
We take a look at the stinky backside of surveillance, gas about the latest video-conferencing threats, and jump into the murky world of 5G conspiracy theories.
All this and much much more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by technology broadcaster David McClelland and featuring an interview with LastPass’s Barry McMahon.
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
Hello, hello, and welcome to Smashing Security, Episode 173. My name's Graham Cluley.
So right now I'm waving my arms around, wiggling my bum around a little bit, doing whatever I can to try and lift the spirits in lockdown Britain.
Now, on yet another stuck-at-home special, Graham looks at the stinky backside of surveillance. David is going to gasp about the latest on video conferencing snafus.
And I'm jumping into the conspiracy tank to find out what sharing bogus stuff online gets us. All this and much more coming up on this episode of Smashing Security. See? Smiling.
Something which could change the face of Britain and indeed the world when it comes to authentication, biometrics, all of these things.
In fact, first of all, let's take a trip back in time, because in 2011, remember those halcyon days, 2011, long before—
For instance, maybe this could be something which could be used in offices to securely unlock PCs.
So in place of passwords or facial recognition or Touch ID, you would simply sit in your chair and that would unlock your computer because it would take your bum print.
What they had found was that there was bacteria in your digestive tract, which leaves a clear genetic signature in your, in your— Penis? Nope. In your poop, right?
So they could say with 86% accuracy in their tests, they could match poop to people in their study.
And there were concerns at the time that this could be a potential privacy concern because of course, people are donating poop for scientific research.
And, you know, there are presumably large databases and storehouses full of poop where it's studied for medical reasons and potentially, people could identify whose poop was whose.
And that could, yes?
This gadget, which they say can be retrofitted to any ordinary loo, can potentially detect early warning signs of cancer, and other serious diseases, right?
Now, I'm a little bit nervous of this kind of thing because I remember writing—
And what was discovered was that hackers could basically hijack control of this smart toilet via its app, make it repeatedly flush, raise water usage in your utility bills.
But more than that, they could actually remotely and unexpectedly open and close the lid or activate the—
Whenever I've travelled to the Far East, one of the most exciting things is going to the bathroom in a Japanese or in a Taiwanese hotel, where I've stayed in the past.
And these washlets, with the remote controls the size of a 105-letter QWERTY keyboard. I have no idea what buttons I'm pressing, but boy, is it fun.
You could be mid-delivery and you're sitting there pressing buttons and splashing water and running electronics all over your ass. And you think it's fun.
And I thought, actually— Oh my God! This is actually—
But the rest of it, I thought, no, this is actually— This is something which they've adopted in Asia, but actually we could have a lot more of in the West.
I worked on a TV show a few years ago, and we went and filmed a special feature there because some of these toilets were smartphone-controlled.
They were connected loos, which I guess opens them up to some potential abuse.
Now, this new gadget made by Stanford University, it can be fitted to any ordinary loo, but it also comes with this companion smartphone app.
And apparently it will use artificial intelligence to analyse your poop and urine as it passes through.
And I think, you know, I'd probably prefer if some app was doing it instead.
He says, because the thing about his smart toilet gadget is that unlike wearables, you can't take it off. Everyone uses the bathroom. There's no avoiding it, he says.
And it also has this brilliant disease-detecting element to it.
Because I was thinking, well, look, if it's going to collect data about the state of your poop, what happens if you go around a friend's house and you've got a bit of a grotty tummy, right?
And you think, oh, crumbs, you know, everything's running.
You could use their device. The device might think it was the owner of the house, right? And so the way they get round that is there is a fingerprint scanner on the flush handle.
And get this, this is two-factor authentication.
It also takes what's called your anal print, which is— It captures with the video camera stills of, and I quote here, "the distinctive creases in the lining of the—" I can't believe, I can't say the word.
I can't say the word. Anyway, the point is that it is collecting all of this information. So it knows who you are, just like a fingerprint.
Apparently there is a thing called an anal print as well.
Now, if I was a resident of Bristol—I was a student there—I do find it a little bit offensive they've called it the Bristol Stool Scale, I have to say.
