There’s a wee data breach with unhealthy implications in Scotland, privacy has gone off the rails in the UK, and a cheater blames Apple for his expensive divorce.
All this and much more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Lianne Potter of the “Compromising Positions” podcast.
Plus don’t miss our featured interview with Abhishek Agrawal, CEO of Material Security.
Warning: This podcast may contain nuts, adult themes, and rude language.
0:00
0:00
0:00
0:00
Enjoying the show? Listen in Apple Podcasts and hit Follow.Enjoying the show? Listen in Spotify and hit Follow.
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
Maybe they looked through and they were just like, you know, no one cares about Bernie's gout. Nobody's interested in Hamish's warts.
Muriel only has weeks to live. It'll be fine.
Smashing Security, episode 377: An Unhealthy Data Dump. Ransomware, ransomware surveillance, and a Cheetah Sues Apple with Carole Theriault and Graham Cluley.
Hello, hello, and welcome to Smashing Security episode 377. My name's Graham Cluley.
Hello, hello, and welcome to Smashing Security episode 377. My name's Graham Cluley.
And I'm Carole Theriault.
And Carole, we're joined this week by a special guest, someone who's been on the show before, the newly anointed at the European Security Blogger Awards. It is Lianne Potter.
You won an award, didn't you, Lianne? Hello.
You won an award, didn't you, Lianne? Hello.
I did. The newcomer, which sounds like a really fun Western title. But yeah, and join the pantheons now of Smashing Security. So, you know, all bow down for Compromising Positions.
So that's the name of your podcast, isn't it?
It is indeed. And for the love of George Michael, please do not just Google Compromising Positions. Google Compromising Positions cybersecurity podcast. I cannot be held responsible.
Let's thank this week's wonderful sponsors: 1Password, Smashing Security, and Vanta. It's their support that helps us give you this show for free.
Now, coming up on today's show, Graham, what do you got?
Now, coming up on today's show, Graham, what do you got?
I'm going to be talking about hackers and haggis.
Okay.
What about you, Lianne?
I'm going to be talking about how Amazon have been watching us as we go on our merry way aboard this nation's disastrous infrastructure, the trains.
And I'm going to be touching upon who to blame when things go unpredictably awry. Plus, we have a featured interview with Abhishek Agrawal.
He is the co-founder and CEO of Material Security. We talk about email threats today and common misconceptions. All this and much more coming up on this episode of Smashing Security.
He is the co-founder and CEO of Material Security. We talk about email threats today and common misconceptions. All this and much more coming up on this episode of Smashing Security.
Now, chums, chums, or should I say lads and lassies, buckle up. Because I'm going to be taking you on a wee trip north of the border to the lands of—
Oh God, no.
Kilts, whisky, and Ockey the New. Yes, I'm talking about Birmingham, of course. That's where we're heading. No, a little bit further north than that.
I can't pull the wool over your eyes because you can hear the bagpipes in the distance.
We are, of course, in beautiful bonnie Scotland, where the sheep's stomachs are considered a delicacy. So gather round, ye brave souls. Pack your raincoats.
I can't pull the wool over your eyes because you can hear the bagpipes in the distance.
We are, of course, in beautiful bonnie Scotland, where the sheep's stomachs are considered a delicacy. So gather round, ye brave souls. Pack your raincoats.
Are sheep stomachs used in bagpipes?
Well, that's a very interesting question. I'm pretty sure sheep stomachs are somehow involved in the haggis, aren't they?
Yeah, I think— Well, you can get something called a bagpipe lung, can't you? So I think they're pretty grim inside those bagpipes. They get really mouldy.
So I think if it was made out of sheep stomach as well.
So I think if it was made out of sheep stomach as well.
Yeah. Yeah.
There's been a lot of recalls in the UK about sandwiches and things, I think. Yeah. You need to be careful about that sort of thing.
Basically, bagpipes are a sheep's stomach just sort of prodded with a few recorders and things, isn't it? That's what they've got.
I bought you one once.
Exactly. I have owned a set of bagpipes. I enjoyed playing them. I have played them in public. I played them, in fact, at InfoSec one year, many, many years ago.
It's a shame that we don't do ASBOs in this country anymore.
They ended up punctured.
Ouch.
But yes, that was it. Nevermore, nevermore. But don't worry about that, because I want to tell you the terrible tale of what's been going down in Dumfries and Galloway.
Lovely parts of the world.
Have you been there, Lianne?
I have, I have. Very, very pretty.
It's very pretty, I think. There's all sort of spooky castles and lakes and beaches and all sorts of loveliness.
Well, the National Health Service systems, the IT systems up there, they were hit by the Inc Ransom Group in February, who alleged that they had stolen huge amounts of patient and staff data, 3 terabytes worth, they said that they had taken, was taken under the nose of the NHS Scotland up there.
And to back up their claim, Inc Ransom published what they called a proof pack on the dark web. So, I think it was the confidential information of about 6 patients.
They said, "We've got a lot more than this, but we've got 6 patients' worth of data." But they dangled it. They said, "This is what we've got.
We will release more unless you pay the ransom." Oh, right, a kind of teaser saying, "Here's a little bit of the stuff that you might expect, and we have 3 terabytes worth." Yeah, it's a bit if you kidnap you know, a relative of John Paul Getty, you cut off their ear and send that to the family and say, look, we've clearly got him.
Although, how would you know?
Well, the National Health Service systems, the IT systems up there, they were hit by the Inc Ransom Group in February, who alleged that they had stolen huge amounts of patient and staff data, 3 terabytes worth, they said that they had taken, was taken under the nose of the NHS Scotland up there.
And to back up their claim, Inc Ransom published what they called a proof pack on the dark web. So, I think it was the confidential information of about 6 patients.
They said, "We've got a lot more than this, but we've got 6 patients' worth of data." But they dangled it. They said, "This is what we've got.
We will release more unless you pay the ransom." Oh, right, a kind of teaser saying, "Here's a little bit of the stuff that you might expect, and we have 3 terabytes worth." Yeah, it's a bit if you kidnap you know, a relative of John Paul Getty, you cut off their ear and send that to the family and say, look, we've clearly got him.
Although, how would you know?
I don't even know who John Paul Getty is.
Oh, he was a billionaire back in the '70s, '80s.
Why would I know that?
Well, just, you know.
Knowledge?
Just general knowledge.
Did you know, Lianne?
I only knew because there was a film that they tried to make recently, and I believe it was supposed to star Kevin Spacey, and then it got—
Oh, aha.
It got canned for reasons that we won't go into. And then they remade it entirely again. So it cost the studio millions and millions and millions.
Oh.
And it flopped. So that was worth it.
Oh dear. Anyway, so what the ransomware groups do is sometimes they release a little bit of the data. They say, "Look, obviously we've got a lot more than this.
We've got a lot more than this, but you can check." and you'll be able to see that this is data related to some of your patients in this case.
And if you want to stump up the cash, then we won't release the millions and millions of other pieces of data as well. So they asked for a ransom.
The news became public knowledge, I think the following month, the media were all over it. One headline I read said, Cyber expert urges against panic over NHS data leak.
And I thought those were very wise words for the expert to urge against panic.
I sometimes wonder why they contact experts, the media, cybersecurity experts, because it's isn't that the blinding, bleeding obvious?
It's to say, well, I'll tell you what I suggest. I suggest you don't panic. It's you know, Corporal Jones used to advise that in Dad's Army. He was always saying, don't panic as well.
We've got a lot more than this, but you can check." and you'll be able to see that this is data related to some of your patients in this case.
And if you want to stump up the cash, then we won't release the millions and millions of other pieces of data as well. So they asked for a ransom.
The news became public knowledge, I think the following month, the media were all over it. One headline I read said, Cyber expert urges against panic over NHS data leak.
And I thought those were very wise words for the expert to urge against panic.
I sometimes wonder why they contact experts, the media, cybersecurity experts, because it's isn't that the blinding, bleeding obvious?
It's to say, well, I'll tell you what I suggest. I suggest you don't panic. It's you know, Corporal Jones used to advise that in Dad's Army. He was always saying, don't panic as well.
Another archaic reference. Okay.
Indeed.
John Paul Getty. That's me. You can see what era I'm from.
Not mine.
No. Anyway, so they didn't pay up, right? The NHS got them. They refused to pay the ransom.
Okay.
So they're saying, "No, this is not good." And this is something we advise often on this show, that we'd prefer if people didn't just kind of pay up and stay quiet and stay shut.
So they're saying, "No, this is not good." And this is something we advise often on this show, that we'd prefer if people didn't just kind of pay up and stay quiet and stay shut.
But I wonder how they make that decision, right?
Maybe they looked through the taster and they were just like, "No one cares about Bernie's gout. Nobody's interested in Hamish's warts."
Muriel only has weeks to live. It'll be fine.
They should have asked Hamish and Bernie how they feel about it. Shouldn't they ask the opinion of the people whose data is at risk of being exposed?
I think they'd mostly say no. I would prefer not.
Yeah, I don't want people to know about my hemorrhoids.
Couldn't they have emailed everyone and said, look, here's the information they've got. They know about your warts, about your halitosis.
