Can a video game help your company’s staff choose stronger passwords? Why might satellite-based internet communications be bad for security? And what are the alternatives to TikTok?
All this and much much more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by The Cyberwire’s Dave Bittner.
0:00
0:00
0:00
0:00
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
Hey everybody, Carole here. This is a shout out to our lovely Patreon supporters. These are the people that help give you the show for free, and we adore them.
This week we give heartfelt thanks to Phil, Sean, Zupa, Joe Mergel, David Lydia, Alexander Schellhass, Geoff Cole, The Green Girl, Afifi4, and Yan. All of you, thank you.
We couldn't do it without you. If you want to join our amazing Patreon community and get a few little extras, check us out at smashingsecurity.com/patreon.
And let's get this show on the road.
This week we give heartfelt thanks to Phil, Sean, Zupa, Joe Mergel, David Lydia, Alexander Schellhass, Geoff Cole, The Green Girl, Afifi4, and Yan. All of you, thank you.
We couldn't do it without you. If you want to join our amazing Patreon community and get a few little extras, check us out at smashingsecurity.com/patreon.
And let's get this show on the road.
They used it on almost 5,000 employees.
Okay.
And boy, were they pissed.
Yeah, they were loving it. They were loving it. They're like, this is a great use of my time. This is helping me with my bonus. Thank you very much.
Smashing Security, episode 191. We are on the bird with Carole Theriault and Graham Cluley. Hello, hello, and welcome to Smashing Security episode 191. My name is Graham Cluley.
I'm Carole Theriault.
And we're joined this week by a regular returning guest. He hasn't been back for a while, but we're delighted to have him on the show again. It's Dave Bittner from the CyberWire.
Hello, hello.
Hey, Mr. Bittner.
Hi, I'm excited to be back. Thank you for having me.
Yeah, so it's a little digital trip to the UK.
Yes, yes.
Because you can't fly here really.
No, we're not welcome there anymore, are we?
Nope.
No. Yeah.
On that jolly note, let's start the podcast. Carole Theriault, what's coming up on the show this week?
First, let's thank this week's sponsor, LastPass. Its support helps us give you this show for free.
Now, coming up on today's show, Graham introduces us to Passworld, Dave educates us on satellites, and I'll be looking at alternatives to TikTok.
All this and much more coming up on this episode of Smashing Security.
Now, coming up on today's show, Graham introduces us to Passworld, Dave educates us on satellites, and I'll be looking at alternatives to TikTok.
All this and much more coming up on this episode of Smashing Security.
Now, chums, imagine waking up in the middle of the jungle on a dark, spooky night.
I can tell you lived in suburbs.
No, but seriously, imagine it. Surrounded by odd noises.
Wah, wah.
Strange animals. Now in this particular case, you're not only in the middle of the jungle, but you're also an archaeologist.
Okay, so not scary at all then.
Well, it's not quite Indiana Jones. A young girl archaeo—
Oh, she's female, so what'd she know?
Well—
No wonder she's afraid.
God.
Anyone could be afraid. Well, look, she is exploring the jungle. Her name is Soma, and she's hunting for ancient lost statues. And she's about 60 pixels high.
I just want you to picture her because I'm describing a new video game, a video game called Passworld. Password with an L shoved in in order to make it—
I just want you to picture her because I'm describing a new video game, a video game called Passworld. Password with an L shoved in in order to make it—
Thanks for explaining. Yeah.
Well, in order to make it harder to spot, probably, if you're trying to crack the password, they put an extra letter in.
Developed by the researchers at—is it Tata Consultancy Services or Tata? They're a big—is it Tata or potato? T-A-T-A. I think they're a big Indian.
Developed by the researchers at—is it Tata Consultancy Services or Tata? They're a big—is it Tata or potato? T-A-T-A. I think they're a big Indian.
Tata.
Tata. You think?
I go with Tata. Yeah.
Okay. Anyway, this chap, Gokul Jayakrishnan, is a researcher at Tata. Oh, I can't remember. Anyway, there.
And in recent days, he explained at the USENIX Symposium on Usable Privacy and Security all about this video game that he's been writing.
And the reason why he was talking about it at the conference is that this game was designed in order to find out how helpful games could be at helping people choose better, stronger passwords.
And in recent days, he explained at the USENIX Symposium on Usable Privacy and Security all about this video game that he's been writing.
And the reason why he was talking about it at the conference is that this game was designed in order to find out how helpful games could be at helping people choose better, stronger passwords.
What, gamify the password selection effectively? Cool.
So I went and watched the video, and we'll put a link in the show notes. And there's also—
Good research, Graham. Good research.
Thank you very much. And there's also a technical paper which you scanned. Which I scanned quickly.
Which you made in a paper airplane with your son for it. Yeah. Okay. Good.
And because you're probably wondering what kind of game it is, right? Well, it's a platformer from about 1992 is the best way to describe it.
You've got your little character of Soma with her lockdown hair and a satchel on the back.
You've got your little character of Soma with her lockdown hair and a satchel on the back.
She looks adorable.
She is adorable.
She looks like Dora the Explorer.
Mm-hmm. She does.
Yes, she does, yes. And she jumps from platform to platform, and she picks up little tablets.
Not tablets you swallow, but stone tablets, which have different mechanisms for making your password harder.
Not tablets you swallow, but stone tablets, which have different mechanisms for making your password harder.
Is this made by Mormons?
No, not that kind of tablet. Okay. No.
Okay.
But— Carole, I was really hoping the Mormon Church would sponsor the podcast one day. And if you're gonna make—
Sure, they're gonna do it any day, any second.
Right.
Any second. And they're in.
Anyway, so she's picking up these things and they are different characteristics of passwords.
So for instance, an uppercase letter or a lowercase letter or a symbol or something that, right? And as she's dotting around, she will occasionally bump into a wild animal.
So she might bump into a fox.
So for instance, an uppercase letter or a lowercase letter or a symbol or something that, right? And as she's dotting around, she will occasionally bump into a wild animal.
So she might bump into a fox.
Ooh, scary. God, she must be so scared.
Right. And so the fox, rather than— I don't think it bites.
Thank God it wasn't a skunk, because then she'd probably be terrified.
There is a raccoon.
Oh, not a raccoon.
Yeah, there is a raccoon.
Geez. See, in England, I think the biggest animal here is a hedgehog. So they just don't get wildlife really.
We call them trash pandas here.
Hey, hedgehogs are super cute.
No, no, no. Raccoons are trash pandas.
Yeah, no, hedgehogs.
Yeah. Anyway, so when you bump into, for instance, the fox, the fox will say, yeah, hello, hello, Miss Soma. Hello, Miss Soma. Let me talk to you about vulnerable sequences. Okay.
Guessing alphabetic and numeric sequences is relatively easy for an attacker.
Guessing alphabetic and numeric sequences is relatively easy for an attacker.
Do you get it?
Do you get it? And so they explain some rules.
And so what they say is, don't use letters in sequence XYZ, and don't use numbers 4567, because it says that's the kind of thing which I know how to crack in a password, right?
And so what they say is, don't use letters in sequence XYZ, and don't use numbers 4567, because it says that's the kind of thing which I know how to crack in a password, right?
So, okay, so if I understand you correctly, they have created a game that teaches the average Joe in the street how to select a strong password, because people may not actually know.
They think it's strong because they put 1, 2, 3, ABC, but actually that's really lame.
They think it's strong because they put 1, 2, 3, ABC, but actually that's really lame.
I think also it's worth noting that in the animal kingdom, foxes are known for their password cracking abilities.
Yeah, well, you know, smart as a fox. We don't say that for nothing.
Exactly. No, no, it comes from somewhere.
Exactly.
Well, I wonder— she's petrified.
