WEBVTT

1
00:00:03.672 --> 00:00:12.897
<v Zoe Rose>We need an LLM that says, here's how to do it. And don't forget to consider these things.</v>

2
00:00:12.897 --> 00:00:22.896
<v Unknown>No, no, we don't need that actually, Zoe. We don't need any help for the criminals in covering up the tracks. Interesting.</v>

3
00:00:22.896 --> 00:00:32.896
<v Unknown>Interesting that you should suggest that. Smashing Security, episode 475. JadePuffer, the AI that ran a ransomware attack all by itself.</v>

4
00:00:32.896 --> 00:00:42.896
<v Unknown>With Graham Cluley and special guest Zoe Rose. Hello, hello, and welcome to Smashing Security episode 475. My name's Graham Cluley.</v>

5
00:00:44.058 --> 00:00:45.246
<v Zoe Rose>And I'm Zoe Rose.</v>

6
00:00:45.246 --> 00:00:50.323
<v Graham Cluley>Hello, Zoe. Welcome back to the show. It's been a while since you've been on. How are you doing?</v>

7
00:00:50.323 --> 00:00:54.740
<v Zoe Rose>Well, usually when I join, something massive has happened.</v>

8
00:00:54.740 --> 00:00:54.996
<v Graham Cluley>Right.</v>

9
00:00:54.996 --> 00:00:58.609
<v Zoe Rose>At the moment, I have not acquired another child or a pet.</v>

10
00:00:58.609 --> 00:01:00.197
<v Graham Cluley>So, well done.</v>

11
00:01:00.197 --> 00:01:01.015
<v Zoe Rose>Yeah.</v>

12
00:01:01.015 --> 00:01:07.397
<v Graham Cluley>So for those who don't know Zoe, what are you? I mean, people who haven't heard of you before, what do you do exactly?</v>

13
00:01:07.397 --> 00:01:15.367
<v Zoe Rose>That's a good question. What do I do? I work in security and pretend I know what I'm talking about half the time.</v>

14
00:01:15.367 --> 00:01:19.120
<v Graham Cluley>Oh, okay. It seems fair enough. And you work for a big company?</v>

15
00:01:19.120 --> 00:01:25.518
<v Zoe Rose>I have a bloody long title now, actually. That's the change. That's what's new. My title has massively increased.</v>

16
00:01:25.518 --> 00:01:27.201
<v Graham Cluley>Okay, give us your title. Let's hear it.</v>

17
00:01:27.201 --> 00:01:36.194
<v Zoe Rose>All right. It is C-Cert, which if you know what that stands for, it has more words, but we'll just stick to some letters. Security Operations Development Manager.</v>

18
00:01:36.194 --> 00:01:36.659
<v Graham Cluley>Wow.</v>

19
00:01:36.659 --> 00:01:37.012
<v Zoe Rose>Yeah.</v>

20
00:01:37.012 --> 00:01:42.911
<v Graham Cluley>Security Operations Development Manager, like SODOM, is basically what you're saying.</v>

21
00:01:42.911 --> 00:01:44.305
<v Unknown>Yeah, sure.</v>

22
00:01:44.305 --> 00:01:51.805
<v Graham Cluley>Interesting. Well, before we kick off, let's thank this week's wonderful sponsors, Arctic Wolf, NordLayer, and Vanta.</v>

23
00:01:51.805 --> 00:01:59.305
<v Graham Cluley>We'll be hearing more about them later on in the podcast. This week on Smashing Security, we're not going to be talking about how a Greek politician investigating spyware had his own mobile phone hacked.</v>

24
00:01:59.305 --> 00:02:06.805
<v Graham Cluley>You'll hear no discussion of how a US Department of Homeland Security information sharing database has been accessed by hackers. And we won't even mention how hackers are using a fake World Cup t-shirt offer to spread malware.</v>

25
00:02:06.805 --> 00:02:14.306
<v Graham Cluley>So Zoe, what are you going to be talking about this week?</v>

26
00:02:27.841 --> 00:02:33.849
<v Zoe Rose>I'm going to talk about Apple's Hide My Email isn't actually as hidden as it sounds like.</v>

27
00:02:33.849 --> 00:02:42.584
<v Graham Cluley>And I'm going to be telling the tale of how a 15-year-old with a chatbot became a cybercriminal and what happens when the AI just does the whole job itself.</v>

28
00:02:42.584 --> 00:02:51.318
<v Graham Cluley>All this and much more coming up on this episode of Smashing Security.</v>

29
00:02:51.318 --> 00:02:55.567
<v Joe>Graham, am I right in thinking that Arctic Wolf are sponsoring the show this week?</v>

30
00:02:55.567 --> 00:03:03.586
<v Graham Cluley>You are right, Joe.</v>

31
00:03:03.586 --> 00:03:11.604
<v Graham Cluley>They've just published a new report, 2026 State of the Cybersecurity Attack Surface, and they analysed over 800,000 real IT assets to find out how exposed organisations actually are.</v>

32
00:03:11.604 --> 00:03:14.651
<v Joe>And I'm guessing everything is hunky-dory.</v>

33
00:03:14.651 --> 00:03:22.449
<v Graham Cluley>No, not so much. The reality is they found 1 in 3 IT assets is missing at least one critical security control.</v>

34
00:03:22.449 --> 00:03:24.873
<v Joe>One in three? That's terrible.</v>

35
00:03:24.873 --> 00:03:34.670
<v Graham Cluley>Isn't it just? 10% of assets have no endpoint security at all. 17% are completely invisible to the tools that are supposed to be monitoring them.</v>

36
00:03:34.670 --> 00:03:37.770
<v Joe>So the tools don't even know those assets exist?</v>

37
00:03:37.770 --> 00:03:43.551
<v Graham Cluley>Right. Ghost assets wandering around your network, unprotected, unmonitored.</v>

38
00:03:43.551 --> 00:03:48.643
<v Joe>Like a retired geography teacher who's somehow still on the school network.</v>

39
00:03:48.643 --> 00:03:53.734
<v Joe>Nobody added him, nobody removed him, and he's been quietly in there for 11 years downloading maps of Paraguay.</v>

40
00:03:53.734 --> 00:04:01.600
<v Graham Cluley>Yeah, yeah, I guess so, Joe. The point is, your attackers will find him before you do because they are specifically looking for the forgotten, the unpatched, the invisible.</v>

41
00:04:01.600 --> 00:04:09.467
<v Graham Cluley>That's the path of least resistance.</v>

42
00:04:09.467 --> 00:04:12.479
<v Joe>So what does the report tell us to actually do about it?</v>

43
00:04:12.479 --> 00:04:18.624
<v Graham Cluley>Arctic Wolf's report covers how to prioritize the exposures that actually matter. Cut through all that noise and verify that when you fix something, it actually stays fixed.</v>

44
00:04:18.624 --> 00:04:24.769
<v Graham Cluley>And the report is free to download.</v>

45
00:04:24.769 --> 00:04:27.307
<v Joe>Free! I like that. Where do I get it?</v>

46
00:04:27.307 --> 00:04:30.524
<v Graham Cluley>SmashingSecurity.com/ArcticWolf.</v>

47
00:04:30.524 --> 00:04:35.807
<v Joe>That's SmashingSecurity.com/ArcticWolf. And thanks to Arctic Wolf for supporting the show.</v>

48
00:04:35.807 --> 00:04:41.088
<v Joe>And please keep an eye on your IT assets and retired geography teachers.</v>

49
00:04:41.088 --> 00:04:48.588
<v Graham Cluley>So, chums, I want to tell you about two stories really this week. On the surface, they don't seem connected. One of them involves a fully automated, sophisticated, AI-driven ransomware attack against a company.</v>

50
00:04:48.588 --> 00:04:56.088
<v Graham Cluley>Nasty stuff. The other involves a 15-year-old lad in Japan who just wanted to cause some chaos on an animation streaming website. These stories appear different, but they're actually telling the same story.</v>

51
00:04:56.088 --> 00:05:03.588
<v Graham Cluley>And that story is something we've been warning about for a while. That the skills needed to commit a cyberattack are in the hands now of practically everybody on the internet. So let's start in Japan.</v>

52
00:05:03.588 --> 00:05:11.088
<v Graham Cluley>Have you ever been to Japan, Zoe?</v>

53
00:05:26.805 --> 00:05:27.610
<v Zoe Rose>I have not.</v>

54
00:05:27.610 --> 00:05:35.677
<v Graham Cluley>Well, it's a fabulous place, I have to say. If you ever get the chance, it's a great place to go and visit. So anyway, I love Japan.</v>