Literally warts and all.
Erectile dysfunction.
I mean, they could have had maybe a whip around of everyone in Dumfries and Galloway and said, "Look, if you stump together £5, we can probably pay the ransom." They didn't even think of that.
Anyway, they refused to pay. And of course, the hackers released everything. They released everything. And that's pretty bad because a data leak like this—
I mean, they could have had maybe a whip around of everyone in Dumfries and Galloway and said, "Look, if you stump together £5, we can probably pay the ransom." They didn't even think of that.
Anyway, they refused to pay. And of course, the hackers released everything. They released everything. And that's pretty bad because a data leak like this—
So they do that for free because they didn't get their cash, just as a vendetta.
Yes.
It's not enough that they steal it. They have to also make it public for free for everyone. Or do they make it public for sale?
Well, they published it on their website so anyone could go and download it. And of course, commercially for them, it does send a very clear message to future victims.
We will actually carry out our threat. So that's why they do release it.
We will actually carry out our threat. So that's why they do release it.
If we're talking about the commerciality of things like ransomware and stuff like that, why don't they have payment plans instead? To me, that would be more commercially viable.
Instead of just going, oh, I'm going to spit my dummy out and release the data. Let's put you on a little payment plan here.
If you don't want to pay the full amount, I know you're hard up, NHS, lately. Let's put it on layaway for you.
Instead of just going, oh, I'm going to spit my dummy out and release the data. Let's put you on a little payment plan here.
If you don't want to pay the full amount, I know you're hard up, NHS, lately. Let's put it on layaway for you.
If you stop paying, something bad might happen. Anyway, could be embarrassing, this data leaking, because it claimed to have all kinds of information. For instance, it had X-rays.
Can you imagine how embarrassing X-rays can be? Have you ever seen your own X-rays?
Can you imagine how embarrassing X-rays can be? Have you ever seen your own X-rays?
I don't think X-rays would be that embarrassing.
Well, you haven't got any clothes on in an X-ray. It could be embarrassing.
You don't normally have skin in an X-ray either. It's just bones.
It's interesting that we're more embarrassed about our skin than what's inside our bodies, isn't it?
This is a weird episode, I gotta say. I just don't even know where your brain's going.
What if an X-ray revealed something inside your body which you didn't want revealed to the general public?
Like a tampon?
Oh my God. No, I wasn't thinking anything like that. I was thinking, I don't know.
The outrage.
A garden rake or something like that. Who knows? A toothbrush, a piece of Lego. I don't know. It could be very humiliating.
But also the other data which maybe was now in the hands of criminals was letters from consultants to patients, which could be, you know, about their embarrassing wart or condition.
But also the other data which maybe was now in the hands of criminals was letters from consultants to patients, which could be, you know, about their embarrassing wart or condition.
I think the word's personal, private stuff.
Private.
Right?
Patient complaints. So if you make a complaint against a surgeon or a consultant, internal, external information.
So there's a potential for this to become public, potential for extortion maybe, or just simple embarrassment.
Things that you don't want your loved ones or your workplace or your friends knowing, or you don't want someone to set up a searchable database.
So there's a potential for this to become public, potential for extortion maybe, or just simple embarrassment.
Things that you don't want your loved ones or your workplace or your friends knowing, or you don't want someone to set up a searchable database.
So you think this NHS group should have paid? That's what it sounds like.
Well, I'm just saying it's a complicated decision.
Oh, okay.
It is.
You're sort of stuck between a rock and a hard place.
A rock and a gallbladder, I don't know.
But seriously, some of the data which was exposed was a concern. For instance, there were records related to the mental health of children and teenagers.
That's not good.
Not good. Not good.
And we've seen attacks like that before where people have actually been approached after their medical information about their mental health has been exposed, and the ransom demand be made not only to the NHS or that medical body, but also to the patients as well.
And we've seen attacks like that before where people have actually been approached after their medical information about their mental health has been exposed, and the ransom demand be made not only to the NHS or that medical body, but also to the patients as well.
The ransom gang does not win hearts and minds with this, though. I don't think most people would be thinking, yeah, really cool. You stole from a hospital.
Come here to do a job. I don't come here to be liked. Is that what they— that's my mantra.
So this is why Dumfries and Galloway NHS are now writing to every household in the area.
All 15 of them.
Well, I did— I've done my research. Apparently, it's around about 150,000 people.
Well, they're not handwritten. Okay.
It's like it's an error.
I'd like to think they were handwritten. That'd be good.
That would be good. Or if they had to sign them manually, that'd be fantastic. But they've now sent them this letter saying about the data that's been published, the risks.
There was also some advice about not to click on links in emails from people they didn't know or companies they didn't know.
And don't provide any information to people you don't know who contact you on the phone or via social media.
And you can go and read the letter that D&G have— That's not Dolce Gabbana, by the way. That's Dumfries Galloway. Very different things. Very different things.
And they've even got an easy-read version. So clearly they're recognising that some of their patients may not be—
There was also some advice about not to click on links in emails from people they didn't know or companies they didn't know.
And don't provide any information to people you don't know who contact you on the phone or via social media.
And you can go and read the letter that D&G have— That's not Dolce Gabbana, by the way. That's Dumfries Galloway. Very different things. Very different things.
And they've even got an easy-read version. So clearly they're recognising that some of their patients may not be—
Able to increase the font?
Is that because they read it in the dumped data leak? That, "Oh yeah, Dave can't see very well." Is that where they got that information from?
Or it's not just the size of the font, but it's shorter paragraphs. Nice icons. They've tried to make it a bit friendlier.
I think it's for people who maybe find reading lots of paragraphs a bit more complicated and challenging.
I think it's for people who maybe find reading lots of paragraphs a bit more complicated and challenging.
Right, right, right.
There's a dedicated helpline which you can ring up, and they even say if you see anything suspicious, call the police on 101 and report it. So dial 101 to get in touch with them.
Well, good for them. I mean, that seems like, you know, they're doing all the right things.
It's the best you can do in that situation.
But it's difficult, isn't it?
When you write to everybody saying that there's been a data breach and to look out for it, maybe that actually makes it easier for the scammers and identity thieves to exploit the situation to call up people and say, "You remember that letter you got the other day?
Well, I'm calling about that, or I need you to go to this website to claim your compensation." You can see that there may be other attacks in the wake of this.
When you write to everybody saying that there's been a data breach and to look out for it, maybe that actually makes it easier for the scammers and identity thieves to exploit the situation to call up people and say, "You remember that letter you got the other day?
Well, I'm calling about that, or I need you to go to this website to claim your compensation." You can see that there may be other attacks in the wake of this.
Yeah, but if they did nothing, they also have all the information so they could email them and go, "Guess what? A cyberattack happened.
We're going to call you the next few days to ask for information to repopulate or do anything else."
We're going to call you the next few days to ask for information to repopulate or do anything else."
Oh, the criminals could, you mean? Yes, I see.
Yes. Anything could be—no matter what they did, there's an extra risk after this happens. That's all I'm saying.
So you're stuck once again between a rock and Lianne's hard place. What did she say?
Gallbladder.
Oh, the pain. Lianne, what do you have for us this week?
Well, this week I've got something quite an out-and-out cyber incident, but I'd get your opinion on it about what it means for the cybersecurity industry.
So when in 1983 Rockwell explained he always feels somebody's watching him and he has no privacy, whoa, he wasn't far off. And now we're seeing that today.
So turns out Amazon have been watching us for the last two years as we go upon our merry way on the trains.
Now imagine this—you're on a train station, you're minding your own business, you're waiting for the train home, and then suddenly you notice that the CCTV camera is swerving towards you and you think, "Oh, it's just normal security, right?" But little did you know that that camera is actually a smart CCTV camera pumped to the eyeballs with AI surveillance stuff.
And so apparently for the last two years, and we've only found out about this because an organisation called Smashing Security did a request for information.
So when in 1983 Rockwell explained he always feels somebody's watching him and he has no privacy, whoa, he wasn't far off. And now we're seeing that today.
So turns out Amazon have been watching us for the last two years as we go upon our merry way on the trains.
Now imagine this—you're on a train station, you're minding your own business, you're waiting for the train home, and then suddenly you notice that the CCTV camera is swerving towards you and you think, "Oh, it's just normal security, right?" But little did you know that that camera is actually a smart CCTV camera pumped to the eyeballs with AI surveillance stuff.
And so apparently for the last two years, and we've only found out about this because an organisation called Smashing Security did a request for information.
Mm-hmm.
They've been doing a trial on all of us monitoring crowds as we wait for our trains, not just if people are up to no good or anything that, but also trying to guess our age. Cheeky.
Trying to know what gender we are.
Trying to know what gender we are.
Cheeky.
Indeed. But also our moods as well. So deducing if we're happy, sad, or angry. And I think if anyone has had the pleasure of using UK trains lately, it's probably the last two.
I don't think I've ever been happy on a train in a very long time here.
But my question to you—so one, we wouldn't have known about this unless this organisation did a request for information.
And obviously, you know, Network Rail said they take privacy and security very seriously, of course, so that's okay then.
But what I would to ask you is now as cybersecurity professionals, as we enter this—everything's got an AI attachment to it—how do we keep up in this?
