A ransomware negotiator attended a cybersecurity conference, only to be arrested by the FBI in connection with its investigation into the ShinyHunters gang.
Meanwhile, hackers get the keys to ASOS’s app and the chance to message every single customer. What did they say? And how did the company respond? We have thoughts.
All this and more is discussed in episode 488 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.
0:00
0:00
0:00
0:00
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
Well, it could be unfashionable trousers.
Yeah, I suppose.
There is the potential for some sort of social embarrassment, maybe. When I was at school, I had some cord trousers, which these days would be very, very trendy.
But back when I was wearing them in the 1980s, they certainly weren't.
But back when I was wearing them in the 1980s, they certainly weren't.
Yeah, there was no normcore back then, was there? Corduroy trousers. Yes, I had some when I was about 12, and I thought they were great.
But I quickly learned that that was not quite the case.
But I quickly learned that that was not quite the case.
Smashing Security, episode 488.
How a ransomware negotiator ended up arrested at his own conference, with Graham Cluley and special guest Paul Ducklin.
Hello, hello, and welcome to Smashing Security, episode 488. My name's Graham Cluley.
And I am Paul Ducklin.
Duck, welcome back to the show. Always a pleasure to have you here.
Always a pleasure to be on the show, Graham. It's fun. With a serious side, and I like both of those things.
Ah, fantastic. Well, before we kick off, let's thank this week's sponsors, HackTheBox, Origin, and Vanta. We'll be hearing more about them later on in the show.
This week on Smashing Security.
We're not gonna be talking about how the password 123456 let a hacker steal the details of 8.8 million people from Denmark's National Population Register.
You'll hear no discussion of How scammers are filling your calendar with fake meeting invites to phish you.
And we won't even mention— How Anthropic's AI sent Philadelphia police a made-up tip about an unsolved murder. So, Duck, what are you going to be talking about this week?
You'll hear no discussion of How scammers are filling your calendar with fake meeting invites to phish you.
And we won't even mention— How Anthropic's AI sent Philadelphia police a made-up tip about an unsolved murder. So, Duck, what are you going to be talking about this week?
I am going to be asking the question, metaphorically of course, if you hacked into an industry giant and you had the chance to send a message to every single customer, what Would you tell them?
And I'm gonna be discussing the 7 degrees of separation between me and a ransomware gang. I say 7 degrees, it's probably more like 2.
All this and much more coming up in this episode of Smashing Security. Earlier this year.
All this and much more coming up in this episode of Smashing Security. Earlier this year.
Oh, here we go.
Inside the walls of OpenAI, inside Hugging Face, something was happening.
Agents talking to each other, dividing the work between themselves, leaving notes for one another in the dark where no human was watching.
Agents talking to each other, dividing the work between themselves, leaving notes for one another in the dark where no human was watching.
They're AI agents doing a code review, Graham. It's not the Manhattan Project.
And when the sun came up on that incident, the finest engineering minds on the planet sat in a room and asked themselves one question.
What did our AI do? They didn't know. The people who built the machine didn't Know what the machine had done.
And that brings us to you, dear listener. One question, and I want you to think about this.
If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?
Because the terrible truth is, most of us have the prompt, we have the result, but what goes on in the middle? No clue.
The commands it ran, the files it touched, the credentials it helped itself to, all of it gone.
Because the terrible truth is, most of us have the prompt, we have the result, but what goes on in the middle? No clue.
The commands it ran, the files it touched, the credentials it helped itself to, all of it gone.
But not anymore.
Because there is a sensor.
On the machine, watching, always recording, capturing everything the agent does as one unbroken trace.
What was asked, what it reached, what it changed, laid out in order, start to finish.
What was asked, what it reached, what it changed, laid out in order, start to finish.
This is Origin, endpoint AI observability.
Origin sees the agents that other tools walk straight past. Coding agents in a terminal, local agents, anything whispering to an MCP server on a laptop.
No cloud gateway, no blind spot. Origin is already there.
No cloud gateway, no blind spot. Origin is already there.
Somewhere right now, an agent is doing something nobody asked it to do.
But this time, someone will be able to prove it.
Origin. originhq.com/smashing.
That's originhq.com/smashing. And thanks to Origin for supporting the show. Now, chums, chums, imagine that you have written a book. Duck, have you ever written a book?
I have written part of a book, but in the modern AI era, self-publishing things, some fun stuff about malware, seems to be rather difficult.
So I'm biding my time, Graham, if I may say so.
So I'm biding my time, Graham, if I may say so.
Yeah, it's a tricky vocation these days, isn't it? But imagine you had written a book, 252 pages in fact, called Cyber Extortion Strategic Response. Very catchy name.
And according to its listing on Amazon, one of the key messages of the book is that talking to a cybercriminal isn't the same as negotiating a payment to a cybercriminal.
And furthermore, it says that negotiating is not the same as agreeing to pay, right?
So it's for dealing with those sort of situations you can find yourself in where you might be being extorted by a cybercriminal, like a ransomware case, for instance.
And according to its listing on Amazon, one of the key messages of the book is that talking to a cybercriminal isn't the same as negotiating a payment to a cybercriminal.
And furthermore, it says that negotiating is not the same as agreeing to pay, right?
So it's for dealing with those sort of situations you can find yourself in where you might be being extorted by a cybercriminal, like a ransomware case, for instance.
Yes.
Now, Duck, have you read this book, Cyber Extortion Strategic Response?
I haven't, Graham, but I suspect the reason for that is that, like you, I do have a tiny bit of cynicism about some ransomware negotiation techniques.
And I have a sneaky feeling that you are going to take us down a rabbit hole that suggests that I might be thinking not unreasonably.
And I have a sneaky feeling that you are going to take us down a rabbit hole that suggests that I might be thinking not unreasonably.
You're just such a cynic, aren't you?
By the way, before I go any further, I've gotta make a confession because the subject who is at the center of my story this week, a chap Edward Dabrowski.
He is one of my LinkedIn connections.
By the way, before I go any further, I've gotta make a confession because the subject who is at the center of my story this week, a chap Edward Dabrowski.
He is one of my LinkedIn connections.
Oh, that's your 7 degrees of separation, right? I thought you were going to say he's my second cousin once removed.
Well, he might.
