WEBVTT

1
00:00:03.228 --> 00:00:13.227
<v Dave Bittner>I have to say, what this reminds me of is there was a glitch on Amazon for</v>

2
00:00:13.227 --> 00:00:23.228
<v Dave Bittner>a while. I don't know if it's still there, where if you went to buy condoms, it</v>

3
00:00:23.228 --> 00:00:33.228
<v Dave Bittner>would ask you, would you like to buy this item used?</v>

4
00:00:46.390 --> 00:00:55.450
<v Graham Cluley>Dave, always lovely to have you back on the show. Star of The Cyber Wire, Hacking Humans, that other one I've forgotten the name of.</v>

5
00:00:55.450 --> 00:01:05.087
<v Dave Bittner>Caveat.</v>

6
00:01:05.087 --> 00:01:13.533
<v Graham Cluley>Caveat, thank you.</v>

7
00:01:10.064 --> 00:01:17.564
<v Graham Cluley>Smashing Security.</v>

8
00:01:13.533 --> 00:01:21.240
<v Dave Bittner>It's all good, Graham.</v>

9
00:01:17.564 --> 00:01:25.064
<v Graham Cluley>Smashing Security, episode 486, Vibe-Coded Shops and Hackable Flock Cameras, with Graham Cluley and special guest Dave Bittner.</v>

10
00:01:21.240 --> 00:01:31.240
<v Graham Cluley>The good news is, Dave, actually, is I'm going to be recommending that all of our listeners go and check out your podcasts, particularly next week, because there isn't</v>

11
00:01:25.064 --> 00:01:32.564
<v Graham Cluley>Hello, hello, and welcome to Smashing Security, episode 486.</v>

12
00:01:31.240 --> 00:01:41.240
<v Graham Cluley>going to be an episode of Smashing Security next week. I am grabbing a map, a compass, and a rucksack full of cheese sandwiches, and I am going to</v>

13
00:01:32.564 --> 00:01:40.064
<v Graham Cluley>My name's Graham Cluley.</v>

14
00:01:41.240 --> 00:01:51.240
<v Graham Cluley>be venturing into the wilds of Britain because I'm moving house. I'm going to a different part of the UK.</v>

15
00:01:44.320 --> 00:01:54.320
<v Dave Bittner>Just put a</v>

16
00:01:54.320 --> 00:02:04.320
<v Dave Bittner>Y cable in</v>

17
00:02:03.805 --> 00:02:09.246
<v Dave Bittner>I'm talking about a bunch of researchers who are asking the</v>

18
00:02:04.320 --> 00:02:14.320
<v Dave Bittner>there. What could go wrong?</v>

19
00:02:09.246 --> 00:02:14.687
<v Dave Bittner>question, what the flock?</v>

20
00:02:14.687 --> 00:02:20.365
<v Graham Cluley>And I'm gonna be going online to buy a laser-equipped kiwi.</v>

21
00:02:20.365 --> 00:02:26.042
<v Graham Cluley>All this and much more coming up on this episode of Smashing Security.</v>

22
00:02:26.042 --> 00:02:31.566
<v Graham Cluley>This episode of Smashing Security is sponsored by Vanta.</v>

23
00:02:31.566 --> 00:02:41.566
<v Graham Cluley>It's 2:00 AM.</v>

24
00:02:41.566 --> 00:02:51.566
<v Graham Cluley>Somewhere, a security</v>

25
00:02:51.566 --> 00:03:01.566
<v Graham Cluley>team is drowning.</v>

26
00:02:52.765 --> 00:02:58.116
<v Graham Cluley>The spreadsheets. There are so many spreadsheets. Vendor risk assessments unread. Audit evidence scattered like ash in the wind.</v>

27
00:02:57.486 --> 00:03:27.486
<v Dave Bittner>And I'm Dave Bittner.</v>

28
00:02:58.116 --> 00:03:03.466
<v Graham Cluley>I've filled out the same questionnaire 4 times this week, Graham. 4 times! Some men choose to face this alone, but not tonight.</v>

29
00:03:03.466 --> 00:03:21.521
<v Joe>Okay, Graham, this is a bit much.</v>

30
00:03:21.521 --> 00:03:34.106
<v Graham Cluley>Yeah, fair point. Anyway, Vanta—</v>

31
00:03:34.106 --> 00:03:46.581
<v Joe>Thank God.</v>

32
00:03:46.581 --> 00:03:53.204
<v Graham Cluley>Vanta's a trust management platform that automates the mind-numbing stuff that makes you want to poke your eyes out with a fork. No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit ready for SOC 2, ISO 27001, HIPAA, GDPR, the works. And it uses AI. Yes, Joe, it does.</v>

33
00:03:53.204 --> 00:04:00.817
<v Joe>To flag risks and streamline evidence collection so your whole security program stays in shape, not just</v>

34
00:04:00.817 --> 00:04:08.429
<v Joe>the week before an audit.</v>

35
00:04:08.429 --> 00:04:22.149
<v Graham Cluley>No more 2:00 AM dread. No more spreadsheet purgatory. Just peace.</v>

36
00:04:22.149 --> 00:04:27.853
<v Joe>And $1,000 off if you demo</v>

37
00:04:27.853 --> 00:04:33.559
<v Joe>it right now.</v>

38
00:04:33.559 --> 00:04:50.252
<v Graham Cluley>$1,000?</v>

39
00:04:50.252 --> 00:04:57.875
<v Joe>vanta.com/smashing. Go now before it's too late.</v>

40
00:04:57.875 --> 00:05:05.973
<v Graham Cluley>That's vanta.com/smashing.</v>

41
00:05:05.973 --> 00:05:13.829
<v Joe>And thanks to Vanta for supporting the show.</v>

42
00:05:13.829 --> 00:05:19.567
<v Graham Cluley>Now, chums, there are important questions to be asked of this week's guest, Mr. Dave Bittner.</v>

43
00:05:19.567 --> 00:05:25.305
<v Graham Cluley>I won't beat around the bush, Dave. How do you feel about crusty socks?</v>

44
00:05:25.305 --> 00:05:35.648
<v Dave Bittner>How do I feel about crusty socks?</v>

45
00:05:35.648 --> 00:05:46.343
<v Graham Cluley>Yes, how do you feel about them?</v>

46
00:05:46.343 --> 00:05:55.163
<v Dave Bittner>I try to avoid them whenever possible.</v>

47
00:05:47.064 --> 00:06:17.064
<v Dave Bittner>Wow.</v>

48
00:05:55.163 --> 00:06:05.163
<v Graham Cluley>You're not growing</v>

49
00:06:05.163 --> 00:06:15.163
<v Graham Cluley>any in Chez</v>

50
00:06:15.163 --> 00:06:25.163
<v Graham Cluley>Bittner right now?</v>

51
00:06:16.079 --> 00:06:23.055
<v Graham Cluley>I imagine they are pretty fresh and clean, those beautiful feet of yours these days. I'm asking because this week, somewhere in Auckland, New Zealand, there is a convenience store that briefly was selling a pair of crusty socks on its website. And that wasn't all they were selling. They were also selling a rather divine Princess Diana commemorative plate.</v>

52
00:06:23.055 --> 00:06:33.322
<v Unknown>Oh no.</v>

53
00:06:33.322 --> 00:06:43.322
<v Graham Cluley>And if you were quick, you could also have</v>

54
00:06:43.322 --> 00:06:53.322
<v Graham Cluley>bought all of New Zealand's national parks.</v>

55
00:06:50.165 --> 00:06:55.220
<v Graham Cluley>Now, this wasn't some marketing stunt. This wasn't a flea market with any old bric-a-brac and odds and sods and national parks and the like. Instead, this particular store had made a bit of an error when it built its website. It had used something called Base44, and Base44 is a vibe coding platform owned by Wix, one of those places where they sort of roll your own website.</v>