And where does this sort of ethics and morals lie in us helping organizations protect this stuff?
'Cause our organizations that we work in are gonna make us do stuff this, but where do we actually come in on this conversation and say, "Hey, I'm not quite happy with actually storing all this data because of the potential consequences if we lose this stuff." Not just going beyond normal data privacy stuff, which, you know, hopefully most of our organizations look after, but then what if that falls into the wrong hands?
I don't think I've ever been happy on a train in a very long time here.
But my question to you—so one, we wouldn't have known about this unless this organisation did a request for information.
And obviously, you know, Network Rail said they take privacy and security very seriously, of course, so that's okay then.
But what I would to ask you is now as cybersecurity professionals, as we enter this—everything's got an AI attachment to it—how do we keep up in this?
And where does this sort of ethics and morals lie in us helping organizations protect this stuff?
'Cause our organizations that we work in are gonna make us do stuff this, but where do we actually come in on this conversation and say, "Hey, I'm not quite happy with actually storing all this data because of the potential consequences if we lose this stuff." Not just going beyond normal data privacy stuff, which, you know, hopefully most of our organizations look after, but then what if that falls into the wrong hands?
Yeah.
And, you know, potential misuse and things that.
It is spooky. It makes me think of this case in the States a few years back where there were these facial recognition cameras in malls.
Yes.
And the idea was to detect any immigrants that had not gone through the proper channels. So that's what's kind of scary about this.
I'm guessing, okay, and tell me if you know or if I'm completely off-piste here, but I'm guessing Amazon made a deal with the train networks to say, here's the deal and it's less money than you'd pay elsewhere, selling all the benefits.
But actually, do they get to harvest the information as well or does it stay within the UK train?
I'm guessing, okay, and tell me if you know or if I'm completely off-piste here, but I'm guessing Amazon made a deal with the train networks to say, here's the deal and it's less money than you'd pay elsewhere, selling all the benefits.
But actually, do they get to harvest the information as well or does it stay within the UK train?
Well, it's not clear on the article itself and then the kind of request, you know, who knows, they could be just going, oh well, we could sell a lot of coffee, you know, travel coffee cups there, Amazon, or what other things could we sell, you know, more iPads and things to keep people entertained, better headphones and things.
I don't know, I'm just speculating where it could be useful. But what I do know is this is happening so much now, this lack of consent or even a discussion.
So yes, you know, I'm sure most of us would probably say there is actually positive benefits for them, keeping an eye out for people doing wrong things trespassing on rail tracks and things.
And, you know, not to go too dark, but, you know, people do commit suicide on the trains, and spotting that kind of emotional change will be very useful.
But my worry is we're constantly making these kind of concessions, and where does it stop?
I don't know, I'm just speculating where it could be useful. But what I do know is this is happening so much now, this lack of consent or even a discussion.
So yes, you know, I'm sure most of us would probably say there is actually positive benefits for them, keeping an eye out for people doing wrong things trespassing on rail tracks and things.
And, you know, not to go too dark, but, you know, people do commit suicide on the trains, and spotting that kind of emotional change will be very useful.
But my worry is we're constantly making these kind of concessions, and where does it stop?
Well, I'm not making the concessions. I don't even know this is happening, right?
The general public doesn't know this is happening until someone reveals it through an information request.
The general public doesn't know this is happening until someone reveals it through an information request.
Normally they have a little sign up, don't they, in very small font somewhere on the wall saying, just so you know, by being here, you agree to being on CCTV and maybe we're scoring you.
But what's stopping a restaurant doing it, for example?
What if all Nando's right across the UK started putting AI powers just to see, detect emotions and see how happy their customers are, right?
What if all Nando's right across the UK started putting AI powers just to see, detect emotions and see how happy their customers are, right?
And then you'd just be bitching to your fellow person, complaining about...
You're less likely to commit suicide or something in a Nando's than you are suffering the British rail system.
You're less likely to commit suicide or something in a Nando's than you are suffering the British rail system.
Have you eaten at Nando's?
I have actually. I have only eaten once in about— it was about 3 weeks ago.
Oh, so it's fresh in your mind. It is fresh in my mind. And how was your mental health?
I was fine, thank you very much.
Excellent. I had a salad-y sort of thing. It was alright. The next few stories, Nando's have AI surveillance. Yeah, because Graham said it was fine.
I was with some young people at the time who possibly, you know—
What, in their 40s?
More frequent visitors to Nando's than myself. But I mean, there are obviously legitimate reasons for doing this. Yes, understandable reasons, you know.
AI-powered cameras.
The people who own the stations, they're not doing this because they've got anything nefarious in mind.
I suspect that they're doing this because they're doing it for people's safety and protection.
The worry will be, of course, as you were suggesting, Carole, that what's Amazon going to do with all of this data? How could it use it?
And of course, at what point does law enforcement get involved and think, oh, we've got access to this?
And already in the United Kingdom, we have a huge number of CCTV cameras watching us everywhere we go. We're one of the most surveilled states in the world, aren't we?
I suspect that they're doing this because they're doing it for people's safety and protection.
The worry will be, of course, as you were suggesting, Carole, that what's Amazon going to do with all of this data? How could it use it?
And of course, at what point does law enforcement get involved and think, oh, we've got access to this?
And already in the United Kingdom, we have a huge number of CCTV cameras watching us everywhere we go. We're one of the most surveilled states in the world, aren't we?
Yeah, absolutely.
I know we're surveilled, but I don't know how we fit in with everyone.
Yeah, I think we're not— I think, isn't China known as probably the most surveilled state? I think we're really close, not far behind from that, actually.
Wow.
Bucket hats a-go-go, I think, right?
So yeah, so while there is definitely benefits for AI surveillance, like improving safety, you have to balance it with privacy concerns.
So all I can say to you really, I don't have an answer, but you know, next time you're at the train station remember just to give the cameras your best smile.
So all I can say to you really, I don't have an answer, but you know, next time you're at the train station remember just to give the cameras your best smile.
Would you consider wearing a balaclava?
Well, we've not had much of a summer, so maybe, yeah. Yeah.
Fair enough. Carole, what have you got for us this week?
So, this story is thanks to friend of the show, Anna Brading, who sent it over to me. So, this story is kind of a twofer. You know what I mean by twofer?
Mm-hmm.
Well, yeah, so it can be used here on Smashing Security, but it also could be used on my other podcast, Sticky Pickles, which is focused on dilemmas.
Very good.
Always promoting your other podcasts.
So Lianne, Graham, pay attention because there's going to be a what-do-you-do-now moment for you to ponder, okay?
Okay.
Okay. All right. I love this. Yeah, good.
Okay. So I'm introducing you to Richard. Richard's a married guy living in the UK.
Right.
Now he's been married for a while, and apparently happily so, right?
But he must have hit a bumpy road of sorts in Marriageville, because for a time, things must have not been going so great.
Like, so not great that Richard decided to secretly start stepping out to take advantage of one of the world's oldest professions.
But he must have hit a bumpy road of sorts in Marriageville, because for a time, things must have not been going so great.
Like, so not great that Richard decided to secretly start stepping out to take advantage of one of the world's oldest professions.
Oh, a bookie's?
No, not whittling either. Right. Prostitution.
Okay. Ding dong.
So, Richard, with his trusty iPhone, starts messaging some ladies of the night, if I can use that term.
I always think they're vampires when they get referred to as ladies of the night.
I know.
Maybe they are. Maybe some are. That'd be so cool.
I think that's cool and also weird.
Yeah.
But this is all, of course, on the down low, right? Wife is not to find out.
So, to keep his missives to the ladies, mistresses of the street, whoa, he deletes the messages on his phone so she can't see them. So all good, all good.
You know, he's having secret sexy time messages and trysts, and his wife is none the wiser.
So, to keep his missives to the ladies, mistresses of the street, whoa, he deletes the messages on his phone so she can't see them. So all good, all good.
You know, he's having secret sexy time messages and trysts, and his wife is none the wiser.
Yeah, when you say all good, not really that good, to be honest.
But well, good for him. He's thinking this is what he wants to do. He's stepping out and he's not leaving any tracks and no breadcrumbs, no breadcrumbs.
Until, until, until his wife opens iMessages on the home iMac. And there is a veritable waterfall of deleted messages to prostitutes.
And they tumble down the page revealing that darling Richard has had long periods of infidelity.
Then these, of course, are the messages he believed he had deleted and wiped for good. Right?
Until, until, until his wife opens iMessages on the home iMac. And there is a veritable waterfall of deleted messages to prostitutes.
And they tumble down the page revealing that darling Richard has had long periods of infidelity.
Then these, of course, are the messages he believed he had deleted and wiped for good. Right?
Busted.
Busted.
So what do you do now? Okay, you're first. You're Richard's wife. What do you do? What do you do?
Change the locks?
Kill him?
I think I would screenshot them. Screenshot them just in case they get deleted again.
Oh God, that's quick thinking.
Yeah. Oh, that's smart. See, cyber professional. Cyber professional. Yeah, very good. Well, you know, this basically led Richard's wife to file for divorce. I mean, no real surprise.