But there were some bits which were dodgy. Now, all of this data, of course, is being collected. And what do you think is happening with it?
Well, according to the researchers, it is securely stored and analysed in an encrypted cloud server. So that's all right then. Nothing to worry about there.
Nothing can possibly go wrong. So I think this has some medical uses.
I think maybe in some ways this is a cool idea because not many people would rip their existing loo out and replace it with one just for these features.
Although clearly David, you know, has been to the showroom.
But I think it's an interesting biometric and I just wanted to talk about something which wasn't coronavirus related and I think maybe this is a way of the future.
Clearly, there's lots of interesting medical information which can be gathered from what exits your body and from examination of that.
And it could, you know, give early warning of things. But is it a price we are prepared to pay? I don't know.
Do you go in a showroom and just sit down and pretend?
I've been to some high-end home renovation shows where various manufacturers are showing off their washlets and, you know, their state-of-the-art loos. Washlet? Is that the name?
Is that the term? A washlet is the technical term for them indeed, yes. Oh, for toilets? Well, for the toilet seats that have got— Okay. That have got the stuff built into them.
Oh, right, yeah. And typically what they do is that there is a Perspex sheet that goes over the seat.
So you can see—You can see what comes out from the back of the loo and where the water is squirting and so on. There is a hole, right? So you're not—Well, no.
So you're not actually sitting on the loo to test it. Oh. But you're seeing all of the technology doing what it would normally do were a person sat on the toilet at that point. Right.
A Perspex sheet stops you from getting splashed in the face, which would be very wrong.
And in all seriousness, I was at an event late last year or so, and a lot of these devices are being installed for vulnerable people, people who are resident in nursing homes and so on.
Oh yeah, great point. Who maybe can't take as good care of themselves as would be ideal, these do a good job of that as well.
So there is a very serious side to what some of these washlets and high-tech toilets do-do.
And over the last few weeks since we've all been in this thing together, I've been talking on the radio and writing in the papers. I'm a gadget doctor in the Metro now, you know. Dr.
McClelland.
But I've been chatting about, guess what, how about how all of these video chat and video conferencing apps have suddenly become part of our essential support network for keeping us in touch with family members, keeping us sane by keeping us in touch with friends, and hopefully helping us keep hold of our jobs as well.
The thing is, is that but a month ago, most people, again, non-techies in particular, had never ever heard of apps like Houseparty or Zoom.
It's safe to say the public certainly has now heard about them, and me along with many, many other tech journalists, we've all been doing our best, as I know you have as well, to try and encourage safe use of them up and down the land.
Unfortunately, lots of hackers and mischief makers are also now very, very well aware of these apps given their sudden prominence and are ramping up their efforts.
So the word is spreading that if you're Zooming, you need to do a password. Okay, that's all good, but mischief making might be enough for some bad guys.
Some will want to make money out of their malicious acts, and the password thing isn't going to get in their way. So we've seen a new trend emerge.
In fact, Trend Micro has just issued a report itself in which a number of fake Zoom installers have emerged that alongside installing the Zoom video conferencing software also bundle in some nasties as well.
So one of the unwanted bits of malware is a coin miner.
Now these little blighters blitz your CPU and your graphics card and contribute to a crypto mining effort that lines somebody else's virtual wallet at your CPU cost.
Not a good thing, but certainly we've seen a big rise in these over the last two or three years.
And you know, the first that many consumers know about it is the fact that the fans on their PC or their Mac is whirring away. They can be delivered via web browsers as well.
Even visiting some websites, that there will install some nasty stuff or just use some CPU cycles.
Another thing that we've seen as well is that alongside the Zoom installers, we're seeing RATs, these remote access trojans, which give hackers full access to your PC or your Mac, and goodness knows what kind of havoc they can wreak.
Because, you know, as someone who maybe, I go, I'm doing a Zoom meeting for the first time later on, let's just do a search and type in Zoom installer, and I find it.
I don't know what the proper website is to install Zoom from, so I download it from a third-party source, not from the Zoom website.
Zoom is running, so as far as I'm concerned, it's been successful. Might be using quite a lot of CPU, but because I've never used Zoom before, maybe that's what it does.