56
00:06:53.322 --> 00:07:03.322
<v Graham Cluley>They were being sold to the highest bidder as well.</v>

57
00:06:55.220 --> 00:07:00.273
<v Graham Cluley>You can go to it and out the other end of the mixer will come a brand new website. Dave, have you ever vibe coded at all? It's very popular these days.</v>

58
00:07:00.273 --> 00:07:09.177
<v Dave Bittner>The closest I have come to vibe coding was I asked ChatGPT to create a version of Pong in BASIC for the TRS-80 Color Computer.</v>

59
00:07:09.177 --> 00:07:18.675
<v Graham Cluley>And did it work?</v>

60
00:07:18.675 --> 00:07:26.841
<v Dave Bittner>Yeah. I mean, it was slow, but it worked.</v>

61
00:07:26.841 --> 00:07:36.305
<v Graham Cluley>I rather approve of that. What do you think of the idea of vibe coding generally?</v>

62
00:07:36.305 --> 00:07:44.803
<v Dave Bittner>I think at this point it's unavoidable. I think it's out of the box and there's no putting it back in there. But the people I know who are professional developers, many of them say that their job has shifted from actually being a developer to being a supervisor of the AI that's actually doing the coding. I suppose as long as there's oversight, then it's okay, but I think everybody's a little nervous about this.</v>

63
00:07:44.564 --> 00:07:54.564
<v Graham Cluley>And I won't have a chance to put out an episode next week.</v>

64
00:07:44.803 --> 00:07:50.680
<v Graham Cluley>I think if you've spent years and years studying how to code and now you've been replaced by a glorified speak-and-spell machine, you are going to be pretty upset about this. I have vibe coded myself sometimes.</v>

65
00:07:50.680 --> 00:07:56.557
<v Graham Cluley>You know how Liam Neeson in that movie says he has a very particular set of skills?</v>

66
00:07:54.564 --> 00:08:04.564
<v Graham Cluley>What I will be doing is I'll be really busy contacting the CEO of Openreach and asking why it's so</v>

67
00:07:56.557 --> 00:08:02.523
<v Dave Bittner>Yes. Yes.</v>

68
00:08:02.523 --> 00:08:09.512
<v Graham Cluley>Well, I have a very particular set of requirements on my computer sometimes. You just, oh, if only my computer would do this in this particular way. And in the past, I would spend hours looking for a utility which did that particular thing. And I do find myself now sometimes thinking, hmm, rather than spending four months coding this myself, maybe I could ask an AI to help me. And bloomin' heck, I mean, they can do it. I wouldn't necessarily want to roll it out to the public. I wouldn't necessarily want to give it to other people and let them find the vulnerabilities in it.</v>

69
00:08:04.564 --> 00:08:14.564
<v Graham Cluley>hard to get me a fibre internet connection to my house when there's a box just 5 feet away from me.</v>

70
00:08:09.512 --> 00:08:21.838
<v Dave Bittner>You're okay being your own guinea pig.</v>

71
00:08:21.838 --> 00:08:29.173
<v Graham Cluley>Yes. You know, think, okay, I could run this on my computer.</v>

72
00:08:29.173 --> 00:08:36.505
<v Graham Cluley>But here's the problem. Somewhere in the process of vibe coding their own e-commerce site, these chaps who were running this store, they somehow left the entire thing open to be edited by anybody on the entire internet.</v>

73
00:08:33.605 --> 00:08:41.105
<v Graham Cluley>Yeah, exactly. What could possibly go wrong? But never fear, folks.</v>

74
00:08:36.505 --> 00:08:46.585
<v Dave Bittner>Oh my.</v>

75
00:08:41.105 --> 00:08:48.605
<v Graham Cluley>If you can hold your breath until Thursday, the 8th of October, there'll be a new episode of Smashing Security then. And in the meantime, check out Caveat and Hacking Humans and The Cyber Wire and all the other — well, thank you. Well, before we kick off, let's thank this week's wonderful sponsors, ThreatLocker, Origin, and Vanta.</v>

76
00:08:46.585 --> 00:08:54.533
<v Graham Cluley>No password required.</v>

77
00:08:48.605 --> 00:08:56.105
<v Graham Cluley>We'll be hearing more about them later on in the podcast. This week on Smashing Security, we won't be talking about how researchers managed to take over the accounts of staff at OpenAI using Anthropic's Claude. You'll hear no discussion of how Dutch police have asked for the public's help after releasing a recording of what they believe to be the voice of a member of the Shiny Hunters hacking group.</v>

78
00:08:54.533 --> 00:08:59.793
<v Dave Bittner>Wow.</v>

79
00:08:56.105 --> 00:09:03.605
<v Graham Cluley>And we won't even mention how North Korea has been posing as recruiters to infect job seekers during fake coding tests and then waiting for them to get hired somewhere real. So Dave, what are you going to be talking about this week?</v>

80
00:08:59.793 --> 00:09:05.054
<v Dave Bittner>How do you miss that?</v>

81
00:09:05.054 --> 00:09:12.119
<v Graham Cluley>Yeah. Exactly. And you also think, well, how did Base44 ever allow that to be possible? So even if it wasn't a vulnerability in Base44, I suspect it was actually the setting up of the particular environment where there was an error. Why did they, considering this was something which was meant to be used by non-professionals, people who weren't versed in computer security and technology — maybe, you know, I need a website. I run a shop selling shoelaces. I know nothing about computers. Can you create me a website? Yes, I'll go and do that. How can they leave it open like that?</v>

82
00:09:12.119 --> 00:09:17.120
<v Dave Bittner>It seems like a top-tier requirement of building</v>

83
00:09:17.120 --> 00:09:22.120
<v Dave Bittner>something like this.</v>

84
00:09:22.120 --> 00:09:31.701
<v Graham Cluley>You would think so.</v>

85
00:09:31.701 --> 00:09:41.392
<v Dave Bittner>Don't let the general public make changes.</v>

86
00:09:41.392 --> 00:09:47.240
<v Graham Cluley>And of course, inevitably, random members of the public did discover that they could just go to the website and make any changes they wanted.</v>

87
00:09:47.240 --> 00:09:53.086
<v Graham Cluley>They could add their own listings to the live site.</v>

88
00:09:53.086 --> 00:10:04.254
<v Dave Bittner>And they did not disappoint.</v>

89
00:10:04.254 --> 00:10:10.384
<v Graham Cluley>Of course, the internet never disappoints when given an opportunity like that. So you too could buy a pair of crusty old socks, or you could purchase a single banana for $850, or a mouldy school lunch. You too could find yourself paying off New Zealand's Deputy Prime Minister for $3,000.</v>

90
00:10:08.524 --> 00:10:38.524
<v Dave Bittner>Graham!</v>

91
00:10:10.384 --> 00:10:16.515
<v Graham Cluley>All kinds of things. There was even this Princess Diana commemorative dinner plate for $1.50. Now, I've shared with you—</v>

92
00:10:16.515 --> 00:10:25.582
<v Dave Bittner>Yes.</v>

93
00:10:25.582 --> 00:10:31.245
<v Graham Cluley>An image, Dave, of this plate.</v>

94
00:10:31.245 --> 00:10:36.905
<v Graham Cluley>I think it's Princess Diana.</v>

95
00:10:36.905 --> 00:10:43.330
<v Dave Bittner>Graham, never before has the beauty of the dear departed princess been on better display than it is on this, this clearly handmade and painted plate. I would be honoured and proud to display this anywhere in my home, and I hope our listeners will take the time to check it out. It's just gorgeous.</v>