And she did that within a month?
And she did that within a month?
Yes.
Of all this happening? But I'm guessing that the divorce process was not all warm and fuzzy. You know, these things rarely are.
Yeah.
But Richard not only say he lost upwards of £5 million, so, you know, $6 million and change.
Whoa, how much did he have to start with?
Right? Who knows? In the divorce. But also he says that his health has taken a turn because of the divorce. He's getting panic attacks.
In order to reduce them, he's taking strong beta blockers, fearing a heart attack.
In order to reduce them, he's taking strong beta blockers, fearing a heart attack.
I thought you were gonna say he had venereal disease. But yeah.
So Richard's now feeling very poor. He's feeling down in the dumps. He's trying to circumnavigate panic attacks. And if you are Richard, what do you do now? What do you do now?
Go on a dating site, maybe?
Find yourself a really rich mama?
Get my haircuts and a change of wardrobe, maybe?
Dye your hair?
Buy myself a convertible car, probably.
Brilliant. Yes. Like a hairdresser's car or something.
Yeah, something like that. Yeah.
Well, you know, you might want to get some money rolling in. Richard certainly does, because $5 million is a serious hit.
So how did he lose $5 million from getting divorced?
Good.
That is not clear. In my research, I have not. I did try and find that out because, you know, fascinating.
But he gets a lightning bolt of an idea, one of those brilliant, trifecta of everything aligning. Just sue Apple, right? Get Apple to refund the losses.
Yes, file a lawsuit, a class action lawsuit against Apple, because Apple is the entity that ruined his life. Not his philandering, Apple.
And yes, let's call upon London-based law firm Rosenblatt to arrange legal action against Apple.
And yes, let's go public to attract men in the same situation to go in with Richard on the suit.
But he gets a lightning bolt of an idea, one of those brilliant, trifecta of everything aligning. Just sue Apple, right? Get Apple to refund the losses.
Yes, file a lawsuit, a class action lawsuit against Apple, because Apple is the entity that ruined his life. Not his philandering, Apple.
And yes, let's call upon London-based law firm Rosenblatt to arrange legal action against Apple.
And yes, let's go public to attract men in the same situation to go in with Richard on the suit.
I'd like to think that at some point, he was turning around and just going, "I don't wanna go away with two of it, one of those meddling tech companies." I've got a theory.
He's already lost $5 million or something. Is that right? £5 million.
£5 million, yeah.
£5 million, okay. It sounds to me like he's about to lose some more money, and he'll be giving it to his legal team. And he's probably not going to be getting the money back.
I'm just thinking that if he's hired this London law firm, Rosenblatt. Whatever.
I'm just thinking that if he's hired this London law firm, Rosenblatt. Whatever.
Clance Guilderson.
To sue the megalith which is Apple, which will definitely have even more expensive lawyers working for it.
I'd love to think that Apple's legal team, when they got that letter through the door, was just a crank.
Okay, but listen, listen, listen, listen, okay?
One possibility for the lack of deletion across all the services may be down to the fact that the device was not linked to a central iCloud account.
So according to Apple support documents, if you use Messages in iCloud, deleting a message or conversation on your Mac deletes it from all your devices where Messages in iCloud is on.
One possibility for the lack of deletion across all the services may be down to the fact that the device was not linked to a central iCloud account.
So according to Apple support documents, if you use Messages in iCloud, deleting a message or conversation on your Mac deletes it from all your devices where Messages in iCloud is on.
So how did it show up on the other device then, if that wasn't linked?
Well, if the account is not linked to an iCloud account, deleting messages will only remove them from the local device and not the linked devices.
So you can link devices separately from using iCloud.
So you can link devices separately from using iCloud.
So he didn't read the flipping manual.
Well, yeah, who does? I'm just asking, right? So Rich reportedly says in The Times, if you were told a message is deleted, you are entitled to believe it's deleted.
Kind of a fair point, I think.
Kind of a fair point, I think.
I think that's reasonable. Yeah.
Yeah. If the message had said these messages are deleted on this device, that would have been a clue, he says.
These messages are deleted on this device only would have been a much clearer indicator.
These messages are deleted on this device only would have been a much clearer indicator.
Hmm. Does he have a case? Did he get $5 million back?
Not yet. We don't know. He says it was a very brutal way for his wife to find out.
Oh, now he cares about her opinion. Okay. Right.
Well, he also reportedly believes that there could have been a chance of the marriage continuing had he been able to talk to her rationally.
But I guess it was difficult after she found out he was secretly stepping out with prostitutes.
But I guess it was difficult after she found out he was secretly stepping out with prostitutes.
Yeah, yeah, yeah.
Now, according to Apple Insider, who absolutely slated this man—
Maybe he should sue his wife for not being prepared to have a rational conversation with him about his use of prostitutes.
Oh, interesting.
Or maybe the prostitutes for being so tempting.
Yeah, maybe she can countersue saying, yeah, the prostitutes should be sued as well for advertising their goods.
Yes, because otherwise he would never have found them.
That's right.
So according to Apple Insider, there would have to be massive changes in UK law for Apple to get blamed or held liable for the inciting incident.
But according to lawyer Simon Walton of Rosenblatt, he says in many cases the iPhone informs the user that messages have been deleted, but as we have seen, this isn't true and is misleading because they are still found on other linked devices, something Apple doesn't tell its users, he added.
But according to lawyer Simon Walton of Rosenblatt, he says in many cases the iPhone informs the user that messages have been deleted, but as we have seen, this isn't true and is misleading because they are still found on other linked devices, something Apple doesn't tell its users, he added.
We shouldn't be listening to the lawyers at all because the lawyers don't give a damn. All the lawyers care about is that they're getting paid by their client.
Whatever crackpot they are, they don't care whether the person that they're representing is sane or not. They're just taking the cash.
Whatever crackpot they are, they don't care whether the person that they're representing is sane or not. They're just taking the cash.
It's interesting, a lot of media reports intimated that they were surprised that Rosenblatt took this case on, because it seems like a pretty clear non-winner.
I think it was the prostitutes who have been intimated with.
If Apple were to change the wording slightly right now, which I think they probably should—
I agree with you, yeah.
But if they did, would that be an admission that they were wrong? And so they can't.
I don't know. The world is so ugly. I don't know. I'm gonna end with a quote from Richard, okay? He says, quote, "We were very happily married and had been for over 20 years.
I think what has been a superb marriage has been thrown away for something which many men do." What? And some women do. But mainly men.
So to surmise, it is completely and utterly Apple's fault. And best of luck, Richard.
I think what has been a superb marriage has been thrown away for something which many men do." What? And some women do. But mainly men.
So to surmise, it is completely and utterly Apple's fault. And best of luck, Richard.
It's Richard who speaks for all men, apparently.
Yeah, Richard who speaks for mankind.
Man, oh man.
Does your email security solution fit your alert budget?
Relying on built-in controls or traditional blockers will inevitably lead to more noise than your instant response team can handle.
Well, Material Security takes a pragmatic approach to email security, stopping new flavors of phishing and pretexting attacks before reaching the user's mailbox, while searching through everyone's mailbox for similar messages in a campaign.
What gets surfaced to your team are the highest-value cases to investigate, with all the context and reach consolidated into a single view.
Remediations are a breeze with Material Security. So go try it out for yourself at smashingsecurity.com/material. That's smashingsecurity.com/material.
And thanks to Material Security for supporting the show.
Relying on built-in controls or traditional blockers will inevitably lead to more noise than your instant response team can handle.
Well, Material Security takes a pragmatic approach to email security, stopping new flavors of phishing and pretexting attacks before reaching the user's mailbox, while searching through everyone's mailbox for similar messages in a campaign.
What gets surfaced to your team are the highest-value cases to investigate, with all the context and reach consolidated into a single view.
Remediations are a breeze with Material Security. So go try it out for yourself at smashingsecurity.com/material. That's smashingsecurity.com/material.
And thanks to Material Security for supporting the show.
When it comes to ensuring your company has top-notch security practices, things can get complicated fast.
Vanta automates compliance for ISO 27001, SOC 2, GDPR, and more, saving you time and money.
With Vanta, you can unify your security program management with a built-in risk register and reporting and proactively manage security reviews with AI-powered security questionnaires.
Over 7,000 global companies like Atlassian, Phyton, Flow Health, and Quora use Vanta to build trust and prove security in real time.
Our listeners get 10% off Vanta at vanta.com/smashing. That's v-a-n-t-a.com/smashing for 10% off. And thanks to Vanta for sponsoring the show.
Vanta automates compliance for ISO 27001, SOC 2, GDPR, and more, saving you time and money.
With Vanta, you can unify your security program management with a built-in risk register and reporting and proactively manage security reviews with AI-powered security questionnaires.
Over 7,000 global companies like Atlassian, Phyton, Flow Health, and Quora use Vanta to build trust and prove security in real time.
Our listeners get 10% off Vanta at vanta.com/smashing. That's v-a-n-t-a.com/smashing for 10% off. And thanks to Vanta for sponsoring the show.
In a perfect world, end users would only work on managed devices with IT-approved apps.
But every day, employees use personal devices and unapproved apps that aren't protected by MDM, IAM, or any other security tool.