55
00:05:35.677 --> 00:05:43.745
<v Graham Cluley>I love Japanese culture. One of the things which is really big in Japan is anime. Are you into anime at all?</v>

56
00:05:43.745 --> 00:05:51.341
<v Zoe Rose>I think I've seen some, but I'd probably be the worst guest to try and talk about it in any educated way.</v>

57
00:05:51.341 --> 00:05:58.841
<v Graham Cluley>Oh, don't worry. I'm not going to talk about it in an educated way. It's that animation where everyone's got really big eyes.</v>

58
00:05:58.841 --> 00:06:06.341
<v Graham Cluley>It's a big deal, particularly in Japanese culture. And there is a popular anime streaming service called Bandai Channel. And you can think of it as being a bit like Japanese Netflix, but specifically for anime.</v>

59
00:06:06.341 --> 00:06:13.841
<v Graham Cluley>And last November, something really odd happened on this particular streaming service. People found that they were being unsubscribed. Not just a few people, but thousands and thousands of them.</v>

60
00:06:13.841 --> 00:06:21.341
<v Graham Cluley>By the time Bandai Channel noticed and shut down all of its services — what the hell's going on here? We're going to turn everything off — a total of 46,812 accounts had been cancelled in under 4 hours.</v>

61
00:06:40.697 --> 00:06:41.418
<v Zoe Rose>Oh, mate.</v>

62
00:06:41.418 --> 00:06:49.165
<v Graham Cluley>Bandai Channel investigated what it thought might be a leak of its membership database.</v>

63
00:06:49.165 --> 00:06:56.911
<v Graham Cluley>And this week, Japanese police have arrested the person that they believe to be the culprit of this particular attack, a 15-year-old schoolboy.</v>

64
00:06:56.911 --> 00:06:58.180
<v Zoe Rose>Eh, as you would, yeah.</v>

65
00:06:58.180 --> 00:07:04.218
<v Graham Cluley>And according to media reports, he'd been teaching himself about computers since primary school, and he had built the attack</v>

66
00:07:04.218 --> 00:07:10.254
<v Graham Cluley>tool that targeted Bandai Channel using ChatGPT.</v>

67
00:07:10.254 --> 00:07:17.038
<v Zoe Rose>All right, I could see that. I mean, I can't say that open source tooling or any tooling out there hasn't already been used maliciously, just like it is used for research.</v>

68
00:07:17.038 --> 00:07:23.819
<v Zoe Rose>So it stands to reason that this would also be used, honestly.</v>

69
00:07:23.819 --> 00:07:32.029
<v Graham Cluley>But the only thing is, of course, that the AIs are meant to have guardrails to prevent you from writing malicious code.</v>

70
00:07:32.029 --> 00:07:33.300
<v Zoe Rose>Guardrails, oh yeah, okay.</v>

71
00:07:33.300 --> 00:07:41.841
<v Graham Cluley>Oh, I think they've got better, haven't they, over time? They have got better, but what you're saying, I guess, in Zoe Rose's hacking house, maybe you are capable of subverting the security and getting around it with your elite skills.</v>

72
00:07:41.841 --> 00:07:50.384
<v Graham Cluley>Is that what you're saying?</v>

73
00:07:50.384 --> 00:07:58.418
<v Zoe Rose>Mate, you don't have to be that complex. Just keep trying.</v>

74
00:07:58.418 --> 00:08:06.449
<v Zoe Rose>I think that we have to remember that this stuff is built by us, humans, and we are not the most effective people. We make mistakes and it just amplifies our mistakes.</v>

75
00:08:06.449 --> 00:08:13.213
<v Graham Cluley>So, this 15-year-old schoolboy, he just described what he wanted to a chatbot, and the chatbot helped him build a programme that could break into accounts and cancel the subscriptions.</v>

76
00:08:13.213 --> 00:08:19.976
<v Graham Cluley>According to reports, the teenager told police he didn't have a particular grudge against the company.</v>

77
00:08:19.976 --> 00:08:26.740
<v Graham Cluley>He just could do it, and so he did do it.</v>

78
00:08:26.740 --> 00:08:36.278
<v Zoe Rose>I relate to this child. I would have to say, if I was a 15-year-old child doing this, I'd be like, "Mate, it works!" I'd be so excited.</v>

79
00:08:36.278 --> 00:08:42.177
<v Graham Cluley>I think there's probably a lot of listeners as well who can identify that maybe aged 15, they would've done something like that as well. I would like to think, Zoe, that you wouldn't do it now.</v>

80
00:08:42.177 --> 00:08:48.078
<v Graham Cluley>A little bit of adult common sense or decorum.</v>

81
00:08:48.078 --> 00:08:50.005
<v Zoe Rose>Sure, yeah, of course.</v>

82
00:08:50.005 --> 00:08:57.505
<v Graham Cluley>You don't sound convinced. Now, he is not the only teenager in Japan to have harnessed the power of AI to hack in this way. In December last year, a 17-year-old from Osaka was arrested for using ChatGPT to build a tool that hoovered up 7.25 million records from a chain of internet cafes. And apparently his goal was to steal credit card information from members in order to then go and buy Pokémon cards, which, I mean, it sounds like a complete cliché, doesn't it?</v>

83
00:08:57.505 --> 00:09:05.005
<v Graham Cluley>In Japan to do something like this. Before that, in February, three teenagers — a 14-year-old, a 15-year-old, a 16-year-old — were arrested for using ChatGPT to fraudulently generate mobile phone contracts in other people's names. And they sold these stolen Rakuten mobile subscriptions for cryptocurrency and then used the proceeds to gamble online and buy video game consoles. So there's been a fair amount of this.</v>

84
00:09:05.005 --> 00:09:12.505
<v Graham Cluley>Three separate cases in Japan, multiple teenagers, all using AI chatbots as their primary development tool, just like teenagers are probably using AI to write their homework these days as well. Now, I don't want to suggest that these kids are going to a chatbot and just typing in something like "hack the Bandai channel" into ChatGPT. The 15-year-old arrested this week clearly had some existing tech expertise. But what is happening is the gap between being an interested teenager who's got some computer knowledge and a person capable of attacking a platform with 46,000 users and stealing their information — that has noticeably reduced.</v>

85
00:09:12.505 --> 00:09:20.005
<v Graham Cluley>That's one of the big changes AI has caused.</v>

86
00:10:39.850 --> 00:10:48.023
<v Zoe Rose>I would say yes, but they got caught. Operational security, I think, is quite difficult to do.</v>

87
00:10:48.023 --> 00:10:54.149
<v Graham Cluley>Yes. They still didn't cover their tracks properly, but AI impresses me with the speed with which it can code.</v>

88
00:10:54.149 --> 00:11:00.278
<v Graham Cluley>Your boss isn't listening — have you ever done any vibe coding, Zoe?</v>

89
00:11:00.278 --> 00:11:07.778
<v Zoe Rose>You know, I have made use of certain functionality of AI to figure out what it could do.</v>

90
00:11:07.778 --> 00:11:15.278
<v Zoe Rose>It is interesting and I will admit it is helpful, but, and that's the big but, if I know what I need done and I understand the</v>

91
00:11:15.278 --> 00:11:22.778
<v Zoe Rose>foundations, I can make it effective for me. So, if I'm not a skilled person and I'm using it for a skilled resource, it's noticeably lacking a</v>

92
00:11:22.778 --> 00:11:30.278
<v Zoe Rose>lot of things.</v>

93
00:11:30.336 --> 00:11:36.028
<v Graham Cluley>You don't think it's getting better? Can you foresee a time when it becomes more professional, maybe?</v>

94
00:11:36.028 --> 00:11:37.327
<v Zoe Rose>I do see it getting better, yes. But I think the way that our brains seem to function is if we think that this feature can work for us, we start to lose that functionality in ourselves.</v>

95
00:11:37.327 --> 00:11:47.975
<v Graham Cluley>Yes.</v>

96
00:11:47.975 --> 00:11:49.533
<v Zoe Rose>And so we're not—</v>

97
00:11:49.533 --> 00:11:53.034
<v Graham Cluley>Our brain turns to porridge is what you're saying if we use AI too much.</v>

98
00:11:53.034 --> 00:12:00.038
<v Zoe Rose>I used to be able to figure out how to walk to different places alone. Now it's like, where is my map?</v>

