberWire, back on the podcast again.</v>

15
00:02:12.699 --> 00:02:18.031
<v Graham Cluley>We can't get you away from a microphone, can we?</v>

16
00:02:18.031 --> 00:02:23.854
<v Dave Bittner>I know, I'm like a terrible rash and difficult</v>

17
00:02:23.854 --> 00:02:29.679
<v Dave Bittner>to get rid of.</v>

18
00:02:29.679 --> 00:02:36.584
<v Graham Cluley>Do you ever feel like, you know, I've had enough of this, it's time to time to hang up my spurs.</v>

19
00:02:36.584 --> 00:02:43.487
<v Graham Cluley>Well, I suppose they're not spurs, are they?</v>

20
00:02:41.561 --> 00:03:11.561
<v Dave Bittner>And I'm Dave Bittner.</v>

21
00:02:43.487 --> 00:02:57.056
<v Dave Bittner>Time to hang up my XLR cables.</v>

22
00:02:57.056 --> 00:03:06.835
<v Graham Cluley>My XLR cables, yeah.</v>

23
00:03:06.835 --> 00:03:13.306
<v Dave Bittner>Not so much that, but I will tell you there are times when I smash my head against the desk and say, I need a vacation. I need a break.</v>

24
00:03:13.306 --> 00:03:19.776
<v Dave Bittner>I need to get away from the bad news.</v>

25
00:03:19.776 --> 00:03:26.436
<v Graham Cluley>Yeah.</v>

26
00:03:26.436 --> 00:03:33.096
<v Graham Cluley>I mean, I find it tough doing one podcast a week, but you do about 89 a week.</v>

27
00:03:33.096 --> 00:03:39.346
<v Dave Bittner>I do. I do.</v>

28
00:03:39.346 --> 00:03:45.597
<v Dave Bittner>I have to learn how to navigate it so it doesn't take too hard a toll on you emotionally, but I'm, you know, I'm mostly there, but there are days, Graham, there are days.</v>

29
00:03:45.597 --> 00:03:54.108
<v Graham Cluley>Well, we certainly do appreciate you coming on the Smashing Security podcast today. And before we kick off, let's thank this week's wonderful sponsors, Meta, ESET, and Vanta. We'll be hearing more about them later on in the podcast. This week on Smashing Security. We won't be talking about how hackers working for the Russian government broke into thousands of home routers to steal passwords.</v>

30
00:03:54.108 --> 00:04:02.618
<v Graham Cluley>You'll hear no discussion of how tourists traveling to Hong Kong have been warned that it's now a criminal offense to refuse to hand over to police the passwords for all your personal devices. And we won't even mention how after authorities cracked down on the use of Telegram, WhatsApp, and VPNs, Russian citizens have switched to using two other apps. For instant message and video call, including in some cases smart cat feeders. So Dave, what are you going to be talking about this week?</v>

31
00:04:02.618 --> 00:04:12.185
<v Dave Bittner>I'm talking about some wealthy California crypto holders who are being</v>

32
00:04:12.185 --> 00:04:21.752
<v Dave Bittner>targeted in wrench attacks.</v>

33
00:04:21.752 --> 00:04:25.471
<v Graham Cluley>And I'm going to be shining a light on how LinkedIn is shining a light on its users. All this and much more coming up on this episode of Smashing Security. Well, before we kick off, we've just got a moment to thank one of this episode's sponsors, ESET. Now, there's no shortage of cybersecurity vendors claiming to be the best, of course, but ESET is one of the few that's been proven it for 30 years. Research has always been at the core of what ESET does. Their threat intelligence teams are actively tracking APT groups and ransomware affiliates and publishing findings that the security community actually reads and references. That's not a marketing line. That's 30 years of doing the work. And here's what makes it interesting. 3 decades of research means that ESET has built up global telemetry that most vendors simply don't have access to. They combine that telemetry with AI-native technology and human expertise, and that's what powers both their products and their MDR service. Real intelligence behind the protection, not just pattern matching. 110 million users worldwide trust ESET with their endpoints, cloud, email, and mobile devices. That number doesn't happen by accident. So why don't you check them out right now? Go to smashingsecurity.com/ESET. That's smashingsecurity.com/ESET. And thanks to ESET. For supporting the show. Now, chums, chums, LinkedIn. Don't you love it? Don't you love it? I love it. Oh boy. It's great.</v>

34
00:04:25.471 --> 00:04:31.305
<v Dave Bittner>If by love you mean hate and do everything in my power to avoid it, then yes, I love it.</v>

35
00:04:31.305 --> 00:04:39.497
<v Graham Cluley>Oh, Dave, Dave, it's a wonderful service. It's a fantastic place. It's a platform where people I've never met can endorse me for skills that I don't have.</v>

36
00:04:39.497 --> 00:04:40.202
<v Dave Bittner>Right.</v>

37
00:04:40.202 --> 00:04:47.673
<v Graham Cluley>Right? Have you ever been told you are excellent at being an astronaut? You know, brain surgeon? Absolutely. Yes, he's fully qualified. Qualified for that.</v>

38
00:04:47.673 --> 00:04:50.644
<v Dave Bittner>Good news, we got the perfect job for you.</v>

39
00:04:50.644 --> 00:04:52.714
<v Graham Cluley>Belly dancer. Oh yes, sirree.</v>

40
00:04:52.714 --> 00:04:54.016
<v Dave Bittner>Yeah.</v>

41
00:04:54.016 --> 00:05:01.064
<v Graham Cluley>But you know what I love the most about LinkedIn is the humility. The humility that everyone shows up there.</v>

42
00:05:01.064 --> 00:05:01.882
<v Dave Bittner>Oh yes.</v>

43
00:05:01.882 --> 00:05:11.882
<v Graham Cluley>You know, because no one's afraid to be a little bit vulnerable on LinkedIn these days, are they? They're all sharing the lessons they've learned on life's journey, often from their failures. Maybe they've been made redundant and they started up a company and now they've succeeded and they're encouraging others.</v>

44
00:05:11.882 --> 00:05:21.882
<v Graham Cluley>They're saying, look, I was a failure too, just like you, but now I am magnificent. Or they'll give you a humble brag about stepping on an orange. There'll be some lesson they've learned in life and they'll post about it and link to it.</v>

45
00:05:21.882 --> 00:05:31.882
<v Graham Cluley>I find those heartwarming. Don't you? Don't you love those?</v>

46
00:05:34.665 --> 00:05:41.077
<v Dave Bittner>Oh, for sure. I can't get enough of them. It's a highlight of my day. Go on.</v>

47
00:05:41.077 --> 00:05:47.622
<v Graham Cluley>You know what? I think it's great because there's not a site out there that is more unintentionally entertaining than LinkedIn.</v>

48
00:05:47.622 --> 00:05:54.168
<v Graham Cluley>Seeing what people are posting, it's a good old guffaw. So I go there every day.</v>

49
00:05:54.168 --> 00:05:57.843
<v Dave Bittner>Well, I, you know, I was recently turned on to a Reddit group.</v>

50
00:05:57.843 --> 00:05:58.500
<v Graham Cluley>Oh, yes.</v>

51
00:05:58.500 --> 00:06:04.262
<v Dave Bittner>Actually, uh, Maria Varmazis told me about— there's a Reddit group called LinkedIn Lunatics.</v>