And that means that we're cutting corners, maybe some of the normal processes and measures to protect ourselves that we would normally take, we're not doing because we're just being a little bit more reactive.
But the thing is, it's exactly that that the bad guys are looking to exploit at the moment.
And particularly given that we're relying on our technology now more than ever to continue whatever's left of normal in our daily lives.
We need to be more vigilant now than we have ever been before.
Just, I think actually people, you know, if you're setting up a Zoom, I think absolutely go to the right website to download it.
Don't just type in Zoom in Google and take the first advertising.
Not to mention my in-laws, because apparently they listened to the episode where I talked about how I've got them a Facebook Portal and want— only at the moment social distancing is preventing me having to have that discussion with them.
And it is difficult, it is confusing, particularly when some web browsers, you open up the first page you're presented with by default, your homepage is a search engine rather than typing in the URL.
And again, this is advice as much for non-techies as it is for techies. You know, this is for my wife, this is for my dad.
They've been invited to a Zoom conference to join in a family chat with family members finding it very, very difficult to get together at the moment.
So as frustrating as it is, Carole, and I totally get it. You're right. I know I'm right.
I must admit, while I was researching my story, Graham, I did have a look to see if there were any Facebook Portal security snafus over the last week or so.
It's going to speed up the internet. I've read exponentially faster download and upload speeds. Dave, what do you think about that?
A month or so ago, the International Commission of Non-Ionizing Radiation Protection, how's that for a name? The ICNIRP, just to make it quick and snappy.
Now, they came out at the early March saying 5G is safe. So this is all good news because we are hoping that this might calm some of the existing conspiracy theories around 5G.
Snopes, the truth-sayer in most things, if not all, they've addressed a few of these conspiracy theories.
There was one claim that cell tower workers were required to wear hazmat suits while working on 5G equipment. That was considered false by Snopes.
Another one was that Japan was banning the development of 5G over health concerns. Again, false, right? They're actually investing in the technology.
So according to this great article in Wired, which you sent me this morning, Graham, RT, the media house, has been leading a disinformation campaign against 5G for some time now.
But whatever the case may be, we know that the Russkies are pretty au fait with disinformation campaigns. We've seen it for the last few years.
So it's no surprise around the time that experts were saying that 5G was safe, some corners of the internet had different ideas, and all this 5G hogwash was already a-swilling.
So Wired pinpoints the drama kicked off on January 22nd when a Belgian newspaper published an interview with a Dutch GP and he said 5G is life-threatening and no one knows it.
That was what the headline said. And the GP didn't just claim that 5G was dangerous, he also said it might be linked to coronavirus. How would that work?
Add to this that there was this video that was making the rounds on Facebook and Instagram and all these places showing people in China tearing down a 5G tower.
And the title that went with this video was, "The 5G tower was being torn down in an attempt to stop the spread of COVID-19." Virtual huddle huddle. Right, okay.
Then you've got media companies starting to write about, and when I say media, I am actually doing the quote unquote. The bunny ears? Daily Star. What do you guys call that?
This was the 26th of March, right at— well, you know, just as the number of deaths, just as the real— not that concern wasn't already starting to spread in the UK by then, but this headline is technically incorrect, but also just totally inflammatory and irresponsible.
The next piece says, "There are fears that the UK could be hit harder by coronavirus because of the rollout of the 5G network." And in the article, they have quotes, not from scientists or experts, but an activist and a philosophy lecturer at the Isle of Wight College.
And they're saying things like, "Yeah, this is really bad," but they have no expertise in the field.
So for those who don't know, the Daily Star is, it's not the most popular tabloid newspaper in the UK, but it's certainly not unpopular.
I suppose they'd have to WhatsApp them or something like that instead.
It's lovely that it's there, but there are many of these networks up and down the country.
And you know, these stories can go very quickly viral if there aren't some controls put in place.
But it suddenly kind of goes to a tipping point when people Woody Harrelson, yes, that Woody Harrelson from Cheers, yes, right?
So this conspiracy 5G COVID video from China falls into his digital lap, and the dude that he is either watches it or reads the headline and decides to share it on his Instagram with his 2 million followers.