99
00:12:00.038 --> 00:12:00.760
<v Graham Cluley>Right.</v>

100
00:12:00.760 --> 00:12:01.548
<v Zoe Rose>So, I think yes, AI is getting better. I don't ever, well, maybe, maybe I'm wrong, but I don't foresee it in the near future to fully replace people because it doesn't have that capability. But the problem is before it gets to the place where it can replace people, do we still have the skills on our side?</v>

101
00:12:01.548 --> 00:12:22.221
<v Graham Cluley>Yes.</v>

102
00:12:22.221 --> 00:12:24.274
<v Zoe Rose>To do the critical thinking.</v>

103
00:12:24.274 --> 00:12:30.673
<v Graham Cluley>Good point.</v>

104
00:12:30.673 --> 00:12:37.071
<v Graham Cluley>Well, what it feels like to me is that something which would have taken years of study for a human and weeks of hard work can now be accomplished in an afternoon with the aid of an AI.</v>

105
00:12:37.071 --> 00:12:41.096
<v Zoe Rose>Well, wouldn't we just call those script kiddies? Wouldn't they still classify as that?</v>

106
00:12:41.096 --> 00:12:46.626
<v Graham Cluley>Well, maybe they would, but if a script kiddie can hack into an organisation and cancel accounts.</v>

107
00:12:46.626 --> 00:12:50.330
<v Zoe Rose>But they used to be able to do these things as well with other tools.</v>

108
00:12:50.330 --> 00:12:58.890
<v Graham Cluley>Yes, but they needed some sort of assistance, didn't they? Whereas now you can know nothing at all. You don't have to have spent any time on the script kiddy forums.</v>

109
00:12:58.890 --> 00:13:02.256
<v Zoe Rose>I suppose, I suppose. Maybe it's just faster.</v>

110
00:13:02.256 --> 00:13:02.658
<v Graham Cluley>Yeah.</v>

111
00:13:02.658 --> 00:13:03.554
<v Zoe Rose>Fair enough.</v>

112
00:13:03.554 --> 00:13:06.937
<v Graham Cluley>It feels to me like that's where things are heading, which brings us to my second story.</v>

113
00:13:06.937 --> 00:13:12.932
<v Zoe Rose>I'm going to flag, I'm going to flag the point that I made earlier is that operational security isn't always there.</v>

114
00:13:12.932 --> 00:13:15.385
<v Graham Cluley>Yes, we can hopefully catch them later.</v>

115
00:13:15.385 --> 00:13:20.865
<v Zoe Rose>We need an LLM that says, here's how to do it. And don't forget to consider these things.</v>

116
00:13:20.865 --> 00:13:28.365
<v Graham Cluley>No, no, we don't need that actually, Zoe. We don't need any help for the criminals in covering up the tracks. Interesting, interesting that you should suggest that.</v>

117
00:13:28.365 --> 00:13:35.865
<v Graham Cluley>This thought that AI can be harnessed by people with little technical knowledge to cause some harm brings me to my second story, which shows, I believe, where things are heading. So security researchers at Sysdig have just published what they're calling the first documented case of fully autonomous AI-driven ransomware. This is not AI-assisted, it's not AI-accelerated or any of those sort of marketing terms.</v>

118
00:13:35.865 --> 00:13:43.365
<v Graham Cluley>There's no human steering the attack at all. This is just an AI agent doing the entire job from start to finish entirely by itself. And they're calling this thing Jade Puffer.</v>

119
00:13:43.365 --> 00:13:50.865
<v Graham Cluley>Because, well, why wouldn't you?</v>

120
00:14:13.817 --> 00:14:15.278
<v Joe>Yeah.</v>

121
00:14:15.278 --> 00:14:18.250
<v Graham Cluley>I don't know why they've called it Jade Puffer, to be honest.</v>

122
00:14:18.250 --> 00:14:20.337
<v Zoe Rose>Because it's an excellent name.</v>

123
00:14:20.337 --> 00:14:24.176
<v Graham Cluley>Well, yes, I know, but why didn't they call it lumpy trousers? Or why didn't they call it—</v>

124
00:14:24.176 --> 00:14:26.360
<v Zoe Rose>Because Jade Puffer is more exciting.</v>

125
00:14:26.360 --> 00:14:34.116
<v Graham Cluley>Oh, okay. Alright. Well, I was thinking maybe someone at Sysdig in their lab was a fan of tropical fish ornaments.</v>

126
00:14:34.116 --> 00:14:41.874
<v Graham Cluley>Maybe it's just a very dull job. Maybe, maybe the name is actually made up by an AI. Maybe.</v>

127
00:14:41.874 --> 00:14:42.538
<v Zoe Rose>Could be.</v>

128
00:14:42.538 --> 00:14:48.210
<v Graham Cluley>There you go. Putting someone out of work again, Zoe.</v>

129
00:14:48.210 --> 00:14:58.434
<v Zoe Rose>Oh, when I have to think of codenames for things, I usually stick to a theme. I'm not going to say what theme because I might embarrass myself, but I stick to a theme.</v>

130
00:14:58.434 --> 00:15:08.659
<v Zoe Rose>So all my codenames are in a theme. So if you figure out certain projects and certain things that needed codenames anywhere I've worked, you probably can guess which ones I created.</v>

131
00:15:08.659 --> 00:15:15.647
<v Graham Cluley>That's one of Zoe's.</v>

132
00:15:15.647 --> 00:15:22.634
<v Graham Cluley>So Jade Puffer is doing the entire job.</v>

133
00:15:22.634 --> 00:15:29.621
<v Graham Cluley>It finds a way in, it steals passwords, it breaks into secondary servers, it encrypts the data, it leaves a ransom note demanding bitcoin, all without a single human having to put a hoodie on in their darkened bedroom.</v>

134
00:15:29.621 --> 00:15:30.054
<v Zoe Rose>Excellent.</v>

135
00:15:30.054 --> 00:15:36.972
<v Graham Cluley>Now, the unnamed victim organisation, they weren't exactly running a tight ship, to be honest. Apparently they had some software with a known security flaw. There'd been a patch out for at least a year.</v>

136
00:15:36.972 --> 00:15:43.890
<v Graham Cluley>They hadn't patched it. And it was internet-facing.</v>

137
00:15:43.890 --> 00:15:46.378
<v Zoe Rose>And so most organisations.</v>

138
00:15:46.378 --> 00:15:47.260
<v Joe>Yeah.</v>

139
00:15:47.260 --> 00:15:54.760
<v Graham Cluley>Yeah. So Jade Puffer was able to get in and it helped itself to passwords, account details, API keys for OpenAI and Anthropic and Google Gemini. 'Cause you know, that's often what they're after now.</v>

140
00:15:54.760 --> 00:16:02.260
<v Graham Cluley>They don't want to use their own AI tokens. They'd rather use someone else's. And they're stealing cloud infrastructure credentials for AWS, and cryptocurrency seed keys to break into wallets.</v>

141
00:16:02.260 --> 00:16:09.760
<v Graham Cluley>And then it moved on to its real target, which was the company's production database. And it tried to create a hidden admin account for itself to access that database, but it failed. It made a technical error.</v>

142
00:16:09.760 --> 00:16:17.260
<v Graham Cluley>And what was eye-opening was that the AI diagnosed the problem as it was trying.</v>

143
00:16:32.635 --> 00:16:33.197
<v Zoe Rose>Oh, cool.</v>

144
00:16:33.197 --> 00:16:42.374
<v Graham Cluley>And fixed— no, not cool, Zoe Rose, not cool at all. You really got to remember what side you're on. And it fixed the problem.</v>

145
00:16:42.374 --> 00:16:51.551
<v Graham Cluley>And it took round about 31 seconds to fix the problem. Now, Sysdig's researchers, they said if a human had read that same error message—</v>

146
00:16:51.551 --> 00:16:53.875
<v Zoe Rose>Lots more searching online.</v>

147
00:16:53.875 --> 00:16:59.567
<v Graham Cluley>Yeah, they would then have had to have Googled it. They'd then have to go and make a cup of tea or something, or whatever it is, you know, scratch their head for a bit. It would have not taken 31 seconds to recode in order to do it properly.</v>

148
00:16:59.567 --> 00:17:06.381
<v Zoe Rose>You know what this makes me think though?</v>

149
00:17:06.381 --> 00:17:13.194
<v Zoe Rose>I should rethink my stance on automated pen tests.</v>

150
00:17:13.194 --> 00:17:20.008
<v Zoe Rose>Oh, maybe there is an AI out there that could be a decent red teamer.</v>