52
00:06:04.262 --> 00:06:08.112
<v Graham Cluley>I've been there. In fact, I think I've been, I've been included in on it before.</v>

53
00:06:08.112 --> 00:06:12.605
<v Dave Bittner>Okay, well, it's just, it's very entertaining, very entertaining.</v>

54
00:06:12.605 --> 00:06:22.605
<v Graham Cluley>Yes, I did make an appearance up there and I got a certain amount of abuse about a humble brag. Didn't involve stepping on an orange, but clearly I'd showed a little bit too much humility or been self-promoting too much. Now, of course, I don't go on LinkedIn looking for a job.</v>

55
00:06:22.605 --> 00:06:32.605
<v Graham Cluley>What fool would go on LinkedIn to look for a job? That's not what it's there for. You know, it's not to say though that I don't love the feeling of a recruiter sliding into my DMs, which they do occasionally, saying, oh, we've got the perfect job for you.</v>

56
00:06:32.605 --> 00:06:42.605
<v Graham Cluley>We can tell that you're a cybersecurity and AI whatchamacallit. And sometimes they offer me jobs which are entirely inappropriate. I think there was once a touring group that they asked me to join, a chorus line for HMS Pinafore or something going around Bulgaria.</v>

57
00:07:00.454 --> 00:07:03.264
<v Dave Bittner>Well, see, that would grab my attention, actually.</v>

58
00:07:03.264 --> 00:07:05.432
<v Graham Cluley>You would be tempted by that, wouldn't you?</v>

59
00:07:05.432 --> 00:07:09.208
<v Dave Bittner>Yes, I would. That fish would work on me.</v>

60
00:07:09.208 --> 00:07:22.733
<v Graham Cluley>Now, one thing is clear, LinkedIn is a deeply strange corner of the internet. And this week, it got that little bit stranger because a German privacy group— and you always have to worry when a privacy group is German, they're serious about their privacy.</v>

61
00:07:22.733 --> 00:07:36.257
<v Graham Cluley>They are called Fairlinked, and they've published what they're calling the Browsergate Report. And you always know you're in trouble, don't you, when there's a gate involved?</v>

62
00:07:36.257 --> 00:07:36.978
<v Dave Bittner>Oh, absolutely.</v>

63
00:07:36.978 --> 00:07:40.687
<v Graham Cluley>You know, ever since 1972, 2, I think it was.</v>

64
00:07:40.687 --> 00:07:41.072
<v Dave Bittner>Yeah.</v>

65
00:07:41.072 --> 00:07:50.411
<v Graham Cluley>I often wondered, no, what if there was a scandal involving something like the Brandenburg Gate? Would you then have Brandenburg Gate Gate?</v>

66
00:07:50.411 --> 00:07:55.033
<v Dave Bittner>Or perhaps a scandal involving Bill Gates.</v>

67
00:07:55.033 --> 00:08:05.033
<v Graham Cluley>Bill Gates Gate. You know, yes.</v>

68
00:08:05.033 --> 00:08:15.033
<v Graham Cluley>Maybe that's the defence to prevent there being a scandal about you is to change your surname to Gate beforehand. Anyway, Browsergate reveals that every single time you open LinkedIn in a Chrome-based browser, the LinkedIn platform will quietly inject a little bit of JavaScript into your session.</v>

69
00:08:15.033 --> 00:08:25.033
<v Graham Cluley>And that little bit of JavaScript, well, I say it's little, is 2.7 megabytes, David, 2.7 megabytes of JavaScript.</v>

70
00:08:27.528 --> 00:08:30.555
<v Dave Bittner>Well, by today's standards, that's nothing.</v>

71
00:08:30.555 --> 00:08:40.556
<v Graham Cluley>That's barely anything, is it? And that, that what it does is starts scanning your browser for over 6,000 specific installed extensions. Hmm.</v>

72
00:08:40.556 --> 00:08:50.556
<v Graham Cluley>So it's looking for all kinds of information about what you are running on your computer within your browser while you're on LinkedIn. It also harvests your CPU core count, your available memory, your screen resolution, your battery status, your time zone, your language settings. And this isn't once per visit to LinkedIn.</v>

73
00:08:50.556 --> 00:09:00.556
<v Graham Cluley>This is every single click that you make. Hmm. So you click on someone's profile and it's going to send a fingerprint, a unique, pretty much unique fingerprint with all these different indicators regarding your computer.</v>

74
00:09:19.024 --> 00:09:19.586
<v Dave Bittner>Right.</v>

75
00:09:19.586 --> 00:09:33.182
<v Graham Cluley>Or if you ignore a connection request from someone you met at a conference a few years ago, again, it will send a fingerprint or If you spend 4 minutes reading a post about 3</v>

76
00:09:33.182 --> 00:09:46.778
<v Graham Cluley>things the Navy SEALs taught me about inbox zero, it's going to— it's going to send your fingerprint. And none of this, none of this is mentioned anywhere in LinkedIn's privacy policy, which is absolutely fine.</v>

77
00:09:46.778 --> 00:09:47.419
<v Dave Bittner>Sure.</v>

78
00:09:47.419 --> 00:09:50.004
<v Graham Cluley>No, absolutely fine and dandy, isn't it? It's brilliant.</v>

79
00:09:50.004 --> 00:10:20.004
<v Dave Bittner>No worries. No worries.</v>

80
00:09:50.004 --> 00:09:57.504
<v Graham Cluley>No worries at all. So 6,000 extensions is looking nice.</v>

81
00:09:57.504 --> 00:10:05.004
<v Graham Cluley>I think I've got 6,000. And what are these extensions?</v>

82
00:10:05.004 --> 00:10:12.504
<v Graham Cluley>Well, it turns out they're like language and grammar extensions. So if you have a tool which helps you translate LinkedIn posts, for instance, hmm, it will pick that up or a grammar extension, something to make you look more eloquent on LinkedIn.</v>

83
00:10:12.504 --> 00:10:20.004
<v Graham Cluley>If you're using a tax tool, If you— oh, also extensions designed for people with ADHD or dyslexic users, because there are dyslexic extensions you can put on your browser which change the font to make it easier to read, for instance. There are tools that notify users— oh, this was an odd one— tools that notify users of Islamic prayer times.</v>

84
00:10:39.763 --> 00:10:41.384
<v Dave Bittner>Oh, that's not at all problematic.</v>

85
00:10:41.384 --> 00:10:43.535
<v Graham Cluley>Who would be interested in that, I wonder?</v>

86
00:10:43.535 --> 00:10:49.958
<v Dave Bittner>No, no. What could possibly— history has told us what could possibly go wrong with tracking people based on their religion.</v>

87
00:10:49.958 --> 00:10:59.725
<v Graham Cluley>And there are also extensions that could indicate your politics. I don't know quite what they do. Maybe they change your wallpaper to a particular flag or put a color scheme on your laptop.</v>

88
00:10:59.725 --> 00:11:09.490
<v Graham Cluley>I'm not sure. But anyway, many of these aren't scraping tools. These are personal tools.</v>

89
00:11:09.490 --> 00:11:19.255
<v Graham Cluley>They could reveal deeply private information about you and your health and your faith or your neurology. And that's not really what you want LinkedIn to be secretly cataloging, is it?</v>