Right. I'm not blaming him because he's just doing what a lot of people do.
He saw a headline or he watched a video, he made a snap decision that it was either entertaining or valid, and he basically sent it to all his followers.
Amanda Holden, she's a — Is she a celeb? Britain's Got Talent judge?
She's not really in my echo chamber, but, you know, she spewed some nonsense to her followers online, and loads of high-profile semi-celebs seem to do the same kind of thing.
Now, what could go wrong? What would be the problem with all this? Well, quite a lot, it turns out.
Because people thought that burning mobile phone masts in Birmingham, Merseyside, Belfast would be a good idea. Some of these mobile towers weren't even 5G.
The last number I saw of the totaling the number was 20 mobile phone masts in the UK were either petrol bombed or set alight.
You've got all these communities out there who are reliant on mobile connectivity and they're trapped at home.
And that means people can't make phone calls, they can't apply for money, can't order food, can't manage their accounts. Not everybody has a solid broadband connection.
Not everybody has broadband. And people may, my friend, a friend in Australia, she had just got a new job.
She got a new computer and suddenly COVID hit and she had to work from home. But her new computer was set in such a way that it wouldn't connect to her home Wi-Fi signal.
But all the software was on her computer. So she had to use her cell phone to do the link in order to work. And it was a brand new job.
And of course at this time, that's one thing you don't want to lose is your job. So there's lots of people in those kind of scenarios. So this is a big, big deal. Yes.
And of course, then people are videoing these arson attacks, putting them on socials and perpetuating the bullshit.
They're not letting us spread our stupid YouTube videos.
Which is extremely rare, to say that there was no basis in fact that COVID-19 was in any way connected to 5G.
He condemned the attacks on the telecoms infrastructure and calling online stories linking coronavirus to 5G utterly baseless. Tell me if this calms you down and brings you on side.
Okay. All right. This is now a matter of national security.
Police and counterterrorism authorities are investigating, but rest assured that our mobile and broadband networks remain resilient and that you, your families, and businesses will stay connected.
Again, it's interesting.
So they cite the rapid growth of neighborhood social media groups like Nextdoor and Instagram. David has in his street, right?
Yeah, but a failure to promote scientific evidence about 5G as well. And you've got a terrified population looking to make sense of this new COVID world.
His quote, "I'm absolutely outraged, absolutely disgusted that people would be taking action against the very infrastructure that we need to respond to this health emergency.
It's absolute and utter rubbish." So he's not happy.
One of the ways, one of the things they're trying to tell people, the conspiracists, is going, look, COVID-19 is spreading just as quickly in cities and even in countries that are yet to roll out 5G.
Iran, for example. Exactly. Iran has no 5G, but Iran is, what is it, number 2 on the list of number of deaths due to this?
You know, the Greenwich Peninsula was one of the first main sort of 5G test areas, yet it still emerged out of China.
You know, there's allegations that the virus is able to communicate using 5G. Which is absolutely ridiculous.
So, you know, that's part of the Daily Star argument, was the fact that it's making it easier for the virus to take hold in us.
And if we switch off the 5G networks, then our immunity will all instantly come back.
And you know, I've been asked to talk about 5G and, you know, is 5G a threat and all the rest of it.
There is almost no way to convert an anti-5G fanatic.
The best job I think that I can do with my limited powers is to try and convince people who might be hearing from these 5G fanatics to take what they say with a pinch of salt.
5G at the moment is—
But 5G is no different to 4G. It uses, at the moment anyway, pretty much the same technology.
And knocking out these cell sites, obviously it's inconvenient for those of us who maybe use 4G and 5G for our home broadband or our phone calls.
But these same masts are used for, in the UK anyway, the ESN, the Emergency Services Network.
This is the closed-off mobile network that emergency services, the people who are trying to save our lives, that we go out every Thursday night and we clap from the rooftops, they're unable to communicate if these mobile signals get knocked out.
It gets me so cross.
They'll see one of these messages and it's a bit like the National Enquirer, right? They see it and they think, "That's so insane. I've got to send that to my mates.