96
00:10:43.330 --> 00:10:50.638
<v Graham Cluley>It's a beautiful thing. And there it is alongside the Laser Kiwi, which obviously is something every person in New Zealand needs. Dave, if you had the opportunity to list something on a site like this, what sort of thing do you imagine you would want to list? What wonders would you put up on this online emporium?</v>

97
00:10:50.638 --> 00:10:59.472
<v Dave Bittner>Oh my goodness, I don't know. But I have to say what this reminds me of is — there was a glitch on Amazon for a while. I don't know if it's still there, where if you went to buy—</v>

98
00:10:59.472 --> 00:11:06.111
<v Graham Cluley>Was this the buy route?</v>

99
00:11:05.043 --> 00:11:15.043
<v Dave Bittner>No, no, no. But when I was a</v>

100
00:11:06.111 --> 00:11:16.111
<v Dave Bittner>No, no. If you went to buy condoms,</v>

101
00:11:15.043 --> 00:11:25.043
<v Dave Bittner>teenager, I think I had issues with crusty</v>

102
00:11:16.111 --> 00:11:26.111
<v Dave Bittner>it would ask you, would you like to</v>

103
00:11:24.690 --> 00:11:34.198
<v Dave Bittner>Tickles me.</v>

104
00:11:25.043 --> 00:11:35.043
<v Dave Bittner>socks, but it's been a while.</v>

105
00:11:26.111 --> 00:11:36.111
<v Dave Bittner>buy this item used?</v>

106
00:11:34.198 --> 00:11:41.650
<v Graham Cluley>Some people would.</v>

107
00:11:41.650 --> 00:11:50.034
<v Dave Bittner>Tickles me to this day. So yeah, it's not just a small little convenience store that these sort of things can happen to. Happens to the largest commerce platform in the world, right?</v>

108
00:11:50.034 --> 00:11:59.937
<v Graham Cluley>So at some point, the actual store owner tweaked what was going on and he tried to fight back, but he didn't know how to secure the site. So instead what he did was he started posting other items for sale with titles like, please stop hacking us. And within minutes, someone else added a new listing saying, well, don't use an AI site builder then, which seems like fair enough security advice coming for free from the general public.</v>

109
00:11:59.937 --> 00:12:08.429
<v Dave Bittner>Mm-hmm.</v>

110
00:12:08.429 --> 00:12:14.125
<v Graham Cluley>Now, this, as I said, may not have been explicitly the fault of Base44. Maybe the security settings hadn't been set properly. But, you know, it's not as though this were the first time that Base44 has made the headlines. Last year, security researchers at Wiz found an authentication bypass vulnerability in the platform. That allowed unauthorised access to private apps built by its users.</v>

111
00:12:14.125 --> 00:12:19.822
<v Graham Cluley>What that meant was if you could see the URL, which of course you could in your browser, of a particular app, you would then be able to create a verified account to access it as the owner yourself. So the supposedly secret app ID was there for anybody to see in the URL. So security, not necessarily their strong point. Wow.</v>

112
00:12:19.822 --> 00:12:30.477
<v Dave Bittner>How is Base44 still in business, one has to ask?</v>

113
00:12:30.477 --> 00:12:36.798
<v Graham Cluley>And how much did Wix pay in order to acquire Base44? I hope they think this was money well spent.</v>

114
00:12:36.798 --> 00:12:43.120
<v Graham Cluley>Or maybe they bought them and then got rid of all the security engineers. I don't know.</v>

115
00:12:43.120 --> 00:12:53.717
<v Dave Bittner>Yeah.</v>

116
00:12:49.572 --> 00:13:19.572
<v Dave Bittner>Wow.</v>

117
00:12:53.717 --> 00:13:03.717
<v Graham Cluley>So Dave, there's going to be a lot of small businesses wanting their websites to be built or refreshed.</v>

118
00:13:03.717 --> 00:13:13.717
<v Graham Cluley>It's like, oh, we can't really carry on with this Dreamweaver site we created in 1999 anymore, we're going to have to do a bit of a</v>

119
00:13:11.697 --> 00:13:21.697
<v Graham Cluley>You know what?</v>

120
00:13:13.717 --> 00:13:23.717
<v Graham Cluley>revamp of that. And so you've got to think a lot of people will turn to simple tools that promise a lot, but that the users don't really understand.</v>

121
00:13:21.697 --> 00:13:31.697
<v Graham Cluley>There are probably people who</v>

122
00:13:27.542 --> 00:13:28.071
<v Dave Bittner>No.</v>

123
00:13:28.071 --> 00:13:29.433
<v Graham Cluley>And that's going to be a problem.</v>

124
00:13:29.433 --> 00:13:35.769
<v Dave Bittner>Just crowdsource everything on your website, right? Open it up to the entire internet. What could go wrong?</v>

125
00:13:31.697 --> 00:13:41.697
<v Graham Cluley>pay more for that.</v>

126
00:13:35.769 --> 00:13:43.269
<v Graham Cluley>Because these tools, they're explicitly marketed at people who have no idea, not a clue what an access control setting is.</v>

127
00:13:43.269 --> 00:13:50.769
<v Graham Cluley>And the AI might happily build you a gorgeous looking website, but it won't necessarily tell you if you've left all the doors and windows wide open.</v>

128
00:13:50.769 --> 00:13:58.269
<v Graham Cluley>So I raise a glass right now to the people of New Zealand who, with good humour, have— I mean, technically, I suppose what they did was maybe that was against the law.</v>

129
00:13:58.269 --> 00:14:05.769
<v Graham Cluley>I don't know whether it was or not.</v>

130
00:14:06.640 --> 00:14:07.057
<v Dave Bittner>Hmm.</v>

131
00:14:07.057 --> 00:14:14.110
<v Graham Cluley>If it's been left open like that. But it appears not to have been done for malicious reasons, but everyone had a good old laugh about it, which is good fun.</v>

132
00:14:14.110 --> 00:14:22.269
<v Dave Bittner>I suppose the flip side is that this convenience store operator is seeing more traffic to their website than probably ever before.</v>

133
00:14:22.269 --> 00:14:29.769
<v Graham Cluley>It's interesting, isn't it? Because sometimes there can be marketing stunts like this to get you some traffic.</v>

134
00:14:29.769 --> 00:14:37.269
<v Graham Cluley>I tried going to this particular website — right now it's down. You get a Cloudflare error.</v>

135
00:14:37.269 --> 00:14:44.769
<v Graham Cluley>I don't know if it's because too many people have gone there or they thought, we don't know how to stop this, we're just going to yank out some cables — they've turned it off. But there have been cases in the past where companies — I can think of one dating site for beautiful people, for instance, where they intentionally pretended that they had been hacked in order to get lots of press coverage.</v>

136
00:14:44.769 --> 00:14:52.269
<v Graham Cluley>A very unusual story. I'll link to it in the show notes if anyone's interested in that.</v>

137
00:15:00.261 --> 00:15:03.611
<v Graham Cluley>This episode of Smashing Security is supported by Origin.</v>

138
00:15:03.611 --> 00:15:11.322
<v Graham Cluley>Joe, did you see that big story about AI agents running around inside OpenAI and Hugging Face's own environment?</v>

139
00:15:11.322 --> 00:15:15.076
<v Joe>The ones dividing up work between themselves and reviewing each other's output?</v>

140
00:15:15.076 --> 00:15:20.811
<v Graham Cluley>That's the one.</v>

141
00:15:20.811 --> 00:15:26.544
<v Graham Cluley>One of the things that really struck me was how the people who actually built those AI models had a hard time reconstructing exactly what the agents had done and said to each other.</v>

142
00:15:26.544 --> 00:15:35.222
<v Joe>Right, and that's really the point. Even the experts closest to the technology struggled to answer a simple question: what did our AI actually do?</v>