90
00:11:19.255 --> 00:11:26.966
<v Dave Bittner>No, I would not expect this of them, although I have to say these days nothing surprises me anymore.</v>

91
00:11:26.966 --> 00:11:35.623
<v Graham Cluley>Right. And it's dangerous information because that is linked to your real name, right? No one calls themselves Fruitbat79 on LinkedIn.</v>

92
00:11:35.623 --> 00:11:36.327
<v Dave Bittner>That's right.</v>

93
00:11:36.327 --> 00:11:42.672
<v Graham Cluley>You've got your real name and your employer and your job title, etc. So this isn't by any means anonymous browsing data.</v>

94
00:11:42.672 --> 00:11:49.015
<v Graham Cluley>You are logged in LinkedIn. LinkedIn knows exactly who you are.</v>

95
00:11:49.015 --> 00:11:49.643
<v Dave Bittner>Right.</v>

96
00:11:49.643 --> 00:11:58.357
<v Graham Cluley>And it's also going to know if, for instance, you're secretly looking for work and it will be logging that against your profile on the very website that your boss</v>

97
00:11:58.357 --> 00:12:07.072
<v Graham Cluley>uses, because this list includes over 500 job search tools.</v>

98
00:12:07.072 --> 00:12:07.346
<v Dave Bittner>Hmm.</v>

99
00:12:07.346 --> 00:12:16.875
<v Graham Cluley>So if you have those tools installed, when you go on LinkedIn, it knows about it. It knows you're looking for a job. Well, your current employer has an account as well. So LinkedIn internally apparently calls this a spectroscopy.</v>

100
00:12:16.875 --> 00:12:26.402
<v Graham Cluley>Spectroscopy? Is that it? It sounds like a colonoscopy.</v>

101
00:12:26.402 --> 00:12:31.370
<v Dave Bittner>I think that's right. That's the tool that chemists use to tell the elements, right?</v>

102
00:12:31.370 --> 00:12:41.370
<v Graham Cluley>Yeah. Isn't it shining a</v>

103
00:12:31.370 --> 00:12:36.196
<v Dave Bittner>Yeah.</v>

104
00:12:36.196 --> 00:12:44.299
<v Graham Cluley>Didn't you have some sort of high-profile figure who strongly believed in shining a bright light inside your body in order to kill COVID? Oh, that's not Stalin.</v>

105
00:12:41.370 --> 00:12:51.370
<v Graham Cluley>light or a very bright</v>

106
00:12:44.299 --> 00:12:52.403
<v Graham Cluley>All that. Yeah.</v>

107
00:12:51.370 --> 00:13:01.370
<v Graham Cluley>light and determining something? Yeah.</v>

108
00:12:52.403 --> 00:13:00.506
<v Graham Cluley>Anyways, apparently back in 2017, which is around about the time LinkedIn introduced this feature, so it's only really been uncovered now. Back then, LinkedIn was scanning for 38 extensions, which feels like, well, maybe that's all right.</v>

109
00:13:00.506 --> 00:13:00.892
<v Dave Bittner>Hmm.</v>

110
00:13:00.892 --> 00:13:10.115
<v Graham Cluley>Because maybe these were extensions which were scraping information, maybe people's personal information off LinkedIn. They may want to stop that from happening.</v>

111
00:13:10.115 --> 00:13:19.341
<v Graham Cluley>By 2024, it had gone from 38 extensions to 461, which is still a lot, but you could perhaps argue there are 461 ways to scrape LinkedIn. I'll be honest with you, I actually have an extension in my browser which does take information from LinkedIn, right?</v>

112
00:13:19.341 --> 00:13:28.565
<v Graham Cluley>So I have a CRM for customers and things and people who contact me asking me to do work for them and things. And it's useful sometimes just to collect information about, you know, who are they, what's their job title, what's their contact details if we connected and things.</v>

113
00:13:28.565 --> 00:13:42.030
<v Dave Bittner>Right.</v>

114
00:13:42.030 --> 00:13:48.447
<v Graham Cluley>And so I've got this little button which I can press which does take it from their profile and add it to my CRM and it saves me some time. So, you know, I do kind of do this now.</v>

115
00:13:48.447 --> 00:13:54.864
<v Graham Cluley>I don't know if LinkedIn don't like that I've got this little tool.</v>

116
00:13:54.864 --> 00:13:56.957
<v Dave Bittner>You're not doing it at scale.</v>

117
00:13:56.957 --> 00:14:04.922
<v Graham Cluley>No, no, no. I'm doing it maybe once or twice a week. Right.</v>

118
00:14:04.922 --> 00:14:12.885
<v Graham Cluley>Anyway, they've now gone from 38 to 461 banned extensions, or rather logged extensions. Now it's 6,000. I looked this morning, it's 6,222.</v>

119
00:14:12.885 --> 00:14:14.744
<v Dave Bittner>But who's counting?</v>

120
00:14:14.744 --> 00:14:24.744
<v Graham Cluley>Well, it's the German privacy guys who are counting. So LinkedIn have been asked about this. And what they've said is the claims made are plainly wrong.</v>

121
00:14:24.744 --> 00:14:34.744
<v Graham Cluley>And they say that while at the same time not denying that they do have a list of 6,000 extensions. They haven't denied any of that. They've only tried to discount the intention behind it.</v>

122
00:14:34.744 --> 00:14:44.744
<v Graham Cluley>So they say the scanning is purely to identify extensions that scrape data. In violation of their terms of service. Again, I don't know what that has to do with Muslim prayer times.</v>

123
00:14:47.349 --> 00:14:47.990
<v Dave Bittner>Right.</v>

124
00:14:47.990 --> 00:14:57.440
<v Graham Cluley>They say they don't use the data to infer anything sensitive about their users. And they say that this report from these German guys should be taken with, you know, a pinch of salt.</v>

125
00:14:57.440 --> 00:15:06.890
<v Graham Cluley>In fact, they say that the person behind the report had their account banned by LinkedIn for scraping in the past. And apparently a German court denied their injunction request.</v>

126
00:15:06.890 --> 00:15:16.341
<v Graham Cluley>Against the platform. So there is some beef between the researchers and LinkedIn.</v>

127
00:15:16.341 --> 00:15:19.563
<v Dave Bittner>So this is all sour grapes according to LinkedIn?</v>

128
00:15:19.563 --> 00:15:27.846
<v Graham Cluley>Well, that's what they're kind of claiming. But I think it's possible that the person who discovered this, maybe they were behaving badly at some point, right?</v>

129
00:15:27.846 --> 00:15:36.126
<v Graham Cluley>But it's also entirely possible that the thing they discovered is still a problem. And those two things are not mutually exclusive.</v>

130
00:15:36.126 --> 00:15:44.408
<v Graham Cluley>So if someone with a speeding ticket tells you that your house is on fire, you should probably still check. Is it a bit warm in here?</v>

131
00:15:44.408 --> 00:15:45.548
<v Dave Bittner>Right, right.</v>

132
00:15:45.548 --> 00:15:53.048
<v Graham Cluley>Rather than just say, no, no, no, you've got a speeding ticket. I don't know. Anyway, what can you do about this problem?</v>

133
00:15:53.048 --> 00:16:00.548
<v Graham Cluley>Well, the obvious thing to do is either not go to LinkedIn or use a different browser. So if you use Firefox, you're largely protected. The way its extensions work don't expose the same identifiers that Chrome does.</v>