They won't believe this." So maybe counting the number of shares is assuming that everyone that's sharing it is a bona fide believer.
Whereas I can imagine sharing something because it shocked me.
And so—
Have you actually scrolled to the bottom of the article?
Whenever I forward anything, I get back, did you read it?
So many of us now are realizing that moving to a fully work from home environment isn't always easy, but LastPass is here to make that transition easier, all without decreasing security.
LastPass ensures your employees have secure access to their work applications and provides remote employees the ability to securely share passwords across teams in order to stay on top of critical projects.
If you want to learn more, visit lastpass.com/smashing. On with the show.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish.
It doesn't have to be coronavirus-related necessarily. Better not be.
Anyway, the thing is that someone on Reddit or somewhere like that, they said to me, keep the recommendations for fun Nintendo Switch games coming.
And so I thought, all right, I'll do that because let's spread a little bit of joy when everyone's stuck at home with their family trying to keep everyone entertained.
And that is why I can recommend to you a game which is available for just about every platform under the sun, not just the Nintendo Switch, and it is called Totally Reliable Delivery Service.
And if you've ever played a game, these sort of ragdoll-based games or these games like Human Fall Flat. Is that what it's called?
This is a game where basically you're sort of in control of somebody's body and it's like you decide when they move their arms or if they're holding on to something and they're grabbing things and you can play it with your friends and you pick up parcels and all you have to do is deliver them to the place they're meant to go and mayhem results.
It is very, very funny. Before you know it, you're hanging on to the edge of a biplane while your friend is trying to fly the plane to get the package to a certain place in time.
You're falling over everything. Everything's crashing, smashing up. It's hilarious fun.
Totally Reliable Delivery Service I found it slightly gets you agitated. You don't go the full Gordon Ramsay, but it's very, very enjoyable.
And I can confirm it's very difficult to fly a helicopter. So that is my recommendation this week.
So my recommendation, my pick of the week, is Totally Reliable Delivery Service.
There are some great online resources. Everyone knows that Joe Wicks has been doing a PE class every morning at 9 o'clock.
And it's had, you know, millions of views and that's all good. But I want to highlight another one that actually we found very, very handy from an educational point of view.
The kids absolutely love it and it's called Let's Go Live with Maddie and Greg. Now, UK TV viewers may well know Maddie Moat from her CBeebies television show, Do You Know?
Maddie's Do You Know? And that's a— it's a science program for kids who are, you know, up to the age of maybe 6 or 7 or 8 or so. But I've certainly enjoyed watching it.
Greg Foot is also a kind of science presenter. Blue Peter does their science experiments and things.
They've come together to do this daily live show at 11 o'clock where they explore science and nature, and it's full of makes, it's full of live camera feeds, it's got guests on it.
It's from their spare bedroom, but it's absolutely brilliant. I love Maddie, I love Greg, and my kids love watching them and making the makes. We've got models all over our house.
We've got bird feeders outside.
I think yesterday or today the other day they were doing scale models of the solar system but using bits of fruit and other things lying around the house. It's great.
Every day, 11 o'clock on YouTube, and obviously available to watch on demand thereafter. But send them photos, engage with them. That's great.
And I think, I mean, one thing that this whole thing has brought out is lots of people putting their stuff out online and sharing their knowledge, sharing their skills.
And certainly from a parent's point of view. There's so much there for kids to engage with.
You know, it looks quite professionally done and all the rest of it, the cuts and the— I'm just— are Maddie and Greg a couple? You said it's their spare bedroom.
And I'm thinking they're awfully close to each other. So they must be better friends than you and I are, Graham.
Is that preventing me from sleeping? Or am I listening to podcasts because I can't sleep? However, either way, my eyes get rested while I listen to podcasts. That's why podcasts rule.
So I've been listening to this podcast called Power Corrupt.
Now, Graham, I did send it to you and I said, you better listen, you better listen, you have to listen, you have to listen.
I actually didn't listen to the first series yet, so I kind of did it in reverse. This is the full second series, and I'm going to go back and listen to the first one.