143
00:15:35.222 --> 00:15:40.352
<v Graham Cluley>Which is exactly the question this week's sponsor, Origin, wants you thinking about.</v>

144
00:15:40.352 --> 00:15:45.484
<v Graham Cluley>If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?</v>

145
00:15:45.484 --> 00:15:52.177
<v Joe>For most teams, the honest answer is not much.</v>

146
00:15:52.177 --> 00:15:58.869
<v Joe>You've got the prompt and you've got the final result, but everything in between — the commands it ran, the files it changed, the credentials it picked up along the way — that's usually gone the moment the terminal closes.</v>

147
00:15:58.869 --> 00:16:07.852
<v Graham Cluley>And that's the gap our sponsor, Origin, was built to close. Origin is an endpoint AI observability company.</v>

148
00:16:07.852 --> 00:16:16.836
<v Graham Cluley>A sensor on the machine records the agent's work as it happens. Who started the session, what was asked, what the agent reached, and what it changed, all on one timeline.</v>

149
00:16:16.836 --> 00:16:25.168
<v Joe>So if something unexpected happens, you're not piecing it together from scattered logs. You open the trace and read the session in order from the original prompt through to the outcome.</v>

150
00:16:25.168 --> 00:16:31.698
<v Graham Cluley>It works wherever agents actually operate too. Coding agents in a terminal, local agents, anything calling an MCP server on a laptop.</v>

151
00:16:31.698 --> 00:16:38.229
<v Graham Cluley>None of that needs to pass through a cloud gateway for Origin to see it.</v>

152
00:16:38.229 --> 00:16:44.799
<v Joe>So if you want to see what a trace actually looks like, head to originhq.com/smashing.</v>

153
00:16:44.799 --> 00:16:54.259
<v Graham Cluley>That's originhq.com/smashing. And thanks to Origin for sponsoring the podcast.</v>

154
00:16:54.259 --> 00:17:00.655
<v Dave Bittner>Well, Graham, do you have Flock Safety cameras over on your side of the pond yet?</v>

155
00:17:00.655 --> 00:17:08.746
<v Graham Cluley>Flock surveillance cameras? Yes, we do. Britain is supposed to be the country with more CCTV cameras than practically anywhere else.</v>

156
00:17:08.746 --> 00:17:16.836
<v Graham Cluley>I think we've only got more than North Korea. But these Flock ones, they're making lots of headlines over in the States, aren't they? They seem to be quite invasive.</v>

157
00:17:16.836 --> 00:17:23.948
<v Dave Bittner>They are. And we're doing our best to catch up with you all.</v>

158
00:17:23.948 --> 00:17:31.058
<v Dave Bittner>These Flock Safety cameras are popping up like dandelions all over the place. In fact, there are open-source projects to track their locations.</v>

159
00:17:31.058 --> 00:17:38.171
<v Dave Bittner>People have put together Google Maps where you can look at your community and see where the Flock Safety cameras are around you.</v>

160
00:17:38.171 --> 00:17:38.652
<v Graham Cluley>Right.</v>

161
00:17:38.652 --> 00:17:46.152
<v Dave Bittner>There are several around where I live, and they're easy to spot. They have a particular look to them, and I find it disturbing as they're popping up all over the place. These are licence plate reading cameras.</v>

162
00:17:46.152 --> 00:17:53.652
<v Dave Bittner>So the idea is you drive by with your car, it takes a picture of your car, it logs your licence plate, it logs the type of car, what direction you were going, the time of day, all that sort of thing. And of course, you get enough of these little bits of data, and you can put together a picture of where someone's going and when they're going and what they may be up to. So hackers have gotten their hands on one of these cameras.</v>

163
00:17:53.652 --> 00:18:01.152
<v Dave Bittner>And by getting their hands on one, I think they backed a truck into it and ran off with it. I think that's sort of the subtext of what's going on here. But there are hundreds of thousands of them all over our great nation, so I don't think they'll miss the one.</v>

164
00:18:01.152 --> 00:18:08.652
<v Dave Bittner>But they got a good look inside the cameras, and from a security point of view, it's not good. There's a hacker collective called Stegonogram.</v>

165
00:18:42.449 --> 00:18:43.667
<v Unknown>Okay.</v>

166
00:18:43.667 --> 00:18:49.666
<v Dave Bittner>Of course, there's a jaunty zero in the middle of the word Stegonogram instead of an O, because hackers.</v>

167
00:18:49.666 --> 00:18:50.548
<v Graham Cluley>Yes.</v>

168
00:18:50.548 --> 00:19:01.978
<v Dave Bittner>So they got their hands on this Flock camera. They took it apart, and they extracted its storage.</v>

169
00:19:01.978 --> 00:19:13.407
<v Dave Bittner>And the group Distributed Denial of Secrets has published images of those file systems, which has enabled lots of researchers to take a look under the hood at what exactly is going on here. So security researcher Mika Lee, who you've interviewed before, haven't you, Graham?</v>

170
00:19:13.407 --> 00:19:13.807
<v Graham Cluley>I mean, have you?</v>

171
00:19:13.807 --> 00:19:15.330
<v Dave Bittner>Mika's been a guest on Smashing.</v>

172
00:19:15.330 --> 00:19:19.319
<v Graham Cluley>I don't think — no, Mika hasn't been on Smashing Security, but I certainly know their work.</v>

173
00:19:19.319 --> 00:19:29.319
<v Dave Bittner>Yeah. So well-known researcher, well-respected.</v>

174
00:19:19.319 --> 00:19:49.319
<v Unknown>Yeah.</v>

175
00:19:29.319 --> 00:19:39.319
<v Dave Bittner>He took a look and published a blog post about this. He found that this camera was running a modified version of Android 8.1, which is an OS that was released in 2017 and no longer supported by Google.</v>

176
00:19:39.319 --> 00:19:49.319
<v Dave Bittner>Its patching was dated to June of 2018, and its underlying Linux kernel was also, in his words, ancient. So in other words, this camera was watching modern traffic with software security that was from the 2010s.</v>

177
00:19:52.903 --> 00:20:01.578
<v Dave Bittner>Lee identified several publicly known vulnerabilities that are applicable to components of the device. He saw flaws that could allow malicious software already running on the camera to gain deeper control.</v>

178
00:20:01.578 --> 00:20:10.253
<v Dave Bittner>But then, sort of the chef's kiss of all this, are the credentials.</v>

179
00:20:10.253 --> 00:20:10.719
<v Graham Cluley>Right.</v>

180
00:20:10.719 --> 00:20:30.640
<v Dave Bittner>He found an API key hardcoded into a software library that's shared by 19 Flock applications that run on the camera. So based on his analysis, that key is used during the process by which the cameras obtain their credentials for accessing Flock's backend infrastructure. So the—</v>

181
00:20:30.640 --> 00:20:40.018
<v Graham Cluley>Is it possible the person who created these cameras then got a job at Base44 creating a website building tool?</v>

182
00:20:40.018 --> 00:20:40.883
<v Dave Bittner>Yes, yes.</v>

183
00:20:40.883 --> 00:20:41.220
<v Graham Cluley>Right.</v>

184
00:20:41.220 --> 00:20:50.758
<v Dave Bittner>Because they had excellent credentials. And the people looked at their past work and said, well, this looks good to us. Yeah.</v>

185
00:20:50.758 --> 00:20:52.280
<v Graham Cluley>Good enough.</v>

186
00:20:52.280 --> 00:20:56.144
<v Dave Bittner>The device also stored authentication credentials in plaintext—</v>