151
00:17:20.008 --> 00:17:26.388
<v Graham Cluley>Yeah, well, there are more and more companies who are beginning to do that, aren't there? Anyway, Jade Puffer sorted itself out.</v>

152
00:17:26.388 --> 00:17:26.906
<v Zoe Rose>Good on it.</v>

153
00:17:26.906 --> 00:17:33.040
<v Graham Cluley>Encrypted all the items in the database, deleted the originals, so the data is now gone. So it's been held hostage.</v>

154
00:17:33.040 --> 00:17:38.040
<v Zoe Rose>Do they know? Question.</v>

155
00:17:38.040 --> 00:17:43.041
<v Zoe Rose>Do they know? If the ransomware actually is done properly and it can actually revert backwards, or is it all gone?</v>

156
00:17:43.041 --> 00:17:49.785
<v Graham Cluley>A very good question.</v>

157
00:17:49.785 --> 00:17:56.528
<v Graham Cluley>And the kind of question which would only be asked by a cynical cybersecurity expert such as yourself, because actually you have put your finger on the whole flaw in this plan.</v>

158
00:17:56.528 --> 00:17:57.234
<v Zoe Rose>Oh mate, did I?</v>

159
00:17:57.234 --> 00:18:11.464
<v Graham Cluley>So although it did encrypt the files and it did generate a unique decryption key, which was going to be the only thing which would ever unlock those files for the victim, it failed to send that key back to the criminals. So it effectively disappeared.</v>

160
00:18:11.464 --> 00:18:25.695
<v Graham Cluley>Even if someone had paid, there was no chance you were ever going to get the decryption key back to get your data back. So there was a flaw in the code.</v>

161
00:18:25.695 --> 00:18:31.386
<v Zoe Rose>Well, we've seen this before though, in legitimate people. Yes.</v>

162
00:18:31.386 --> 00:18:37.077
<v Zoe Rose>Actual cybercriminals. So maybe the AI is at the functional level of sass in people already.</v>

163
00:18:37.077 --> 00:18:44.397
<v Graham Cluley>Maybe it is. But more than that, in the actual ransom note where it listed the bitcoin address, what it used was a generic bitcoin address, which is used in all the bitcoin documentation.</v>

164
00:18:44.397 --> 00:18:51.717
<v Graham Cluley>It's like using example@example.com.</v>

165
00:18:51.717 --> 00:18:58.165
<v Zoe Rose>That's excellent. I love these little failures. It's just yeah, lovely.</v>

166
00:18:58.165 --> 00:19:04.615
<v Zoe Rose>It's like these script kiddies. I know how to do this because it's done it for me, but I don't actually know how to apply it logically.</v>

167
00:19:04.615 --> 00:19:04.951
<v Graham Cluley>Yes.</v>

168
00:19:04.951 --> 00:19:10.561
<v Zoe Rose>And it's a limited capacity of this highly functional, very fast, efficient tooling that's still not there.</v>

169
00:19:10.561 --> 00:19:16.173
<v Zoe Rose>I don't know, it's just really interesting to me.</v>

170
00:19:16.173 --> 00:19:28.073
<v Graham Cluley>And there were other things which were interesting about this ransomware as well, because the security researchers, they knew they were looking at an AI rather than a human attacker. Because the AI couldn't stop itself from offering a running commentary on what it was doing.</v>

171
00:19:28.073 --> 00:19:39.972
<v Graham Cluley>So when they looked at its attack scripts, they were stuffed with comments and explanations of what it was doing. And as we know, no humans are ever gonna document— It's commenting!</v>

172
00:19:39.972 --> 00:19:45.699
<v Zoe Rose>Oh my goodness, it's like a programmer that can't comment their own code. It's bloody commenting. It's like—</v>

173
00:19:45.699 --> 00:19:53.270
<v Graham Cluley>So the AI had left comments in its own code discussing which parts of the database were the best return on investment. I love this.</v>

174
00:19:53.270 --> 00:20:00.843
<v Graham Cluley>So, yeah. Less than ideal for the criminals, really.</v>

175
00:20:00.843 --> 00:20:08.450
<v Zoe Rose>Well, I mean, to be fair though, if they got the money, they got the money. They didn't have to do that much. So, their return on investment ain't that bad, is it?</v>

176
00:20:08.450 --> 00:20:11.980
<v Graham Cluley>Well, but they haven't got the money 'cause they didn't list the right bitcoin address.</v>

177
00:20:11.980 --> 00:20:13.359
<v Zoe Rose>Oh, okay, never mind.</v>

178
00:20:13.359 --> 00:20:18.925
<v Graham Cluley>They listed the example one. So, they bungled, basically.</v>

179
00:20:18.925 --> 00:20:24.491
<v Graham Cluley>They've got an AI accomplice, and it has bungled. Achieved precisely nothing other than damage.</v>

180
00:20:24.491 --> 00:20:32.748
<v Zoe Rose>But maybe it was a test, and maybe they've had it successful since then, innit? 'Cause how many companies actually say when they've been hit by ransomware?</v>

181
00:20:32.748 --> 00:20:40.248
<v Graham Cluley>That's true. It may well have since been developed further, and maybe it is succeeding. So what connects this 15-year-old in Japan who zapped these 46,000 anime accounts and this rogue AI that wiped a company's database and then forgot how to actually extort the money afterwards?</v>

182
00:20:40.248 --> 00:20:47.748
<v Graham Cluley>I think the connection is that AI is making it easier to be a cybercriminal. It is opening up this career opportunity, if you like, to more people. So as people are struggling with the cost of living, as people are finding, oh, crumbs, you know, I can't get a job or whatever, more people might be tempted into cybercrime because AI could well help them.</v>

183
00:20:47.748 --> 00:20:55.248
<v Graham Cluley>JadePuffer, this new ransomware, it's not perfect. It fell over. It failed to handle the encryption properly and extort any money.</v>

184
00:20:55.248 --> 00:21:02.748
<v Graham Cluley>But sooner rather than later, as you've already suggested, I think problems like that are going to be fixed.</v>

185
00:21:30.890 --> 00:21:33.505
<v Joe>This week's episode is supported by NordLayer.</v>

186
00:21:33.505 --> 00:21:38.450
<v Graham Cluley>NordLayer. And before anyone says anything, no, it's not NordVPN.</v>

187
00:21:38.450 --> 00:21:39.678
<v Joe>I wasn't going to say that.</v>

188
00:21:39.678 --> 00:21:46.558
<v Graham Cluley>You were absolutely going to say that, Joe. They are both from Nord Security, but NordLayer is a completely different product.</v>

189
00:21:46.558 --> 00:21:53.440
<v Graham Cluley>NordVPN is for individuals. NordLayer is a network security platform built for businesses.</v>

190
00:21:53.440 --> 00:21:56.316
<v Joe>Right, so what does NordLayer actually do?</v>

191
00:21:56.316 --> 00:22:04.349
<v Graham Cluley>Well, think about how your team works today. People logging in from home, from hotel Wi-Fi, from coffee shops, from wherever.</v>

192
00:22:04.349 --> 00:22:06.196
<v Joe>From a sun lounger, hopefully.</v>

193
00:22:06.196 --> 00:22:12.910
<v Graham Cluley>You'd be lucky. And the moment someone logs into a company network over an unsecured connection, you've got a problem.</v>

194
00:22:12.910 --> 00:22:19.624
<v Graham Cluley>Credentials intercepted, phishing attacks, unauthorised access. It's a scary world out there for travelling workers.</v>

195
00:22:19.624 --> 00:22:21.148
<v Joe>So NordLayer fixes that.</v>

196
00:22:21.148 --> 00:22:28.719
<v Graham Cluley>It gives you encrypted connectivity for your whole team from anywhere, up to 1 gigabyte per second with zero additional hardware required.</v>

197
00:22:28.719 --> 00:22:36.288
<v Graham Cluley>But it goes well beyond just encrypting the connection.</v>

198
00:22:36.288 --> 00:22:43.858
<v Graham Cluley>You get centralised control over who can access what based on their identity, their device, whether their device is actually compliant, and if someone leaves the company, you revoke their access immediately.</v>

199
00:22:43.858 --> 00:22:53.858
<v Joe>No more ex-employees</v>

200
00:22:43.858 --> 00:22:52.882
<v Graham Cluley>No more of that. And it will block malicious sites, risky downloads, dangerous domains, and it can even detect shadow apps.</v>