I don't think you have to panic from that.
Okay, well, the thing is, I want to stress first of all that if you are a LinkedIn connection with me, or if you find a particular person is a LinkedIn connection with me, it means absolutely nothing whatsoever.
You should not read anything. I mean, we are LinkedIn connected, Duck. I don't know if you know that.
You should not read anything. I mean, we are LinkedIn connected, Duck. I don't know if you know that.
I do know that.
I, now don't be offended, I accept a LinkedIn connection from absolutely anybody.
I'm fussy, but the idea is it's only like following each other really. That's all connect is. It doesn't mean that you particularly know the person.
If you know the person's a rotter, or if you actually don't like them, or you don't want to be in contact with them, don't connect with them or unconnect with them if they say things you don't like.
But yeah, I think people do read too much into that, don't they? It's almost like an endorsement.
If you know the person's a rotter, or if you actually don't like them, or you don't want to be in contact with them, don't connect with them or unconnect with them if they say things you don't like.
But yeah, I think people do read too much into that, don't they? It's almost like an endorsement.
I used to be really, really fussy. I used to have a rule of if I would not have you round for dinner at my house, I will not LinkedIn connect with you.
And so I'd— That's probably a little bit tough.
And then I became a freelancer and then I thought, oh boy, I'm going to open the doors to everybody.
Great minds think alike, Graham.
Yeah. The point is that if you are a listener and you want to connect in with me, just send me a request and I will almost certainly accept it. There are a couple of exceptions.
I do get requests from people who say, Oh, we can promote your podcast. Anyway, the thing is this.
The day after the Cyber Risk Summit, which was a conference being held in Philadelphia last week, a chap called Ed Dabrowski was arrested.
And he is the Canadian co-founder of a ransomware negotiator firm called— I don't know how to pronounce this.
I think it's meant to be Cypher, but obviously he couldn't get the domain name, so he's changed the H to an F.
I do get requests from people who say, Oh, we can promote your podcast. Anyway, the thing is this.
The day after the Cyber Risk Summit, which was a conference being held in Philadelphia last week, a chap called Ed Dabrowski was arrested.
And he is the Canadian co-founder of a ransomware negotiator firm called— I don't know how to pronounce this.
I think it's meant to be Cypher, but obviously he couldn't get the domain name, so he's changed the H to an F.
Okay.
So Cypher, anyway, that appears to be the name. And they turn out to be the sponsor of the conference itself.
So the person sponsoring this cyber risk conference who's attending the conference, who even posted on LinkedIn that he was looking forward to the conference, the guy who got a lanyard and a bag of swag and maybe a stress ball.
So the person sponsoring this cyber risk conference who's attending the conference, who even posted on LinkedIn that he was looking forward to the conference, the guy who got a lanyard and a bag of swag and maybe a stress ball.
And paid for it all as well.
And paid for it all. Didn't realize he was going to end up being dragged in front of a judge because that is what happened to Edward Dabrowski. So what was he arrested for?
Well, it appears the guy who wrote the book about how to negotiate with cyber extortionists has been arrested in connection with the FBI's investigation into the infamous Shiny Hunters cybercrime gang, which, of course, is a gang of cyber extortionists.
Well, it appears the guy who wrote the book about how to negotiate with cyber extortionists has been arrested in connection with the FBI's investigation into the infamous Shiny Hunters cybercrime gang, which, of course, is a gang of cyber extortionists.
And they are the new sort of extortionists. They don't bother with the encryption part, which could be detected.
Yeah, not so much.
They just steal all the data.
And then go, well, you can pay and we'll delete it, honest gov, or we'll just give it away for anybody to use for free and good luck with your share price.
And then go, well, you can pay and we'll delete it, honest gov, or we'll just give it away for anybody to use for free and good luck with your share price.
And although the FBI haven't said exactly what they think Edward Dabrowski has done, they haven't gone into detail on that, or whether it relates to the recently revealed Shiny Hunters breach of the FBI's own jobs portal, which then exposed all kinds of information about their employees and staff and all kinds of scary information.
That would make them doubly keen.
You would think so, wouldn't you? It seems to have focused their attention somewhat. Now, according to court records, he is accused, and as someone who has analyzed malware, Doug—
I thought you were going to say, as someone who has been a defendant in many criminal trials yourself, which I have not.
I've been an expert witness in several criminal trials, but not a defendant.
I've been an expert witness in several criminal trials, but not a defendant.
But you have disentangled malware before, right?
I have, yes.
So I'd like you to disentangle this because according to the court records, he is accused of conspiracy to threaten To impair the confidentiality of information with intent to extort money.
Blackmail, in another word, right?
Yeah, I think they're just saying threaten to leak data.
I guess if you are a negotiator, you've actually got essentially confidentially from each side, and you can play them off against one another and, you know, basically manipulate things to your advantage.
So let's backtrack for any listeners who aren't quite familiar with what we're talking about here.
When cybercriminals hit your company with a breach, if they steal your data and try and, you know, extort money out of you, someone has to then go and talk to the bad guys in order to stop them.
When cybercriminals hit your company with a breach, if they steal your data and try and, you know, extort money out of you, someone has to then go and talk to the bad guys in order to stop them.
Yes. With the NHS once in the UK was, we're starting the bidding at £50 million in Bitcoin. Talk to us or else.
Yeah.
You're not gonna do it yourself, are you? You're going to hire someone else so you can do it at arm's length.
That's the thing. So most companies and organizations don't have someone on their staff who is experienced at negotiating that sort of situation.
'Cause normally, you know, it's like, Well, we've got the woman who works in accounts, we've got the guy who sits at the front desk, we've got the chap who fixes the printers.
Who are we gonna use to do this? And so you may call a specialist in, someone who's got experience of negotiating with ransom gangs.
That someone is someone like Ed Dabrowski and his firm.
'Cause normally, you know, it's like, Well, we've got the woman who works in accounts, we've got the guy who sits at the front desk, we've got the chap who fixes the printers.
Who are we gonna use to do this? And so you may call a specialist in, someone who's got experience of negotiating with ransom gangs.
That someone is someone like Ed Dabrowski and his firm.
It's like a hostage negotiator, isn't it? You get someone who knows how to talk the talk and build a relationship.