She does look petrified. But it's a little bit too educational to be fun at this stage, right? Because there's a big information—
You said the word sequence.
Well, because you've bumped into a fox and you're expecting to do some sort of Pokémon style battle, but instead they're saying, oh, don't use alphabetic or numeric sequences.
So there's a bit more of a game element than simply that, right? So you will bump into other characters as well. So you might bump into a snake who might remind you—
So there's a bit more of a game element than simply that, right? So you will bump into other characters as well. So you might bump into a snake who might remind you—
Oh, they're the worst.
Well, I think actually the trash pandas, the raccoons might be the worst of all, but all of them.
Snakes are so self-righteous.
So after a while, you've collected lots of tablets to make up what eventually you will have to generate into a password. And you've been advised on tips as well.
So you get to your camp in a clearing in the jungle and it says, okay, you're going to have to stay here for the night, right?
And you are going to create a gate to stop all the crazy animals, the fox, the raccoon, the snake, the wombat, whatever it may be, from coming in by choosing a strong password, right?
So you write your password which in the example I'm looking at right now, it is the word strong, but with a capital T and a capital G.
So you get to your camp in a clearing in the jungle and it says, okay, you're going to have to stay here for the night, right?
And you are going to create a gate to stop all the crazy animals, the fox, the raccoon, the snake, the wombat, whatever it may be, from coming in by choosing a strong password, right?
So you write your password which in the example I'm looking at right now, it is the word strong, but with a capital T and a capital G.
I wouldn't advise that to be strong.
Well, no, this is how they're playing it, right? In this particular example. So that, and then at, and then 007, and then a capital letter at the end. So it's not perfect.
It's strong at 007P.
It's strong at 007P.
Da-na-da-na.
Copyright, Carole. Copyright. And so during the night, each animal comes up to your gate and it tries to get through your password.
It looks at the characteristics and it will say, oh, you know, you haven't got an alphabetical sequence there, so it's not 123 and it's not XYZ, or you don't have more than two repeating letters, or you haven't just got a dictionary word with a number on the end.
So they will sniff out and try and get past. And so there's a gamified little element there, trying to get you to build a stronger password to keep the bad animals out of your camp.
It looks at the characteristics and it will say, oh, you know, you haven't got an alphabetical sequence there, so it's not 123 and it's not XYZ, or you don't have more than two repeating letters, or you haven't just got a dictionary word with a number on the end.
So they will sniff out and try and get past. And so there's a gamified little element there, trying to get you to build a stronger password to keep the bad animals out of your camp.
Question. Okay, this is very cool, because I think it's cool that people understand how to build a strong password.
Surely the way to win this game is to have a password manager and then just cut and paste the automatically generated password that they provide.
Surely the way to win this game is to have a password manager and then just cut and paste the automatically generated password that they provide.
It is. And don't call me Shirley.
Yes, yes. That is the way to win the game. But Carole—
See, I'm smart.
The real win is for employees to have strong passwords, isn't it? This is being used. This was used inside Tata, they used it on almost 5,000 employees.
Okay.
And boy, were they pissed.
Yeah, they were loving it. They were loving it. They're, this is a great use of my time. This is helping me with my bonus. Thank you very much.
So they did this on 5,000 employees. And what they did was they measured the passwords.
They looked at them, and they also not only looked to see if people were choosing, you know, how diverse the passwords were.
And they say that afterwards, there was an increase in password diversity.
And apparently, there was a 77% reduction in the use of common organisational terms, and many fewer employees were using blocked terms in their passwords.
But they also asked people whether they could remember their password. So there was a diversionary game.
So after you've survived two nights in the camp, they then got you to do another game, which is, okay, you're now going to have to get loads of twigs and make a campfire, right?
You have to get twigs and put them in the right order and start a little spark off.
And having done that, they then went back to the people unexpectedly and said, "So what's your password? Do you remember it?" Right?
They looked at them, and they also not only looked to see if people were choosing, you know, how diverse the passwords were.
And they say that afterwards, there was an increase in password diversity.
And apparently, there was a 77% reduction in the use of common organisational terms, and many fewer employees were using blocked terms in their passwords.
But they also asked people whether they could remember their password. So there was a diversionary game.
So after you've survived two nights in the camp, they then got you to do another game, which is, okay, you're now going to have to get loads of twigs and make a campfire, right?
You have to get twigs and put them in the right order and start a little spark off.
And having done that, they then went back to the people unexpectedly and said, "So what's your password? Do you remember it?" Right?
And was the right answer no? Because I think it's very good if people don't remember their passwords, so then they don't reuse them.
Again, password— I'm so sorry, password managers are good things.
Again, password— I'm so sorry, password managers are good things.
I'm wondering if the variation in the strength of their password was the result of the employees banging their heads against their keyboards in frustration.
You know what? Password managers are obviously great, right? And we're clearly big fans of them on this podcast. But there are— Yeah, and there are—
It has nothing to do with the fact that they sponsor both of our shows.
But— But there are circumstances where sometimes you do need to remember a password. You need to remember your master password, for instance, right?
You don't put your master password, or you can do, I suppose, inside your password manager.
You don't put your master password, or you can do, I suppose, inside your password manager.
I wouldn't use your master password inside the game either. Just like, no offense or anything. No, no. I just think that'd be bad.
There does need to be the ability sometimes to come up with a strong password which you remember rather than entirely relying upon your— Okay, true.
I understand what you're saying. However, I have to remember a lot of things, right?
I think most people now have to remember a lot of things they don't want to remember, PIN numbers, passcodes, door, you know, digital door opening stuff. There's just too much.
And if you don't use the same one, it's— And so this is doing it just for fun. Asking me to remember a complicated password.
I think most people now have to remember a lot of things they don't want to remember, PIN numbers, passcodes, door, you know, digital door opening stuff. There's just too much.
And if you don't use the same one, it's— And so this is doing it just for fun. Asking me to remember a complicated password.
It's not doing it just for fun. It's doing it to teach people better password practices.
I'm all for that. I just don't know if the having to remember the password is important.
Look, don't get so upset if you fail, right? I'm not crying. You're not gonna— Now, they did do a survey because Dave said, oh, this sounds so much fun. They did do a survey.
They claim most people said it was fun.
They claim most people said it was fun.
Most loved it.
I've looked at the graph. I would say 50%. Said this game, which was employed as a tool.
Okay, well, that's— Hey, that's a win. Right, Dave?
That's all you need.
Yeah. I just imagine, you know, because there's nothing that employees love more than having a mandatory thing that takes them away from getting their work done throughout the day.
Nothing better than that, right? We all love that.
Nothing better than that, right? We all love that.
It's what we live for.
Yeah. I remember, Carole, do you remember way back when there was a cybersecurity company we both worked for for some years?
Oh, yes. I thought this was—
Do you know what I'm going to talk about?
Yes, I know exactly what you're talking about.
So you tell people about it.
It was a game where you were playing the IT admin person.
That's right.
It was a 2D game, right? It was flat.
Yes.
And you had to run around the building and get all the computers fixed before the timer went out.
That's right.
And the idea was you play this game so that you can become a better IT person. Unfortunately, it wasn't very fun.
It wasn't very fun.
It was actually because an IT request would come in in the game saying a vulnerability has been discovered on this computer and you'd have to get up from your desk and you'd have to go walk to the lift and go up in the lift to the floor where the computer was and press a button and then come back to your IT department.
It was basically their job. But in a game form, it's, oh, here's something to—
It was actually because an IT request would come in in the game saying a vulnerability has been discovered on this computer and you'd have to get up from your desk and you'd have to go walk to the lift and go up in the lift to the floor where the computer was and press a button and then come back to your IT department.
It was basically their job. But in a game form, it's, oh, here's something to—
But you know what?