187
00:20:56.144 --> 00:20:56.673
<v Graham Cluley>Of course.</v>

188
00:20:56.673 --> 00:21:06.673
<v Dave Bittner>On an unencrypted partition. Now I will say, as you and I are recording this, this API key has been making the rounds on social media.</v>

189
00:21:06.673 --> 00:21:16.673
<v Dave Bittner>It is everywhere. If you want to look for it, people are just posting and reposting, having the time of their lives posting this hardcoded key for Flock.</v>

190
00:21:11.619 --> 00:21:21.619
<v Dave Bittner>Not going to</v>

191
00:21:16.673 --> 00:21:26.673
<v Dave Bittner>Obviously it's illegal to use this key to do what you want with Flock's API server, but do we know what you could do with this?</v>

192
00:21:21.619 --> 00:21:31.619
<v Dave Bittner>recognise it as</v>

193
00:21:27.516 --> 00:21:32.429
<v Graham Cluley>Is it a case of taking data off the cameras or maybe putting data on the cameras?</v>

194
00:21:31.619 --> 00:21:41.619
<v Dave Bittner>being human. No.</v>

195
00:21:32.429 --> 00:21:39.929
<v Dave Bittner>It seems as though this key is how the camera authenticates itself with Flock's mothership, if you will.</v>

196
00:21:39.929 --> 00:21:47.429
<v Dave Bittner>So it says, this is who I am, this is where I am, which is another thing.</v>

197
00:21:47.429 --> 00:21:54.929
<v Dave Bittner>The camera sends its GPS coordinates to identify where it is.</v>

198
00:21:54.929 --> 00:22:02.429
<v Dave Bittner>And so with this information, you could basically authenticate yourself on Flock's API on their home base servers and pretend to be one of the remote cameras.</v>

199
00:22:03.458 --> 00:22:13.458
<v Graham Cluley>We could pretend to be</v>

200
00:22:03.458 --> 00:22:09.068
<v Dave Bittner>We could, we could.</v>

201
00:22:09.068 --> 00:22:10.431
<v Graham Cluley>And muddy their database.</v>

202
00:22:10.431 --> 00:22:16.603
<v Dave Bittner>Imagine the fun we could have. We could post pictures of that Princess Di plate. Just—</v>

203
00:22:13.458 --> 00:22:23.458
<v Graham Cluley>a Flock camera if we</v>

204
00:22:16.603 --> 00:22:19.248
<v Graham Cluley>I don't think facial recognition is going to work on that plate.</v>

205
00:22:19.248 --> 00:22:19.792
<v Dave Bittner>No, no.</v>

206
00:22:19.792 --> 00:22:29.792
<v Graham Cluley>I don't think you'd even— Even if they had</v>

207
00:22:23.458 --> 00:22:33.458
<v Graham Cluley>wanted to, maybe.</v>

208
00:22:28.159 --> 00:22:29.846
<v Graham Cluley>No.</v>

209
00:22:29.792 --> 00:22:39.792
<v Graham Cluley>a modern Flock camera rather than one built in</v>

210
00:22:29.846 --> 00:22:37.837
<v Dave Bittner>So the logs recovered from the camera contained GPS coordinates.</v>

211
00:22:37.837 --> 00:22:45.828
<v Dave Bittner>This particular camera seemed to have come from somewhere in Wisconsin, and researchers were able to use Google Street View to find the particular camera, I suppose, when it was still there.</v>

212
00:22:39.792 --> 00:22:49.792
<v Graham Cluley>2017, 2018, I don't think it was—</v>

213
00:22:45.828 --> 00:22:49.939
<v Graham Cluley>Yes.</v>

214
00:22:49.939 --> 00:23:06.259
<v Dave Bittner>Flock, of course, in response to the stories that have been written about this in places like 404 Media and Wired, they have said, and I quote, they take security seriously and they maintain a vulnerabilities disclosure programme. Yeah.</v>

215
00:23:06.259 --> 00:23:12.672
<v Graham Cluley>Is it possible that their statement was also written in 2017 or 2018? They had that in their back pocket because—</v>

216
00:23:12.672 --> 00:23:13.424
<v Dave Bittner>It's possible.</v>

217
00:23:13.424 --> 00:23:15.750
<v Graham Cluley>I think we've heard that one before a few times, haven't we?</v>

218
00:23:15.750 --> 00:23:23.556
<v Dave Bittner>So related to all of this, I think it's worth mentioning that there is a huge amount of pushback against these Flock cameras here in the States right now.</v>

219
00:23:23.556 --> 00:23:31.362
<v Dave Bittner>There are municipalities who have had contracts with them and are cancelling the contracts.</v>

220
00:23:31.362 --> 00:23:31.778
<v Unknown>Yeah.</v>

221
00:23:31.778 --> 00:23:41.778
<v Dave Bittner>There is a story from a police organisation in Illinois where the former police chief and two of the other high-level police people in this police force were using the town's Flock licence plate cameras to monitor the police chief's ex-wife. He had instructed other officers to track her, allegedly. The state police confirmed there's an active investigation into the matter.</v>

222
00:23:41.778 --> 00:23:51.778
<v Dave Bittner>Again, obviously all alleged, but these three police officers resigned from the force when this information came out. So again, there's a lot of pushback. People feel as though this has gone a little too far, that our locations are being tracked.</v>

223
00:23:51.778 --> 00:24:01.778
<v Dave Bittner>That the information is accessible without a warrant by police officers. So I think the folks who make the Flock cameras have been set back on their heels a little bit at the amount of pushback there is. And now to add on to that, these reports of how insecure and easy to hack both their cameras are and their central servers.</v>

224
00:24:36.550 --> 00:24:44.210
<v Graham Cluley>It's what we like to call an omni-shambles, isn't it? I like that. I like that.</v>

225
00:24:44.210 --> 00:24:48.980
<v Dave Bittner>I'm going to steal that, Graham. Omni-shambles. I like that. That has a nice ring to it.</v>

226
00:24:48.980 --> 00:24:57.970
<v Graham Cluley>Yeah. These are devices which, sometimes it is argued, they are being introduced into society in order to protect us, to make us feel more secure.</v>

227
00:24:57.970 --> 00:25:06.958
<v Graham Cluley>But in fact, they're either being abused or they are themselves insecure in their very nature in the first place.</v>

228
00:25:06.958 --> 00:25:18.979
<v Dave Bittner>And to be fair, law enforcement will say this is a powerful tool for them to be able to solve crimes. And there's no question that that's true.</v>

229
00:25:18.979 --> 00:25:31.000
<v Dave Bittner>It's just a matter of how much are we all willing to give up in order to do that? And that's the unresolved question so far, but it's moving rapidly.</v>

230
00:25:31.000 --> 00:25:34.284
<v Graham Cluley>This episode of Smashing Security is brought to you by ThreatLocker.</v>

231
00:25:34.284 --> 00:25:37.856
<v Joe>Agentic AI is changing the speed of cyberattacks, Graham.</v>

232
00:25:37.856 --> 00:25:47.569
<v Graham Cluley>Yes, I read about that too. Self-directing ransomware, AI worms that adapt as they go, agents chaining tools together with no human anywhere near the controls.</v>

233
00:25:47.569 --> 00:25:52.561
<v Joe>So basically, the attackers have automated their way to a 4-day workweek and the rest of us haven't.</v>

234
00:25:52.561 --> 00:25:57.569
<v Graham Cluley>When enumeration, exploitation, and lateral movement happen at machine speed, plans like, oh, we'll catch it when someone checks their</v>

235
00:25:57.569 --> 00:26:02.578
<v Graham Cluley>alerts, they begin to fall apart.</v>

236
00:26:02.578 --> 00:26:07.631
<v Joe>Like most incident response plans, then. Great in the slide deck, less great at 3 AM.</v>