But it touches upon smuggling and ransoms and election riggings and assassinations and heists and money laundering, disinformation and propaganda. So it's just fascinating.
The interviewees are top class, the information is pertinent for today, and it's honestly made me wiser about the world.
There's this one episode called "Godfather of Fake News," and he interviews this guy who is effectively an American who is proudly spewing out fake news all the time.
And he is very proud and happy to do it, and he makes a living at it. And he feels he's doing it for the good of the people because he's showing them they're stupid.
And it is just really hard to listen to, but also because you can get another point of view on things and it can help change the way you might deal with it should you meet someone like that.
Anyway, fascinating. So listen to it. It's pertinent for now, especially those of us that are facing elections and facing political disruptions. It's a good way to educate yourself.
So Power Corrupts by Brian Klaas is the podcast. Fantastic.
And don't forget, if you want to make sure you never miss another episode, subscribe in your favorite podcast app such as Apple Podcasts, Spotify, or Pocket Casts.
Literally, we thank you from the bottom of our hearts, and we hope that you and yours are keeping safe.
Check out smashingsecurity.com for past episodes, sponsorship details, and information on how to get in touch with us.
Maybe you should introduce yourself because this is the first time that you've been on the show and we've invited you on here because you work at LogMeIn, you know, the LastPass parent company.
And so maybe you can just give a little introduction on what you do there and all that.
I work very closely with colleagues based in Australia and all across our European markets as well.
So you must have seen a huge shift even in your office when all this kicked off.
For different parts of the workforce, you know, they will have started a career in LogMeIn and they may have always been office-based, and so therefore working from home is a totally different thing.
For myself, you know, brand new.
And for others, they've joined LogMeIn or they've been in other organizations where, you know, part of their routine was working from home or being very highly mobile.
And so less office space. So, you know, different people with different disciplines and different behaviors need different things.
And then you add into the mix for all of that then family life, right? Because I have two small kids here, so they may make a guest appearance at some stage.
Myself and my wife, we both work full-time. Both of us are working remotely and we're both juggling two kids as well. So it's very, very different.
So literally overnight, things have changed.
And that's put a lot of strain on a lot of different aspects, not just the organization, not just what the employee needs to do, but also on family life.
I mean, obviously from an organizational point of view, companies are going to be we need to try and stay afloat as long as we can through this crisis, ride the wave as ethically and morally as we can.
Others, of course, are going to scramble and run.
But for those good companies out there who are trying to do the right thing, there's a mountain of stuff that they need to think about.
Because as you were saying, you have worked at LastPass, and they already have some policy for work-at-home remote workers. They've been practicing this policy forever.
So, but there's so many companies now that are doing it for the very, very first time, and they want to get it right.
LastPass is uniquely positioned because some of the stuff you guys work on actually can help, you know, makes it more secure and makes it easier for the user.
The security perimeter or the security boundary is now sitting at the kitchen table, not sitting at the office, not sitting at the desk in the office, or wherever you can get a nice quiet place in your own home these days.
So, you know, we're seeing a lot of that happening. Next, coming very quickly behind that is security and trust, right?
So, strategy for a lot of security leaders has actually, you know, taken a back seat. That's put on the shelf at the minute because this is totally unprecedented.
A lot of security leaders are going to be playing catch-up.
What we've been working with organizations in LastPass for the last couple of years has been to help organizations build a culture of trust, build a culture of awareness, and build a culture of understanding why it's important to be more cybersecurity aware care and be more vigilant about what you click on, what you download, etc.
It was the first time I was outside of the main network and I couldn't connect for an hour because of all the different blocks that they put in to ensure that the system was safe.
And I got so frustrated, I went out to an Apple Store and bought my MacBook.
So you're right, adding friction can almost force employees to find workarounds that the organization may not think is great.
They will be as innovative as anything. So if you put the roadblocks up, you're not going to bring people on the journey with you.
And so flipping to the organization perspective, the organization now is going to be playing catch-up in terms of we need to deploy solutions, we need to deploy them fast, we need to be able to configure them, we need to be able to implement policies, and we need them to scale because this isn't just going to be a domestic problem, a challenge I should say, it's a global challenge that organizations will have.
