
The FBI is hoping that its hunt for Capitol rioters will go viral, a cryptocurrency con lets its perpetrator live the high life… for a while, and just what does Facebook have against cows and a team of cricketers?
All this and much more is discussed in the latest edition of the award-winning “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by BBC technology correspondent Zoe Kleinman.
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
Nude, nude, headless. I mean, not armless, what am I saying? Headless.
My name's Graham Cluley.
I can see why couples pick a memorable date now.
Graham, what do you have?
Or do you think of an agile, state-of-the-art crime-fighting machine using the latest technology?
You're just thinking, there they are in their— oh yeah, they'd be there in their little hideout, you know, spying upon people, gathering information about criminals, pressing buttons to enhance CCTV footage to work out who somebody is.
No, you're mixing it up with CSI instead. But what you may find is actually they're not completely stagnant.
They're not completely sitting on their laurels and not using new technology because if you go to the FBI website right now, you will find that they have revamped it.
Normally when you go to the FBI website, you are faced with thumbnails of the most wanted bad guys.
So you can check out, for instance, the most wanted cyber criminals around the world, many of whom appear to be wearing the uniforms of the Chinese military in their snapshots.
And ultimately, you end up opening up PDF documents on each one, which they call posters, as though people were gonna print them out and put them on their wall.
And it's maybe not the best approach in order to deal with the hundreds, if not thousands of people who are persons of interest to do with the January 6th storming of the US Capitol building.
They call it the Capital Violence section, where you can see a photo collage of people of interest.
Sometimes many photos of the same person, with an indication of what they're wanted for, whether it's an attack on a federal officer or a member of the media.
And they're asking people for their help, of course. Now, we've spoken before about social media folks getting involved in a manhunt, and how that can go wrong.
But of course, there's a lot of people who are very, very keen for these people to be identified and dealt with.
And so there have been a number of social media accounts which have been built up specifically now trying to identify people.
Now, when I first heard about this, I thought, well, that doesn't sound like a very good idea because—
Little, you know, say Martha, who just runs a little flower shop down in Nantucket, happens to look like one of the people on the page and then gets totally—
Because you are on Bake Off. I can't bake for toffee, so it's just as well I was not on— It's not Paul Hollywood, is it?
But yeah, so there you go. I do have one.
I know that you're saving up and you want to do some extra work, you've got to be picky about what you choose." I said, "Sorry, I don't know what you're talking about.
What are you talking about?" And it turned out that this woman who sounds like me was the voice of Sun Bingo, which being a BBC reporter did not go down very well. But it wasn't me.
So your big kind of character people who are very distinctive find it harder to get work than your kind of just straight professional friendly voice. So there you go.
Quite often, for instance, with bank robberies, they will come up with a nickname to reference the robber's physical appearance, right?
Rather than just saying a man walked in, he was 34 years old, they will call him the Geezer Bandit or the Grandma Bandit or the Plain—
Because he looked like a zombie from The Walking Dead.
And so they called him the Spelling Bee Bandit. So it's almost like they're trying to mock them into saying, "Oh, actually my spelling's great.
Oh, I shouldn't have put my hand up about that."
So we've got the FBI have created and revamped their website to make it easier to hunt for particular people and find out more information about them.
But we've also got groups like Sedition Hunters.
Now, Sedition Hunters, they've got a presence on Twitter or on Instagram and Facebook, as well as a website where they are posting up pictures and they're creating viral little graphics, which they're encouraging people to share of individuals who've been caught up in—
There's another young, fresh-faced attacker who's called the Capitol Boy Band, or #CaptainAdolf, or Pee-wee. Well, you see sort of funny moustache.
And another one I don't understand, just called scallops. I don't know why that is.
Now, what I'm impressed with, with the Sedition Hunters, is they are saying on every graphic, don't, goodness gracious, hold your horses, for heaven's sake, don't name this person if you know them.
Don't reply with their name. Contact the FBI directly. Here's the website.
So it doesn't appear that there's too much craziness going on because, of course, it would only require one person to say, Luigi Stashcamo looks rather like that plumber who came round the other day.
One person I want to tell you about is a chap called Jon Schaffer. Now, I'm sure you are both fans of the heavy metal band Iced Earth.
It goes without saying that you know Iced Earth, of course.
He allegedly sprayed police with bear spray while wearing a vest which had a picture of Trump photoshopped onto the Terminator 2 bicycle.