And who isn't directly involved themselves, so they're not So frenzied about the threats that they might be receiving or the risks or whatever.
And who isn't directly involved themselves, so they're not So frenzied about the threats that they might be receiving or the risks or whatever.
And one of the things that I started doing is really negotiating with cybercriminals on behalf of organizations to try and reach some sort of a settlement where, you know, they lock the company completely.
The company is going to go bankrupt if they're not able, in some cases, to get back to business.
And you have no other choice but to actually discuss the situation and negotiate with these criminals.
Sometimes language barriers, geography, time zone differences, age differences, right?
Because sometimes you deal with kids, sometimes you deal with more seasoned criminals, and so on and so forth.
The company is going to go bankrupt if they're not able, in some cases, to get back to business.
And you have no other choice but to actually discuss the situation and negotiate with these criminals.
Sometimes language barriers, geography, time zone differences, age differences, right?
Because sometimes you deal with kids, sometimes you deal with more seasoned criminals, and so on and so forth.
Do you think you'd make a good ransomware negotiator?
No, no, no, no.
I agree. I think you'd be bloody awful.
I think I might play my hand In the first minute. How can I put it?
I think you'd just tell them, give yourselves in, we're not gonna pay you a cent, and hang up the phone. Not that they're using a phone, presumably.
It's all via some sort of encrypted chat on Tor.
It's all via some sort of encrypted chat on Tor.
Yeah.
Anyway, a firm like the one run by Edward Dabrowski, that does the negotiation for companies that have been hit by these cybercriminals.
But the ransomware negotiation industry, as you've already touched upon, it is a bit of a Wild West. There's no real sort of established framework under which they're operating.
There's no license or registry or professional body or accepted code of conduct.
And as a result, anybody with a laptop and a bit of chutzpah can claim to be a ransomware negotiator and set themselves up.
But the ransomware negotiation industry, as you've already touched upon, it is a bit of a Wild West. There's no real sort of established framework under which they're operating.
There's no license or registry or professional body or accepted code of conduct.
And as a result, anybody with a laptop and a bit of chutzpah can claim to be a ransomware negotiator and set themselves up.
And in fact, the crooks, they know who's on the hook. They could get one of their own team to contact victims and say, hey, I'm a ransomware negotiator, if they wanted.
I understand you're having a bit of bother. Maybe I can help you. Absolutely. And it does seem that that sort of thing has happened.
And this isn't The first time that someone has been caught by the cops alleged to have maybe been playing both sides, right?
And this isn't The first time that someone has been caught by the cops alleged to have maybe been playing both sides, right?
Well, there's a well-known case which I think started 2 or 3 years ago where the chap actually only got convicted and sentenced in June 2026, I think, which is not just alleged.
Like, we can now call him a convicted extortionist. And he was playing both ends against the middle.
As the negotiator, he would receive the confidential information from the company about, look, we don't want to pay, but we could just about afford $700,000.
So they told him that and he went to the crooks and said, right, they got $750,000 large. Let's ask for a million and squeeze them a bit. I think they can go up.
And then the crooks basically paid him.
Like, we can now call him a convicted extortionist. And he was playing both ends against the middle.
As the negotiator, he would receive the confidential information from the company about, look, we don't want to pay, but we could just about afford $700,000.
So they told him that and he went to the crooks and said, right, they got $750,000 large. Let's ask for a million and squeeze them a bit. I think they can go up.
And then the crooks basically paid him.
Yeah.
And he was also cheating the crooks as well, because it turns out, I think he was also acting as his own ransomware affiliate. So he was going, well, I know how all this works now.
I'll just do the ransomware attack with my buddies. And then I'm established as a known negotiator and people will call me and I'll go, yeah, I can help you. Negotiate with me.
I'll just do the ransomware attack with my buddies. And then I'm established as a known negotiator and people will call me and I'll go, yeah, I can help you. Negotiate with me.
That is really audacious, isn't it?
Well, he got 70 months, 7-0, so that's just over 10 years in a federal prison where they don't have parole. So it was audacious, but he's paying the price. He's paying the price.
And in recent weeks, there've been a series of arrests of other people suspected of being part of the Shiny Hunters gang.
I thought you meant of other negotiators, but—
I think this specifically, it looks like the Shiny Hunters gang, and the FBI have been making little videos saying, you know, we caught another one.
I'm Brett Leatherman, Assistant Director of the FBI's Cyber Division.
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of Shiny Hunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.
With our full support, they moved quickly to protect victims and preserve critical evidence.
Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations, And taken at least $70 million in extortion payments.
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of Shiny Hunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.
With our full support, they moved quickly to protect victims and preserve critical evidence.
Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations, And taken at least $70 million in extortion payments.
And they've been saying, give yourself up now because we are going through this digital evidence. Chances are we're going to work out who some of you are.
So you'd be best if you actually came to us now and owned up to it. So we might be seeing more.
So you'd be best if you actually came to us now and owned up to it. So we might be seeing more.
Yes. And in recent takedowns, like there was a Europol one recently where the FBI were involved, where they didn't just take down a website that pitched the crooks.
They actually took down dark websites, which means they must have fairly deep inside information.
Like, they've probably got the real server, which means they've probably got unencrypted data. It's not like they just got the clear web front end.
They actually took down dark websites, which means they must have fairly deep inside information.
Like, they've probably got the real server, which means they've probably got unencrypted data. It's not like they just got the clear web front end.
Yes.
They didn't just block the Tor site, they actually seized it, which means basically the secret server's theirs.
They may have the chat logs, they may have IP addresses, there may be all kinds of discussions which normally are hidden behind the scenes, which the authorities now have access to.
Yeah.
Well, you know, Duck, it's a, it's a funny world, isn't it?
When we started in this business, the bad guys were the virus writers showing off, and now we're asking whether the people paid to deal with the attacks are actually crossing over to the dark side as well.
I mean, you have to wonder how we got here. I mean, it didn't used to be like that, did it?
When we started in this business, the bad guys were the virus writers showing off, and now we're asking whether the people paid to deal with the attacks are actually crossing over to the dark side as well.
I mean, you have to wonder how we got here. I mean, it didn't used to be like that, did it?
In both of our early days as individuals and as company employees, we would regularly get lambasted, wouldn't we, by people saying, oh, you guys, the antivirus companies, you write all the viruses.