And so how do you knit the end-user experience with the security challenges that are happening today and make sure that everything is frictionless the whole way through?
And that's always been the big challenge for security leaders.
Typically, they want to put something in place for all the right reasons, and the end users go, this is just too restrictive, we can't use it.
But now security leaders are having to evaluate these tools to go, okay, if we don't do this the right way, we don't have any control here, and we won't have any influence.
And so that's why you're starting to see a lot more—and this isn't new, it's just been accelerated given the coronavirus situation we're in—but now you're starting to see multifactor authentication, single sign-on, and password management as well.
So what you're trying to do, what the security leaders are trying to do, is they're trying to meet people where they are. They're at home.
You're trying to meet them where they're comfortable with the tools that they're using, i.e., their tablet, their desktop, or whatever it may be.
And so if you can help them use them tools and help them be productive, but then also in the backend ensure that they're secure, and that then by association, the byproduct of that is that your organization will be secure, then you've significantly reduced the risk profile ransomware profile that you may be exposed to now in this whole new world of operating.
Since the coronavirus started, any big story, anything that people are interested in, you can be guaranteed there's always going to be some sort of a scam associated with it because everybody wants to click on it, and everybody wants to be up to date.
So if there's news—this isn't new, phishing has been around forever and a day. And the reason it's still around is because it still works. People still click on things.
Therefore, if they still click on them and they enter in their credentials, guess what? The scammers have got what they needed. Coronavirus is no different.
We've just seen a significant amount of scams increase. Click on this link, please.
I've seen a recent one for a home delivery service saying that you were short in the amount that you paid to get the parcel delivered.
Can you please click on this link to complete the payment.
It's kind of crazy, so it's almost like the coronavirus phishing attacks, attacks normally would maybe be language specific or regionally specific, whereas here your net could be extremely wide.
That may be for a cure, or it may be to find out who in your neighborhood has coronavirus or whatever it is, right? There's nobody not going to click on something like that.
So we're all vulnerable. Everybody's vulnerable from that perspective.
Problem is, is that when people click on this from a LastPass perspective, you click on that link and it may look like your bank account website, it may look like your national delivery service website, it may look like your health insurance website, but it's not, right?
And that's the key thing. It's not. But if you're having to remember your passwords and reusing your passwords, you're just going to put in whatever information they ask for.
LastPass will check the URL, and if the URL doesn't match what you have in your vault, well, guess what? It's not going to auto-populate.
And so straight away, people will go, hmm, that's a little odd. Same with single sign-on, right?
There's applications that when people were in the office, they would have always been logging into, and because you're in the office and because you're on our network, well, guess what?
We can let you in, it's fine.
The beauty of single sign-on and the simplicity of single sign-on is that now for all of these applications that people typically have to remember passwords for, you can put them all just behind one wall.
And so it's simple, it's secure, you have the one password to access all of them applications.
Security teams now aren't able to go around in the office and talk to people and help people and whatever else.
So unless they want a deluge of more support tickets coming into their desk. What do they need to do? They need to make it simplistic and intuitive.
And that's not to say that the solution needs to be less secure. The solution can be really secure.
It just means that you need to make sure that the user experience is nice and slick.
What advice do you have for them to try and control their work environment so that the kids don't get on the systems and they make sure that their work stays safe and clear?
People are trying to log into different applications at different times.
Your broadband is probably maxed out to the last and you're trying to, you know, everybody's trying to work and everybody's trying to have their own social time as well.
So, you know, a few tips I would have would be try to, if you don't already, right, if you don't already, I would say download LastPass, download the family's version of LastPass if you're in the home, and add the different applications that you use to that and different devices that you use to that.
So be it some of the elements from your connected home, be it your Wi-Fi router, be it your different applications that you stream material through online, add them into that.
And that way then, everybody has the password that they need to hand whenever they want to access anything. And, you know, what's the benefit of that, you might ask?
Well, the benefit of that, you might ask, would be that you don't have one child fighting with another child because they've changed the password on Netflix and won't tell them what it is, or changed the password on something else and tell them what it is.