His bandmates have left the band in disgust. So they no longer have a vocalist and a bassist anymore. And they've said it's all because of what John did at the Capitol.
So it's just him and a drummer now. And his Kickstarter's having some problems too. So folks, be very careful. Maybe we could play a little bit of their music.
Oh no, maybe we shouldn't. We shouldn't support them. Should we?
We're going to go now to sexy cows.
This was a story that I did last week that went a bit viral, which is quite exciting when you're old like me and you don't sort of do viral stuff very often deliberately anymore.
Anyway, this guy called Mike Hall runs a small digital photo gallery, right?
And he takes pictures mainly of landscapes and the beach and the sea and, you know, the odd bit of wildlife.
And he decides that he wants to sort of start advertising on Facebook, so he puts a load of his pictures up on his gallery page, and then he picks takes a few of them and decides to run them as ads.
Yeah. And thinks nothing more of it, you know, is prepared to spend, I don't know, a couple hundred quid, you know, this is not a big, big thing, right?
And then he finds that all of his pictures have been blocked by Facebook, and at one point his entire account was blocked by Facebook, because they said his images contained overtly sexual content.
But I can't— I mean, I have looked at this story quite a lot now, and I can't see any sort of compromising position between these two cows.
Also too sexy for Facebook was a picture of the England cricket team in a huddle.
Apparently that was selling adult products, that was also banned, which I can't quite get.
So because he wasn't actually selling Hong Kong, he couldn't sell a photo of Hong Kong.
Okay, doesn't it look like a woman, an armless woman maybe, walking towards you nude? Nude? Headless, I mean, not armless. What am I saying?
Squint your eyes, people. Squint your eyes.
So the poor guy, absolutely everything he was putting up was just getting knocked back. And then in despair, in the end, he came to me and said, what's going on?
So I sort of took it up, and it was all very swiftly resolved. And Facebook said it was a mistake, and it apologized for any inconvenience.
Now all of his sexy photos are back online where they should be.
That's quite a few people.
I mean, other than if they'd maybe employed someone like Carole?
It took them a little while to come back, and then eventually they just apologized. I suspect you might be right, Carole, that it was at some point some sort of algorithm fail.
But I guess, you know, this comes back to this thing with these enormous faceless companies that when you hit that wall, there's absolutely nothing you can do about it.
You can't phone anyone, you can't talk to anyone.
You just sort of appeal and then you get an auto-reply saying, "Well, no, you've been blocked," and that's the end of the discussion.
And you can see why Facebook does that, but also it must be phenomenally frustrating.
They were really into buildings in a sexy way and did kind of disgusting things to the Eiffel Tower and such things.
But really, really, really good at maths. So this guy's in uni in Australia and he wants to become a physicist, but he falls in love with the crypto industry, right?
Wants to make it his vocation. So he goes and takes an internship in China with OKCoin, right? Where he builds a platform between two venues. So one in China and one in the US.
And this was to allow the firm to take advantage of price fluctuations between crypto coin exchanges.
Okay, so basically you have different exchanges and the same coin can be sold for different prices at different exchanges.
This is 2017. And at that age, I think I was looking for my pants under someone's bed, you know? I wasn't—
Anyway, this guy drops out of university from Australia, moves to New York, right, full of piss and vinegar, and he launches a crypto hedge fund called Virgil Sigma Fund.
And his pared-down pitch is this: he's, look, I can make money, I've got a trading algorithm that I've built, and I look for the price differences between cryptocurrencies like Bitcoin and tons of others.
And I'm looking at 40 different exchanges around the world. And this is going to make a shit ton of money for all of us. And the pitch works.
In a mere year or two, he goes from nothing because he just started the company to an estimated $90 million. Okay.
He provided all the spreadsheets for them. He explained where the exchanges were making money, which weren't, which were the cryptos that he was focusing on.
And they even tweeted— I saw this tweet from them saying, Virgil Capital is the 21-year-old hedge fund manager who's got a way of making money on Bitcoin whether it goes up, down, or nowhere at all.
So because he's featured on Wall Street Journal and he's featured on CNBC, new investors come knocking the door, want to get into bed with the crypto king Kinn.
And see, good joke, not queen.
And he's the sole owner, but you know, he's not managing the day-to-day operations, but soon because his name's attached to it, it's got $20+ million from investors.