134
00:16:00.548 --> 00:16:08.048
<v Graham Cluley>Similarly, Brave, that blocks tracking endpoints by default. Safari users largely in the clear as well. But if you're on Chrome or Edge, Edge of course is a Chrome-based browser, you are being scanned every time you visit and there's no setting to stop them from doing it.</v>

135
00:16:08.048 --> 00:16:15.548
<v Graham Cluley>And LinkedIn is not being upfront about what it is doing. So regulators have been informed. We'll have to see if anything comes from this, but it's not great, is it?</v>

136
00:16:32.110 --> 00:16:39.802
<v Dave Bittner>It's not great. And I wonder, how does this come up against GDPR over, over in your neck of the woods?</v>

137
00:16:39.802 --> 00:16:46.774
<v Graham Cluley>Yes, well, I think this German privacy guy has lodged a GDPR complaint with the regulators, so we'll have to see.</v>

138
00:16:46.774 --> 00:16:53.748
<v Graham Cluley>It does sound like the guys at LinkedIn are rather scooping up a bit too much information.</v>

139
00:16:53.748 --> 00:17:02.869
<v Dave Bittner>What do you make of this, though? Do you think it's just browser fingerprinting that's kind of spun out of control, or do you think there's more to it than that?</v>

140
00:17:02.869 --> 00:17:09.493
<v Graham Cluley>I don't think it's necessarily being done with malicious intent.</v>

141
00:17:09.493 --> 00:17:16.118
<v Graham Cluley>How can I be in this industry so long and be so naive to think that it It won't be used for advertising purposes or surveillance.</v>

142
00:17:16.118 --> 00:17:31.118
<v Dave Bittner>What even counts</v>

143
00:17:16.118 --> 00:17:24.186
<v Graham Cluley>What even counts? That's true. That is very true.</v>

144
00:17:24.186 --> 00:17:32.256
<v Graham Cluley>Now, you mentioned to me about LinkedIn earlier because I'm a user of this very cool browser. I don't use Google. I use Kagi.</v>

145
00:17:31.118 --> 00:17:46.118
<v Dave Bittner>as malicious intent anymore, right?</v>

146
00:17:32.256 --> 00:17:40.324
<v Graham Cluley>Okay. And they introduced this new feature and you reminded me earlier about this. They've got this translator thing, haven't they?</v>

147
00:17:40.324 --> 00:17:41.035
<v Dave Bittner>They do.</v>

148
00:17:41.035 --> 00:17:48.694
<v Graham Cluley>Where, you know, like you have Google Translate, you can translate between languages, but now with Kagi, you can translate something into LinkedIn speak.</v>

149
00:17:48.694 --> 00:17:49.096
<v Dave Bittner>Yes.</v>

150
00:17:49.096 --> 00:17:50.461
<v Graham Cluley>Have you had a go at this?</v>

151
00:17:50.461 --> 00:17:57.943
<v Dave Bittner>Oh, I have. Why don't you type something in here and we'll see how it translates. This is great fun.</v>

152
00:17:57.943 --> 00:18:01.673
<v Graham Cluley>Okay, okay. So what should I say?</v>

153
00:18:01.673 --> 00:18:07.220
<v Dave Bittner>Let's say, looking forward to this week's Smashing Security podcast with my co-host, my co-host</v>

154
00:18:07.220 --> 00:18:12.767
<v Dave Bittner>or my special guest, Dave Bittner.</v>

155
00:18:12.767 --> 00:18:13.553
<v Graham Cluley>Stand down, Dave.</v>

156
00:18:13.553 --> 00:18:13.874
<v Dave Bittner>Thank you.</v>

157
00:18:13.874 --> 00:18:14.853
<v Graham Cluley>Sorry.</v>

158
00:18:14.853 --> 00:18:17.243
<v Dave Bittner>I got ahead of myself, you know.</v>

159
00:18:17.243 --> 00:18:24.743
<v Graham Cluley>Okay. It's done a little translation into LinkedIn. So it starts off, of course, with an emoji.</v>

160
00:18:24.743 --> 00:18:32.243
<v Graham Cluley>So I've got a rocket emoji. Thrilled to announce— come on, British, I'm never thrilled— that I'll be joined by the one and only Dave Bittner on this week's episode of the Smashing Security podcast. Microphone emoji.</v>

161
00:18:32.243 --> 00:18:39.743
<v Graham Cluley>Can't wait to dive deep into the latest in cybersecurity. You won't want to miss this conversation. #cybersecurity, #infosec, #postcast, #networking, #thoughtleadership.</v>

162
00:18:39.743 --> 00:18:47.243
<v Graham Cluley>Oh, I can change my excitement level. I can go for high energy with more emojis and hype.</v>

163
00:18:52.791 --> 00:18:57.205
<v Dave Bittner>That's right. And you can puke hashtags as well.</v>

164
00:18:57.205 --> 00:19:05.069
<v Graham Cluley>Well, we've got time right now to chat about one of our sponsors this week, Vanta. SPEAKER_02. Oh yes, my favorites. What do they do again?</v>

165
00:19:05.069 --> 00:19:10.510
<v Graham Cluley>They stop you running your entire security program out of a spreadsheet, Joe. SPEAKER_02. That seems aimed at me personally, Graham.</v>

166
00:19:10.510 --> 00:19:19.497
<v Graham Cluley>Well, it is a little bit, yes. But you know how most companies have to prove they're secure to customers or auditors and regulators, and the whole thing involves chasing down evidence, filling in questionnaires and forms, updating the same spreadsheet cells over and over again. SPEAKER_02.</v>

167
00:19:19.497 --> 00:19:28.483
<v Graham Cluley>Over and over again. It sounds utterly soul-destroying.</v>

168
00:19:28.483 --> 00:19:29.142
<v Dave Bittner>Yeah.</v>

169
00:19:29.142 --> 00:19:33.314
<v Graham Cluley>Well, Vanta automates all of that. SPEAKER_02. Automates it?</v>

170
00:19:33.314 --> 00:19:33.875
<v Dave Bittner>How?</v>

171
00:19:33.875 --> 00:19:42.493
<v Graham Cluley>Well, their trust management platform keeps a continuous eye on your systems. It pulls everything into one place. And keeps you audit-ready around the clock.</v>

172
00:19:42.493 --> 00:19:51.111
<v Graham Cluley>So no more staring at the ceiling at 2 AM wondering whether you've got the right controls in place or whether one of your suppliers has been breached. SPEAKER_02. The stuff of nightmares.</v>

173
00:19:51.111 --> 00:20:00.684
<v Graham Cluley>Yeah, it would be, wouldn't it? But this Banta solution uses AI as well, and it's the useful kind— flagging risks, collecting evidence, slotting into the tools your team already uses so you move faster, scale without the headaches, and perhaps actually get some sleep.</v>

174
00:20:00.684 --> 00:20:10.258
<v Graham Cluley>Go to vanta.com/smashing to find out more. SPEAKER_02.</v>

175
00:20:10.258 --> 00:20:19.832
<v Graham Cluley>That's vanta.com/smashing. And thanks to Vanta for supporting the show.</v>

176
00:20:19.832 --> 00:20:21.595
<v Graham Cluley>Dave, what's your story for us this week?</v>