237
00:26:07.631 --> 00:26:17.144
<v Graham Cluley>ThreatLocker puts default deny and least privilege between the agent and its next move. Application allowlisting decides what's allowed to run at all.</v>

238
00:26:17.144 --> 00:26:26.659
<v Graham Cluley>Ringfencing limits what trusted applications can reach or launch, and privileged access management takes away elevation the agent never needed in the first place.</v>

239
00:26:26.659 --> 00:26:29.913
<v Joe>So speed's not the problem anymore. Getting through the door is.</v>

240
00:26:29.913 --> 00:26:38.846
<v Graham Cluley>So get ahead of machine speed attacks with ThreatLocker. Head to threatlocker.com/smashing to find out more and book your free demo.</v>

241
00:26:38.846 --> 00:26:47.049
<v Joe>That's threatlocker.com/smashing. Thanks to ThreatLocker for supporting the show and for doing the fast bit so we don't have to.</v>

242
00:26:47.049 --> 00:26:51.055
<v Graham Cluley>And welcome back. Can you join us at our favourite part of the show? The part of the show that we like to call Pick of the Week. Pick of the Week.</v>

243
00:26:51.055 --> 00:27:21.055
<v Dave Bittner>Pick of the Week.</v>

244
00:26:51.055 --> 00:26:59.609
<v Graham Cluley>Pick of the Week is the part of the show where everyone chooses something they like. It could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish.</v>

245
00:26:59.609 --> 00:27:08.165
<v Graham Cluley>It doesn't have to be security-related necessarily. Better not be.</v>

246
00:27:08.165 --> 00:27:16.721
<v Graham Cluley>Now, Dave, I wonder if, like me, you are a fan of the movie La La Land.</v>

247
00:27:16.721 --> 00:27:18.805
<v Dave Bittner>Uh, I—</v>

248
00:27:18.805 --> 00:27:21.851
<v Graham Cluley>Oh, hang on. There was a pause.</v>

249
00:27:21.851 --> 00:27:26.740
<v Dave Bittner>I have watched La La Land twice, I believe.</v>

250
00:27:26.740 --> 00:27:27.141
<v Unknown>Oh.</v>

251
00:27:27.141 --> 00:27:33.119
<v Dave Bittner>I enjoyed watching La La Land. I will say I did not go gaga for La La the way many other people did.</v>

252
00:27:33.119 --> 00:27:39.098
<v Dave Bittner>And this is surprising for me because I love a musical.</v>

253
00:27:39.098 --> 00:27:41.648
<v Graham Cluley>Yes. Love a musical.</v>

254
00:27:41.648 --> 00:27:47.953
<v Dave Bittner>For whatever reason, it just didn't resonate with me the way it did with other people, but that's okay. That's just me.</v>

255
00:27:47.953 --> 00:27:54.258
<v Dave Bittner>I have no doubt this is a wonderful movie, and clearly people love it, so good on them.</v>

256
00:27:54.258 --> 00:28:01.701
<v Graham Cluley>I think you're a bit more of a Seven Brides for Seven Brothers kind of thigh-slapping style musical fan, right?</v>

257
00:28:01.701 --> 00:28:06.673
<v Dave Bittner>That's true. Yes. Give me The Music Man or Singin' in the Rain, and I'm happy as a clam.</v>

258
00:28:06.673 --> 00:28:06.849
<v Dave Bittner>Okay.</v>

259
00:28:06.849 --> 00:28:08.212
<v Dave Bittner>All right.</v>

260
00:28:08.212 --> 00:28:15.712
<v Graham Cluley>Well, I love La La Land. If you haven't seen it, of course, it was the movie which had the Best Picture Oscar cruelly ripped from its paws back in 2017.</v>

261
00:28:15.712 --> 00:28:23.212
<v Graham Cluley>If you haven't seen it, unlike Dave, who I'm beginning to question his judgement, I think you should go and watch it. Tell me if you like it, and if you didn't like it, unsubscribe from Smashing Security immediately.</v>

262
00:28:23.212 --> 00:28:30.712
<v Graham Cluley>Go on, clear off, clear off the lot of you. Well, no, no, no, no, no, no, no, no, no, no, come.</v>

263
00:28:30.712 --> 00:28:38.212
<v Graham Cluley>Come back. Didn't mean it.</v>

264
00:28:41.069 --> 00:28:44.701
<v Dave Bittner>Oh my! I think what am I not going to be invited back anymore?</v>

265
00:28:41.973 --> 00:29:11.973
<v Graham Cluley>Labours of love.</v>

266
00:28:44.701 --> 00:28:52.201
<v Graham Cluley>Dave, don't leave just yet. You've got a few more minutes to go. All right.</v>

267
00:28:52.201 --> 00:28:59.701
<v Graham Cluley>Anyway, if any of you are still listening, I love La La Land. I could watch it on a loop, and my pick of the week this week is a website that is La La Land related. So I've stumbled across a website called seeing-stars.com, and it's done something brilliant.</v>

268
00:28:59.701 --> 00:29:07.201
<v Graham Cluley>They have tracked down literally every single filming location used in the movie. So there's a real spot in Boulder City, Nevada, where Ryan Gosling goes to pick up Emma Stone when he visits her in her hometown. There's a pier where he sings City of Stars to an old married couple and dances with the wife.</v>

269
00:29:07.201 --> 00:29:14.701
<v Graham Cluley>There's the famous observatory. I think it's in Rebel Without a Cause as well, or some James Dean movie.</v>

270
00:29:29.512 --> 00:29:30.394
<v Unknown>Yeah.</v>

271
00:29:30.394 --> 00:29:39.486
<v Graham Cluley>Where they have their dreamy planetarium dance scene. There's even tiny little throwaway moments, which may just be on the screen for a second, like a parking lot that Emma Stone walks through for an audition.</v>

272
00:29:39.486 --> 00:29:48.576
<v Graham Cluley>So this isn't a brief list. This is every single location throughout the movie.</v>

273
00:29:48.576 --> 00:29:57.667
<v Graham Cluley>This La La Land lunatic has watched the movie with his pause button. He's worked out where everything was taken.</v>

274
00:29:57.667 --> 00:29:58.325
<v Dave Bittner>Right.</v>

275
00:29:58.325 --> 00:30:05.614
<v Graham Cluley>It's extraordinary. And he's posted alongside the screencaps, real photos, map links, Street View. He's given a narrative as well.</v>

276
00:30:05.614 --> 00:30:12.902
<v Graham Cluley>There are so many pages of this, and I found myself trawling through this and I thought, you know what? This is the kind of obsessiveness I want to see on the internet. This is like the old days.</v>

277
00:30:12.902 --> 00:30:20.191
<v Graham Cluley>There used to be lots of bonkers sites like this.</v>

278
00:30:20.191 --> 00:30:50.191
<v Dave Bittner>Yes.</v>

279
00:30:21.713 --> 00:30:23.317
<v Dave Bittner>Yes, I agree.</v>

280
00:30:23.317 --> 00:30:30.817
<v Graham Cluley>And I don't think anyone's got enough time really these days. It doesn't feel like anyone's actually putting the effort into building something.</v>

281
00:30:30.817 --> 00:30:38.317
<v Graham Cluley>This was definitely not created — if you haven't seen La La Land, go watch La La Land for goodness' sake. But also, after watching it, you might want to go and check out this website.</v>

282
00:30:38.317 --> 00:30:45.817
<v Graham Cluley>The other thing is, if La La Land isn't your thing, the same guy has documented all of the locations used in the Dexter TV series. You must know that one.</v>

283
00:30:45.817 --> 00:30:53.317
<v Graham Cluley>That's that family show about what a police blood spatter expert gets up to in his free time.</v>