There's a giant gap between the security tools we have and the way we actually work.
1Password calls it the Access Trust Gap, and they've also created the first-ever solution to fill it.
1Password Extended Access Management secures every sign-in for every app on every device.
It includes the password manager that you know and love, and the device trust solution you've probably heard of on this podcast, back when it was called Collide.
1Password Extended Access Management cares about user experience and privacy, which means it can go places other tools can't, personal and contractor devices.
It ensures that every device is known and healthy, and every login is protected.
So stop trying to ban BYOD or shadow IT and start protecting them with 1Password Extended Access Management. Check it out at 1password.com/smashing.
And thanks to 1Password for supporting the show. And welcome back, and you join us at our favorite part of the show, the part of the show that we call Pick of the Week.
But every day, employees use personal devices and unapproved apps that aren't protected by MDM, IAM, or any other security tool.
There's a giant gap between the security tools we have and the way we actually work.
1Password calls it the Access Trust Gap, and they've also created the first-ever solution to fill it.
1Password Extended Access Management secures every sign-in for every app on every device.
It includes the password manager that you know and love, and the device trust solution you've probably heard of on this podcast, back when it was called Collide.
1Password Extended Access Management cares about user experience and privacy, which means it can go places other tools can't, personal and contractor devices.
It ensures that every device is known and healthy, and every login is protected.
So stop trying to ban BYOD or shadow IT and start protecting them with 1Password Extended Access Management. Check it out at 1password.com/smashing.
And thanks to 1Password for supporting the show. And welcome back, and you join us at our favorite part of the show, the part of the show that we call Pick of the Week.
Pick of the Week.
Pick of the Week.
Pick of the Week is the part of the show where everyone chooses something they like.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish. Doesn't have to be security-related necessarily.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish. Doesn't have to be security-related necessarily.
Better not be.
Well, my pick of the week this week is not really security-related. It is techie and IT-related. I've been working on a top-secret project lately. Maybe I'll reveal it in a few weeks.
And I've been having to create a little website and set it up. And I've had a niggle. I've had a complexity in the setup of the website, and I was wondering what the problem was.
And it turned out to be— and anyone out there who's geeky and has tried to set up websites and email systems and the like will know those three terrifying letters: DNS.
And your DNS records, you know about that, don't you, Lianne?
And I've been having to create a little website and set it up. And I've had a niggle. I've had a complexity in the setup of the website, and I was wondering what the problem was.
And it turned out to be— and anyone out there who's geeky and has tried to set up websites and email systems and the like will know those three terrifying letters: DNS.
And your DNS records, you know about that, don't you, Lianne?
I have got a website.
The question always is, why has this gone wrong? Could it possibly be DNS that has gone wrong? And the answer is always, yes, it is DNS. It's always, always a DNS problem.
Anytime Facebook or Twitter or anything like that goes down, chances are it's a DNS problem.
Anytime Facebook or Twitter or anything like that goes down, chances are it's a DNS problem.
Pretty much.
It is just the flakiest thing imaginable that the whole internet is relying upon. So I came across a website as I was getting very, very frustrated with DNS entries.
That's unlike you, getting frustrated.
Yes, not like, yeah, exactly. Exactly. Well, I'm careful with how I vent my frustration. I'm not like Richard, but there is a website which I've been to called isitdns.com.
So if you're ever wondering whether it is DNS that's causing the problem or not, just go to isitdns.com. What it says is, yes, it is DNS, which is causing the problem.
So if you're ever wondering whether it is DNS that's causing the problem or not, just go to isitdns.com. What it says is, yes, it is DNS, which is causing the problem.
Very nice. Very nice. It's a good answer.
It's very useful for you. Now, this particular website also sells some merchandise.
For instance, you can get a t-shirt which says, "If DNS had a face, I would punch it." There's another one which says in great big letters with an exclamation mark, "It wasn't DNS!" Oh yeah, it was.
And in smaller writing underneath it goes, "Laughing out loud. Just kidding. It was totally DNS." So it is DNS. I don't know if DNS should be my pick of the week. Is it DNS?
DNS is my pick of the week, but DNS itself is my nitpick of the week. Because I am very, very frustrated by DNS and how often it goes wrong. Lianne, what's your pick of the week?
For instance, you can get a t-shirt which says, "If DNS had a face, I would punch it." There's another one which says in great big letters with an exclamation mark, "It wasn't DNS!" Oh yeah, it was.
And in smaller writing underneath it goes, "Laughing out loud. Just kidding. It was totally DNS." So it is DNS. I don't know if DNS should be my pick of the week. Is it DNS?
DNS is my pick of the week, but DNS itself is my nitpick of the week. Because I am very, very frustrated by DNS and how often it goes wrong. Lianne, what's your pick of the week?
So my pick of the week, I was deliberating about this, but I've decided since it's had a bit of a profound effect on me and I wasn't expecting it.
And I should preface this, the person I'm about to discuss, I am not actually a fan of this person. But I'll go into it.
So my pick of the week is an audiobook, and it's the audio version of Barbra Streisand's autobiography, My Name Is Barbra.
Now I say I'm not a fan, doesn't mean I don't like her, but you know, and I love Funny Girl, and you know, some of the songs are bangers and things like that, but I'm not a hardcore fan, at least not hardcore enough to listen to an audiobook that is 48 hours and 17 minutes long, right?
And I should preface this, the person I'm about to discuss, I am not actually a fan of this person. But I'll go into it.
So my pick of the week is an audiobook, and it's the audio version of Barbra Streisand's autobiography, My Name Is Barbra.
Now I say I'm not a fan, doesn't mean I don't like her, but you know, and I love Funny Girl, and you know, some of the songs are bangers and things like that, but I'm not a hardcore fan, at least not hardcore enough to listen to an audiobook that is 48 hours and 17 minutes long, right?
That sounds dreamy. Does she read it herself, or—
She reads it herself, right?
Oh my God, oh my God, I'm all overcome now. I love Barbra Streisand.
Well, I do now. I am totally besotted with her, absolutely besotted. It's been one of the nicest things I've been listening to over the past weeks. It is absolutely brilliant.
So I saw a review for it and people were saying it's brilliant, and I thought, oh, I'll just give it a go because I love a good audiobook. It's phenomenal.
It's funny, it's heartwarming.
And I tell you what, as I used to listen to it, I did listen to it on double speed because she actually sounds younger on double speed because she's getting on in her years now.
So I saw a review for it and people were saying it's brilliant, and I thought, oh, I'll just give it a go because I love a good audiobook. It's phenomenal.
It's funny, it's heartwarming.
And I tell you what, as I used to listen to it, I did listen to it on double speed because she actually sounds younger on double speed because she's getting on in her years now.
Double speed, like two times, literally?
Yeah.
And she sounds just like she did back in the '70s and '80s again. So, and plus it was 48 hours and 17 minutes.
I had to get through it somehow because I'd actually borrowed it from my local library online audio service. There you go.
I had to get through it somehow because I'd actually borrowed it from my local library online audio service. There you go.
Yeah, yeah.
So I didn't want to keep it all to myself when someone else could be listening to us, which is why I made the choice going double speed.
I absolutely miss her now she's gone out of my life, and I used to just walking around listening to her telling me things. It was so nice.
So it's brilliant, and I just can't say enough how amazing it is. But what was really nice was there was — she's interwoven actually her singing as well.
So if you're not familiar with her work, take it out of double speed because you're trying to get through 48 hours and 17 minutes of audiobook. Listen to her. It's fantastic.
And then put it back on double speed. But she also talks about the Streisand effect. So do you know what the Streisand effect is?
I absolutely miss her now she's gone out of my life, and I used to just walking around listening to her telling me things. It was so nice.
So it's brilliant, and I just can't say enough how amazing it is. But what was really nice was there was — she's interwoven actually her singing as well.
So if you're not familiar with her work, take it out of double speed because you're trying to get through 48 hours and 17 minutes of audiobook. Listen to her. It's fantastic.
And then put it back on double speed. But she also talks about the Streisand effect. So do you know what the Streisand effect is?
Yes.
Yeah, well, yes, just in case you're listening.
So the Streisand effect is the — was pretty much an unintended consequence of Barbra Streisand's attempt to censor some information about her.
So what basically happened was, and she goes into detail in her book, was some photographer decided to take loads of pictures of houses that were on cliff faces about to fall into the ocean, basically.
And Barbra Streisand's house was one of them, and it was for environmental reasons. Create this book.
However, she was one of the only people they mentioned her by name, so they gave exact coordinates of where she lived.
And you know, obviously a massive breach of privacy, which we've been talking about all this episode really, haven't we?
So yeah, so the Barbra Streisand effect is basically she sued, and what happened is it went from 6 people seeing this image in a book to obviously being absolute massive news and everyone knows.
Yeah, yep, just really interesting to hear a perspective on it. So my pick of the week is Get Comfort I would say start making friends with Barbra Streisand.
I was very tempted afterwards. I was so moved by her book.
I was very tempted to write to her and say, "I'm not a fan, but I've really enjoyed your book." But then my other half said, "That's not a very nice thing to write to someone." But I meant it in good faith.