177
00:20:21.595 --> 00:20:27.435
<v Dave Bittner>Well, Graham, uh, I am talking about life imitating art.</v>

178
00:20:27.435 --> 00:20:33.276
<v Dave Bittner>And by art, I mean the classic XKCD comic, which I'm sure you are familiar with.</v>

179
00:20:33.276 --> 00:20:36.086
<v Graham Cluley>This is the comic with the little stickmen, isn't it?</v>

180
00:20:36.086 --> 00:20:44.819
<v Dave Bittner>It is, yeah. The comic with the little stickmen generally talking about tech and occasionally cybersecurity.</v>

181
00:20:44.819 --> 00:20:53.554
<v Dave Bittner>And I have to say, the first time I saw this particular comic, it had indeed been printed out and stuck to a bulletin board in a break room. That was the first time I saw it, but I've seen it dozens of times afterwards.</v>

182
00:20:53.554 --> 00:21:02.288
<v Dave Bittner>I thought perhaps the two of us could reenact this for our listeners before I dig into the story here.</v>

183
00:21:02.288 --> 00:21:02.673
<v Graham Cluley>Okay.</v>

184
00:21:02.673 --> 00:21:07.410
<v Dave Bittner>So I will narrate and also I will be one of the characters and you can be the other characters.</v>

185
00:21:07.410 --> 00:21:07.730
<v Graham Cluley>Okay.</v>

186
00:21:07.730 --> 00:21:16.192
<v Dave Bittner>It starts off, we've got these two stick figures. One of them is holding a laptop in front of the other one, and it's described as a crypto nerd's imagination. And the person says, "His laptop's encrypted.</v>

187
00:21:16.192 --> 00:21:24.653
<v Dave Bittner>Let's build a multimillion-dollar cluster to crack it." Ah, no good. It's—</v>

188
00:21:24.653 --> 00:21:30.108
<v Graham Cluley>what's that say? It's too small for me to read. Hang on, I have to increase the size of it.</v>

189
00:21:30.108 --> 00:21:35.563
<v Graham Cluley>No good. It's 4096-bit RSA. Blast!</v>

190
00:21:35.563 --> 00:21:41.343
<v Dave Bittner>Our evil plan is foiled. And then the next frame says, what would actually happen?</v>

191
00:21:41.343 --> 00:21:47.124
<v Dave Bittner>His laptop's encrypted. Drug him and hit him with his $5 wrench until he tells us the password.</v>

192
00:21:47.124 --> 00:21:54.928
<v Graham Cluley>Got it. And that is so true, isn't it? Yeah.</v>

193
00:21:54.928 --> 00:22:02.730
<v Graham Cluley>You know, we put all these technological things in place. In order to protect our passwords or protect our bitcoin wallets, but basically some good old-fashioned violence really does the trick.</v>

194
00:22:02.730 --> 00:22:12.730
<v Dave Bittner>It really does. And I think that's part of why this is such a classic cartoon and why it resonates with the community, because I think particularly in cybersecurity, so often people</v>

195
00:22:12.730 --> 00:22:22.730
<v Dave Bittner>go for the technologically irresistible solution to a problem when the more practical solution may be what's really needed, in this case, a $5 wrench that you can whack someone with until</v>

196
00:22:22.730 --> 00:22:32.730
<v Dave Bittner>they give you the information you want. So my story comes from KTLA, which is one of the local TV affiliates in California.</v>

197
00:22:36.171 --> 00:22:36.635
<v Graham Cluley>Right.</v>

198
00:22:36.635 --> 00:22:44.329
<v Dave Bittner>Picture this. You're at home minding your own business. You hear a knock at the door and they say it's a pizza delivery.</v>

199
00:22:44.329 --> 00:22:45.531
<v Graham Cluley>I ordered pizza here.</v>

200
00:22:45.531 --> 00:22:47.070
<v Dave Bittner>Well, you didn't order pizza.</v>

201
00:22:47.070 --> 00:22:50.324
<v Graham Cluley>I'm still not going to say no. I'm happy. You know? Yeah.</v>

202
00:22:50.324 --> 00:22:51.318
<v Dave Bittner>Go on, have it.</v>

203
00:22:51.318 --> 00:22:54.419
<v Graham Cluley>All right. Free pizza.</v>

204
00:22:54.419 --> 00:23:00.323
<v Dave Bittner>So last year, back in November in San Francisco, someone went and opened their door and that annoying knock turned</v>

205
00:23:00.323 --> 00:23:06.227
<v Dave Bittner>into a $13 million crypto robbery.</v>

206
00:23:06.227 --> 00:23:06.965
<v Graham Cluley>Oh boy.</v>

207
00:23:06.965 --> 00:23:12.500
<v Dave Bittner>So attackers who were posing as delivery drivers, they forced their way into this person's home.</v>

208
00:23:12.500 --> 00:23:18.034
<v Dave Bittner>They tied the victim up, threatened to cut off his fingers.</v>

209
00:23:18.034 --> 00:23:18.771
<v Graham Cluley>Oh.</v>

210
00:23:18.771 --> 00:23:29.150
<v Dave Bittner>And then spent about an hour extracting passwords before walking away with bitcoin and Ethereum. And evidently this wasn't a one-off.</v>

211
00:23:29.150 --> 00:23:39.528
<v Dave Bittner>They said there were similar delivery driver ruses in San Jose and Sunnyvale and Los Angeles. So kind of seemingly California-based for the moment or focused.</v>

212
00:23:39.528 --> 00:23:39.833
<v Graham Cluley>Yeah.</v>

213
00:23:39.833 --> 00:23:47.333
<v Dave Bittner>And in some cases, the investigators think that the suspects have first compromised victims' DoorDash or Uber Eats accounts. To learn where they lived.</v>

214
00:23:47.333 --> 00:23:54.833
<v Dave Bittner>So they're not just showing up randomly. They shopped a target list first.</v>

215
00:23:54.833 --> 00:24:02.333
<v Dave Bittner>Now, there are suspects here. So law enforcement has tracked down some people and arrested them that they allege have done these dastardly deeds.</v>

216
00:24:02.333 --> 00:24:09.833
<v Dave Bittner>But I'm wondering about what you make of this, this whole idea that if you have a big cache of cryptocurrency, someone might show up and threaten or even perform physical violence against you.</v>

217
00:24:18.905 --> 00:24:27.355
<v Graham Cluley>It's horrifying, isn't it? And I mean, even if some of these chaps have been arrested or apprehended, it's so easy to imagine that other people may copy this approach.</v>

218
00:24:27.355 --> 00:24:35.803
<v Graham Cluley>It's just horrendous that this could happen. I guess the only answer really is you've got to keep really quiet about the fact that you've got a great big hoard of bitcoin or Ethereum somewhere, you know.</v>

219
00:24:35.803 --> 00:24:44.251
<v Graham Cluley>Yeah, you can't go around showing off about it.</v>

220
00:24:44.251 --> 00:24:53.700
<v Dave Bittner>Right. That was my next question is, is how did the bad guys come to know that this person in particular, or these people that they targeted, had large caches of cryptocurrency so they could go after them?</v>

221
00:24:53.700 --> 00:25:03.148
<v Dave Bittner>Do you think it may have been as simple as somebody just bragging about their success?</v>

222
00:25:03.148 --> 00:25:08.165
<v Graham Cluley>It might have been that. I mean, first of all, if you've got millions and millions of cryptocurrency, chances are that you're not going to be living in a shed somewhere, are you?</v>