201
00:22:52.882 --> 00:23:01.904
<v Graham Cluley>So if someone on your team has started using some AI tool that your security team hasn't approved—</v>

202
00:22:53.858 --> 00:23:03.858
<v Joe>still wandering around</v>

203
00:23:01.904 --> 00:23:02.913
<v Joe>I'd never do that.</v>

204
00:23:02.913 --> 00:23:11.828
<v Graham Cluley>Yeah, well, whatever. NordLayer can spot that too. And there's no complex infrastructure to set up. Apparently you can be up and running in just about 10 minutes.</v>

205
00:23:03.858 --> 00:23:13.858
<v Joe>your systems 6 months later.</v>

206
00:23:11.828 --> 00:23:41.828
<v Joe>10 minutes.</v>

207
00:23:11.828 --> 00:23:21.383
<v Graham Cluley>10 minutes. Plans start from just $8 per user per month. And right now there is a summer sale.</v>

208
00:23:21.383 --> 00:23:30.938
<v Graham Cluley>New customers get up to 20% off annual plans until the end of August 2026. Use the code NLsummer26 at checkout.</v>

209
00:23:30.938 --> 00:23:37.507
<v Joe>Whoa, all I have to do is type in that code at nordlayer.com/smashing and I can get a great deal? Let me write that down.</v>

210
00:23:37.507 --> 00:23:38.881
<v Graham Cluley>Yep, go ahead, write it down.</v>

211
00:23:38.881 --> 00:23:40.190
<v Joe>What's the code again? I forgot.</v>

212
00:23:40.190 --> 00:23:43.343
<v Graham Cluley>Oh, Joe. NLsummer26.</v>

213
00:23:43.343 --> 00:23:47.919
<v Joe>Got it. Off to nordlayer.com/smashingigo.</v>

214
00:23:47.919 --> 00:23:54.583
<v Graham Cluley>And thanks to NordLayer for supporting the show. Zoe, what's your story for us this week?</v>

215
00:23:54.583 --> 00:24:07.222
<v Zoe Rose>I was talking about Apple's Hide My Email. So if you don't know what that is, it's if you have an iCloud account, you can select the feature that says Hide My Email.</v>

216
00:24:07.222 --> 00:24:19.862
<v Zoe Rose>It generates a random email address that you can enter instead of your main email. Theoretically, the point is privacy, to keep from the association with this, whatever you're signing up for, with your true identity.</v>

217
00:24:19.862 --> 00:24:26.059
<v Graham Cluley>Yeah. And presumably it means that you will know where someone got your email address from. So if you create—</v>

218
00:24:26.059 --> 00:24:27.585
<v Zoe Rose>It's like watermarking it. Yeah.</v>

219
00:24:27.585 --> 00:24:32.867
<v Graham Cluley>Yeah. And you could obviously shut it down if it's then abused by spammers or scammers in some way.</v>

220
00:24:32.867 --> 00:24:40.946
<v Zoe Rose>Yeah. I use it for the use case that you just said, so I can have it for a temporary amount of time. Remove it, and then I'm good.</v>

221
00:24:40.946 --> 00:24:49.027
<v Zoe Rose>It's very useful for that. I don't use it for a highly sensitive sort of, maybe I don't want somebody to associate this action with my identity. I don't use it in that use case.</v>

222
00:24:49.027 --> 00:24:57.105
<v Zoe Rose>But being as what it was marketed as, I could imagine a lot of people do.</v>

223
00:24:57.105 --> 00:24:57.363
<v Graham Cluley>Right.</v>

224
00:24:57.363 --> 00:25:00.217
<v Zoe Rose>Right. So that's more the concern for me.</v>

225
00:25:00.217 --> 00:25:03.986
<v Graham Cluley>So what's happened with it? What's happened with this Hide My Email feature?</v>

226
00:25:03.986 --> 00:25:13.875
<v Zoe Rose>There is a vulnerability, quote unquote, that you can associate your generated email address with the original legitimate mailbox.</v>

227
00:25:13.875 --> 00:25:14.580
<v Graham Cluley>Right.</v>

228
00:25:14.580 --> 00:25:21.772
<v Zoe Rose>Yeah.</v>

229
00:25:21.772 --> 00:25:28.963
<v Zoe Rose>So theoretically, if I go to a naughty site and I want to sign up for an account and I don't want you to see it's me, I could use this generated account and then this site will email this generated account, which would then come to my main legitimate email.</v>

230
00:25:28.963 --> 00:25:29.204
<v Graham Cluley>Yes.</v>

231
00:25:29.204 --> 00:25:36.826
<v Zoe Rose>And then if I don't want it anymore, I can delete the account on the website or disable it within my settings. Very useful. Theoretically, it's going to be very helpful for a lot of people.</v>

232
00:25:36.826 --> 00:25:44.449
<v Zoe Rose>From my perspective, I would still make the assumption that that's traceable without knowing that it was. Yeah. I didn't know it was.</v>

233
00:25:44.449 --> 00:25:52.070
<v Zoe Rose>I always assumed it would be because, you know, it's technology and technology is—</v>

234
00:25:52.070 --> 00:25:52.471
<v Graham Cluley>Flawed.</v>

235
00:25:52.471 --> 00:25:53.211
<v Zoe Rose>Rubbish.</v>

236
00:25:53.211 --> 00:25:53.451
<v Joe>Yes.</v>

237
00:25:53.451 --> 00:25:55.315
<v Zoe Rose>Yeah, that's a nice way of saying it.</v>

238
00:25:55.315 --> 00:25:56.728
<v Graham Cluley>A dumpster fire. Yes.</v>

239
00:25:56.728 --> 00:26:05.560
<v Zoe Rose>Yeah, perfect. And I used to work in OSINT, so open source intelligence.</v>

240
00:26:05.560 --> 00:26:14.393
<v Zoe Rose>My job used to be aggregating data and connecting the dots and making very overly-sized webs of details. You know that picture where it's like the guy and he's got the pictures and all the red strings together?</v>

241
00:26:14.393 --> 00:26:17.364
<v Graham Cluley>Oh, the red string, yes, like a conspiracy board, yes.</v>

242
00:26:17.364 --> 00:26:24.643
<v Zoe Rose>Mate, that was me, and that's exactly what I did.</v>

243
00:26:24.643 --> 00:26:31.922
<v Zoe Rose>And I still look it, but LLMs, further to what you were talking about, they just make that easier as well because you can aggregate data quite quickly with a lot of tooling.</v>

244
00:26:31.922 --> 00:26:39.201
<v Zoe Rose>I imagine they're using LLMs as well to aggregate more data, because it's not that difficult to tag and connect the dots.</v>

245
00:26:39.201 --> 00:26:39.586
<v Joe>Right.</v>

246
00:26:39.586 --> 00:26:49.586
<v Zoe Rose>Right? These vulnerabilities probably make it much easier. I mean, I imagine it is.</v>

247
00:26:49.586 --> 00:26:59.586
<v Zoe Rose>And so, I would always take the assumed compromise approach. So, I would always assume that they're connectable. But as a non-technical person, I could 100% see how they would not think that this is connectable.</v>

248
00:26:59.586 --> 00:27:09.586
<v Zoe Rose>And if you're doing it because you're hiding some kink, okay, embarrassing, not the end of the world. But for some users, they're trying to get help for dangerous situations. Maybe they're a survivor of domestic abuse and violence.</v>

249
00:27:13.638 --> 00:27:14.218
<v Graham Cluley>Yes, yes.</v>

250
00:27:14.218 --> 00:27:22.670
<v Zoe Rose>So this could be quite risky for them if their abuser is able to connect the dots, if their stalker is able to identify them.</v>

251
00:27:22.670 --> 00:27:31.121
<v Zoe Rose>And so I agree with the Smashing Security researchers' publication of the fact that it is vulnerable and it is not protecting you in the way that it's supposed to be, or it claims to be.</v>

252
00:27:31.121 --> 00:27:39.573
<v Zoe Rose>The disappointing thing is apparently it was June last year that the vulnerability was disclosed to them.</v>

253
00:27:39.573 --> 00:27:42.555
<v Graham Cluley>Oh, to Apple. So Apple's known about this for a year.</v>

254
00:27:42.555 --> 00:27:51.130
<v Zoe Rose>According to the article, it was a year, and in May the update was it was going to be resolved shortly, and we're in July and there's no resolution yet.</v>

255
00:27:51.130 --> 00:27:51.611
<v Graham Cluley>Ah.</v>

256
00:27:51.611 --> 00:27:59.483
<v Zoe Rose>So that's why, from what I've read, that's why they wanted to publish it, because they're concerned for the safety of people that are making use of this.</v>