She's really converted me. I'm so interested. I'm going to go through all her film back catalog. Yeah, brilliant.
So the Streisand effect is the — was pretty much an unintended consequence of Barbra Streisand's attempt to censor some information about her.
So what basically happened was, and she goes into detail in her book, was some photographer decided to take loads of pictures of houses that were on cliff faces about to fall into the ocean, basically.
And Barbra Streisand's house was one of them, and it was for environmental reasons. Create this book.
However, she was one of the only people they mentioned her by name, so they gave exact coordinates of where she lived.
And you know, obviously a massive breach of privacy, which we've been talking about all this episode really, haven't we?
So yeah, so the Barbra Streisand effect is basically she sued, and what happened is it went from 6 people seeing this image in a book to obviously being absolute massive news and everyone knows.
Yeah, yep, just really interesting to hear a perspective on it. So my pick of the week is Get Comfort I would say start making friends with Barbra Streisand.
I was very tempted afterwards. I was so moved by her book.
I was very tempted to write to her and say, "I'm not a fan, but I've really enjoyed your book." But then my other half said, "That's not a very nice thing to write to someone." But I meant it in good faith.
She's really converted me. I'm so interested. I'm going to go through all her film back catalog. Yeah, brilliant.
Oh, you should. You should. Barbra Streisand's great. The Way We Were. Have you seen The Way We Were?
I have seen The Way We Were. I love Funny Girl.
Funny Girl is great. Yeah, yeah.
Talk? Oh, she's so sexy. And what's up?
Well, if you're interested in that, she does go into quite a lot of detail. She is, I didn't realize the people she was connected with, I should say.
My, if you could see me, my glasses will be wiggling. But yeah, she's had quite the life, we'll put it that way.
But yeah, I miss Barbra every single day now that that audiobook has finished.
My, if you could see me, my glasses will be wiggling. But yeah, she's had quite the life, we'll put it that way.
But yeah, I miss Barbra every single day now that that audiobook has finished.
Oh, that's a beautiful pick of the week.
Well I may see if I can borrow it from my library as well. That sounds terrific.
It's brilliant.
Mm-hmm.
Fantastic. Carole, what's your pick of the week?
Well, weird, Leanne, because I also have a book, an audiobook. Mine is a memoir with the best title that I've seen this year, I'm Glad My Mom Died.
This is a 2022 dark comedic memoir by this former actress called Janine Jenna McCurdy. Have you heard of her?
This is a 2022 dark comedic memoir by this former actress called Janine Jenna McCurdy. Have you heard of her?
No.
She's known for sitcoms, mostly kids' sitcoms. So one's called iCarly, Sam Cat, Malcolm in the Middle, you may have heard of.
Yeah, Malcolm in the Middle. Yeah.
That played here. Yeah, I hadn't really seen any of these, but I didn't know anything about Jennette McCurdy, but I really liked the title.
So when I saw it in my feed, I was like, I'm going to get that audiobook. Let's try it.
And it's great because she was a child actress and the whole book is about her going through that with her difficult relationship with her mother who was obviously in charge of her at the time.
So she started acting at age 6 and got talked into going to auditions by her mother at that time.
Apparently her mom's own acting aspirations were thwarted by her disapproving parents.
So when I saw it in my feed, I was like, I'm going to get that audiobook. Let's try it.
And it's great because she was a child actress and the whole book is about her going through that with her difficult relationship with her mother who was obviously in charge of her at the time.
So she started acting at age 6 and got talked into going to auditions by her mother at that time.
Apparently her mom's own acting aspirations were thwarted by her disapproving parents.
Oh no, not showbiz mom.
I want to give you the life I never had, that kind of thing. Yeah, Mom does not come off very good—Mommie Dearest not good.
Jennette was not allowed to shower on her own until her late teens because her mom had to do it to make sure she was really, really clean. Forced her into diets.
And despite winning all these awards for the sitcoms, she was a complete anorexic who leaned on alcohol way too much.
But despite all these shocking behind-the-scenes revelations, she's a really punchy writer with some great comedic moments that weave all these hardships together.
And it seems writing is very much her thing. She says of it in the book, performing feels inherently fake, writing feels inherently real.
Anyway, so if this sounds like your thing, check it out. I'm Glad My Mom Died by Jennette McCurdy. You can find it wherever you get your books or audiobooks from.
It is my pick of the week.
Jennette was not allowed to shower on her own until her late teens because her mom had to do it to make sure she was really, really clean. Forced her into diets.
And despite winning all these awards for the sitcoms, she was a complete anorexic who leaned on alcohol way too much.
But despite all these shocking behind-the-scenes revelations, she's a really punchy writer with some great comedic moments that weave all these hardships together.
And it seems writing is very much her thing. She says of it in the book, performing feels inherently fake, writing feels inherently real.
Anyway, so if this sounds like your thing, check it out. I'm Glad My Mom Died by Jennette McCurdy. You can find it wherever you get your books or audiobooks from.
It is my pick of the week.
Now, Carole, you've been chatting to the folks at Material this week.
Yes, I have. Abhishek Agrawal, he's the co-founder and CEO of Material, and we talk about all things email and email security. Check it out.
So today on Smashing Security's featured interview, we are speaking with Material Security's co-founder and CEO, Abhishek Agrawal.
Now, Material Security are creators of a multi-layer detection and response toolkit for email.
And today, we're going to find out about email threats and find out what dangers they pose for organizations right now in 2024. So welcome to Smashing Security, Abhishek Agrawal.
A delight to have you here.
So today on Smashing Security's featured interview, we are speaking with Material Security's co-founder and CEO, Abhishek Agrawal.
Now, Material Security are creators of a multi-layer detection and response toolkit for email.
And today, we're going to find out about email threats and find out what dangers they pose for organizations right now in 2024. So welcome to Smashing Security, Abhishek Agrawal.
A delight to have you here.
Thank you for having me. I'm excited to be here.
Now, first, maybe we could start with getting to know you. What can you tell us about your background and what led you to co-found Material Security?
Yeah, sure thing. So before founding this company, I was a very early PM at Dropbox. Where I actually wasn't on the security side.
I led data infrastructure groups, which powered a lot of Dropbox's internal monetization and experimentation efforts.
I also worked on search and a lot of the different consumer surfaces there. And my background before that is I was at Microsoft Research working on productivity-related incubations.
So really background was in product and engineering more focused on the productivity side. And this company was kind of a new foray into security.
And at Dropbox, we had definitely some exposure to the internal security team that led to some of the early ideas here.
But my background's primarily on the productivity side before this company.
I led data infrastructure groups, which powered a lot of Dropbox's internal monetization and experimentation efforts.
I also worked on search and a lot of the different consumer surfaces there. And my background before that is I was at Microsoft Research working on productivity-related incubations.
So really background was in product and engineering more focused on the productivity side. And this company was kind of a new foray into security.
And at Dropbox, we had definitely some exposure to the internal security team that led to some of the early ideas here.
But my background's primarily on the productivity side before this company.
Right. And then, so you founded Material Security in 2017?
That's right. Yep.
Yeah. And what led to that? So what was the niggling thing that you thought needed to be resolved? Founding a company is not easy peasy.
It takes a lot of time and strategy and money and all that stuff.
It takes a lot of time and strategy and money and all that stuff.
For sure.
Yeah.
So first of all, there were three of us, so I had two co-founders also from Dropbox, and we all worked together at Dropbox.
And really it was kind of a team-first thing where we knew we wanted to work together and build something. And we started exploring different spaces around that same time.
In 2017, one thing that was top of mind for everybody was the 2016 election cycle that had just happened in the US.
And really it was kind of a team-first thing where we knew we wanted to work together and build something. And we started exploring different spaces around that same time.
In 2017, one thing that was top of mind for everybody was the 2016 election cycle that had just happened in the US.
Yeah.
And that election cycle in particular, there were some very high-profile email-related attacks.
And being kind of new to the security world, we sort of approached that with, I would say, kind of a very naive, but maybe sort of fresh perspective where we were like, oh, this is kind of strange.
We thought email security was a solved problem. It's this 30, 40-year-old app. You know, why is email security playing a role in elections. This is kind of crazy.
And you start kind of digging at the problem and you realize that there's definitely opportunities to improve upon the current state of things.
So that was the genesis, that specific problem, you know, analyzing the election-related hacks, what could have been done better.
And that really led to some ideas that once we started socializing with our immediate network, we realized that there's an opportunity here.
And being kind of new to the security world, we sort of approached that with, I would say, kind of a very naive, but maybe sort of fresh perspective where we were like, oh, this is kind of strange.
We thought email security was a solved problem. It's this 30, 40-year-old app. You know, why is email security playing a role in elections. This is kind of crazy.
And you start kind of digging at the problem and you realize that there's definitely opportunities to improve upon the current state of things.
So that was the genesis, that specific problem, you know, analyzing the election-related hacks, what could have been done better.
And that really led to some ideas that once we started socializing with our immediate network, we realized that there's an opportunity here.
Ooh, tell us more about that.
So in those election hacks, if you think about what happened, someone was able to breach a mailbox and what that does is gets them, you know, 10, 15 years of email because all of us, when we moved to cloud email, started archiving all this mail.