Hey, here's something you'll want to play.
In defence of that, Animal Crossing is effectively go around and keep— stay alive, get some fish, get some bugs, plant some flowers.
And when people seem to play that a lot, you too can live the exciting world of IT tech support.
Guess what? Now it makes sense because now everyone's under lockdown.
She was before her time, the one who created the game for that company that we don't mention.
Yeah. Anyway, so Passworld, I don't know if it's going to be released for other people to try out inside their organisation. It does look a bit retro.
So there may be some pushback from workers for that.
So there may be some pushback from workers for that.
They're going to go, hey, the graphics are shit, so we're not playing?
I like the memory test, because it reminded me there was a world leader who recently demonstrated his magnificent memory, remembering the words person, woman, man, camera, TV.
And he kept— he did it a few times just to show everyone that he was worth re-electing.
And he kept— he did it a few times just to show everyone that he was worth re-electing.
Yeah, it was extraordinary.
Incredible. So I think— I think Passworld may have a future. And that is why it's not my pick of the week, but it is my story today. Yeah, that's perfect.
Speaking of memory, Graham can't remember what part of the show we're in.
I know, I know. 'Cause it had so little to do with security.
Right. Well, dear me. Dave, what have you got for us?
Well, let's take a little trip back in time, shall we, together?
Oh, here we go.
Yeah, because I didn't do that this week.
Yeah, thank you.
Back in my younger days when I was fresh out of college, I believe you all refer to it as university.
Yes.
Well, or polytechnic, depends where you went.
Okay. Thank you.
I worked in the TV business. And one of the entry-level jobs that was available to folks who were fresh out of school was being a tape op. And that stands for tape operator.
This person had basically two jobs during a live TV show. One was to hit the record button on the broadcast VCR before we went on the air to record the show.
And you'd be surprised how often tape ops forgot to do that, or you'd find yourself leaping across the room to smash the record button to watch the reels start spinning.
And the other job was to stand by and to be ready to roll in stories that were prerecorded on tape.
So this is the pre-digital era when things were recorded on tape and we had things like VCRs and all that kind of stuff.
So my favorite thing about being the tape op was it meant that I got to hang out in master control, which was the room that had all the tape machines and the routing switches and the waveform monitors and the vectorscopes.
This person had basically two jobs during a live TV show. One was to hit the record button on the broadcast VCR before we went on the air to record the show.
And you'd be surprised how often tape ops forgot to do that, or you'd find yourself leaping across the room to smash the record button to watch the reels start spinning.
And the other job was to stand by and to be ready to roll in stories that were prerecorded on tape.
So this is the pre-digital era when things were recorded on tape and we had things like VCRs and all that kind of stuff.
So my favorite thing about being the tape op was it meant that I got to hang out in master control, which was the room that had all the tape machines and the routing switches and the waveform monitors and the vectorscopes.
Chairs with wheels.
Oh, yeah, yeah, yeah. So it was the engineering epicenter of the place, but it also meant that I got to hang out with the satellite engineers.
And they were the ones who were responsible for sending our signal up into space and monitoring that it came back properly. And they were sort of wizard-like.
They had all sorts of cool lingo they'd use. They'd say things like, "Let's light this candle," or, "We are on the bird."
And they were the ones who were responsible for sending our signal up into space and monitoring that it came back properly. And they were sort of wizard-like.
They had all sorts of cool lingo they'd use. They'd say things like, "Let's light this candle," or, "We are on the bird."
What does that mean?
Well, the bird is the satellite. So there's a bird in the sky, right?
Right, right, right.
So when your signal was live, you know, they would come into the control room and they'd say, "Control, we are on the bird." And then when you were done, they'd say things like, "Tell Star 5 we are clear.
That is a good night from us." So it was very Apollo-like, right? And you're sending things into space and back again. I mean, how cool is that?
So I got to learn about how satellite transmissions work and some of the technical limitations there, which brings me to satellite delay.
So when a satellite is in geosynchronous orbit, that means it is about 36,000 kilometers from Earth.
And that means that a round-trip signal at the speed of light, which we all know thanks to Eric Idle is the fastest speed there is, takes about half a second.
And the delays can add up if you have multiple hops. The signal goes up and down from multiple satellites.
And I think we've all seen this where you'll have a news anchor who's speaking to a reporter who's somewhere on the other side of the world, and the news anchor will say, "Bob, what do you think about this?" And there'll be several seconds of delay before we see the reporter reply.
That is a good night from us." So it was very Apollo-like, right? And you're sending things into space and back again. I mean, how cool is that?
So I got to learn about how satellite transmissions work and some of the technical limitations there, which brings me to satellite delay.
So when a satellite is in geosynchronous orbit, that means it is about 36,000 kilometers from Earth.
And that means that a round-trip signal at the speed of light, which we all know thanks to Eric Idle is the fastest speed there is, takes about half a second.
And the delays can add up if you have multiple hops. The signal goes up and down from multiple satellites.
And I think we've all seen this where you'll have a news anchor who's speaking to a reporter who's somewhere on the other side of the world, and the news anchor will say, "Bob, what do you think about this?" And there'll be several seconds of delay before we see the reporter reply.
Hey, Graham. Maybe that's our problem when we've talked on the phone, right? We have a satellite delay because normally it's like, "Hello, over." Yes. Hello?
Yes.
Are you there?
Carole and I seem to have a communication problem.
Yeah, that's what it is. Yeah.
That's what it is. It's satellites. Okay. Right, right, right, right.
So I took us all on this little geeky side trip to bring us back to the modern day where there are people who get their internet via satellite.
There are situations where if people live in rural areas where they can't—
There are situations where if people live in rural areas where they can't—
Your 5G tower has been burned down.
Right, right, exactly, exactly. But there are also, for example, maritime uses, out on ships, cruise ships.
Also, if you're using the internet on an airplane, which I think probably most of us have done, that's being serviced via satellite.
Also, if you're using the internet on an airplane, which I think probably most of us have done, that's being serviced via satellite.
I think most of us have done it once and then thought, I'm never doing that again. Not at that price. Yeah, exactly.
Exactly. So there's a researcher named James Pavor. He is a PhD candidate at Oxford.
And he presented at Black Hat and DEF CON on research that he and his colleagues have been doing on the security of satellite internet.
And he presented at Black Hat and DEF CON on research that he and his colleagues have been doing on the security of satellite internet.
All right.
And there's a really nice interview with James over on the Security Weekly podcast. I'm trying to get him on our own Research Saturday show.
So we'll have a link to that interesting interview. You can get his slides and all that sort of stuff as well.
But basically what James and his team have been looking at for the past couple of years is the security, or lack thereof, of satellite internet.
And what it comes down to is that because of the delay that's built into communications with satellites, that means latency, right?
In internet terms, that's latency, that the delay between a signal getting from point A to B and back again.
And so in order to minimize latency, the folks who are in the business of providing satellite internet basically do a friendly man in the middle with you and your data where they're doing all sorts of tricks.
And I admit I don't know all the technical details of them, but ways to reduce the impact of the latency.
And just for example, satellite internet sucks for playing online video games because of the latency, right? It's just, it's no good for that.
So because of these tricks that they're doing, what it means is encryption does not play nice with satellite internet.
So much of the communication that's going on is going on in the clear.
And James and his team have discovered that with about $300 of off-the-shelf hardware, basically a little dish-like antenna and a card you can put in your computer that can tune into these things, you can eavesdrop on satellite internet communications.
And he and his team have done just that. And they've been able to listen in on all sorts of communications.
They said particularly things from airplanes are interesting because who is doing communications from airplanes? Who's dropping the money?
So we'll have a link to that interesting interview. You can get his slides and all that sort of stuff as well.