257
00:27:59.483 --> 00:28:07.025
<v Graham Cluley>So that feels quite noble to me that the researchers withhold technical details of exactly how to exploit this to prevent that sort of exploitation event, people obviously finding themselves in a</v>

258
00:28:07.025 --> 00:28:14.567
<v Graham Cluley>pickle, but Apple should have done something by now, surely.</v>

259
00:28:14.567 --> 00:28:23.786
<v Zoe Rose>Well, and it's disappointing because Apple always likes to market themselves as privacy-focused, right? And if you're going to market yourself that way, bloody do it.</v>

260
00:28:23.786 --> 00:28:25.550
<v Graham Cluley>Yeah, walk the walk. Yeah.</v>

261
00:28:25.550 --> 00:28:33.050
<v Zoe Rose>And there are priorities. So the one thing I always get frustrated with, they're marketing their autonomous cars, is they're not actually autonomous, or they can't achieve what they want, or they don't even have the capability that they're marketing. And that's dangerous for people's safety.</v>

262
00:28:33.050 --> 00:28:40.550
<v Zoe Rose>This is also dangerous. Maybe it's not as physically visible how dangerous it can be, but I work and volunteer with organisations that support survivors of domestic abuse and violence. I've also been through a very similar situation myself.</v>

263
00:28:40.550 --> 00:28:48.050
<v Zoe Rose>It's scary being in that environment. And when the technology you're relying on to protect you, and in some people's case it is protecting their life, and you're not doing it to the best of your ability, that's, that's really, really disappointing. So I'm hoping it resolves it, but I think the main takeaway here is you cannot rely 100% on technology.</v>

264
00:28:48.050 --> 00:28:55.550
<v Zoe Rose>You just can't.</v>

265
00:29:17.960 --> 00:29:25.709
<v Graham Cluley>So I've got a question, Zoe. Is a broken privacy feature worse than no privacy feature?</v>

266
00:29:25.709 --> 00:29:33.458
<v Graham Cluley>Because of the false confidence it creates, because people would have used this thinking they were being private, thinking they were doing the right thing.</v>

267
00:29:33.458 --> 00:29:40.958
<v Zoe Rose>And in many cases they probably were fine. Right. In many cases it's probably fine.</v>

268
00:29:40.958 --> 00:29:48.458
<v Zoe Rose>It's the cases that it's not fine and assuming that it is, that you're protected, where it can go drastically wrong. I think knowing that it is broken allows you to consciously choose what use cases is it going to fit for, right? Not knowing means that you're unconsciously putting yourself at risk, and that's what I'm not okay with.</v>

269
00:29:48.458 --> 00:29:55.958
<v Zoe Rose>I still make use of the functionality for the case that I've already said. If I want to have a temporary mailbox, it's a great resource. It's still connectable, yes, but it's a great resource.</v>

270
00:29:55.958 --> 00:30:03.458
<v Zoe Rose>I can just remove it.</v>

271
00:30:17.336 --> 00:30:25.614
<v Graham Cluley>And I also know there are some other third-party services which offer sort of masked emails and things like Fastmail. I think ProtonMail offers this as well.</v>

272
00:30:25.614 --> 00:30:39.798
<v Zoe Rose>They do, yep, and they're useful if you 100% want to keep them separate. At the end of the day, you have to be separate, but as our lovely 15-year-old found out, OPSEC is very difficult.</v>

273
00:30:39.798 --> 00:30:53.981
<v Zoe Rose>Right? And so, if you want to keep them separate for your own safety or for specific reasons, maybe you have a much, much more intense threat map than I do, and you've got nation state after you, then there's a lot more to consider.</v>

274
00:30:53.981 --> 00:31:00.336
<v Graham Cluley>But I guess for now, all eyes are on Apple and how they're going to respond to this, albeit 13 months later.</v>

275
00:31:00.336 --> 00:31:07.501
<v Zoe Rose>Well, and it goes back to responsibility because they're marketing it as hide my email address and they know there's a vulnerability. So, who's accountable there if something happens?</v>

276
00:31:07.501 --> 00:31:14.665
<v Zoe Rose>How do we force organisations to care? And I think at the end of the day, we're European, right?</v>

277
00:31:14.665 --> 00:31:21.830
<v Zoe Rose>Well, European, not EU for you, but—</v>

278
00:31:21.830 --> 00:31:23.404
<v Graham Cluley>Thanks for reminding me.</v>

279
00:31:23.404 --> 00:31:30.904
<v Zoe Rose>Just in case you forgot.</v>

280
00:31:30.904 --> 00:31:38.404
<v Zoe Rose>To be fair, I'm not either.</v>

281
00:31:38.404 --> 00:31:45.904
<v Zoe Rose>But at the end of the day, we have more protections than somebody in North America because of the regulations and putting the accountability back on the vendor.</v>

282
00:31:45.904 --> 00:31:53.404
<v Zoe Rose>So, as these things happen and as technology changes, as much as I hate regulation and compliance for the sake of compliance, I do hope it makes a difference and puts more accountability back on the organisations to respond in an appropriate timeframe and not market falsely.</v>

283
00:31:59.460 --> 00:32:07.299
<v Graham Cluley>Well, we've got time now to talk about one of today's sponsors, Vanta. Joe, what keeps you up at 2 o'clock in the morning?</v>

284
00:32:07.299 --> 00:32:09.105
<v Joe>The dog next door, mostly.</v>

285
00:32:09.105 --> 00:32:13.221
<v Graham Cluley>Oh, right, well, yeah, but I'm talking professionally, what keeps you up?</v>

286
00:32:13.221 --> 00:32:21.339
<v Joe>Oh, whether we've got the right security controls in place, whether our vendors are secure, how to escape the nightmare of outdated tools and endless manual processes.</v>

287
00:32:21.339 --> 00:32:26.210
<v Graham Cluley>Exactly, which is where today's sponsor comes in. It's Vanta.</v>

288
00:32:26.210 --> 00:32:29.840
<v Joe>Fanta, the fizzy orange drink. How can this possibly be true?</v>

289
00:32:29.840 --> 00:32:39.196
<v Graham Cluley>No, no, Joe, it's Vanta with a V. It's a trust management platform.</v>

290
00:32:39.196 --> 00:32:48.554
<v Graham Cluley>It's not a drink full of sugar. It automates all of that tedious manual compliance work so you can stop drowning in spreadsheets, chasing audit evidence, and filling out questionnaire after questionnaire.</v>

291
00:32:48.554 --> 00:32:50.442
<v Joe>Lush, I hate questionnaires.</v>

292
00:32:50.442 --> 00:32:57.674
<v Graham Cluley>Well, who doesn't? Vanta continuously monitors your systems.</v>

293
00:32:57.674 --> 00:33:04.907
<v Graham Cluley>It centralises your security data. It keeps your program audit ready all of the time.</v>

294
00:33:04.907 --> 00:33:12.141
<v Graham Cluley>It also uses AI to streamline evidence collection and flag risks. It automates compliance for SOC 2, ISO 27001, HIPAA, GDPR, and more.</v>

295
00:33:12.141 --> 00:33:16.290
<v Joe>So basically it handles the boring stuff so we can focus on the interesting stuff.</v>

296
00:33:16.290 --> 00:33:25.756
<v Graham Cluley>Exactly. Precisely that. And for a limited time, new customers can get $1,000 off.</v>

297
00:33:25.756 --> 00:33:35.221
<v Graham Cluley>$1,000? Yep, $1,000. Head to vanta.com/smashing, that's V-A-N-T-A dot com slash smashing, and get started today.</v>

298
00:33:35.221 --> 00:33:44.523
<v Joe>And maybe get a decent night's sleep for once. Oh, and unlike fizzy drinks, Fanta isn't bad for you. That was a fruit twist.</v>

299
00:33:44.523 --> 00:33:48.272
<v Graham Cluley>And welcome back, and you join us at our favourite part of the show, the part of the show that we like to call Pick of the Week.</v>

300
00:33:48.272 --> 00:34:18.273
<v Joe>Pick of the Week.</v>

301
00:33:48.272 --> 00:34:18.273
<v Zoe Rose>Pick of the Week.</v>

302
00:33:48.272 --> 00:33:58.272
<v Graham Cluley>Pick of the Week is the part of the show where everyone chooses something they like. Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish.</v>