223
00:25:08.165 --> 00:25:13.182
<v Graham Cluley>You're going to be living somewhere nice.</v>

224
00:25:13.182 --> 00:25:13.920
<v Dave Bittner>Right. True.</v>

225
00:25:13.920 --> 00:25:19.260
<v Graham Cluley>So they may have, first of all, cut out the likely candidates of people they're going to target because of that.</v>

226
00:25:19.260 --> 00:25:19.662
<v Dave Bittner>Yeah.</v>

227
00:25:19.662 --> 00:25:26.597
<v Graham Cluley>But I have certainly seen, I mean, I get phishing emails every single day sent to an email address, which I used when I once purchased a hardware bitcoin wallet kind of thing. Right.</v>

228
00:25:26.597 --> 00:25:33.534
<v Graham Cluley>One of, one of those hardware keys.</v>

229
00:25:33.534 --> 00:25:36.035
<v Dave Bittner>Right.</v>

230
00:25:36.035 --> 00:25:42.455
<v Graham Cluley>And it pretends to come from that particular company, and they're all nonsense, right? I can spot them, but I'm sure there are people who would be fooled by it. So they know that my email address is somehow connected with cryptocurrency. Now, as it is, they don't know I've only got $5 worth of cryptocurrency rather than $5 million. But that information combined with, oh, look, he's got a really flash car, or, oh my goodness, you know, he keeps on going on these macho podcasts talking about his bitcoin billions or whatever it may be, could lead to specific people people being targeted. But it is a problem which actually, you know, it goes beyond the bitcoin wallets.</v>

231
00:25:42.455 --> 00:25:48.876
<v Graham Cluley>It goes into all areas of life, doesn't it? You know, if you have passwords or if you have things protecting important data to you, you can have all the technology in the world defending you. And organized criminals can think, well, if it's too hard to hack him, maybe we'll take an axe and try and hack him or threaten to hack him or hack his fingers off. Of course you're going to tell them. It's horrific.</v>

232
00:25:48.876 --> 00:25:56.376
<v Dave Bittner>It is. You know, I, my eyes were opened to this whole sort of thing.</v>

233
00:25:56.376 --> 00:26:03.876
<v Dave Bittner>Not long ago, I was having a conversation with Chris Pearson, who's the CEO of a company called Black Cloak, and their specialty is executive protection online. But part of what they do is physical protection where people need bodyguards.</v>

234
00:26:03.876 --> 00:26:11.376
<v Dave Bittner>And yeah, evidently, if you are a high-wealth person or a person of enough importance in the business world, like kidnappings still happen and you have to be protected. He also shared with me that you get to a certain level and you're prohibited from driving your own car by your board of directors because it's considered too much of a hazard to the company.</v>

235
00:26:11.376 --> 00:26:18.876
<v Dave Bittner>So you are required to have a personal driver.</v>

236
00:27:33.468 --> 00:27:41.029
<v Graham Cluley>I've been prohibited by my wife, but I think that's for the general public's protection rather than mine.</v>

237
00:27:41.029 --> 00:27:41.432
<v Dave Bittner>Yes, of course.</v>

238
00:27:41.432 --> 00:27:43.358
<v Graham Cluley>Of course.</v>

239
00:27:43.358 --> 00:27:49.942
<v Dave Bittner>Slightly different circumstances, but same results, I suppose.</v>

240
00:27:49.942 --> 00:27:56.107
<v Graham Cluley>Okey-dokey. A little bit of time now to talk about Meta, who are one of our sponsors this week. SPEAKER_02. What does this one do?</v>

241
00:27:56.107 --> 00:28:00.763
<v Graham Cluley>They set up your office network so you don't have to. SPEAKER_02. That's it?</v>

242
00:28:00.763 --> 00:28:09.121
<v Graham Cluley>Yeah, well, pretty much. Yeah, that's it. You know when you move into a new office and suddenly you're juggling ISPs and floor plans and hardware and configuration? It basically becomes a second job, doesn't it?</v>

243
00:28:09.121 --> 00:28:17.479
<v Graham Cluley>SPEAKER_02. Yes, I know this one. It's when the contractor turns up on the wrong day or at the wrong address and tries to install the wrong thing.</v>

244
00:28:17.479 --> 00:28:27.479
<v Graham Cluley>That's the one, yeah.</v>

245
00:28:27.479 --> 00:28:37.479
<v Graham Cluley>Well, Meta's entire pitch is, what</v>

246
00:28:37.479 --> 00:28:47.479
<v Graham Cluley>if that just wasn't your problem?</v>

247
00:31:37.338 --> 00:31:48.424
<v Dave Bittner>Ugh. SPEAKER_02. I'm listening.</v>

248
00:31:48.424 --> 00:31:53.976
<v Graham Cluley>So you hand them a physical address and a floor plan, and they sort out the ISP, they design the network, they show up on site, they rack their own hardware. SPEAKER_02.</v>

249
00:31:53.976 --> 00:31:59.528
<v Graham Cluley>Their own hardware, not reselling someone else's kit?</v>

250
00:31:59.528 --> 00:32:05.423
<v Graham Cluley>Yep, their own hardware, and they get the whole thing up and running. Hmm.</v>

251
00:32:05.423 --> 00:32:11.317
<v Graham Cluley>SPEAKER_02. But what if I like being put on hold for 45 minutes to listen to pan flute music?</v>

252
00:32:11.317 --> 00:32:19.092
<v Graham Cluley>Well, tough luck, Joe. Tough luck. And once you're up and running, You get one dashboard, monitoring, management, security, VLANs, firewall, DNS security, SD-WAN, the whole caboodle. SPEAKER_02. So full visibility with none of the legwork.</v>

253
00:32:19.092 --> 00:32:24.662
<v Graham Cluley>Yep, that's exactly it. And it's sold through a subscription model, so there's no nasty surprises. There's even a hardware buyback program if you've already got kit from another vendor.</v>

254
00:32:24.662 --> 00:32:30.232
<v Graham Cluley>SPEAKER_02. Ah, that's rather civilized.</v>

255
00:32:30.232 --> 00:32:35.838
<v Graham Cluley>Isn't it just? So head over to meter.com/smashing. To find out more, that's meter.com/smashing.</v>

256
00:32:35.838 --> 00:32:41.444
<v Graham Cluley>SPEAKER_02. And thanks to Meter for supporting the show.</v>

257
00:32:41.444 --> 00:32:49.885
<v Graham Cluley>And welcome back, and you join us at our favourite part of the show, the part of the show that we like to call Pick of the Week.</v>

258
00:32:49.885 --> 00:33:00.478
<v Dave Bittner>Pick of the Week.</v>

259
00:33:00.478 --> 00:33:09.539
<v Graham Cluley>Pick of the Week is the part of the show where everyone chooses something they like. Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish. It doesn't have to be security-related necessarily.</v>

260
00:33:09.539 --> 00:33:19.402
<v Dave Bittner>Better not be.</v>

261
00:33:19.402 --> 00:33:25.326
<v Graham Cluley>Ah, well, my pick of the week this week is not security-related.</v>

262
00:33:25.326 --> 00:33:31.252
<v Graham Cluley>My pick of the week, well, it actually relates to a previous pick of the week.</v>