But basically what James and his team have been looking at for the past couple of years is the security, or lack thereof, of satellite internet.
And what it comes down to is that because of the delay that's built into communications with satellites, that means latency, right?
In internet terms, that's latency, that the delay between a signal getting from point A to B and back again.
And so in order to minimize latency, the folks who are in the business of providing satellite internet basically do a friendly man in the middle with you and your data where they're doing all sorts of tricks.
And I admit I don't know all the technical details of them, but ways to reduce the impact of the latency.
And just for example, satellite internet sucks for playing online video games because of the latency, right? It's just, it's no good for that.
So because of these tricks that they're doing, what it means is encryption does not play nice with satellite internet.
So much of the communication that's going on is going on in the clear.
And James and his team have discovered that with about $300 of off-the-shelf hardware, basically a little dish-like antenna and a card you can put in your computer that can tune into these things, you can eavesdrop on satellite internet communications.
And he and his team have done just that. And they've been able to listen in on all sorts of communications.
They said particularly things from airplanes are interesting because who is doing communications from airplanes? Who's dropping the money?
Yeah.
The expense. And who finds it important to keep doing their business? Well, it's business people.
Yes.
So when they can find a downlink from an airplane, typically that can have high-value stuff in it. It can have passwords and corporate information and all that sort of stuff.
So yeah, in short, basically it's very, very— it'll add more latency to satellite communications if those things, those communications were encrypted. Is that basically correct?
Yeah, that is basically it.
And so in order to make satellite internet usable, to make it palatable, to not make it even more miserable than it is, in most cases they do away with the encryption.
And so that allows other folks to be able to listen in.
And so in order to make satellite internet usable, to make it palatable, to not make it even more miserable than it is, in most cases they do away with the encryption.
And so that allows other folks to be able to listen in.
By default, you'd think, wouldn't it be cool if they had encryption on and say, look, we're going to encrypt this. So if you're saying anything important, we're protecting that.
But if you want it to be a bit of a faster link, you can get rid of encryption if both parties agree. But then it's open to the internet.
But if you want it to be a bit of a faster link, you can get rid of encryption if both parties agree. But then it's open to the internet.
That is an option. I mean, you can always encrypt your own stuff at your end. You could always use a VPN to go through the satellite.
But one of the things that James points out in his research is that you don't necessarily know if your internet traffic is taking a hop on a satellite.
But one of the things that James points out in his research is that you don't necessarily know if your internet traffic is taking a hop on a satellite.
That's what I was wondering, whether the only people who are affected are the ones who've sort of bought into the satellite internet service.
Presumably communications are going in both directions.
I'm sending information to somebody, if they are remote or if they use a satellite internet link, that information could maybe be intercepted at their end as well.
Presumably communications are going in both directions.
I'm sending information to somebody, if they are remote or if they use a satellite internet link, that information could maybe be intercepted at their end as well.
Absolutely.
Absolutely.
And the way that satellites work is the signal that they send back down to Earth is huge. They are covering a large swath of the planet. That's why they work.
So it's not like it's a direct sort of laser beam between point A and point B, this signal is coming down and hitting entire continents.
So anybody with an antenna can pick them up and try to pick out what could be going on within them. So really interesting research from James.
If you want to dig into it quickly, I recommend the Security Weekly podcast video.
So it's not like it's a direct sort of laser beam between point A and point B, this signal is coming down and hitting entire continents.
So anybody with an antenna can pick them up and try to pick out what could be going on within them. So really interesting research from James.
If you want to dig into it quickly, I recommend the Security Weekly podcast video.
Hang on a minute. This James chap, right? And I'll go and listen to the podcast and hopefully you'll get him on a future show of yours as well.
Has he come up with any proposals as to what can be done to better handle this?
Has he come up with any proposals as to what can be done to better handle this?
He has. In fact, he and his team have come up with some ways to deal with both the delay and the security.
One of the things I learned about this that was fascinating to me, being an old video guy, is that a lot of the digital communications for satellite internet has basically been grafted on old video standards.
One of the things I learned about this that was fascinating to me, being an old video guy, is that a lot of the digital communications for satellite internet has basically been grafted on old video standards.
They're using—
I'm not surprised, though.
They're using MPEG-4, which is a tried and true video standard, and they're basically grafting on data channels onto MPEG-4 standards because that's what the satellites are used to seeing, right?
That's what the satellites want to see are these MPEG-4 streams. So, of course, it's just really fascinating work here.
They're using MPEG-4, which is a tried and true video standard, and they're basically grafting on data channels onto MPEG-4 standards because that's what the satellites are used to seeing, right?
That's what the satellites want to see are these MPEG-4 streams. So, of course, it's just really fascinating work here.
It reminds me a little of something Pentest Partners were talking about in the last few days, which is Boeing 747s.
Apparently their critical software updates are delivered by 3.5-inch floppy disks.
Apparently their critical software updates are delivered by 3.5-inch floppy disks.
Yes, well, actually, I think that's probably pretty safe these days.
It may well be safe, but it really shows you that, you know, technology can move on, but some of the hardware we use and some of the standards we're using are really still quite old.
Well, the idea, I think the idea is prevalent, especially in big, big organizations, that better the devil you know, right?
So the system we have may not be the cutting edge, but we know how to work it and we're not in that shit show of something's been exposed or—
So the system we have may not be the cutting edge, but we know how to work it and we're not in that shit show of something's been exposed or—
And things would definitely be worse if satellites suddenly couldn't communicate with us because we decided to upgrade the encryption or something, you know, if we goofed up that.
So I imagine there's a lot of nervousness about doing things like that.
So I imagine there's a lot of nervousness about doing things like that.
Exactly, it's hard to just go up there and fix them.
That's what your satellite engineers really should have done. That's what would've impressed me.
If they said, "I'm a satellite engineer," you'd have thought, "Gee, wow, you're going up in your suit." A giant slingshot, yeah.
If they said, "I'm a satellite engineer," you'd have thought, "Gee, wow, you're going up in your suit." A giant slingshot, yeah.
You know, Elon Musk could have thought about this, right?
And he could have sent someone up in his car when he sent the car up and they could drive around and go fix all the satellites.
And he could have sent someone up in his car when he sent the car up and they could drive around and go fix all the satellites.
So, Carole, to that point, the constellation of satellites that Elon Musk is putting into orbit right now, thousands of satellites, but these are not geosynchronous.
These are in very low Earth orbit.
These are in very low Earth orbit.
Why? Why?
Because being closer to Earth, there's less delay, less latency.
So does that mean it's gonna ruin our night sky? Are there gonna be a line so it spells Elon Musk is the best?
Yes, astronomers are already up in arms. No, seriously.
I bet they are.
You're blocking my view of Venus.
I know, this is a— I'm just digressing slightly. I can't now.
I'm fucking too rude. Carole, Carole, what's your story for us this week?
Well, last week, Donald Trump, President of the United States, if you haven't heard of him, issued yet another pair of executive orders that would ban any US transaction with the Chinese companies that own TikTok and WeChat.
Now, those companies are ByteDance and Tencent. And he said the US must take aggressive action in the interest of national security.
And this executive order is going to be put in force in 40-some days.
This made some people freak out because Tencent, while it owns WeChat, also owns quite a lot of games like League of Legends, Fortnite, which we know are extremely popular in the States.
So people were like, what do you mean you're going to block— what are you going to block that too? And they were like, no, no, no, no, no.
Video game companies owned by Tencent will not be affected by this executive order. It's just the WeChat stuff, which is weird.
You don't trust the company, you don't trust the company.
Now, those companies are ByteDance and Tencent. And he said the US must take aggressive action in the interest of national security.
And this executive order is going to be put in force in 40-some days.
This made some people freak out because Tencent, while it owns WeChat, also owns quite a lot of games like League of Legends, Fortnite, which we know are extremely popular in the States.