Similar kind of crypto investment hedge fund thing. So this is the Australian dream success story, right?
At this stage, he's 23, 24, and he's got two incredibly successful hedge fund firms, and he's riding the crypto wave at the right time. This is fantastic. So fade to black.
So he's tap dancing in front of all these investors saying, "Business is booming." But meanwhile, he's stuffing his own pockets with their cash and spending on a rather high roller lifestyle.
For example, he signed a lease for an apartment in 50 West New York. Okay, this was in a 64-story luxury condo building.
Okay, I want you to price what you think this might be, Graham.
Okay, and because he was spending all his money on these type of fripperies, right, and his cars and all this blah blah he could not pay the investors, the original investors.
And he started tap dancing even harder, a Looney Tune cartoon, trying to buy time, you know, saying, oh, the money's tied up, or I'm investing in brand new stuff.
Or at one point, he even blamed loan sharks in China for his troubles because he's getting really scared. And then he goes, he started the second company.
He basically tells the people that were running the second company, close shop, close shop, give me all the money, because he wanted to take that money to pay off the original investors.
Just a week before he was nabbed by a New York district attorney, he did an interview where he was continuing to boast about his company's successes and trying to lure in new investments, obviously driven by the need to pay up, right?
He's lost that $90 million. It's gone. All of it. All of it's gone. So at the ripe old age of 24, Kin is facing 20 years in prison.
Now, a prison cell is probably a little bit smaller than his $23,000 apartment.
But as far as I could understand is that in order to be a hedge fund manager or owner or something, you have to be accredited and somehow basically by law, right?
You're kind of an accredited investor or there's a certified investor. There's a word that they use.
And you're thinking, okay, so I don't know if this is the case where this was, there was a lack of legislation in crypto world.
But apparently they've agreed to a plea deal that it's suggesting between $100,000 and 150 to 180 months. So that's a long time. And a fine of $350,000.
He didn't, you know, I'll exploit the fact that the prices are different between different places and move it from this place to that place and sell them here.
"Buy it here." You know, it sounds quite a cunning sort of plan, but obviously, he was more focused on the expensive apartment and other luxuries, maybe.
There's loads of links in the show notes if you want to go read more about it.
I have no real moral of the story other than, you know, stop investing in stuff you don't know anything about and you can't— I don't understand how people would throw millions at something because he's printed out a fucking spreadsheet.
'Cause that's all people rely on. It's, "Oh, the numbers look good."
So if some young whippersnapper comes up and does a nice PowerPoint presentation, you'll probably say, "Well, I don't really understand all this stuff.
I'd be on your bike." Well, many sensible people would, Carole, but there's also all these investors who are fearful that they're not investing enough in this just in case, you know, it does take off.
They don't want to be the ones who don't do it.
Which he had been holding for years. Oh my gosh. This is going back a couple of years. I think it was 2017. He said at the time it was worth about half a million dollars.
But, you know, the banks aren't going to help you, the financial authorities aren't going to help you, that money's gone.
And it was a phishing attack as well, so he'd clicked a link that looked like his wallet link and wasn't.
And they were able to sort of, you know, on the blockchain they could kind of track where it was going, but they couldn't get it back.
Looking at what's going on with Bitcoin, it's probably worth even more than it was last week, but he said it would be worth £2.8 million today, that Bitcoin.
And he said he just has to try not to think about it. But, you know, I think that's what you forget, isn't it?
If something happens with your bank, as awful as it is, your bank will help you, you know, you'll get support. But there's nothing, there's no safety net there.
And I don't know if this is true, Graham, you might know this story.
Somebody told me that most of the world's Bitcoin is held in a very, very small number of wallets because, you know, you've got your big, big people, haven't you, that have got hold of it all.
And if one of them were to pull out, it would just send the whole thing into turmoil. Is that true?
I did hear that there's only a couple of hundred Bitcoin wallets who appear to be responsible for most of the laundering which goes on after sort of ransomware attacks and suchlike.
So it's a relatively small number who are doing that. But maybe, and of course, our good friend, friend of the show, Elon Musk.
Even though it appears no new login details are exposed, the sharing of so much data increases the risk that previously exposed credentials could be used to gain access to your online accounts, particularly where passwords have been reused.
1Password's Watchtower feature can check for passwords that have been affected by breaches and tell you when a password has been reused. Don't wait for a data breach.