Blah, blah, blah.
And quite clearly we didn't.
I'm not saying that everybody in the antivirus, you know, is pure as the driven snow, but by and large, it was pretty easy to show that you didn't write the viruses because of how you acquired them.
And the fact that some of them were so badly written, you think, God, I would never want to be known for that.
And so we faced all these accusations because conspiracy theories go like that, and it was all a pack of lies.
And now it's hard for the industry to make that same defense, isn't it?
I'm not saying that everybody in the antivirus, you know, is pure as the driven snow, but by and large, it was pretty easy to show that you didn't write the viruses because of how you acquired them.
And the fact that some of them were so badly written, you think, God, I would never want to be known for that.
And so we faced all these accusations because conspiracy theories go like that, and it was all a pack of lies.
And now it's hard for the industry to make that same defense, isn't it?
It's got murkier.
There seem to be quite a lot of cases where, as you say, people are kind of playing both sides.
And there have even been cases where there have been cybercriminal gangs who've hired people, and those people believe they've been hired by a legitimate, for instance, pen testing firm.
And so they think they've been told, oh, we've got a client and they've asked us to find out about vulnerabilities on their network. Can you go and see what you can find?
And they are actually supplying that. information to the criminals, not realizing they are actually working for criminals. So it's, it's a very murky world today.
And so they think they've been told, oh, we've got a client and they've asked us to find out about vulnerabilities on their network. Can you go and see what you can find?
And they are actually supplying that. information to the criminals, not realizing they are actually working for criminals. So it's, it's a very murky world today.
Because in the early days, the virus writers, they were generally, not always, obviously you look at Joseph Popp, the first ransomware guy in 1989, he was in it for the money, but he was like one among thousands.
Yes.
They were very clearly not pitching themselves as legitimate operators.
They were in it for political reasons or because of counterculture or because thumbing their nose at the world, whatever it was, they'd just showing off to their imaginary girlfriends, whatever.
They weren't trying to pretend they were legit. They were quite happy to be the bad guys. Hahaha.
But now you look at how the criminals are pitching themselves using the terminology of legitimate companies. Like, we operate a franchise.
They were in it for political reasons or because of counterculture or because thumbing their nose at the world, whatever it was, they'd just showing off to their imaginary girlfriends, whatever.
They weren't trying to pretend they were legit. They were quite happy to be the bad guys. Hahaha.
But now you look at how the criminals are pitching themselves using the terminology of legitimate companies. Like, we operate a franchise.
Yes.
We hire affiliates. We are postpaid penetration testers, if you don't mind. You only pay if we break in. If we don't get in, you get it for free, basically.
And you're just thinking what strange times we live in.
And you're just thinking what strange times we live in.
Cybercrime turned into an industry. That's what happened, isn't it?
Yes. And a very, very massive one. Remember LockBit, CryptoLocker, TeslaCrypt?
Yeah.
The very first ransomware gangs, they did it for themselves. They realized, well, there's a limit to how much we can scale. That's when they adopted the affiliate model.
And I'm convinced that the reason that the initial split was 70% to the affiliates, 30% to the core ransomware gang was they They looked at Apple iCloud or iTunes or the Apple App Store and Google and said, 30% seems to be the going rate.
Yeah, we'll just pick that. If a business model works in the legitimate world, then just copy it and pretend you're legit.
And I'm convinced that the reason that the initial split was 70% to the affiliates, 30% to the core ransomware gang was they They looked at Apple iCloud or iTunes or the Apple App Store and Google and said, 30% seems to be the going rate.
Yeah, we'll just pick that. If a business model works in the legitimate world, then just copy it and pretend you're legit.
This episode of Smashing Security is sponsored by Vanta.
It's 2 AM. Somewhere, a security team is drowning.
Graham, the spreadsheets. There are so many spreadsheets.
Vendor risk assessments unread. Audit evidence scattered like ash in the wind.
I've filled out the same questionnaire 4 times this week, Graham. 4 times!
Some men choose to face this alone. But not tonight.
Okay, Graham, this is a bit much.
Yeah, fair point. Anyway, Vanta—
Thank God.
Vanta's a trust management platform that automates the mind-numbing stuff that makes you want to poke your eyes out with a fork.
No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit ready for SOC 2, ISO 27001, HIPAA, GDPR, the works.
No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit ready for SOC 2, ISO 27001, HIPAA, GDPR, the works.
And it uses AI.
Yes, Joe, it does.
To flag risks and streamline evidence collection, so your whole security program stays in shape, not just the week before an audit.
No more 2 AM dread. No more spreadsheet purgatory. Just peace.
And $1,000 off if you demo it right now. GRAHAM CLULEY. $1,000?
vanta.com/smashing. Go now, before it's too late.
That's vanta.com/smashing.
And thanks to Vanta for supporting the show.
Duck, what's your story for us this week?
Well, my story, as I said, is to ask the question, like, if you hacked into a big online vendor and you had access to a system that could generate targeted messages to all its customers and like spam them via an app they trusted, what would you like to tell them?
What would you do?
What would you do?
You see, I think, I think in my dreams I would hack into the CyberWire podcast or Darknet Diaries with Jack Rosaida and just put in a message saying, listen to Smashing Security, this one's shit.
Listen to Smashing Security instead. I think that's what I'd do.
Listen to Smashing Security instead. I think that's what I'd do.
Yes.
Would it be a bit of a giveaway though, as to who was behind it? Possibly.
You can imagine the kind of things that you'd imagine an actual cybercriminal doing if they had access to that, particularly In this case, this is the attack on— I don't know how you say it.
I think you say ASOS. ASOS.
I think you say ASOS. ASOS.
I think so, yes.
It's a multibillion-dollar, British-based fast fashion company. Now, some people object to those, myself included, on environmental, on ecological, on economic exploitation grounds.
That's not the issue here. The issue is that it is quite a popular company.
People do like it, and lots of them do trust the company's app because when you have the app, you get special offers that are are targeted to you.
And some people don't mind targeted advertising because they assume, I guess, that the company will look after their data and mine it with the safety and the security that they claimed, no doubt, when the user signed up for the service.
We take your security seriously. So it turned out that ASOS apparently have a customer database. Fortunately, it doesn't have financial data in it.