So people were like, what do you mean you're going to block— what are you going to block that too? And they were like, no, no, no, no, no.
Video game companies owned by Tencent will not be affected by this executive order. It's just the WeChat stuff, which is weird.
You don't trust the company, you don't trust the company.
What is Donald Trump's problem with TikTok?
I think it's a problem with China.
Oh, I thought it was a problem with Sarah Cooper and this was his way of shutting her up.
No, but I mean, there's speculation that the personal grudge he has against TikTok is that it was the youngsters, the kids on TikTok who were responsible for his embarrassing campaign rally.
They booked tickets for his rally, didn't they? Yes. Yeah.
Yes. So they thought because of the TikTokers, they thought that there were going to be tens of thousands of people. There were going to be lines around the block.
They installed overflow presentations with big jumbotrons outside, and then basically nobody showed up.
They installed overflow presentations with big jumbotrons outside, and then basically nobody showed up.
Well, it's nice. It's predictable. It's a president that he's reacting to. Okay.
Yes.
Yes. So that— I mean, who knows if that's true, but there is speculation to that end.
There are a number of companies out there that have banned the use of TikTok within their company organization, and the administration considers the Chinese-owned app to be potentially a security threat.
And that's not just them, right? Other people have been making these sounds for a number of months.
And that's not just them, right? Other people have been making these sounds for a number of months.
Yeah, we've banned it here at Cluley Associates.
Have you? Well, how's that working? Is anyone following the ban?
Well, 50% of the employees are following the ban, which is me. My wife, not so much.
So that means that if TikTok wants to continue working in the US, they need to find a new parent company.
And one of the options was to sell its US operations to Microsoft or another US firm or alternatively face an outright ban.
Rumors are flying also about Twitter having preliminary chats about a combination approach of doing business with TikTok, which probably now has blown up since this executive order.
TikTok have not confirmed or denied it, but it's funny because Twitter, they started with Vine, didn't they?
And one of the options was to sell its US operations to Microsoft or another US firm or alternatively face an outright ban.
Rumors are flying also about Twitter having preliminary chats about a combination approach of doing business with TikTok, which probably now has blown up since this executive order.
TikTok have not confirmed or denied it, but it's funny because Twitter, they started with Vine, didn't they?
Yeah, there was Vine and there was Periscope.
Periscope, that's right.
I was just mulling in my mind, I was thinking, if Trump really did want to kill off TikTok, then I think selling it to Microsoft might be a good idea, because after all, look at the mess they made with Skype.
Skype is shit. I really hate Skype.
Yeah, but it shouldn't be, should it? It shouldn't be, but it is. And I don't think it initially was. I think it was initially amazing.
And it's just— anyway, that's sort of distraction.
And it's just— anyway, that's sort of distraction.
Well, there's all kinds of fallout and complications with this executive order.
One of them is the ACLU say that the executive order would violate First Amendment rights of users in the US by subjecting them to civil and possibly criminal penalties for communicating with family members, friends, or business contacts that might be on these apps via WeChat, for example.
One of them is the ACLU say that the executive order would violate First Amendment rights of users in the US by subjecting them to civil and possibly criminal penalties for communicating with family members, friends, or business contacts that might be on these apps via WeChat, for example.
Because it's written into the Constitution, isn't it, that you should be able to do a TikTok-style dance anytime that you want to? That's the really important thing.
No, no, but also WeChat is basically like Google Hangouts or whatever.
Oh yeah, WeChat's absolutely huge, but not as popular obviously outside China.
So TikTok, what are going to be some of the complications? Because the thing is TikTok is raking in the cash, right? And there's a lot of companies that want a piece of this action.
So ByteDance, owner of TikTok, took a larger chunk of the digital advertising market than Tencent and Baidu. They took in about a quarter of all ad revenue, so $7 billion USD.
That's not chump change. And they're currently valued at $75 billion.
So if they're going to be banned and it's such a lucrative market, you can imagine there's going to be some what we call alt TikToks trying to make some noise.
And I wanted to give you, because actually just yesterday I was talking to a friend from Boston who was talking about his daughter and saying, she wants to get on TikTok.
I don't want her on TikTok, but what are the options? What other things can we suggest.
So ByteDance, owner of TikTok, took a larger chunk of the digital advertising market than Tencent and Baidu. They took in about a quarter of all ad revenue, so $7 billion USD.
That's not chump change. And they're currently valued at $75 billion.
So if they're going to be banned and it's such a lucrative market, you can imagine there's going to be some what we call alt TikToks trying to make some noise.
And I wanted to give you, because actually just yesterday I was talking to a friend from Boston who was talking about his daughter and saying, she wants to get on TikTok.
I don't want her on TikTok, but what are the options? What other things can we suggest.
All right.
So this is for you, Dan. Okay. So number 1, I call it the grandpa. Okay. This is a company called Byte, not ByteDance.
Now, the reason I called the grandpa is it launched just before Christmas, which turns out in this world is actually quite old, as you'll see soon.
Now, the reason I called the grandpa is it launched just before Christmas, which turns out in this world is actually quite old, as you'll see soon.
I think I have a Byte account.
Do you? Well, I'm not surprised.
Because the grandpa thing.
Well, because it was created by Vine's creator. And it has this kind of cult following of, if you were into Vine, then you'd be into this, right?
So basically, it's TikTok, but with a little less whiz-bang. The videos can only be 6.5 seconds long rather than, I think, 15.
And its minimalist option is what people are calling it. So if you want an app with more editing options, this may not be the one for you right now.
And of course, what's very nice is they have a privacy agreement, which actually makes sense, and you can read it online, which is all very good.
Number 2 is Triller, thriller without the H. And I'm calling these guys the dark horse. So they have about 250 million users, and it's growing very fast.
I think they're trying to become the new Zoom, next to Skype, for example, when the pandemic happened.
So basically, it's TikTok, but with a little less whiz-bang. The videos can only be 6.5 seconds long rather than, I think, 15.
And its minimalist option is what people are calling it. So if you want an app with more editing options, this may not be the one for you right now.
And of course, what's very nice is they have a privacy agreement, which actually makes sense, and you can read it online, which is all very good.
Number 2 is Triller, thriller without the H. And I'm calling these guys the dark horse. So they have about 250 million users, and it's growing very fast.
I think they're trying to become the new Zoom, next to Skype, for example, when the pandemic happened.
How can that happen? How can a service have 250 million users and I've never heard of it. How quickly has that grown? That's unbelievable, isn't it?
And this is basic— well, you're about to tell us.
And this is basic— well, you're about to tell us.
It's a TikTok alternative, but it uses— I'm putting this in quotes because it's what they call it— AI-guided editing tools.
So whatever the heck that means, probably they have some helpful tips like the Microsoft paper clip. Yeah, Clippy clip clip going, "Hey, you know what's a good idea?
It looks like you're trying to edit a video. Let me help." Now, what makes Triller interesting is it already has a serious foothold in the music industry, unlike Byte.
So there's loads of stars that have invested in this, like Snoop Dogg and Eminem. With those ties, they're able to have a lot of flexibility.
You can find a lot of songs, you can play a lot of stuff. And they are sitting atop the App Store in the US, UK, Brazil, Germany, and Australia. Yeah, so that's interesting.
And they've attracted recently some seriously big investors, and they're flashing out in the ad cash because— their PR cash too.
I've seen loads and loads of interviews with them over the past few weeks. So that's interesting. They're really trying to grab some of this market.
The thing that I didn't like about Triller, however, is I can't find any privacy notice online anywhere, even though they refer to it inside their terms in their agreement terms.
So they keep saying, please refer to our privacy policy, referring to it.