Check out 1Password. . And thanks to them for supporting the show.
Recorded Future delivers the world's most technically advanced security intelligence to disrupt adversaries, empower defenders, and protect organizations.
Well, their podcast, Inside Security Intelligence, takes a deep dive into the world of cyber threat intelligence. They share stories from the trenches and operations floor.
They give you the lowdown on established and emerging adversaries, whether it's the SolarWinds ransomware breach, 5G conspiracy theories, or Russian election interference.
Inside Security Intelligence gives you a fresh take from a variety of industry experts.
Search for the Inside Security Intelligence podcast in all good podcast apps, and thanks to Recorded Future for sponsoring the show.
And welcome back, and you join us for our favorite part of the show, the part of the show that we like to call Pick of the Week.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish.
It doesn't have to be security related necessarily.
I would fall asleep listening to the radio. These days it's podcasts.
And hence I was attracted to a website called Radio Garden. Radio.garden, in fact, is where you can find it. It's also available as an iOS and Android app.
And what it does is it presents to you, rather like Google Earth, the planet Earth, of which we are all inhabiting.
And on it are scattered across the Earth thousands and thousands of green dots. And these are live radio stations.
And you can turn the world around, or you can search for particular places, and you can go and listen to what people are listening to right now, anywhere in the world.
Yeah, but isn't it rather more lovely to have an interface where you can actually sort of zoom in on Chile and go and check out what they're beaming to people and scientists and, you know, Antarctica to listen to, or listen to that show.
I think it's— I think it's— don't knock it until you've tried it, all right?
Anyway, Radio Garden. Why are we talking about this? Radio Garden is my pick of the week.
Neither of us sleeps very well, and during lockdown, oh, just not sleeping very well at all, like loads of people are saying. So, yeah, I decided to have a go with this.
Now, I literally spent some time trying to figure out how to pronounce this, and I could not find a video in which they actually say it.
So it's spelt D-O-D-O-W, which I'm going to say is do-dow, but I don't know, it's French.
Anyway, what it is, is a little kind of circle, like a bit sized like an Amazon Echo Dot, you know, the small ones.
And you turn it on and it emits this kind of blue light, like a beam in a circle that projects up onto the ceiling, right?
And the circle gets bigger and smaller and you're supposed to breathe in when the circle is getting bigger and breathe out when the circle gets smaller, right?
And it's all about obviously kind of slowing down your brain. So it's very simple. That is what it does. There's two settings, 8 minutes and 20 minutes.
And we decided to give it a try last night. So we're lying there and we finally sort of managed to get all the batteries in and work out what we're doing.
We're like, we're not going to do 20 minutes. That just feels like an effort. We're going to go for the 8-minute one. Press the thing.
First couple we missed because we were bickering about where was the best place to put the lights.
And then we did a couple of them, and then he goes, oh, I can't remember whether it was supposed to be breathing in or out, and that made me laugh.
So we missed the first couple of minutes of just us messing about, right? And then we're laying there and we managed to sort of sort ourselves out, and we're doing the breathing.
And actually, it did kind of feel quite relaxing. It was good. It's not like a really harsh blue light, you know, like you get off your phone. It's a sort of gentle, gentle light.
I don't know whether that is actually the case, but that was what it looked like to me. And I was laying there thinking, yeah, I quite like this actually, this is interesting.
And I think I've got to tell you guys about it, I can't wait to talk about this.
And then thinking, why am I lying in bed with my partner watching a blue light and thinking about Graham and Carole? This is really weird.
So I sort of curled up and closed my eyes and I must have drifted off, I think, because when I woke up it wasn't on anymore and I don't know when it stopped.
But yeah, it was good, it was calming, it was relaxing. He fell asleep, and I, well, I said, I must have obviously drifted off or something. It's so simple, isn't it?
I didn't have high expectations. I thought it was worth a shot, but I didn't really have high expectations of it. But yeah, it was pretty good.
And I find it still impossible to do. It sounds so easy, but super impossible. So maybe an aid that would be really useful.
And one of the things they say is, you know, that's fine, let it go, don't stress about thinking.
But actually, they say it's better to just let it happen and then it's gone, and then, you know, you can just sort of get on with it.
I remember— do you remember the George Lazenby James Bond movie, On Her Majesty's Secret Service, where basically, what's his name? Oh, you know, who loves ya baby?