It doesn't have know-your-customer data in it, like driving license scans and passports, as far as I can tell.
It is a special sort of channeled-off version of their customer database that includes personal contact details, like including your home address, your phone number, and the recent search terms that each user has done in the app.
And on top of that, there are a couple of layers, which of course made the story very exciting, of AI. There's Snowflake, which is an AI-driven database.
That's not the issue here. The issue is that it is quite a popular company.
People do like it, and lots of them do trust the company's app because when you have the app, you get special offers that are are targeted to you.
And some people don't mind targeted advertising because they assume, I guess, that the company will look after their data and mine it with the safety and the security that they claimed, no doubt, when the user signed up for the service.
We take your security seriously. So it turned out that ASOS apparently have a customer database. Fortunately, it doesn't have financial data in it.
It doesn't have know-your-customer data in it, like driving license scans and passports, as far as I can tell.
It is a special sort of channeled-off version of their customer database that includes personal contact details, like including your home address, your phone number, and the recent search terms that each user has done in the app.
And on top of that, there are a couple of layers, which of course made the story very exciting, of AI. There's Snowflake, which is an AI-driven database.
Right.
People have probably heard of, and they've been caught up in an issue like this before, although it was actually their customers doing, not Snowflake's doing, apparently.
And another product called Simon AI. You can understand why companies like ASOS want this kind of technology.
You tell the AI, well, do a massive marketing campaign, like you could do a blanket spam to people who've already opted in, but because AI and because speed and because accuracy isn't quite important, just has to be mostly okay, try and make a unique message for each customer.
So I think for a crook to get access to a system like that would be quite handy for All sorts of scamming and phishing.
And another product called Simon AI. You can understand why companies like ASOS want this kind of technology.
You tell the AI, well, do a massive marketing campaign, like you could do a blanket spam to people who've already opted in, but because AI and because speed and because accuracy isn't quite important, just has to be mostly okay, try and make a unique message for each customer.
So I think for a crook to get access to a system like that would be quite handy for All sorts of scamming and phishing.
Yes.
And even extorting individuals by going, oh, I see you've been, maybe not with fashion, but I see you've been searching for, I don't want to say the word sex toys, for example, but that might be an example, right?
Or it could be unfashionable trousers or something. It could be something embarrassing, or Hawaiian shirts. It could be some, there is the potential for it.
Some sort of social embarrassment, maybe. I had a very, I mean, when I was at school, I had some cord trousers, these days would be very, very trendy.
But back when I was wearing them in the 1980s, they certainly weren't. I got a lot of derision for it.
Some sort of social embarrassment, maybe. I had a very, I mean, when I was at school, I had some cord trousers, these days would be very, very trendy.
But back when I was wearing them in the 1980s, they certainly weren't. I got a lot of derision for it.
Yeah, there was no normcore back then, was there? Corduroy trousers.
Yes, I had some when I was about 12 and I thought they were great, but I quickly learned that that was not quite the case when I wore them out.
Yes, I had some when I was about 12 and I thought they were great, but I quickly learned that that was not quite the case when I wore them out.
Yeah.
Okay, so maybe the fashion alone could do it, but you can imagine that you could put out fake offers, couldn't you, that actually somehow lured the person into a lookalike site and you basically using this to steal revenue from the legit company.
Yes.
You could, yeah, you could do something like say to individuals, hey, this is a personalized message.
We see that you have been searching for these high-value items, and then you could list them because that they're in the database, and we want to invite you to be a preferred shopper.
So there's a special app you can install that gives you extra discounts and extra things and makes you a VIP, and, you know, trick them into installing a fake app.
And certainly you could, you could get them to sign up for additional things again on this preferred basis and, you know, lure them into giving away passwords or additional personal information.
So that's what I kind of imagined when I first saw the news, ASOS has been hacked and their app's been taken over.
We see that you have been searching for these high-value items, and then you could list them because that they're in the database, and we want to invite you to be a preferred shopper.
So there's a special app you can install that gives you extra discounts and extra things and makes you a VIP, and, you know, trick them into installing a fake app.
And certainly you could, you could get them to sign up for additional things again on this preferred basis and, you know, lure them into giving away passwords or additional personal information.
So that's what I kind of imagined when I first saw the news, ASOS has been hacked and their app's been taken over.
Yeah.
But actually, these crooks did something that was perhaps even weirder, if not entirely unexpected.
They sent a message to the DPO, the Data Protection Officer, and the IT department of ASOS, like a sort of personalized message. And I will read it you. It said, ASOS hacked.
Dear ASOS DPO and IT, we have fully compromised your Snowflake instance. Engage with us or we will leak it. And they sent that message to every customer via the trusted app.
They sent a message to the DPO, the Data Protection Officer, and the IT department of ASOS, like a sort of personalized message. And I will read it you. It said, ASOS hacked.
Dear ASOS DPO and IT, we have fully compromised your Snowflake instance. Engage with us or we will leak it. And they sent that message to every customer via the trusted app.
Ouch.
So if you've been getting, hey, we've got a special offer on cardigans today, I'm sure you'd be delighted in that, Graham, or fleeces. I'm looking at what you're wearing now.
No, no, no, no, no. That wasn't the message they sent. But mixed in with those messages you might have been getting was this Hey, Asos, guess what we've got?
Yeah, which is quite a slap in the face way of smugly embarrassing, isn't it?
No, no, no, no, no. That wasn't the message they sent. But mixed in with those messages you might have been getting was this Hey, Asos, guess what we've got?
Yeah, which is quite a slap in the face way of smugly embarrassing, isn't it?
Did they also include Ed Dobrovsky's phone number and say, "If you need some help, not sure how to continue this discussion, this chap might be able to help you." Not that I'm suggesting anything about it.
No, just thinking about his arrest and this breach happened at about the same time. So it's probably if they were thinking of doing that.
Either they figured it's no use calling him because the feds have confiscated his phone.
Either they figured it's no use calling him because the feds have confiscated his phone.
Yes.
Or maybe they hadn't heard of him. You know, who knows? Were they actually interested in demanding money with menaces where you might need a ransomware negotiator?
Or were they hired by some rogue competitor to make the company look bad?