And I couldn't find anywhere— I looked online, other people were looking for it and couldn't find it either. So that's interesting.
And that would make me stay the heck away from Triller until I had to be able to see that. Now, this is the last one, is Instagram Reels.
Now, Instagram Reels literally launched this week. These are from the makers of Facebook.
And this is like, you see, I'm talking out of my ass here because I don't know anything about Instagram. But it involves a major revamp of this product they had called Explore.
Don't know. You guys don't know either.
So whatever the heck that means, probably they have some helpful tips like the Microsoft paper clip. Yeah, Clippy clip clip going, "Hey, you know what's a good idea?
It looks like you're trying to edit a video. Let me help." Now, what makes Triller interesting is it already has a serious foothold in the music industry, unlike Byte.
So there's loads of stars that have invested in this, like Snoop Dogg and Eminem. With those ties, they're able to have a lot of flexibility.
You can find a lot of songs, you can play a lot of stuff. And they are sitting atop the App Store in the US, UK, Brazil, Germany, and Australia. Yeah, so that's interesting.
And they've attracted recently some seriously big investors, and they're flashing out in the ad cash because— their PR cash too.
I've seen loads and loads of interviews with them over the past few weeks. So that's interesting. They're really trying to grab some of this market.
The thing that I didn't like about Triller, however, is I can't find any privacy notice online anywhere, even though they refer to it inside their terms in their agreement terms.
So they keep saying, please refer to our privacy policy, referring to it.
And I couldn't find anywhere— I looked online, other people were looking for it and couldn't find it either. So that's interesting.
And that would make me stay the heck away from Triller until I had to be able to see that. Now, this is the last one, is Instagram Reels.
Now, Instagram Reels literally launched this week. These are from the makers of Facebook.
And this is like, you see, I'm talking out of my ass here because I don't know anything about Instagram. But it involves a major revamp of this product they had called Explore.
Don't know. You guys don't know either.
Nope.
We're old. We don't know any of this stuff. Now the biggest difference that people can see in Reels is that they can send videos to friends in the Instagram app as well.
So there's kind of some weird flexibility and what people think are going to be— is going to be great about this is that they already have this huge, huge market, right?
Loads of people use Instagram. And also loads of people know how to use the Instagram filters and all the tools. So there's not this learning process that one has to go through.
So there's kind of some weird flexibility and what people think are going to be— is going to be great about this is that they already have this huge, huge market, right?
Loads of people use Instagram. And also loads of people know how to use the Instagram filters and all the tools. So there's not this learning process that one has to go through.
People have already got a built community there of their friends and so forth, whereas on these other apps you have to go and find them and reconnect with people.
You know, hearing, for example, that Facebook want to get in on the party and that Byte is existing and there's these new— it's not surprising to me that Twitter want to get in on it and maybe even having chats with TikTok on how they could operate together so that they can stay competitive.
But it's ironic, isn't it, that if we think Instagram Reels is going to win this race, this is the privacy and legislation and oversight poo-pooing Zuckerberg, right, who owns this.
And he may be one that benefits most from this executive order.
But it's ironic, isn't it, that if we think Instagram Reels is going to win this race, this is the privacy and legislation and oversight poo-pooing Zuckerberg, right, who owns this.
And he may be one that benefits most from this executive order.
Oh, well, you know, Facebook believes the solution to any problem is more Facebook.
Yeah, it's true.
Yeah. Yeah. I think it'd be brave to vote against Facebook being able to use its clout.
So, Carole, where do you stand on all of these TikTok-style apps from the privacy and security point of view?
So, Carole, where do you stand on all of these TikTok-style apps from the privacy and security point of view?
I think what's happening is parents are seeing their kids using this all the time and they want to know whether it's dangerous or not dangerous.
And I think no one can answer that at the moment, but I think an executive order kind of makes that decision for you.
So if that's going to go across, that means that effectively users are breaking the law if they use this app.
So I guess the phone providers and the host will not provide it on the phone. Like, how will that work? Could you still download it, which won't be available for download?
Will it be just removed from your phone?
And I think no one can answer that at the moment, but I think an executive order kind of makes that decision for you.
So if that's going to go across, that means that effectively users are breaking the law if they use this app.
So I guess the phone providers and the host will not provide it on the phone. Like, how will that work? Could you still download it, which won't be available for download?
Will it be just removed from your phone?
You know what we really need to do? We need to get Donald Trump on as a guest on the show.
Yes, he can explain it all to us.
He could.
Yeah, in very easy language as well. So that would be useful.
That'd be handy. We'll do that. If he's too busy, we'll get Kellyanne Conway or someone like that as well.
Hey, you IT security guys out there, I know that you have a tough job.
If you want increased security without impacting productivity, if you want to secure every entry point to your business, if you want to unify access and authentication, then check out LastPass.
They have the tools to make your life easier. Learn more at smashingsecurity.com/lastpass. Oh, and the rest of you out there, don't freak out.
There's a free password manager for home use. Check it out at smashingsecurity.com/lastpass.
If you want increased security without impacting productivity, if you want to secure every entry point to your business, if you want to unify access and authentication, then check out LastPass.
They have the tools to make your life easier. Learn more at smashingsecurity.com/lastpass. Oh, and the rest of you out there, don't freak out.
There's a free password manager for home use. Check it out at smashingsecurity.com/lastpass.
And welcome back. Can you join us on our favorite part of the show, the part of the show that we like to call Pick of the Week.
Pick of the Week.
Pick of the Week.
Pick of the Week is the part of the show where everyone chooses something they like.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish. Doesn't have to be security related necessarily.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish. Doesn't have to be security related necessarily.
Better not be.
Well, my pick of the week this week is not security related.
Good.
In recent weeks, I've been choosing a few games. Trying to play games which aren't video games because obviously I'm in lockdown with the family.
We talked about this last week. Yes, we did.
Yes.
And this weekend my nephew was celebrating his 18th birthday, which meant that we all descended on London to— yeah, I know— in a socially distanced, hopefully, fashion to celebrate his birthday.
Unusually, he wasn't the only one getting gifts. I was actually given a present. I was given a present by my father-in-law.
Turns out I am once again the winner of the best son-in-law competition, because only I was singled out for a present rather than—
Unusually, he wasn't the only one getting gifts. I was actually given a present. I was given a present by my father-in-law.
Turns out I am once again the winner of the best son-in-law competition, because only I was singled out for a present rather than—
Does he have any other sons-in-law?
He does. He does, including the father of the 18-year-old.
Was he there?
Yes, he was.
You're kidding me.
And so I quite often am recognized as the greatest son-in-law.
Can you just tell me why? What does he say when he says you're the greatest son-in-law? Does he list off some reasons as to why the other one is shit?
He didn't specifically call it the Best Son-in-Law Prize. I thought—
That's just your interpretation.
Yeah. You see, Graham, this is what I deal with, Dave. You always have to question.
I view it as that because I was the only one to be given a gift. And so I thought, well, obviously I'm being singled out for some reason.
It's not my birthday, but I was given the gift. It's a marvellous gift of a little board game called— Well, is it called Corridor or Quoridor? I'm not sure. Q-U-O-R-I-D-O-R.
So, cool.
It's not my birthday, but I was given the gift. It's a marvellous gift of a little board game called— Well, is it called Corridor or Quoridor? I'm not sure. Q-U-O-R-I-D-O-R.
So, cool.
Really batting a thousand with the pronunciations today, Graham.
Now, this is his new joke.
He's gonna be doing this for 4 weeks. This is a strategy game made up on a 9x9 board where each person has 1 pawn, and you have 10 pieces.
1 pawn?
1 pawn, as in a piece.
Oh, right, right. Sorry.
Yeah, please. And they also have 10 pieces of fence, and your mission is to move your pawn over to the other side of the board. And your opponent is trying to do the same as well.