Telly Savalas, right? Telly Savalas is the baddie, right? And he's brainwashing all his female assassins to go and kill leaders around the world.
And he's sort of beaming messages into them while they sleep. And I would worry that something might lull you into some sort of space.
Actually, it is Mark Kermode's Secrets of Cinema. Have you done that before?
So each of the shows is a genre that they focus on, rom-coms or heists or spy movies or superheroes or whatever. And it's just awesome.
It's just what are all the ingredients for this genre that makes audiences keep coming back for more?
What terrifies us, what horrifies us, and what grosses us out, apparently, are the three big pillars. And he talks about techniques the jump scare, right? Or a scary place.
Often these movies happen in a scary place. Someone's entering a scary place, you're thinking, why are you doing that? Don't go there.
Or they have to invite the monster into their house, you know, a vampire. You have an agency in getting into the shit, basically. Or you start losing your mind, right?
So there's all these different techniques to show that. Another one he did was on the heist. We watched that one recently.
Apparently, heist movies play on our sympathies, encouraging us to identify with the characters that in normal life we would never want anything to do with.
One of the cool things in it was talks about that movie Rififi. Do you remember it? Do you ever see that?
And then when they listened to it, all of them together, they went, oh my God, it's way more powerful without the music. Even the composer.
And since then, loads of movies have done that kind of trick, that Thom Cruise dangly from the ceiling one. What was that?
There's no, you know when he dangles down, there's no music or anything to, you know.
You would love this Cluley. Really, really, really. You would really love it.
And I just— well, not so young anymore. Sorry if you're listening. But it's a great, great show. So check it out. Mark Kermode's Secrets of Cinema. It's on the BBC iPlayer.
There's 11 episodes there at the moment when I just checked. So enjoy.
I'm sure lots of our listeners would love to follow you online and hear what you've got to say about things. What's the best way for folks to do that?
So just look for Smashing Security there.
And don't forget, if you want to ensure that you never miss another episode, subscribe in your favorite podcast apps such as Apple Podcasts, Spotify, and Google Podcasts.
And for episode show notes, sponsorship information, guest list, and the entire back catalog of more than 200-ish episodes, check out smashingsecurity.com.
Hosts:
Graham Cluley:
Carole Theriault:
Guest:
Zoe Kleinman – @zsk
Show notes:
- The FBI Wants You To Make These Photos Of Capitol Insurrectionists Go Viral — Huffington Post.
- Capitol Violence — FBI.
- Sedition Hunters.
- Boston Bombing: The Anatomy of a Misinformation Disaster — The Atlantic.
- Iced Earth’s singer and bassist quit band "in response to recent events and circumstances" — NME.
- Capitol Insurrection: More Than 230 People Charged And What We Know About Them — NPR.
- 'Overtly sexual' cow blocked as Facebook ad — BBC News.
- What is Stefan Qin’s edge in crypto? Fraud, says the SEC — Digital Finance.
- Founder Of $90 Million Cryptocurrency Hedge Fund Charged With Securities Fraud And Pleads Guilty In Federal Court — Department of Justice.
- A crypto kid had a $23,000-a-month condo. Then the feds came — Fortune.
- Radio Garden — Explore live radio by rotating the globe.
- Dodow.
- On Her Majesty's Secret Service mind control scene — YouTube.
- Mark Kermode's Secrets of Cinema — BBC.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
- Support us on Patreon!
With 1Password you only ever need to memorize one password. All your other passwords and important information are protected by your Master Password, which only you know. Take the 14 day free trial now at 1password.com
Recorded Future’s podcast, Inside Security Intelligence, takes a deep dive into the world of cyber threat intelligence
They share stories from the trenches and the operations floor, giving you the lowdown on established and emerging adversaries
Whether it’s the SolarWinds breach, 5G conspiracy theories, or Russian election interference, Inside Security Intelligence gives you a fresh take from a variety of industry experts.
Find the Inside Security Intelligence podcast in your favourite podcast app, or at recordedfuture.com/podcast
Follow the show:
Follow the show on Bluesky at @smashingsecurity.com, on the Smashing Security subreddit, or visit our website for more episodes.
Remember: Subscribe on Apple Podcasts, Spotify, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!
Warning: This podcast may contain nuts, adult themes, and rude language.