263
00:33:31.252 --> 00:33:47.058
<v Dave Bittner>Okay.</v>

264
00:33:47.058 --> 00:33:52.438
<v Graham Cluley>Because a few months ago, I think I was on a podcast with Tricia Howard and I was raving about how someone had taken one of the missing episodes of Doctor Who and they had reanimated it. Incredible. Such a piece of work they'd put together animating this lost piece of television which no longer existed in the BBC archives, had not been seen for over 50 years. And I said, this is brilliant. This is my pick of the week.</v>

265
00:33:52.438 --> 00:33:57.816
<v Graham Cluley>Well, what do you know? That missing episode has now been found. SPEAKER_02. Ah.</v>

266
00:33:57.816 --> 00:34:03.180
<v Graham Cluley>Putting that man's two years of work into the animation. Oh, oh. Completely different. It's still very good what he did, but film is fabulous. Found not one, but two missing episodes of Doctor Who from 1965. Episodes of, this was particularly exciting, The Daleks' Master Plan. Space vessel 111, touchdown completed. Excellent. I will await our guest here. Daleks! One of the greatest Doctor Who stories of all time. So it was originally 12 episodes long, and there were only, I think, 3 or 4 which had been found.</v>

267
00:34:03.180 --> 00:34:08.543
<v Graham Cluley>Now we are up to— I really should know this. I think we're up to 5 episodes in total now is what exists. It was found in the collection of a guy who was collecting films, wasn't interested in Doctor Who. He was collecting films about trains and canal boats, and he's sadly deceased. But there was a huge collection of films, and Film is Fabulous, this charity, came in and said, look, we can help catalogue this. And they happened to find these old missing Doctor Who episodes, which are now on BBC iPlayer. I watched them over the weekend. They are wonderful. This is so much better than modern Doctor Who. And it has been an absolute delight. In fact, I had some listeners to the podcast contact me and say, Graham, Graham, when this was announced, Graham, you— and I said, yes, I know, I know. I'm going to wait until they're actually available to watch before I talk about them on the podcast.</v>

268
00:34:08.543 --> 00:34:19.128
<v Dave Bittner>Okay.</v>

269
00:34:19.128 --> 00:34:24.784
<v Graham Cluley>I can tell you're excited, David.</v>

270
00:34:24.784 --> 00:34:30.438
<v Graham Cluley>I am excited.</v>

271
00:34:30.438 --> 00:34:40.523
<v Dave Bittner>I'm happy for you.</v>

272
00:34:40.523 --> 00:34:50.724
<v Graham Cluley>Oh, bless you.</v>

273
00:34:50.724 --> 00:34:59.253
<v Dave Bittner>Have you done any sort of A/B comparison between the reproduction and the original to see how</v>

274
00:34:59.253 --> 00:35:07.784
<v Dave Bittner>close the person actually got?</v>

275
00:35:07.784 --> 00:35:14.114
<v Graham Cluley>To be honest, a lot of the special effects work in his one is far superior to what</v>

276
00:35:14.114 --> 00:35:20.443
<v Graham Cluley>the BBC was doing in 1965.</v>

277
00:35:20.443 --> 00:35:28.085
<v Dave Bittner>Sure, sure.</v>

278
00:35:28.085 --> 00:35:33.726
<v Graham Cluley>I mean, he was tremendous with what he managed to achieve. So I haven't directly compared them. I think that would be a little bit unfair. There is another guy out there who's been recreating all of the Doctor Who episodes using AI, and they are just as horrendous as you can probably imagine.</v>

279
00:35:33.726 --> 00:35:39.367
<v Graham Cluley>Yeah, so you don't really want those. So the real thing is obviously the best of all and what we've really been excited about. So I thought there must be some geeky listeners out there, particularly maybe in Britain and Australia who are really into Doctor Who, who will be very excited about this.</v>

280
00:35:39.367 --> 00:35:44.487
<v Dave Bittner>I'll share one of the reasons that I never got into Doctor Who when it was airing here in the US. It would, it would air on our local PBS stations.</v>

281
00:35:44.487 --> 00:35:49.608
<v Dave Bittner>And this is perhaps the most geeky, nerdy reason in the world for someone to not get into Doctor Who.</v>

282
00:35:49.608 --> 00:35:59.320
<v Graham Cluley>Yeah.</v>

283
00:35:59.320 --> 00:36:06.438
<v Dave Bittner>And that is the frame rate. Oh, Doctor Who's 25 frames per second. Yes. And so they had to do conversions to make it work here because our video runs just, just about 30 frames a second. And we can handle 24 by using a, you know, 2:3 pulldown, all that good stuff.</v>

284
00:36:06.438 --> 00:36:13.554
<v Dave Bittner>But 25 is a little weird. And so it was running at a different speed and it just looked off. So when I was flipping through the channels and I would see, you know, give up, give yourself up, give yourself up, you know, whatever the Daleks said. Uh, it just looked weird to me and I kept on flipping past. Now, I did not flip past Benny Hill, so—</v>

285
00:36:13.554 --> 00:36:19.221
<v Graham Cluley>Oh, Dave, you should have done. Dave, what's your pick of the week?</v>

286
00:36:19.221 --> 00:36:24.887
<v Graham Cluley>And don't say Benny Hill.</v>

287
00:36:24.887 --> 00:36:31.043
<v Dave Bittner>No, it's not Benny Hill. Well, Graham, this is just for you. Oh, this came across my feed, uh, probably about a month ago now. And I thought to myself, oh, perfect. I will save this for the next time I'm on Smashing Security and Graham will enjoy this. Uh, we're talking about chess today. So one of your favorite things.</v>

288
00:36:31.043 --> 00:36:40.835
<v Graham Cluley>I've spoken about Doctor Who. Now we're doing chess. That, that basically is my entire repertoire. You know that.</v>

289
00:36:40.835 --> 00:36:47.297
<v Dave Bittner>So all we need is a briefcase.</v>

290
00:36:47.297 --> 00:36:53.760
<v Dave Bittner>So do you remember back in the '80s and I'd say early '90s, places like Radio Shack had electronic chess sets that you could buy.</v>

291
00:36:53.760 --> 00:37:04.273
<v Graham Cluley>Oh, yes.</v>

292
00:37:04.273 --> 00:37:16.887
<v Dave Bittner>Did you have one?</v>

293
00:37:16.887 --> 00:37:28.603
<v Graham Cluley>Well, uh, yes.</v>

294
00:37:28.603 --> 00:37:34.653
<v Dave Bittner>Of course you did. He asks rhetorically.</v>

295
00:37:34.653 --> 00:37:40.704
<v Dave Bittner>Perhaps a better question is how many did you have?</v>

296
00:37:40.704 --> 00:37:45.735
<v Graham Cluley>I still have one now. But, but, um, but no, I used to go to our department store. This would have been in the early '80s.</v>

297
00:37:45.735 --> 00:37:50.768
<v Graham Cluley>I used to go to the department store and I'd spend an afternoon before I owned one, play in them. Yeah. Because that was my way of having fun as a teenager.</v>

298
00:37:50.768 --> 00:37:56.407
<v Dave Bittner>Right. Young man, young man, are you going to purchase anything?</v>

299
00:37:56.407 --> 00:38:02.045
<v Dave Bittner>We're going to have to ask you to leave.</v>