303
00:33:58.272 --> 00:34:08.273
<v Graham Cluley>Doesn't have to be security related necessarily. Now, my pick of the week this week is related to a news story which I saw on July 1st.</v>

304
00:34:08.273 --> 00:34:18.273
<v Graham Cluley>TV stations in America, they broke their 24-hour rolling news to report on what was going on at the Empire State Building in New York.</v>

305
00:34:24.289 --> 00:34:29.510
<v Zoe Rose>We are following breaking news out of New York City where at least two people have climbed to the very top of the Empire State Building. You can see them there.</v>

306
00:34:29.510 --> 00:34:34.728
<v Zoe Rose>They're on the antenna with a flag.</v>

307
00:34:34.728 --> 00:34:41.858
<v Graham Cluley>That is 1,554 feet above the ground.</v>

308
00:34:41.858 --> 00:34:48.987
<v Graham Cluley>They appear to be protesters and have unfurled a banner that says, "When the power of love beats the love of power, the world knows peace." NBC New York is covering all of it.</v>

309
00:34:48.987 --> 00:34:50.574
<v Zoe Rose>We're going to take a listen right now.</v>

310
00:34:50.574 --> 00:34:52.661
<v Graham Cluley>Did you see this at all, Zoe?</v>

311
00:34:52.661 --> 00:34:54.041
<v Zoe Rose>I did not.</v>

312
00:34:54.041 --> 00:35:01.541
<v Graham Cluley>Well, they had helicopter crews circling around one of the world's most famous buildings because a man and a woman had climbed right to the very, very top. They unfurled a banner saying, "When the power of love beats the love of power, the world knows peace," which is, you know, a very groovy thing to say. They got down from the very top onto a platform and the man got down on one knee and nervously proposed to the woman who had climbed up there with him.</v>

313
00:35:01.541 --> 00:35:09.041
<v Graham Cluley>And, you know, it was all in some ways charming, in other ways just like, what the bloody hell are they doing? Is this what everyone's going to be doing now to propose to each other? This is insanity.</v>

314
00:35:09.041 --> 00:35:16.541
<v Graham Cluley>And they were arrested, of course. Their names are Angela Nikolau and Ivan Birkus. They are two Russian, what are called, rooftoppers, who climb buildings.</v>

315
00:35:16.541 --> 00:35:24.041
<v Graham Cluley>You know, they don't have all the safety gear. They just go up in their trainers, it seems.</v>

316
00:35:54.585 --> 00:35:56.847
<v Zoe Rose>What is it called, like free climbing or something?</v>

317
00:35:56.847 --> 00:36:02.418
<v Graham Cluley>It's that kind of thing. They break into buildings. They're not doing this with permission. They evade security teams.</v>

318
00:36:02.418 --> 00:36:04.135
<v Zoe Rose>May I guess that? Yeah.</v>

319
00:36:04.135 --> 00:36:12.425
<v Graham Cluley>Anyway, this interested me in this case, and I found out that they were the subject of a Netflix documentary a couple of years ago called Skywalkers: A Love Story. And it is that documentary which is my pick of the week.</v>

320
00:36:12.425 --> 00:36:20.715
<v Graham Cluley>And I'll tell you something about myself, Zoe. I am terrified of heights, right?</v>

321
00:36:20.715 --> 00:36:29.005
<v Graham Cluley>I can't stand on a stool, let alone climb up a ladder.</v>

322
00:36:29.005 --> 00:36:33.994
<v Zoe Rose>Mate, I am 155 centimetres, and that is as tall as I need to be.</v>

323
00:36:33.994 --> 00:36:41.494
<v Graham Cluley>Right, right. So you and me both, right? Yeah. I have in the past got up into the loft in my house and I've then been stuck there for 45 minutes thinking, how am I going to get— and that's when there's a ladder attached to the loft. You know, it's like, how am I going to get down?</v>

324
00:36:41.494 --> 00:36:48.994
<v Graham Cluley>But aside from being terrified of heights, I am weirdly drawn to them. I am always thinking, oh, I want to test my fear of heights. See, is this quite as scary. Will I want to throw myself off the— that's my worry, is my brain will sort of short circuit and throw myself off just impulsively. Anyway, I cannot tell you how stomach-churning this documentary was to me because I'm watching these two people climb buildings without permission.</v>

325
00:36:48.994 --> 00:36:56.494
<v Graham Cluley>And they sort of fell in love doing it, which is charming, but sometimes they're having a bit of a row on the way, which has all been recorded on their GoPros. And the woman at one point was having a real panic attack, which is understandable. I would be having a panic attack. I would feel paralysed as well. And the guy is saying, "Come on, you can do it," and all the rest of it.</v>

326
00:36:56.494 --> 00:37:03.994
<v Graham Cluley>And she's like, "No, no, really, I can't." And then she wants to, she wants to prove that she can. I'm not saying that what these guys do is advisable or admirable. I think there's—</v>

327
00:37:54.333 --> 00:37:57.481
<v Zoe Rose>We should flag that there have been people that have died from doing that sort of thing.</v>

328
00:37:57.481 --> 00:38:05.454
<v Graham Cluley>Oh, and some of their friends had died as a result of this. So that is covered in the documentary. So, I mean, it is absolutely appalling.</v>

329
00:38:05.454 --> 00:38:13.425
<v Graham Cluley>I also think it's questionable why Netflix, you know, why is this documentary being made? Is there then a compulsion for people to carry on doing these things?</v>

330
00:38:13.425 --> 00:38:13.987
<v Zoe Rose>Yeah.</v>

331
00:38:13.987 --> 00:38:17.932
<v Graham Cluley>Rather than working in a sandwich bar or something like that. It's, it's—</v>

332
00:38:17.932 --> 00:38:23.947
<v Zoe Rose>I feel like that's not the two alternatives, climbing a ginormous building or making sandwiches.</v>

333
00:38:23.947 --> 00:38:25.759
<v Graham Cluley>This woman, by the way, this woman.</v>

334
00:38:25.759 --> 00:38:26.175
<v Zoe Rose>Yeah.</v>

335
00:38:26.175 --> 00:38:33.675
<v Graham Cluley>She climbs these buildings, she's on Instagram, right?</v>

336
00:38:33.675 --> 00:38:41.175
<v Graham Cluley>And so she's got hundreds of thousands of followers.</v>

337
00:38:41.175 --> 00:38:48.675
<v Graham Cluley>So what she does is she takes an outfit with her, she's got her heels, and she's doing all these sort of glamorous shots of herself doing acrobatics on the top of buildings, you know, which, I mean, they are amazing photographs, but surely if there was one reason why AI was invented was to stop people climbing up buildings and putting their lives at risk to pose on top of a skyscraper.</v>

338
00:38:48.675 --> 00:38:56.175
<v Graham Cluley>Anyway, is this my pick of the week, or is this my nitpick of the week?</v>

339
00:38:59.746 --> 00:39:09.367
<v Zoe Rose>I have to say, you're criticising Netflix for— Yes! Providing this resource, and also recommending it.</v>

340
00:39:09.367 --> 00:39:15.576
<v Graham Cluley>Well, I'm bringing it to light. So this could be a nitpick of the week, rather than a pick of the week.</v>

341
00:39:15.576 --> 00:39:21.784
<v Graham Cluley>I'm not sure which it is, but anyway, I found it compelling, and—</v>

342
00:39:21.784 --> 00:39:27.501
<v Zoe Rose>I would like you to watch it again with the goggles. What do they call that? Like virtual reality?</v>

343
00:39:27.501 --> 00:39:27.965
<v Graham Cluley>Oh my God.</v>

344
00:39:27.965 --> 00:39:30.552
<v Zoe Rose>What? So that you're single point of view of her?</v>

345
00:39:30.552 --> 00:39:32.719
<v Graham Cluley>I'm not wearing virtual reality goggles.</v>

346
00:39:32.719 --> 00:39:34.164
<v Zoe Rose>I would love that.</v>

347
00:39:34.164 --> 00:39:41.889
<v Graham Cluley>Are you insane? I would never do such a thing. Anyway, Skywalker's A Love Story.</v>

348
00:39:41.889 --> 00:39:49.614
<v Graham Cluley>Is it my pick of the week? Is it a nitpick of the week? I'm not sure, but that is what I'm talking about on Smashing Security today.</v>

349
00:39:49.614 --> 00:39:50.661
<v Zoe Rose>Excellent.</v>

350
00:39:50.661 --> 00:39:51.710
<v Joe>Phew.</v>

351
00:39:51.710 --> 00:39:54.980
<v Graham Cluley>Okay, Zoe, what's your pick of the week?</v>