We have sort of infinite storage. And if you just think about the average mailbox, inbox, it just contains all of this different type of data.
You know, in the personal setting, obviously my entire digital life is housed in my email. In a corporate setting, you know, IP, financial reports, employee and customer data.
Just you name it, it all ends up in email.
And so what we kind of got obsessed with was this idea of, well, yes, it's bad that someone got into an email account, but it's really bad that that means that they can just access 15 years of email, 20 years of email immediately.
And so the first idea was kind of, can we add additional layers of protection?
You know, the buzzword is zero trust or defense in depth, but the idea is that just because I get into your email account shouldn't mean that I literally get to access everything.
There should be additional layers of authentication or defense.
Another thing that that election hack taught us is if I get into your email account, I can go reset passwords to all sorts of other services and actually turn that email breach into now a Dropbox breach or a Twitter breach or a bank account breach.
In the case of the election hacks, you know, people got into an iCloud account where now they get text messages.
So it really opens another kind of interesting point, which is email also acts as identity.
So not only does it have years and years of your digital life in there, it also is your identity for a lot of different applications.
And I can use that to now move laterally from an email account to all these other things.
The key point here is that if I am only trying to stop bad emails from coming in, if that's the only context that I'm thinking about email security in, I'm sort of not really doing anything about the content inside email or the fact that I can use it to move laterally.
We have sort of infinite storage. And if you just think about the average mailbox, inbox, it just contains all of this different type of data.
You know, in the personal setting, obviously my entire digital life is housed in my email. In a corporate setting, you know, IP, financial reports, employee and customer data.
Just you name it, it all ends up in email.
And so what we kind of got obsessed with was this idea of, well, yes, it's bad that someone got into an email account, but it's really bad that that means that they can just access 15 years of email, 20 years of email immediately.
And so the first idea was kind of, can we add additional layers of protection?
You know, the buzzword is zero trust or defense in depth, but the idea is that just because I get into your email account shouldn't mean that I literally get to access everything.
There should be additional layers of authentication or defense.
Another thing that that election hack taught us is if I get into your email account, I can go reset passwords to all sorts of other services and actually turn that email breach into now a Dropbox breach or a Twitter breach or a bank account breach.
In the case of the election hacks, you know, people got into an iCloud account where now they get text messages.
So it really opens another kind of interesting point, which is email also acts as identity.
So not only does it have years and years of your digital life in there, it also is your identity for a lot of different applications.
And I can use that to now move laterally from an email account to all these other things.
The key point here is that if I am only trying to stop bad emails from coming in, if that's the only context that I'm thinking about email security in, I'm sort of not really doing anything about the content inside email or the fact that I can use it to move laterally.
So yeah, you're kind of saying that email is the target.
That's exactly right. And that's what we say all the time, that it's not just the way I get in, it's actually the thing I'm after.
And if you think about it only as the way in, then all of your security controls are gonna focus on it as the way in.
But you have to think about it as the actual target of the attacks. For example, very recently, in the US there's been kind of big nation state attacks on government email systems.
Midnight Blizzard was the most recent one. Before that there was SolarWinds, Hafnium, Storm.
In all of these cases, there was not a single malicious email that was sent, but the actual target of the attacks was all of these email content repositories, right?
If I can get into the email account of someone in the State Department, you can only imagine how useful that is from a state actor perspective.
So that sort of illustrates the problem really well, which is if there was no bad email sent, but I can get into an email account in many other ways, like I can bypass MFA, I can install a Chrome extension that gets me access.
I can convince someone to authorize a malicious OAuth application. There's many, many different ways in.
And if you think about it only as the way in, then all of your security controls are gonna focus on it as the way in.
But you have to think about it as the actual target of the attacks. For example, very recently, in the US there's been kind of big nation state attacks on government email systems.
Midnight Blizzard was the most recent one. Before that there was SolarWinds, Hafnium, Storm.
In all of these cases, there was not a single malicious email that was sent, but the actual target of the attacks was all of these email content repositories, right?
If I can get into the email account of someone in the State Department, you can only imagine how useful that is from a state actor perspective.
So that sort of illustrates the problem really well, which is if there was no bad email sent, but I can get into an email account in many other ways, like I can bypass MFA, I can install a Chrome extension that gets me access.
I can convince someone to authorize a malicious OAuth application. There's many, many different ways in.
Yeah.
If I get in, what additional controls we can have in place.
I like this a lot. I like the angle. 'Cause I've always thought of email as a vector, but you're absolutely right.
So tell me, how does Material Security, a multi-layered detection response toolkit, what, how does it help? How does, what is, how does it thwart off the bad stuff?
So tell me, how does Material Security, a multi-layered detection response toolkit, what, how does it help? How does, what is, how does it thwart off the bad stuff?
Yeah.
So on the kind of inbound detection side, we're doing honestly a lot of the same things that have been done for a while.
We're just applying new techniques to them, new types of data sources.
So for example, looking for signals that suggest that it is a malicious email, things like it's a sender your organization has never seen before, or it's doing a lot of urgency in its language, even though it's also at the same time trying to request a financial transaction.
And new sort of technology capabilities like AI and sort of a lot of the recent developments with LLMs are massively helpful for this problem because at the end of the day, you're often trying to decipher kind of the intent of these emails in order to understand if they're malicious.
And these language models can be very useful for that, along with just, you know, basic heuristics that you can apply if you can process a lot of data.
On the side of more techniques to actually help in the case that an account is breached and how do you protect the content inside or how do you stop me from moving laterally there, what we take is kind of a defense-in-depth approach.
So a very simple example, let's say that in my mailbox I have a message that's very, very sensitive. Maybe it's got PII or passport information or something like that.
If it is older than a certain age, what Material does is it redacts the contents of that email and it actually leaves a stub that doesn't contain the actual sensitive content.
It's a redacted version of that message.
We're just applying new techniques to them, new types of data sources.
So for example, looking for signals that suggest that it is a malicious email, things like it's a sender your organization has never seen before, or it's doing a lot of urgency in its language, even though it's also at the same time trying to request a financial transaction.
And new sort of technology capabilities like AI and sort of a lot of the recent developments with LLMs are massively helpful for this problem because at the end of the day, you're often trying to decipher kind of the intent of these emails in order to understand if they're malicious.
And these language models can be very useful for that, along with just, you know, basic heuristics that you can apply if you can process a lot of data.
On the side of more techniques to actually help in the case that an account is breached and how do you protect the content inside or how do you stop me from moving laterally there, what we take is kind of a defense-in-depth approach.
So a very simple example, let's say that in my mailbox I have a message that's very, very sensitive. Maybe it's got PII or passport information or something like that.
If it is older than a certain age, what Material does is it redacts the contents of that email and it actually leaves a stub that doesn't contain the actual sensitive content.
It's a redacted version of that message.
Cool.
The key thing though is that the user of the mailbox can still get the original contents of the message if they pass a side challenge.
On some factor that is very easy for them to do, but would be very hard for an adversary that had gotten into the account to do.
So for example, in the case of our customers, they're often using an IDP like an Okta or Duo.
And so imagine that I get into a mailbox, I see some messages that have been redacted because they're old and they contain sensitive data.
On some factor that is very easy for them to do, but would be very hard for an adversary that had gotten into the account to do.
So for example, in the case of our customers, they're often using an IDP like an Okta or Duo.
And so imagine that I get into a mailbox, I see some messages that have been redacted because they're old and they contain sensitive data.
If I want that message, I press a button, I have to pass a Duo challenge or an Okta challenge.
If I pass it successfully, the message is restored into my mailbox immediately via API. It's seamless. I can interact with the email as I always would in my mailbox.
If I pass it successfully, the message is restored into my mailbox immediately via API. It's seamless. I can interact with the email as I always would in my mailbox.
I'm not going to some third-party website to read my email.
Yeah, yeah.
But then after some amount of time, we're going to redact it again, so that, you know, at rest you're actually protecting this information.
You can apply a similar technique to something like password resets.
So if I go and request a password reset to my Dropbox, well, normally it would just send a password reset email, and if I'm in your account, I just use that to change the password to whatever I want.
And now I've compromised your Dropbox.
You can apply a similar technique to something like password resets.
So if I go and request a password reset to my Dropbox, well, normally it would just send a password reset email, and if I'm in your account, I just use that to change the password to whatever I want.
And now I've compromised your Dropbox.
Yeah.
In the case of Material, what we'll do is we'll actually intercept that password reset email and we will first make you prove again on a side challenge that you're actually the one that is requesting the password reset.
If you say yes, we can deliver it as usual. If you say no, then I could be in your account, but I don't get to go change your password to Dropbox.
If you say yes, we can deliver it as usual. If you say no, then I could be in your account, but I don't get to go change your password to Dropbox.
So you can take these sort of deterministic techniques and just say, hey, there's certain transactions that are so valuable that I'm not gonna let you do them unless you prove your identity again.
And this is really not a new idea. I mean, I'll give you a simple example. Let's say somehow you break into my bank account online.
And this is really not a new idea. I mean, I'll give you a simple example. Let's say somehow you break into my bank account online.