284
00:30:56.083 --> 00:30:58.824
<v Dave Bittner>Lovely little lighthearted jaunt. Yes.</v>

285
00:30:58.824 --> 00:31:05.568
<v Graham Cluley>Yes, exactly. So La La Land on one side, Dexter on the other. You can take your pick and go and check out the locations.</v>

286
00:31:05.568 --> 00:31:08.534
<v Dave Bittner>I love this kind of thing. Yeah, this is great fun.</v>

287
00:31:08.534 --> 00:31:14.442
<v Graham Cluley>That is my pick of the week. Dave, what's your pick of the week?</v>

288
00:31:14.442 --> 00:31:18.303
<v Dave Bittner>Well, Graham, how do I say this?</v>

289
00:31:18.303 --> 00:31:23.633
<v Graham Cluley>Goodbye. That's right.</v>

290
00:31:23.633 --> 00:31:33.079
<v Dave Bittner>I grew up in a household that did not have a lot of musical sophistication. Let's put it that way.</v>

291
00:31:33.079 --> 00:31:42.527
<v Dave Bittner>My parents, who were children of the '50s, not the '60s, which meant they were more Frank Sinatra than the Beatles.</v>

292
00:31:42.527 --> 00:32:12.527
<v Unknown>Okay.</v>

293
00:31:42.527 --> 00:31:43.568
<v Unknown>Okay.</v>

294
00:31:43.568 --> 00:31:43.986
<v Dave Bittner>Yeah.</v>

295
00:31:43.986 --> 00:31:49.791
<v Dave Bittner>When I was a young lad, my father would be down in his workshop doing little projects, and I would be down in the</v>

296
00:31:49.791 --> 00:31:55.596
<v Dave Bittner>basement playing with my Matchbox cars or my Legos.</v>

297
00:31:55.596 --> 00:31:58.965
<v Graham Cluley>Can I just check? He wasn't a blood splatter expert working for the police, was he?</v>

298
00:31:58.965 --> 00:32:00.411
<v Dave Bittner>He was not. No, no, no, no, no.</v>

299
00:32:00.411 --> 00:32:01.486
<v Dave Bittner>Okay.</v>

300
00:32:01.486 --> 00:32:02.111
<v Graham Cluley>Just clearing that up.</v>

301
00:32:02.111 --> 00:32:05.560
<v Dave Bittner>No, no, no. On the 8-track tape player —</v>

302
00:32:05.560 --> 00:32:05.945
<v Unknown>Ooh-hoo!</v>

303
00:32:05.945 --> 00:32:11.721
<v Dave Bittner>Yeah. I can still hear the clunk-clunk sound when it would switch tracks.</v>

304
00:32:11.721 --> 00:32:17.499
<v Dave Bittner>On the 8-track tape player, he would often have an 8-track of the Ray Conniff Singers.</v>

305
00:32:17.499 --> 00:32:17.867
<v Graham Cluley>Right.</v>

306
00:32:17.867 --> 00:32:22.730
<v Dave Bittner>Now, Graham, I don't know if you are lucky enough to know who the Ray Conniff Singers are.</v>

307
00:32:22.730 --> 00:32:23.372
<v Graham Cluley>I'm not.</v>

308
00:32:23.372 --> 00:32:30.219
<v Dave Bittner>I put a link in here just for you of them doing their rendition —</v>

309
00:32:30.219 --> 00:32:38.782
<v Graham Cluley>Hey Jude, don't make it bad. Okay, that's horrible. Yes, it is.</v>

310
00:32:38.782 --> 00:32:47.587
<v Dave Bittner>Yes, it is. So for those who aren't familiar, the Ray Conniff Singers was just a group of vocalists, and they would take popular songs of the day, and they would get together as a choir, and they would sing the songs with an orchestral accompaniment.</v>

311
00:32:47.587 --> 00:32:56.394
<v Dave Bittner>And it was just completely benign, right?</v>

312
00:32:56.394 --> 00:33:02.214
<v Graham Cluley>It was awful. It was, it was.</v>

313
00:33:02.214 --> 00:33:06.773
<v Dave Bittner>But this was the soundtrack of my childhood, right?</v>

314
00:33:06.773 --> 00:33:07.319
<v Graham Cluley>Oh, bless.</v>

315
00:33:07.319 --> 00:33:16.246
<v Dave Bittner>So I heard this kind of thing over and over again. So this was my introduction to a lot of popular songs, was the Ray Conniff Singers cover version of it.</v>

316
00:33:16.246 --> 00:33:16.583
<v Unknown>Oh.</v>

317
00:33:16.583 --> 00:33:26.583
<v Dave Bittner>Yeah. We didn't have any</v>

318
00:33:16.583 --> 00:33:20.932
<v Dave Bittner>Yeah.</v>

319
00:33:20.932 --> 00:33:28.211
<v Dave Bittner>So I say that as introduction to why I have great affection for a documentary that I came across recently. It's called Let's Have a Party: The Piano Genius of Mrs. Mills.</v>

320
00:33:26.583 --> 00:33:36.583
<v Dave Bittner>Beatles albums growing up.</v>

321
00:33:28.211 --> 00:33:35.489
<v Dave Bittner>Graham, are you familiar with Mrs. Mills?</v>

322
00:33:35.489 --> 00:33:38.421
<v Graham Cluley>I am familiar with Mrs. Mills, yes.</v>

323
00:33:36.583 --> 00:33:46.583
<v Dave Bittner>Not a one.</v>

324
00:33:38.421 --> 00:33:40.590
<v Dave Bittner>She is from your neck of the woods.</v>

325
00:33:40.590 --> 00:33:48.019
<v Graham Cluley>Yeah, she was a British lady who could sort of stomp things out on the old piano, on the old Joanna.</v>

326
00:33:48.019 --> 00:33:49.568
<v Dave Bittner>That's right. That's right.</v>

327
00:33:49.568 --> 00:33:55.065
<v Graham Cluley>She was very talented. She wasn't your typical sort of celebrity starlet.</v>

328
00:33:55.065 --> 00:34:00.560
<v Graham Cluley>She wasn't what I would call glamorous.</v>

329
00:34:00.560 --> 00:34:01.202
<v Dave Bittner>No, no, no.</v>

330
00:34:01.202 --> 00:34:31.202
<v Graham Cluley>She was one of us.</v>

331
00:34:01.202 --> 00:34:03.291
<v Dave Bittner>She was a mom, yeah.</v>

332
00:34:03.291 --> 00:34:03.919
<v Graham Cluley>Yes.</v>

333
00:34:03.919 --> 00:34:07.067
<v Dave Bittner>But she could play. She had her own distinct style.</v>

334
00:34:07.067 --> 00:34:07.855
<v Unknown>Yeah.</v>

335
00:34:07.855 --> 00:34:12.112
<v Dave Bittner>I would categorize it as being kind of sing-along music, right?</v>

336
00:34:12.112 --> 00:34:12.530
<v Graham Cluley>Yes.</v>

337
00:34:12.530 --> 00:34:20.280
<v Dave Bittner>This comes from the era before recorded music, when everyone could play piano, and the way people would entertain themselves at a party or in a pub was that someone would sit down and play a</v>

338
00:34:20.280 --> 00:34:28.030
<v Dave Bittner>few tunes, and everyone would have a few drinks and sing along.</v>

339
00:34:28.030 --> 00:34:30.679
<v Graham Cluley>Which sounds bloody marvellous to me. And I think that's exactly the way I think about her as well. It's the kind of roll-out-the-barrel music you can imagine in the corner of the pub.</v>

340
00:34:30.679 --> 00:34:37.039
<v Dave Bittner>Exactly.</v>

341
00:34:37.039 --> 00:34:42.786
<v Graham Cluley>Stomping out a song, people holding their glasses of beer, enjoying the evening, singing along.</v>