300
00:38:02.045 --> 00:38:11.188
<v Graham Cluley>But no, there's been a wide variety of chess computers.</v>

301
00:38:11.188 --> 00:38:21.949
<v Dave Bittner>Right.</v>

302
00:38:21.949 --> 00:38:31.871
<v Graham Cluley>I do have an alarming number of both chess boards and a couple of electronic chess sets around the house as well.</v>

303
00:38:31.871 --> 00:38:40.543
<v Dave Bittner>Well, then you surely remember that the most magical ones of all back in that day were the ones that could move the pieces robotically, right?</v>

304
00:38:40.543 --> 00:38:50.003
<v Graham Cluley>Yes.</v>

305
00:38:50.003 --> 00:38:56.498
<v Dave Bittner>I mean, this was magical. And I've included a link to a video of one of those old-school versions. And it's fun to watch partly just because of the mechanical noises.</v>

306
00:38:56.498 --> 00:39:02.996
<v Dave Bittner>It sounds like the old computer in the original Star Trek series, you know, where it's like working. Bang, bang. You know, there's magnets under the board and it's sliding pieces around.</v>

307
00:39:02.996 --> 00:39:08.545
<v Graham Cluley>Yeah, that's how they worked. It would be like a— typically it'd be a magnet under the board, wouldn't it? Be sort of dragging pieces, but it would have to drag other pieces to the side to, for instance, let the knight go through the pawns.</v>

308
00:39:08.545 --> 00:39:14.094
<v Graham Cluley>And you would think this is very clever how they've made this. Yeah. Yeah.</v>

309
00:39:14.094 --> 00:39:22.793
<v Dave Bittner>So there is a YouTube channel that I frequent. It's called Techmoan. And it is probably, I'd label it as being nostalgia gadgetry. So I enjoy watching it for the old boomboxes and Walkmans and CD players and all that sort of the stuff that, that you and I grew up with and lusted after but weren't able to afford in our teen years. This person goes back and looks at that stuff. But in this case, he was looking at an updated version of one of these robotic chess-playing kits. And this one actually uses a robotic arm to play against you, which I think is a little more advanced and more fun than the old magnetic versions.</v>

310
00:39:22.793 --> 00:39:28.376
<v Graham Cluley>This is a bit like one of those car manufacturing assembly lines, isn't it? If you imagine one of those playing checkers on a slightly smaller scale. Yeah.</v>

311
00:39:28.376 --> 00:39:33.960
<v Graham Cluley>So it's picking up the pieces with a magnet, it looks like, and dropping them down again. Yeah.</v>

312
00:39:33.960 --> 00:39:46.172
<v Dave Bittner>I wonder if, like, you try to cheat</v>

313
00:39:46.172 --> 00:39:58.384
<v Dave Bittner>or something, will it grab your wrist?</v>

314
00:39:58.384 --> 00:40:13.012
<v Graham Cluley>Or if you beat it, would that arm just sweep across the table and send all the pieces Smash you to the ground. Yes. Yes.</v>

315
00:40:13.012 --> 00:40:19.202
<v Dave Bittner>Grab you by the throat.</v>

316
00:40:19.202 --> 00:40:25.391
<v Dave Bittner>I was gonna ask you, is it, is it just dispiriting because you spend all this time trying to come up with the perfect move and you put it in and the, the computer just responds and goes, nope.</v>

317
00:40:25.391 --> 00:40:31.684
<v Graham Cluley>Yeah, it is. And that's why you want to handicap the computer. And obviously with chess programs, you can choose different levels or it can even introduce deliberate mistakes.</v>

318
00:40:31.684 --> 00:40:37.978
<v Graham Cluley>So if you went to a site like I don't know, chess.com or lichess.org, and you started playing as a beginner, it would deliberately play bad moves to try and make things easier for you or not the best move to give you a chance, because otherwise it would really be no fun at all. But in the case of this robot, you want to handicap that as well. You'd actually want to tie its hand behind its back or something, wouldn't you?</v>

319
00:40:37.978 --> 00:40:43.675
<v Dave Bittner>That's right. That's right.</v>

320
00:40:43.675 --> 00:40:49.371
<v Dave Bittner>I'm glad you enjoyed this. Like I said, it struck me as being right up your alley.</v>

321
00:40:49.371 --> 00:40:59.322
<v Graham Cluley>It's very cute.</v>

322
00:40:59.322 --> 00:41:04.583
<v Dave Bittner>So the chess computer and and the Techmoan YouTube channel combined are</v>

323
00:41:04.583 --> 00:41:09.842
<v Dave Bittner>my pick of the week.</v>

324
00:41:09.842 --> 00:41:18.516
<v Graham Cluley>And thank you very much, Dave. That just about wraps up the show for this week. I'm sure lots of our listeners would love to find out what you're up to and follow you online. What's the best way to do that?</v>

325
00:41:18.516 --> 00:41:30.275
<v Dave Bittner>Just go to our website, which is thecyberwire.com.</v>

326
00:41:30.275 --> 00:41:40.269
<v Graham Cluley>And of course, Smashing Security is up on social media. You can find it on LastPass, Sophos, LastPass, and BlueSky. And you can find me, Graham Cluley. Yep, you've guessed it, on LinkedIn. And don't forget to ensure that you never miss another episode. Follow Smashing Security in your favorite podcast apps such as Apple Podcasts, Spotify, and Pocket Casts. Episode show notes, sponsorship info, guest lists, and the entire back catalog of over 460 episodes. Check out smashingsecurity.com. Until next time, cheerio, bye-bye.</v>

327
00:41:40.269 --> 00:41:48.710
<v Dave Bittner>Bye-bye.</v>

328
00:41:48.710 --> 00:41:48.889
<v Graham Cluley>You've been listening to Smashing Security with me, Graham Cluley. I'm grateful to what LinkedIn calls the one and only Dave Bittner for joining us. This episode sponsors ESET, Vanta, and Meta, and also to the following Yep, please make some noise for Willy B, who's certainly a very confident nickname, and we respect it enormously. Jonathan Haddock, who sounds like a character in a Victorian novel about a fishmonger with a dark secret. John Morris. Eisenberg. We can't actually be completely certain that Eisenberg is here, because observing them changes everything. William Sabados. Karen Reynolds. Matt Weir. Jamie Forster, Panda Bear, see, not a real name. Yeah, here we are reading it out on a podcast. And Robert Martin. Thank you all so much. You are the backbone of this show. We're very grateful indeed because those are just a few members of Smashing Security Plus, which means that they get their episodes ad-free and earlier than the general public. And they can also have their names be mercilessly mocked at the end of the show. So if that's the kind of thing that you fancy happening to you, all you have to do is sign up for Smashing Security Plus. Just head over to smashingsecurity.com/plus for all of the details and become a patron of the podcast. But you can support us in other ways if you're short of a few bob. And when in fact you can do it completely for free. Like, subscribe, leave a 5-star review. Most importantly of all, tell your friends about Smashing Security. And encourage them to listen to it. In fact, grab their phones and just subscribe to the podcast without the— oh, hang on, I didn't actually recommend that you do that. Maybe ask their permission before you do that. That'd be wise. But regardless, every little bit helps and it really does make all the effort worthwhile. And thank you to you for tuning in, and I hope you tune in to next week's episode as well. Until then, cheerio, bye-bye.</v>