And it really doesn't matter how, but let's just say you're staring at my bank account. That's bad, obviously.
Yep.
But now let's say that you try to initiate a wire out of it that drains the entire account. What do you think the bank will do? Will it just let you do it? Of course not.
Instead, it makes you verify. It probably will make you reenter your password at a minimum. Probably there'll be some additional verification.
Mm-hmm.
But if you think about email, if I get in once, if I bypass authentication just once, so if I take over a user session, or I bypass MFA somehow, or I get you to authorize a malicious app, that's it.
It's game over. I have access to the entire contents of the email account. I can perform password resets.
It's game over. I have access to the entire contents of the email account. I can perform password resets.
There's no additional verification. It just doesn't make sense with all of the things that an email account has and all of the different ways I can exploit it to move laterally.
It doesn't make sense that we treat all messages as equal. Some of them are way, way, way higher consequence than others.
It doesn't make sense that we treat all messages as equal. Some of them are way, way, way higher consequence than others.
Absolutely.
And our whole idea is that those messages just deserve an additional layer of verification.
Yeah, I really like that because you're right, we kind of treat every email same.
And in fact, the information they contain can make one very unimportant versus one super, super, super sensitive. And it's just sitting in the same bucket.
And in fact, the information they contain can make one very unimportant versus one super, super, super sensitive. And it's just sitting in the same bucket.
Exactly.
So do you have any tips for anyone out there listening to this and thinking about next steps to better protect their email and its gateway to the organization?
Yeah, absolutely. So like everything in security, there's always infinite things you can do. There's always another risk you can cover.
And I always advocate for a very pragmatic approach. So the nice thing about email is that there's really only two cloud email systems that most companies are using.
It's either M365 or Google Workspace. So first of all, just making sure you're fully utilizing the native email security controls that already come with the provider is step one.
And you'd be surprised how many companies we talk to where we just see that they're not even properly configuring their existing security controls that they already own thanks to the email security provider.
So doing an audit of those and really making sure, especially in the Microsoft side, things can be intricate and they can be hard to decipher all the different settings.
But that's step one.
I think after that, if you feel the need to supplement the email security that the native provider is doing, maybe you're still seeing a lot of things get through.
That's where an API-based render is something you may want to evaluate. In the past, there used to be a lot of products that would make you deploy inside the email delivery path.
These are called secure email gateways. The modern sort of alternative to those is to actually take an API-based approach so that we're not routing all email through something else.
But post-delivery, you can have something still looking for malicious emails that may have landed in a mailbox.
If after that you feel that you've got those things under control, that's where then I would advocate thinking next about what do I do about some of the content in here?
How can I address some of those gaps? And so to summarize, it's a maturity curve, right?
Start with the basics, make sure you're actually using what the provider gives you by default.
Then think about supplementing with something if you're still seeing things get through.
And then finally, you can address the problem of content and really thinking about extra controls for messages themselves.
But it's a journey and it's better to start with the basics.
Having said that, obviously, my biased perspective is that if you're picking a platform to do some of these things, you don't want 3 different tools to do 3 different aspects of this.
So, it's best to pick one that can be on that journey with you.
And I always advocate for a very pragmatic approach. So the nice thing about email is that there's really only two cloud email systems that most companies are using.
It's either M365 or Google Workspace. So first of all, just making sure you're fully utilizing the native email security controls that already come with the provider is step one.
And you'd be surprised how many companies we talk to where we just see that they're not even properly configuring their existing security controls that they already own thanks to the email security provider.
So doing an audit of those and really making sure, especially in the Microsoft side, things can be intricate and they can be hard to decipher all the different settings.
But that's step one.
I think after that, if you feel the need to supplement the email security that the native provider is doing, maybe you're still seeing a lot of things get through.
That's where an API-based render is something you may want to evaluate. In the past, there used to be a lot of products that would make you deploy inside the email delivery path.
These are called secure email gateways. The modern sort of alternative to those is to actually take an API-based approach so that we're not routing all email through something else.
But post-delivery, you can have something still looking for malicious emails that may have landed in a mailbox.
If after that you feel that you've got those things under control, that's where then I would advocate thinking next about what do I do about some of the content in here?
How can I address some of those gaps? And so to summarize, it's a maturity curve, right?
Start with the basics, make sure you're actually using what the provider gives you by default.
Then think about supplementing with something if you're still seeing things get through.
And then finally, you can address the problem of content and really thinking about extra controls for messages themselves.
But it's a journey and it's better to start with the basics.
Having said that, obviously, my biased perspective is that if you're picking a platform to do some of these things, you don't want 3 different tools to do 3 different aspects of this.
So, it's best to pick one that can be on that journey with you.
That's brilliant advice. Listeners, you want to learn more? Of course you do. Go visit Material Security by going to smashingsecurity.com/material.
That's smashingsecurity.com/material. Here you're going to find a super engaging demo by YouTuber John Hammond. You can even request your own Material Security demo and much more.
So that's smashingsecurity.com/material. And a huge, huge thank you, Abhishek Agrawal, co-founder and CEO of Material Security.
That's smashingsecurity.com/material. Here you're going to find a super engaging demo by YouTuber John Hammond. You can even request your own Material Security demo and much more.
So that's smashingsecurity.com/material. And a huge, huge thank you, Abhishek Agrawal, co-founder and CEO of Material Security.
Yeah, my pleasure. Thank you.
Terrific stuff. And that just about wraps up the show for this week, Lianne. I'm sure lots of our listeners would love to follow you online and find out what you're up to.
What's the best way for folks to do that?
What's the best way for folks to do that?
Yep. So I'm a menace to society on LinkedIn. LinkedIn, so look me up as Lianne Potter. I'm the one that's really humble on there.
And also the podcast, so Compromising Positions cybersecurity podcast. Don't just Google, as I say, Compromising Positions on its own.
And, you know, award-winning cybersecurity podcast, I should say, joining the likes of yourselves. So come and give us your ears.
And also the podcast, so Compromising Positions cybersecurity podcast. Don't just Google, as I say, Compromising Positions on its own.
And, you know, award-winning cybersecurity podcast, I should say, joining the likes of yourselves. So come and give us your ears.
Fantastic stuff. And you can follow us on Twitter at Smashing Security, no G. Twitter allows to have a G in And don't forget to ensure you never miss another episode.
Follow Smashing Security in your favorite podcast apps, such as Apple Podcasts, Spotify, and Pocket Casts.
Follow Smashing Security in your favorite podcast apps, such as Apple Podcasts, Spotify, and Pocket Casts.
And huge, huge thank you to our episode sponsors, Material, Vanta, and 1Password. And of course, to our wonderful Patreon community. It's thanks to them all that this show is free.
For episode show notes, sponsorship info, guest lists, and the entire back catalog of more than 376 episodes, check smashingsecurity.com.
For episode show notes, sponsorship info, guest lists, and the entire back catalog of more than 376 episodes, check smashingsecurity.com.
Until next time, cheerio, bye-bye, bye-bye.
There we go.
Wonderful. Thank you very much, Lianne. Much appreciated. Appreciate it.
No, thank you, thank you very much. And hopefully, Carole, you'll have time to go for a wee before your next thing.
Exactly.
Yes, I'm sorry, Carole, you haven't got very long, have you?
I've got 5 minutes, that's all I need. So brilliant, everything very good. Thank you, it was great.
Thank you, really appreciate it, it's always a blast.
No worries at all, we really appreciate having you.
Catch you later.
Bye-bye. Okay, bye-bye.
Hosts:
Graham Cluley:
@grahamcluley.com
@
/ grahamcluley
Carole Theriault:
Guest:
Lianne Potter – @Tech_Soapbox
Episode links:
- Cyber attacks update – NHS Dumfries & Galloway.
- J Paul Getty – Wikipedia.
- Cyber expert urges against ‘panic’ over NHS data leak – BBC News.
- “Don’t panic” – Corporal Jones from Dad’s Army – YouTube.
- All households in Scottish region to get alert about hackers publishing stolen medical data – The Record.
- Amazon-Powered AI Cameras Used to Detect Emotions of Unwitting UK Train Passengers – Wired.
- Man ludicrously blames Apple for his wife catching him communicating with prostitutes – Apple Insider.
- Businessman sues Apple after wife finds ‘deleted’ iPhone messages to prostitute – LBC.
- ‘Tech made me do it’ is no excuse for adultery – The Times.
- Is it DNS?
- “My name is Barbra” – Amazon.
- ”I’m Glad My Mom Died” by Jennette McCurdy – Simon & Schuster.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
Sponsored by:
- 1Password Extended Access Management – Secure every sign-in for every app on every device.
- Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get 10% off!
- Material Security – email security that covers the full threat landscape – stopping new flavors of phishing and pretexting attacks in their tracks, while also protecting accounts and data from exploit or exposure.
Support the show:
You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.
Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!
Follow us:
Follow the show on Bluesky at @smashingsecurity.com, or on Mastodon, on the Smashing Security subreddit, or visit our website for more episodes.
Thanks:
Theme tune: “Vinyl Memories” by Mikael Manvelyan.
Assorted sound effects: AudioBlocks.