342
00:34:42.786 --> 00:34:47.849
<v Dave Bittner>Exactly. And so, for me, discovering Mrs.</v>

343
00:34:47.849 --> 00:34:52.911
<v Dave Bittner>Mills has been opening up an entire new category of musical comfort food.</v>

344
00:34:52.911 --> 00:34:53.793
<v Graham Cluley>Right.</v>

345
00:34:53.793 --> 00:34:59.563
<v Dave Bittner>Because of the hardwiring of the awful Ray Conniff Singers in my brain when I was a child, Mrs.</v>

346
00:34:59.563 --> 00:35:05.335
<v Dave Bittner>Mills just slots right in there and I love it to death.</v>

347
00:35:05.335 --> 00:35:09.262
<v Graham Cluley>And she didn't sing, did she? Unlike the Ray Conniff Singers who shouldn't have sung.</v>

348
00:35:09.262 --> 00:35:18.159
<v Dave Bittner>She did not sing, but there were singers on her albums and sometimes on her albums it would be the entire bar who would be singing along.</v>

349
00:35:18.159 --> 00:35:48.159
<v Graham Cluley>Right.</v>

350
00:37:42.489 --> 00:37:50.195
<v Graham Cluley>The algorithm has learned about you, Dave.</v>

351
00:37:50.195 --> 00:37:57.719
<v Dave Bittner>There's no getting rid of me. So I've left a link to Let's Have a Party: The Piano Genius of Mrs.</v>

352
00:37:57.719 --> 00:38:05.246
<v Dave Bittner>Mills, which is a BBC documentary. But Graham, there's a particular thing in here that made me realise that this was the perfect thing to have as my pick of the week just for you, because Mrs.</v>

353
00:38:05.246 --> 00:38:12.771
<v Dave Bittner>Mills' piano is at Abbey Road Studios. To this day, her piano is there, and her piano was used by the Beatles.</v>

354
00:38:12.771 --> 00:38:21.391
<v Graham Cluley>It was. And Dave, hold on to your seat. I have actually seen Mrs. Mills's piano.</v>

355
00:38:21.391 --> 00:38:31.704
<v Dave Bittner>Get out!</v>

356
00:38:31.704 --> 00:38:40.494
<v Graham Cluley>I really have, because I was very lucky a few years ago to actually go into Abbey Road and into Studio 2, which is the famous studio where the Beatles recorded a lot of their songs, the one with the stairs going down the side.</v>

357
00:38:40.494 --> 00:38:47.913
<v Unknown>Yeah.</v>

358
00:38:45.809 --> 00:38:55.809
<v Dave Bittner>So I made the mistake of tracking down</v>

359
00:38:47.913 --> 00:38:53.556
<v Graham Cluley>And that piano is still there.</v>

360
00:38:53.556 --> 00:38:59.199
<v Graham Cluley>They didn't let us play it.</v>

361
00:38:55.809 --> 00:39:05.809
<v Dave Bittner>some of her things in my iTunes app,</v>

362
00:38:59.199 --> 00:39:11.333
<v Unknown>Okay.</v>

363
00:39:05.809 --> 00:39:15.809
<v Dave Bittner>which means now she's in the rotation.</v>

364
00:39:11.333 --> 00:39:22.565
<v Graham Cluley>But yeah, so many amazing songs. I think maybe With a Little Help from My Friends and Ob-La-Di, Ob-La-Da with that digga digga ding ding ding at the beginning — that's all on the Mrs. Mills piano.</v>

365
00:39:22.565 --> 00:39:28.577
<v Dave Bittner>Yes. So I've included a link here from Abbey Road that has a picture of, I think, Paul and John seated at Mrs. Mills' piano.</v>

366
00:39:28.577 --> 00:39:34.590
<v Dave Bittner>The legend goes on beyond Mrs. Mills herself.</v>

367
00:39:34.590 --> 00:39:42.152
<v Graham Cluley>Her piano will live forever through the music of the Beatles, because she was signed by Parlophone. She was on the same record label as the Beatles.</v>

368
00:39:42.152 --> 00:39:50.181
<v Dave Bittner>This woman made a solid living playing piano. Her albums were hits just by going right down the centre. That is my pick of the week.</v>

369
00:39:50.181 --> 00:39:57.983
<v Graham Cluley>This is fantastic. I'm definitely going to check out that documentary. I love that. Well, that just about wraps up the show for this week. Thank you so much, Dave, for joining us. Maybe you can tell our listeners where they can follow you online and find out what you're up to. What's the best way for them to do that?</v>

370
00:39:57.983 --> 00:40:03.755
<v Dave Bittner>Just go to our website, thecyberwire.com, and you'll find all of</v>

371
00:40:03.755 --> 00:40:09.528
<v Dave Bittner>my shows there.</v>

372
00:40:09.528 --> 00:40:20.614
<v Graham Cluley>Terrific stuff. And of course, you can find me, Graham Cluley, on LinkedIn, Bluesky, Mastodon, Instagram, and even the Tok of Tik. The list goes on. And you can also follow Smashing Security on Bluesky, Mastodon, and Reddit.</v>

373
00:40:20.614 --> 00:40:31.702
<v Graham Cluley>Don't forget to ensure you never miss another episode. Follow Smashing Security in your favourite podcast apps such as Apple Podcasts, Spotify, and Pocket Casts. And you can look for our show notes, sponsorship info, guest list, and the entire back catalogue of 486 episodes at smashingsecurity.com. Until a couple of weeks, not next week, the week after. Cheerio. Bye-bye.</v>

374
00:40:24.693 --> 00:40:31.702
<v Graham Cluley>You've been listening to Smashing Security with me, Graham Cluley, and a huge thank you to Dave Bittner for joining me this week and this week's sponsors ThreatLocker, Origin, and Vanta. Do make sure to go and check out their offerings because they help keep the show afloat. Now, chums, according to the limited stats I get to see as to our listenership, the vast majority of you appear to be male. However, we do have a marvellous cohort of female listeners too, and some of them have been kind enough to become members of Smashing Security Plus. So I thought, you know what? Let's give some of them a nice shout out today. So kicking us off are Jessica Orth, Lisa, and Sharon — three fine chums, not putting up with any nonsense. A big huzzah to Sharon, a name which resembles that satisfying crisp click that you might get when closing the lid of a brand new laptop. The legendary Maya MacDonald, the beautifully double-barrelled Adena Bogut O'Brien, and Jane with a Y, because why not? Big love as well to The Green Girl, our most colour-coordinated patron, and to the delightfully whimsical Butterfly Skies. Thank you. And finally for this week, Frankie Guzikowski. Frankly, Frankie can be a boy's name or a girl's name. I'm not sure which way our Frankie leans. But anyway, these fine, upstanding, generous individuals are all members of Smashing Security Plus, which means they get their episodes ad-free earlier than the general public, and perhaps most importantly, have the opportunity to have their names pulled out of the hat at the end of the show and read out for mild ridicule. Curated by myself. If you would like to join them in this exclusive club of the wonderful and slightly foolish, just head over to smashingsecurity.com/plus, where for a modest fee, you too can support the podcast. You can support us in other ways as well. You can write a review; those are always lovely. You can like, you can subscribe, and you can tell your friends about us. Go on, go and find a chum. Collar them and say, you know what? You really should listen to Smashing Security. Well, thanks to all of you who support the show, and I'll be back for another episode on October the 8th. So make sure to tune in then. Until then, cheerio. Bye-bye.</v>

375
00:40:31.702 --> 00:41:01.702
<v Unknown>Bye-bye.</v>

376
00:40:31.702 --> 00:40:32.811
<v Dave Bittner>Bye-bye.</v>