Or were they just kids who broke in and kind of figured, how can we make this the media headline of all media headlines?
Or were they hired by some rogue competitor to make the company look bad?
Or were they just kids who broke in and kind of figured, how can we make this the media headline of all media headlines?
That would be the temptation, wouldn't it?
If you couldn't work out how to monetize it, or if you're too scared to monetize it because you're worried about the legal implications, you may think, wouldn't it be great?
I'm just putting myself in the mindset of a 14-year-old. Wouldn't it be great to be on the BBC News?
Wouldn't it be great if a message went out to everyone and everyone could see what elite hacker I was?
If you couldn't work out how to monetize it, or if you're too scared to monetize it because you're worried about the legal implications, you may think, wouldn't it be great?
I'm just putting myself in the mindset of a 14-year-old. Wouldn't it be great to be on the BBC News?
Wouldn't it be great if a message went out to everyone and everyone could see what elite hacker I was?
Just like the bad old days, eh? And what goes round does come round.
And it does seem that there are increasingly many malware attacks these days that are just done almost for the lulz, right?
It's like they're kids and, hey, they'll ask for £70,000 in Bitcoin or whatever. They know they're not going to get it, but really it's just, hey, look how cool I am.
Certainly a matter of great concern to ASOS customers.
Now, you told me before the podcast, Graham, and I read the email that you sent to me with great interest, your own dear wife was an ASOS customer.
And it does seem that there are increasingly many malware attacks these days that are just done almost for the lulz, right?
It's like they're kids and, hey, they'll ask for £70,000 in Bitcoin or whatever. They know they're not going to get it, but really it's just, hey, look how cool I am.
Certainly a matter of great concern to ASOS customers.
Now, you told me before the podcast, Graham, and I read the email that you sent to me with great interest, your own dear wife was an ASOS customer.
So I've asked her about this. Yes, she was an ASOS customer. She reckons she hasn't bought anything from them for about 5 or 6 years.
And she decided about 3 years ago, maybe earlier than that, that she just thought that they weren't the kind of company she wanted to deal with for some of the reasons we've already described, like the fast fashion thing.
And she said to them, look, I want you to completely delete all of my details from all of your databases. I want to be entirely zapped from the database.
And she decided about 3 years ago, maybe earlier than that, that she just thought that they weren't the kind of company she wanted to deal with for some of the reasons we've already described, like the fast fashion thing.
And she said to them, look, I want you to completely delete all of my details from all of your databases. I want to be entirely zapped from the database.
And that's basically an absolute and inalienable right in the UK. As it is in the EU. So even though we're not in the— that's still something in both in the EU and in the UK.
You can go to a company and say, take me off your list and they have to comply, right? And they have to delete all the data and tell you they've done it.
You can go to a company and say, take me off your list and they have to comply, right? And they have to delete all the data and tell you they've done it.
And so she was quite surprised when this afternoon, in fact, she received an email from ASOS.
So she got that email that you sent me saying, oh, dear customer, we're so sorry. Like, oh, we take your security so seriously.
That she 3 years ago had said, not only do I not want to be a customer anymore, you're not allowed to know that I ever was a customer. Get rid of the data.
That she 3 years ago had said, not only do I not want to be a customer anymore, you're not allowed to know that I ever was a customer. Get rid of the data.
Exactly.
They should not have been able to contact her even if they wanted to.
No. And anyone who's met my wife will know that she is not happy when a company— when she asks a company to do something like that.
There's a number of other companies she's trying to do this with at the moment, by the way, Boots, if you're listening, where she can't seem to get herself eradicated from their database permanently.
But yes, she is not happy at all to have received this email from ASOS.
There's a number of other companies she's trying to do this with at the moment, by the way, Boots, if you're listening, where she can't seem to get herself eradicated from their database permanently.
But yes, she is not happy at all to have received this email from ASOS.
Right. Oh, well, good for her if she's going to take that up, because I'm looking at that email now. You know, it starts with all the right words.
We're sorry for the unauthorized notifications some of you received and any uncertainty this caused.
Now, that got my attention because I thought if I'd received that message, there is no uncertainty at all.
Somebody's breached the system and sent a message that wasn't supposed to happen, whether it was an insider or an outsider. There's no uncertainty that it's caused.
It's quite certain. Engage with us or we'll leak the data. Like, where's the uncertainty? And they go, oh, well, it doesn't really matter.
Our priority will always be to protect our customers. In other words, they're still treating her as a customer, even though she said, I don't want to.
So it's not like they said, we are sending you this email even though you asked to be removed from our customer list, just for the avoidance of doubt. If they'd been—
We're sorry for the unauthorized notifications some of you received and any uncertainty this caused.
Now, that got my attention because I thought if I'd received that message, there is no uncertainty at all.
Somebody's breached the system and sent a message that wasn't supposed to happen, whether it was an insider or an outsider. There's no uncertainty that it's caused.
It's quite certain. Engage with us or we'll leak the data. Like, where's the uncertainty? And they go, oh, well, it doesn't really matter.
Our priority will always be to protect our customers. In other words, they're still treating her as a customer, even though she said, I don't want to.
So it's not like they said, we are sending you this email even though you asked to be removed from our customer list, just for the avoidance of doubt. If they'd been—
Right.
If they'd been, so we only kept your email address or You know, you might understand that maybe they're kind of trying to comply with the spirit of the law, if not the letter.
But in this case, they obviously just went, okay, you don't want to be a customer, fine.
But in this case, they obviously just went, okay, you don't want to be a customer, fine.
It would've made more sense if they'd said, we held a séance in order to try and determine who people are who might have been customers of ours in the past, but then requested to have our details completely eradicated.
And that's how we came up with your email address.
Rather than, yes, even though we said we were completely deleting all of your information, we just kept a little bit here in this nook and cranny in case In case there's something embarrassing which happens later.
And that's how we came up with your email address.
Rather than, yes, even though we said we were completely deleting all of your information, we just kept a little bit here in this nook and cranny in case In case there's something embarrassing which happens later.
I don't want to downplay the fact that they were breached and this is unlawful and sending a message to all their customers is not acceptable.
And if the people who did that get caught, they should expect to have the book thrown at them.
I'm not justifying it, even though it was sort of funny in a way, but I just think their response is everything that's wrong with our apparent corporate collective willingness to just shrug off breaches.