And they are placing down fences occasionally, which you cannot jump around. And you need to get around. And it's surprisingly deep, is what I found.
And they are placing down fences occasionally, which you cannot jump around. And you need to get around. And it's surprisingly deep, is what I found.
Weren't you trying to learn piano for a while?
I'm still waiting until I've— Okay. So look, Carole, I wasn't going to talk about this until I've actually learned how to play the piano.
Yes, I did over a year ago buy a book called Learn the Piano in 5 Weeks, and I haven't yet had the time, and I think I know why.
Well, I'm meant to be practicing for 45 minutes a day, and it's more like 45 seconds a day.
So, but anyway, so I'm a little bit behind schedule on that, but it does sound beautiful what I can do to my ears.
Anyway, that's for another Pick of the Week in the future when I've mastered the piano.
You know, for now, this is quite an interesting game, and I think some of our listeners would really enjoy it. And I was playing it with adults and kids alike.
You can learn the rules in about 2 minutes, and after about the third game, you go, oh, strategy's involved here.
Yes, I did over a year ago buy a book called Learn the Piano in 5 Weeks, and I haven't yet had the time, and I think I know why.
Well, I'm meant to be practicing for 45 minutes a day, and it's more like 45 seconds a day.
So, but anyway, so I'm a little bit behind schedule on that, but it does sound beautiful what I can do to my ears.
Anyway, that's for another Pick of the Week in the future when I've mastered the piano.
You know, for now, this is quite an interesting game, and I think some of our listeners would really enjoy it. And I was playing it with adults and kids alike.
You can learn the rules in about 2 minutes, and after about the third game, you go, oh, strategy's involved here.
I can see just from the Wikipedia page, I think you could actually just build your own little paper or cardboard version of this.
You could, but you'd have to have the little fences stand up.
Yeah. Or just be—
The carpet.
Yeah.
Well, yes, you could do that if you want a little project. My little project is learn the piano. I will come back to you in 18 months and ask you if you've built your corridor board.
All right.
But that is my pick of the week.
Very nice.
It's quite enjoyable.
I'm worrying about you, Ben.
What are you worried about?
Just your mental wellbeing.
Well, this is what's keeping me happy.
It's just been a lot of board games.
It's because I'm having a leisurely August.
Okay.
All right. Jeez.
Any good distraction during the pandemic, right? Any healthy—
Thank you very much, Dave.
You could be cooking, right? You could be cleaning the bathroom. Could be helping out.
That all sounds like hot work. I don't go to my nephew's 18th birthday party to—
Scrub the loo.
To scrub the shit off the side of his loo.
He'd love it though.
No.
An 18-year-old would be in heaven.
I don't think he would love it. I don't think he would love it. You don't know him.
The reason he goes is to be reminded that he's the greatest son-in-law.
Of course. That's why he goes.
Of course.
Yes, self-declared. You're gonna get a t-shirt, Maygrim.
I don't need to. I'm the only one who gets given presents.
Maybe a tiara.
Maybe you're the more needy one, you know.
Maybe. Dave, what's your pick of the week?
Well, I love handy gadgets and I love things that enable me to use the things that I already own beyond their initial intentions.
And like a lot of folks who are homeowners, I have a set of handy cordless tools that I use around the house, a cordless drill, I have a cordless string trimmer.
I have a hedge trimmer. I even have a cordless chainsaw that I use.
And like a lot of folks who are homeowners, I have a set of handy cordless tools that I use around the house, a cordless drill, I have a cordless string trimmer.
I have a hedge trimmer. I even have a cordless chainsaw that I use.
Cordless vacuum?
Do not, no, I don't have a cordless, well, I have a Dustbuster, so a small one, yes, going around and getting the little dust bunnies from the dog hair that floats around the house.
But one of the nice things, I have done what is, I bought into an ecosystem. For these devices, and I happen to have bought into the Black & Decker 20-volt battery system, right?
I don't know, is Black & Decker a brand?
But one of the nice things, I have done what is, I bought into an ecosystem. For these devices, and I happen to have bought into the Black & Decker 20-volt battery system, right?
I don't know, is Black & Decker a brand?
Oh yes, oh yes.
Okay, so you're familiar with it.
Oh yeah.
All right, so thanks to the internet and thanks to China, where if you have an idea for something, chances are someone has already made it, someone has made an adapter for Black & Decker 20-volt batteries that allows you to attach it to the battery, and what you get out of it are a couple of USB power ports, high amperage USB power ports, oh, and a 12-volt power port as well.
So you have these batteries that are high-capacity batteries, and you can use them to do things charge your phone or power your GoPro or basically anything that you would use.
And anything you would need USB power for. You can use the batteries you already have for the tools around your house.
You can clip this thing onto one of those batteries and you can use them for other things. And I think it's very handy. They make them for all different types of tool batteries.
So if you're a DeWalt person, if you're a Makita person, you can find these adapters for all the different brands. And I love it. It's handy. It's great to have around.
And so that is why it is my pick of the week.
So you have these batteries that are high-capacity batteries, and you can use them to do things charge your phone or power your GoPro or basically anything that you would use.
And anything you would need USB power for. You can use the batteries you already have for the tools around your house.
You can clip this thing onto one of those batteries and you can use them for other things. And I think it's very handy. They make them for all different types of tool batteries.
So if you're a DeWalt person, if you're a Makita person, you can find these adapters for all the different brands. And I love it. It's handy. It's great to have around.
And so that is why it is my pick of the week.
That is very cool, Dave, but I see an issue.
Me too. I'm glad— go, Graham.
Which is that then you need to drill a hole or use your electric toilet scrubber, Black & Decker attachment, or whatever it is, and the ruddy battery has run down because you've been charging your phone from it.
Exactly.
Right? You've got a gazillion places to plug in your bloody phone or your USB devices. Why are you draining your Black & Decker battery.
But you see, Graham, this is why you buy into an ecosystem, because when you buy into an ecosystem, you have multiple batteries. Each device comes with a battery.
So the more devices you have, the more batteries you have, the more chargers you have.
So presumably, if you're me, you have a little shelf in your workshop, and that's where your batteries live, and they sit there charging.
So at any given moment, I have 4 batteries that are ready to go, topped off, ready to go.
So it's not an issue of one battery being run down because I have my battery well runneth over.
So the more devices you have, the more batteries you have, the more chargers you have.
So presumably, if you're me, you have a little shelf in your workshop, and that's where your batteries live, and they sit there charging.
So at any given moment, I have 4 batteries that are ready to go, topped off, ready to go.
So it's not an issue of one battery being run down because I have my battery well runneth over.
I'm so jealous of Mrs. Bittner. She is so lucky to have you.
I have another issue that's different. So you are, this is not made by Black & Decker. This is for Black & Decker devices.
Totally unauthorized.
Exactly. So you basically have something that plugs into the wall. You're giving it power and then you're putting your phone into it.
You have no idea what it's sucking off your phone or sucking off anything you put in there.
You have no idea what it's sucking off your phone or sucking off anything you put in there.
Hang on, Carole. You think the battery, you think the battery charger—
How do you know? How do you know?
Yeah, it's not grabbing data on his phone.
It's not hooking up. There's no Wi-Fi. There's no connectivity.
Well, even if it was, even if it was sucking off data from his phone, where is it going to put it, Carole?
Oh, good point. Yeah.
On a satellite?
Yeah. Oh, maybe it's got a satellite sender inside. Transmitter.
Right.
Yes.
This is their plan. One at a time, they're sneaking these devices into battery conversion units to be able to pull things off of our—
It's like a black box of information.
Thank goodness we have you, Carole, to save the world.
A lot of people say that.
A lot of people. It's true. It's true.