352
00:39:54.980 --> 00:40:04.445
<v Zoe Rose>My pick of the week is, I am a single mother of two children and a cat. I'm pretty sure my cat is Satan, but, so I'm very busy.</v>

353
00:40:04.445 --> 00:40:06.539
<v Graham Cluley>So you're the mother of Satan?</v>

354
00:40:06.539 --> 00:40:07.409
<v Zoe Rose>Basically.</v>

355
00:40:07.409 --> 00:40:08.615
<v Graham Cluley>Right, lovely.</v>

356
00:40:08.615 --> 00:40:16.706
<v Zoe Rose>Anyway, pick of the week is, I have no time, and so I've discovered, and by discovered I mean heavily forced to stop not considering by</v>

357
00:40:16.706 --> 00:40:24.797
<v Zoe Rose>multiple people throughout many years, to purchase a Thermomix.</v>

358
00:40:24.797 --> 00:40:30.889
<v Graham Cluley>Oh, now I know what one of those is. Why don't you describe it for our listeners, what a Thermomix is?</v>

359
00:40:30.889 --> 00:40:40.476
<v Zoe Rose>A very, very expensive kitchen tool. But I will say, if you don't like clutter, I was able to remove an insane amount of kitchen tooling.</v>

360
00:40:40.476 --> 00:40:50.061
<v Zoe Rose>And donate it because I've got this Thermomix replaced. But basically it weighs, it measures, it mixes and cooks and all of those fancy things.</v>

361
00:40:50.061 --> 00:40:59.646
<v Zoe Rose>I've made ice cream and lemonade and every dinner, and it does my shopping.</v>

362
00:40:59.646 --> 00:41:06.039
<v Graham Cluley>It's not just cold food, it can do hot food. I have lived in a house with a Thermomix before.</v>

363
00:41:06.039 --> 00:41:06.813
<v Zoe Rose>Oh, wow.</v>

364
00:41:06.813 --> 00:41:12.335
<v Graham Cluley>So I do know— the embarrassing truth is that I only ever made boiled rice in it.</v>

365
00:41:12.335 --> 00:41:17.858
<v Graham Cluley>But I know that you can do extraordinary things.</v>

366
00:41:17.858 --> 00:41:18.472
<v Zoe Rose>So I've got all the recipes.</v>

367
00:41:18.472 --> 00:41:26.418
<v Graham Cluley>They're very expensive. I mean, as a boiled rice machine, I thought this was overpriced, I have to say. Oh no, I did pasta as well. I did pasta as well. But you know, it is—</v>

368
00:41:26.418 --> 00:41:31.266
<v Zoe Rose>You are so bland right now. I did pasta.</v>

369
00:41:31.266 --> 00:41:33.628
<v Graham Cluley>They are expensive devices.</v>

370
00:41:33.628 --> 00:41:41.210
<v Zoe Rose>Okay. They are expensive. And you have to have a subscription to the app for recipes. You don't have to, but I do.</v>

371
00:41:41.210 --> 00:41:42.284
<v Graham Cluley>No, come on.</v>

372
00:41:42.284 --> 00:41:50.586
<v Zoe Rose>Super beneficial though, because I go through the app, I choose the recipes, put in a shopping list. It makes shopping super bloody easy because then I just put it in the thing that delivers. Because I'm not going to the shop with two children and a bloody cat. So it's really useful and it allows me to cook things that are actually really good, to the point where, because I'm not a very good cook, let's be honest. You want me to investigate an incident?</v>

373
00:41:50.586 --> 00:41:58.889
<v Zoe Rose>Right on. You want me to cook pizza from scratch? Questionable. But in this case, it works.</v>

374
00:41:58.889 --> 00:42:18.144
<v Graham Cluley>And it can boil rice very reliably in my experience.</v>

375
00:42:18.144 --> 00:42:27.855
<v Zoe Rose>It even makes cake. I made cheesecake the other day. That's so clever. And muffins, because it has a thingy that goes on top and you can steam them.</v>

376
00:42:27.855 --> 00:42:29.057
<v Joe>Right. Yeah.</v>

377
00:42:29.057 --> 00:42:37.679
<v Graham Cluley>Very clever. Very cool pick of the week. Take out a mortgage though to buy one. Well, that just about wraps up the show for this week.</v>

378
00:42:37.679 --> 00:42:46.300
<v Graham Cluley>Zoe, thank you so much for joining us as a guest. I'm sure lots of listeners would love to find out what you're up to and follow you online. What's the best way to do that?</v>

379
00:42:46.300 --> 00:42:56.300
<v Zoe Rose>Well, I am not massively active online because I'm getting old. And also going back to the mum comment, they could go to my website, rosesec.com, if they really want.</v>

380
00:42:56.300 --> 00:43:06.300
<v Zoe Rose>But I think I'd also like to flag that if they're somebody that related to the story I said earlier about high threat profiles, I would suggest they go and look at organisations like Operation</v>

381
00:43:06.300 --> 00:43:16.300
<v Zoe Rose>Safe Escape or any organisations that specifically tailor their support to domestic abuse and violence survivors, because they will understand those threat maps a lot better than I can summarise.</v>

382
00:43:22.505 --> 00:43:36.045
<v Graham Cluley>Fantastic stuff. Well, we really appreciate you being on the show. And listeners, you can find me, Graham Cluley, on LinkedIn or follow Smashing Security on Bluesky and Reddit and Mastodon.</v>

383
00:43:36.045 --> 00:43:49.586
<v Graham Cluley>And don't forget to ensure you never miss another episode. Follow Smashing Security in your favorite podcast apps such as Apple Podcasts, Spotify, and Pocket Casts for episode show notes, sponsorship info, guest lists, and the entire back catalog of 475 episodes. Check out smashingsecurity.com.</v>

384
00:43:49.586 --> 00:44:03.128
<v Graham Cluley>Until next time. Cheerio, bye-bye. Cheers.</v>

385
00:44:03.128 --> 00:44:16.668
<v Graham Cluley>You've been listening to Smashing Security with me, Graham Cluley. Thanks ever so much to Zoe Rose for joining us this week and to this episode's sponsors, Arctic Wolf, NordLayer, and Vanta. Make sure to check out their special offers because they're supporting the show.</v>

386
00:44:16.668 --> 00:44:30.208
<v Graham Cluley>And talking of people supporting the show, thanks to the following fine fellows, all signed up members of Smashing Security Plus. Let's pick out some of them from the hat right now. We've got first up, Darryl Green and Dave Barker.</v>

387
00:44:30.208 --> 00:44:43.750
<v Graham Cluley>Both of them sound very dependable. I'd trust them to look after my plants while I'm on holiday. Big yay to Richard Anand, Christoph Goossens and Travis West.</v>

388
00:44:43.750 --> 00:44:57.291
<v Graham Cluley>Travis West. Sounds like a Wild West character riding into town, sorting out your endpoint security, then riding off again without a word. And not also to Heisenberg.</v>

389
00:44:57.291 --> 00:45:10.831
<v Graham Cluley>We know who you are, but we can't be certain where you are. And that's fine. Big thanks to Darren Kenny and to the magnificent Trogdork, a name that sounds like the final boss you'd have to beat in a game of Zelda, but probably turns out to be really good at patching vulnerabilities.</v>

390
00:45:10.831 --> 00:45:24.373
<v Graham Cluley>Oh, and finally, Daniel Kromeck and Billy, just Billy, one name Billy, no further questions. He's happy with that. Those are just a few members of Smashing Security Plus, which means that they get their episodes completely ad-free, earlier than the general public as well, they get them.</v>

391
00:45:24.373 --> 00:45:37.913
<v Graham Cluley>And they can have their names pulled out at random to be mercilessly mocked at the end of the show. Who could want for more? If you fancy a little bit of that, join Smashing Security Plus.</v>

392
00:45:37.913 --> 00:45:51.454
<v Graham Cluley>Just head over to our little club at smashingsecurity.com/plus for all of the details. But you don't have to become a member of that. You could support the show in ways which don't cost a penny by liking, subscribing, leaving a 5-star review wherever you listen.</v>

393
00:45:51.454 --> 00:46:04.994
<v Graham Cluley>That will warm my cockles. And of course, tell your friends about the show. Spreading the word really does help.</v>

394
00:46:04.994 --> 00:46:18.536
<v Graham Cluley>And, well, until next time, cheerio, bye-bye.</v>