So at least that way, then everybody has access to everything that they need. All passwords and all usernames and whatever else, passwords can be unique.
And, you know, if you start that at home and that good practice at home, then, you know, for the parents in the house and the working people in the house, maybe bring that up a level and use that yourself within your own office environment.
You would not believe the amount of people who are resetting passwords right now because the Post-it notes that they have their passwords stored on are where?
They're in their office, on the screen, or stuck under the keyboard in the office. And so, you know, how are you trying to remember these things now?
So starting afresh, why not just, you know, download LastPass and start populating your stuff in there as well?
Given that the workforce has changed and the workforce position has changed so rapidly, so quick, trying to get to a stage now where organizations can be secure is going to be a rapid task, and that's going to be very quick.
So, you know, my advice would be look for solutions that meet your need, look for solutions that are going to be easy to use, and look for solutions that can be adopted and will be adopted very heavily.
Yeah, and have—
I think all of them are stressed out and panicking about their jobs and trying to do as much as they can.
But, you know, it's challenging times, as you said, with a broadband that is slower than average because everyone's hitting it at the same time and too many people in a small environment that wasn't designed for work.
So I think the intention's in there.
I love the idea of this software because not only does it help the organization, but it makes the life of the employee easier, which is why I'm a fan of LastPass.
We're trying to be as productive as we can during normal hours and then be even more productive outside of normal hours, if that makes sense.
So before the kids get up, try to get a bit of work in. When the kids go to bed, try to get a bit of work in.
And in between, we do not want to be stuck on phones trying to get stuff sorted out with help desks.
And help desks do not want us calling them with screaming kids in the background as well because everybody's stressed out.
So stuff that just works is the order of the day for organizations now and going into the future because this is going to change how we work and how we operate in the long term.
Tell me about it.
Hosts:
Graham Cluley:
Carole Theriault:
Guest:
David McClelland – @DavidMcClelland
Show notes:
- Engineers unleash car-seat identifier that reads your rear end — Phys.org.
- Identifying personal microbiomes using metagenomic codes — PNAS.
- A mountable toilet system for personalized health monitoring via the analysis of excreta — Nature.
- 'Magic toilet' could monitor users' health, say researchers — The Guardian.
- Toilet hackers could snoop on your poop, steal data of a “personal nature” — Graham Cluley.
- Zoomed In: A Look into a Coinminer Bundled with Zoom Installer — Trend Micro.
- PSA: Fake Zoom installers being used to distribute malware — Bleeping Computer.
- Was a 5G Tower Torn Down in China To Stop COVID-19? — Snopes.
- Coronavirus 5G Conspiracy Theory: UK Cell Towers Burned Over Claims It Causes COVID-19 — International Business Times.
- Coronavirus 5G conspiracy theory spreads as cellphone towers attacked — USA Today.
- 5G is not accelerating the spread of the new coronavirus — Full Fact.
- Influencers among 'key distributors' of coronavirus misinformation — The Guardian.
- How the 5G coronavirus conspiracy theory tore through the internet — Wired.
- Call for social media platforms to act on 5G mast conspiracy theory — The Guardian.
- Totally Reliable Delivery Service – The Game About Terrible Delivery Drivers.
- Totally Reliable Delivery Service – Launch Trailer — YouTube.
- LET'S GO LIVE with Maddie & Greg — YouTube.
- Power Corrupts Podcast.
- The godfather of fake news — BBC News.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
- Support us on Patreon!
LastPass Enterprise makes password security effortless for your organization.
LastPass Enterprise simplifies password management for companies of every size, with the right tools to secure your business with centralized control of employee passwords and apps.
But, LastPass isn’t just for enterprises, it’s an equally great solution for business teams, families and single users.
Go to lastpass.com/smashing to see why LastPass is the trusted enterprise password manager of over 33 thousand businesses.
Follow the show:
Follow the show on Bluesky at @smashingsecurity.com, on the Smashing Security subreddit, or visit our website for more episodes.
Remember: Subscribe on Apple Podcasts, Spotify, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!
Warning: This podcast may contain nuts, adult themes, and rude language.