Exactly.
Yeah. What's your pick of the week?
Okay, so before my pick of the week, a question. Okay, a scenario. What would you do? Okay, you and Dave, you and Dave are best buds, right?
Yes, we are.
And they want to help your poor mom, okay? She needs some money, right.
And you, Graham, hear that the local fish market here in Oxford is housing a four-hundred-pound bluefin tuna in its freezer.
And you, Graham, hear that the local fish market here in Oxford is housing a four-hundred-pound bluefin tuna in its freezer.
Okay, that sounds quite heavy.
And one of your buddies, me, said, "Look, you can get me that tuna, I'm going to give you a good ten grand." And your problem is, how do you get that four-hundred-pound tuna from one side of Oxford to the other without a car and without catching anyone's attention?
How do you guys do it?
How do you guys do it?
Oh, without catching anyone's— I was initially thinking roller skates. You could attach roller skates to corners.
The first problem, it's four hundred pounds and it's sitting on a table. So how do you actually pick it up? It's slippery. Yeah, it's a fish.
It's slippery. It's slippery.
I'd say one bite at a time.
Sushi.
Well, the guys from the Young Offenders TV series, which is my pick of the week, had this exact scenario. They had this exact scene play out, and it's set in Cork.
And your two main characters are best friends, Connor and Jock, and they're both incredibly potty-mouthed, to the point which makes me sound like an angel.
And they sport the most ludicrous pudding basin haircuts I've ever seen in my life. Literally just like the top, almost like a monk. Like a monk.
And your two main characters are best friends, Connor and Jock, and they're both incredibly potty-mouthed, to the point which makes me sound like an angel.
And they sport the most ludicrous pudding basin haircuts I've ever seen in my life. Literally just like the top, almost like a monk. Like a monk.
Like Friar Tuck.
Like Friar Tuck. They're lovable, but play fast and loose with the law. But they handle the tuna by bringing a shopping trolley to the place, breaking in.
But it's an incredibly funny scene. And then of course it gets rocked over at some point halfway on the journey and they don't know what to do with it.
So they end up putting it in the water, right, with a little string around its neck and they just bring it to the other side of town in the water.
This dead fish, they just drag it along. Smart, right?
But it's an incredibly funny scene. And then of course it gets rocked over at some point halfway on the journey and they don't know what to do with it.
So they end up putting it in the water, right, with a little string around its neck and they just bring it to the other side of town in the water.
This dead fish, they just drag it along. Smart, right?
Very clever.
So clever. Except you won't believe what happened when they pull it out. You'll have to watch to find out. It's great, great, great.
This whole plan is based on the fact that there's a convenient river nearby?
Well, this one, yes.
Well, that's the thing. You have to redirect a river to go through your town. Now you said Oxford.
That's why I said Oxford.
I know, I already thought about that.
We have the Thames.
We've got the Thames, right? Okay.
Don't you have one in your fancy neighbourhood, Dave?
Oh, we have many, many rivers.
Of course, of course.
Okay, no, but seriously, this is— The Young Offenders, the script is really funny, incredibly funny. And it's kind of— it's heartwarming and very human.
And you can get it on BBC iPlayer. And I think there's a movie as well, but I haven't seen that yet.
I think the movie was the first thing that they came out, and then they went with this series. I think they're going to work on a season 3 now.
So there's at least 2 series available on iPlayer, and I totally recommend it. 5 stars from me. So that's The Young Offenders on BBC iPlayer.
And you can get it on BBC iPlayer. And I think there's a movie as well, but I haven't seen that yet.
I think the movie was the first thing that they came out, and then they went with this series. I think they're going to work on a season 3 now.
So there's at least 2 series available on iPlayer, and I totally recommend it. 5 stars from me. So that's The Young Offenders on BBC iPlayer.
Cool. All right. Marvelous. Well, that just about wraps up the show for this week. Dave, I'm sure lots of our listeners would love to follow you online.
What's the best way for folks to do that with maximum not maximum, minimum latency.
What's the best way for folks to do that with maximum not maximum, minimum latency.
Two places on Twitter, it is @Bittner, that's B-I-T-T-N-E-R, and everything else is over at thecyberwire.com.
Cool. And you can follow us on Twitter at Smashing Security, no G, Twitter won't allow us to have a G.
And you can also join our subreddit, just look for Smashing Security up on Reddit.
And don't forget, if you want to be sure never to miss another episode, subscribe in your favorite podcast apps such as Apple Podcasts, Spotify, or Pocket Casts.
And you can also join our subreddit, just look for Smashing Security up on Reddit.
And don't forget, if you want to be sure never to miss another episode, subscribe in your favorite podcast apps such as Apple Podcasts, Spotify, or Pocket Casts.
Deep, deep thank you for listening, everyone, supporting us, and sharing our work with your friends, family, and even your enemies.
Also, high five to this week's Smashing Security sponsor, LastPass. Its support helps us give you this show for free.
Check out smashingsecurity.com for past episodes, sponsorship details, and information on how to get in touch with us.
Also, high five to this week's Smashing Security sponsor, LastPass. Its support helps us give you this show for free.
Check out smashingsecurity.com for past episodes, sponsorship details, and information on how to get in touch with us.
Until next time, cheerio, bye-bye.
Bye.
Bye-bye. Bye-bye.
Generation for Instagram is still relatively young, and if they've introduced this new feature, I think it's gonna be so attractive to people that they already have their connections there.
Why would you go and go to a Bite or a Triller.
Generation for Instagram is still relatively young, and if they've introduced this new feature, I think it's gonna be so attractive to people that they already have their connections there.
Why would you go and go to a Bite or a Triller.
Well, yeah, but maybe you have Bite on your machine, so maybe actually it will do— it'll stop it becoming a monopoly. So the grandpas, right, will head to Bite.
I mean, that's great, but this particular grandpa may have a Bite account, but he's never made a Bite video.
Oh, well, don't worry. I don't think anyone's missing it.
Nope.
I'll let you know if they ask for it.
They're just pining away, waiting for the day.
One day, Graham. One day.
Today could be that day.
Hosts:
Graham Cluley:
@grahamcluley.com
@
/ grahamcluley
Carole Theriault:
Guest:
Dave Bittner:
Show notes:
- Passworld: A Serious Game to Promote Password Awareness and Diversity in an Enterprise — USENIX.
- Whispers Among the Stars: A Practical Look at Perpetrating (and Preventing) Satellite Eavesdropping Attacks — Black Hat USA 2020.
- Satellite Broadband Security – James Pavur — YouTube.
- Twitter and TikTok reportedly have had talks about a deal — The Verge.
- Trump bans US transactions with Chinese-owned TikTok and WeChat — The Guardian.
- These apps are scrambling to become the next TikTok — Wired.
- Introducing Instagram Reels — Facebook.
- Quoridor — Wikipedia.
- Quoridor — BoardGameGeek.
- BLACK & DECKER 20V LBX20 Li-Ion Battery USB Power Source Adapter w/DC 12V Port — eBay.
- The Young Offenders — BBC iPlayer.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
- Support us on Patreon!
Sponsor: LastPass
LastPass Enterprise makes password security effortless for your organization.
LastPass Enterprise simplifies password management for companies of every size, with the right tools to secure your business with centralized control of employee passwords and apps.
But, LastPass isn’t just for enterprises, it’s an equally great solution for business teams, families and single users.
Go to lastpass.com/smashing to see why LastPass is the trusted enterprise password manager of over 33 thousand businesses.
Follow the show:
Follow the show on Bluesky at @smashingsecurity.com, on the Smashing Security subreddit, or visit our website for more episodes.
Remember: Subscribe on Apple Podcasts, Spotify, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!
Warning: This podcast may contain nuts, adult themes, and rude language.