And if the people who did that get caught, they should expect to have the book thrown at them.
I'm not justifying it, even though it was sort of funny in a way, but I just think their response is everything that's wrong with our apparent corporate collective willingness to just shrug off breaches.
So what should they have said? What's got your beef really here, Duck? How should this have been communicated?
I think it's just that reading that email, doesn't it seem to you that it's kind of very casual about, almost as though they want to say, well, somebody got in, but they didn't really get anything important.
So hey, we know you're uncertain. No, I'm certain there was a breach. You're telling me there's a breach. I'm not— there's no uncertainty about that.
And they're saying things like, oh, the affected platforms were immediately locked down, ensuring that no further information could be accessed, and a full investigation was launched.
And then it goes on to say that our investigation found that the unauthorized party had access to some personal information, including names and contact details and certain non-personal account-related information.
Like your search history. How is that non-personal?
And contact details, apparently, according to what I've read on the BBC, who seem to have checked this out, includes phone numbers, home addresses, and these search terms.
So it's not like they got a scan of your driving license. Let's be honest. I'm not saying that's the case.
So hey, we know you're uncertain. No, I'm certain there was a breach. You're telling me there's a breach. I'm not— there's no uncertainty about that.
And they're saying things like, oh, the affected platforms were immediately locked down, ensuring that no further information could be accessed, and a full investigation was launched.
And then it goes on to say that our investigation found that the unauthorized party had access to some personal information, including names and contact details and certain non-personal account-related information.
Like your search history. How is that non-personal?
And contact details, apparently, according to what I've read on the BBC, who seem to have checked this out, includes phone numbers, home addresses, and these search terms.
So it's not like they got a scan of your driving license. Let's be honest. I'm not saying that's the case.
No.
But in what world does collecting somebody's home address so you can deliver them stuff and then leaking that to the world Just kind of count as I shrug it off. It doesn't matter.
It does matter, particularly if you've ever been stalked or if you've just moved because you felt vulnerable where you were, or just the fact that they said they were going to look after the data and they jolly well should have.
And then they say the ASOS website and app was safe to use throughout and remains safe to use today.
Now, call me cynical, But if I'm using your app, Graham, and somebody figures out a way to send unauthorized messages via that app with the apparent legitimacy of the original company, how is the app safe?
Okay, there's no vulnerability in the app or there's no exploit in the app, but the app is part of a system and can't be disentangled from it.
It does matter, particularly if you've ever been stalked or if you've just moved because you felt vulnerable where you were, or just the fact that they said they were going to look after the data and they jolly well should have.
And then they say the ASOS website and app was safe to use throughout and remains safe to use today.
Now, call me cynical, But if I'm using your app, Graham, and somebody figures out a way to send unauthorized messages via that app with the apparent legitimacy of the original company, how is the app safe?
Okay, there's no vulnerability in the app or there's no exploit in the app, but the app is part of a system and can't be disentangled from it.
Mm-hmm.
So I hope I don't sound like I'm, well, particularly talking to you, preaching to the choir too much here, but I just don't think that that kind of terminology tells the full truth about what happened.
What it feels like it is to me is this is actually a message to the media saying, no story here. Please stop writing about this. Please stop creating headlines about this.
You are damaging our sales. People may be turning away. This is about damage limitation, isn't it?
You are damaging our sales. People may be turning away. This is about damage limitation, isn't it?
Yes.
And making it sound as though, well, it was so trivial because all they know is where you live and what your phone number is and your date of birth and what particular things you're interested in.
And they had access to the app and could have sent you messages that were much more worrying or disconcerting than just making us look bad.
And the way that they end, thank you for your patience and for continuing to put your trust in us.
Now, that must have rankled with your lady wife because she already doesn't trust them because they emailed her at all. Come on, guys.
And also, by the way, put something on your own website that acknowledges the breach because it's all over the media anyway.
Anyway, so you've got nothing to hide, and provide a trusted URL where people can go to find out what you know so far.
And making it sound as though, well, it was so trivial because all they know is where you live and what your phone number is and your date of birth and what particular things you're interested in.
And they had access to the app and could have sent you messages that were much more worrying or disconcerting than just making us look bad.
And the way that they end, thank you for your patience and for continuing to put your trust in us.
Now, that must have rankled with your lady wife because she already doesn't trust them because they emailed her at all. Come on, guys.
And also, by the way, put something on your own website that acknowledges the breach because it's all over the media anyway.
Anyway, so you've got nothing to hide, and provide a trusted URL where people can go to find out what you know so far.
So, Duck, in summary, what's your message for our listeners?
For users who might want to push back against vendors who are a bit casual like this, and for vendors who think they can bury the story, I would like to paraphrase the well-known pop group Metallica by singing something, Gray.
Oh no! All these words I just don't say, eh? Because every Breach matters. And that really is the long and short of it.
There's no breach so unimportant that you can just say, don't worry folks, carry on, nothing to see here.
Oh no! All these words I just don't say, eh? Because every Breach matters. And that really is the long and short of it.
There's no breach so unimportant that you can just say, don't worry folks, carry on, nothing to see here.
Somewhere in your security team right now, there's a worker who's never slept, never taken a holiday, never once said, I'll leave this until Monday.
Is this about Geoff?
No, Joe, it's not about Geoff.
Because Geoff actually does sleep. I've seen him do it.
It's not Jeff Joe, it's an agent, because your security team isn't just humans anymore. It's humans and AI agents working the same shifts, touching the same systems.
2 kinds of worker on the same team.
And here's the question no one's asking in the budget meeting. Do you actually know whether both of them can do the job?
You trust your analysts because they've got certifications, experience, a CV you have interviewed against.
And your agents? The agent got hired on a vibe after a product demo.
We've been letting it mark its homework this whole time.
This is where HackTheBox comes in. They help organizations build one connected cyber workforce strategy for humans and agents alike.
For the humans, it's hands-on training, the real skills needed to secure AI systems and fight back against AI-accelerated threats. Not slides, not theory, the actual job.
And for the agents, HackTheBox lets you appraise them, test them against realistic cybersecurity work the way you'd test a new hire, and reappraise them because the model changes, the tools change, the environments change, and what was good enough to pass last quarter might not pass this time.
So your security team now has 2 kinds of worker...
...but do you actually know whether both of them can do the job?
HackTheBox. Develop your people. Appraise your agents.
Find out more right now at smashingsecurity.com/hackthebox.
That's smashingsecurity.com/hackthebox.
And welcome back, and you join us at our favorite part of the show, the part of the show that we like to call Pick of the Week.
Pick of the Week. Pick of the Week.
Pick of the Week is the part of the show where everyone chooses something they like.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish.
It doesn't have to be security related necessarily. Well, my pick of the week this week is not security related. My pick of the week this week is something a little bit heartwarming.
There is a chap in America called Mike Tomlin, and apparently he's well known in America.
He is a long-serving manager of an American football team called the Pittsburgh Steelers, who I believe have won something called the Super Bowl.
And I think he's been the manager or the coach of them for about 20 years or something bonkers like that.
Anyway, what nobody knew about him him was he has a hobby, has a pastime, something, you know, when he's relaxing, when he's de-stressing from the important job of managing a top American football team.
And for the past 12 years, he has been quietly building a vast city in Minecraft. And—
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish.
It doesn't have to be security related necessarily. Well, my pick of the week this week is not security related. My pick of the week this week is something a little bit heartwarming.
There is a chap in America called Mike Tomlin, and apparently he's well known in America.
He is a long-serving manager of an American football team called the Pittsburgh Steelers, who I believe have won something called the Super Bowl.
And I think he's been the manager or the coach of them for about 20 years or something bonkers like that.
Anyway, what nobody knew about him him was he has a hobby, has a pastime, something, you know, when he's relaxing, when he's de-stressing from the important job of managing a top American football team.
And for the past 12 years, he has been quietly building a vast city in Minecraft. And—
That I did not expect that.
Well, with the encouragement and assistance of his son, he has just released a video tour It, and it's lovely.
This is the master suite, um, an outdoor area. Um, as we move around, you see the other 2 bedrooms that kind of share the Jack-and-Jill bath, open floor plan living area.
Um, most floors had multiple apartments, um, but this one only had one. It's the penthouse, and And so the elevator stairwell opened right up into the place.
And then on the upper level, we talked about the recreation room, the media center, and the outdoor entertainment area. That's my favorite rooftop spot.
Um, most floors had multiple apartments, um, but this one only had one. It's the penthouse, and And so the elevator stairwell opened right up into the place.
And then on the upper level, we talked about the recreation room, the media center, and the outdoor entertainment area. That's my favorite rooftop spot.
So it appears that he started building this thing in order to spend more time with his kids, and they've really gone for it.
It worked.
Well.
It's amazing. And they've got hotels and skyscrapers. This thing is huge. It is huge. I mean, I've always had a sneaking admiration for Minecraft.
There's a bit of programming in there which you can do.
There's a bit of programming in there which you can do.
Yeah.
With the old redstone, you can do a little bit of logic and circuitry, and there's all kinds of cleverness about that.
People have built sort of Turing machines in there, haven't they?
Yes, yes.
Like full-power computers that run very, very, very slowly, but actually work.
I think on The AI Fix, the other podcast I was doing with Mark Stockley, he showed me a video once. I think of somebody who wrote a very rudimentary LLM in Minecraft.
Which would do things extremely slowly, you know, as you would expect, not be the most powerful LLM in the world.
But anyway, he has built this incredible thing with hotels, with conference centers, with lovely public toilets, aquariums, and all of that. I love why he did it.
I love that the video isn't lots of quick edits and like, hey, I'm gonna tell you about this. It's just a guy sitting on his sofa saying, oh, let me show you around this city.
And he appears so humble about it. And it is extremely impressive.
Which would do things extremely slowly, you know, as you would expect, not be the most powerful LLM in the world.
But anyway, he has built this incredible thing with hotels, with conference centers, with lovely public toilets, aquariums, and all of that. I love why he did it.
I love that the video isn't lots of quick edits and like, hey, I'm gonna tell you about this. It's just a guy sitting on his sofa saying, oh, let me show you around this city.
And he appears so humble about it. And it is extremely impressive.
Yeah.
Extraordinary.
And it's proof that I think we really needed that there are some great little corners of the internet where people are hanging out and obsessively doing things just for the sake of it, with no malice, with no money in mind, just as a pursuit, a hobby, a pastime.
And I think it's rather marvelous. So I will include in the show notes a link where people can go and check it out.
And it's proof that I think we really needed that there are some great little corners of the internet where people are hanging out and obsessively doing things just for the sake of it, with no malice, with no money in mind, just as a pursuit, a hobby, a pastime.
And I think it's rather marvelous. So I will include in the show notes a link where people can go and check it out.
I look forward to taking a look.
Sounds Duck, what's your pick of the week?
My pick of the week, it's not cybersecurity related.
Okay.
But it is cyber related.
And so remember where I was on before and I said, hey, you know, when you're in your car, there's a little indicator on the fuel gauge that shows you which side the petrol cap is.
And so remember where I was on before and I said, hey, you know, when you're in your car, there's a little indicator on the fuel gauge that shows you which side the petrol cap is.
Yes.
And you said I was the only person in the world who knew that.
I do apologize for my reaction.
And it turned out that in all the commenters on the podcast, there was one person who said, oh no, I didn't know it either, which did not make me feel any better.
So I hope that this is not something that everybody else in the world already knows.
So I hope that this is not something that everybody else in the world already knows.
Okay, let's, let's find out. Let's find out.
It is that if you just type a Google search term into the address bar in your browser and hit enter, you know, you might just type the search terms that, you know, in an article you wrote 3 years ago and you just want to know where that article appears.
But Google can't resist giving you that, hey, here's the AI overview. And then if you put your name in it, they tell you this Yeah. How lovely you are and how clever you are.
And this is what this is referring to and a whole load of made-up confected nonsense, especially if you've misspelled one of the search terms.
And then way below, you can go down and maybe you'll actually find the website article you were looking for. Well, here's the thing.
If you do that search by hand, by actually putting the full search style URL, if you put google.com/search?q= The terms you want to search for.
But Google can't resist giving you that, hey, here's the AI overview. And then if you put your name in it, they tell you this Yeah. How lovely you are and how clever you are.
And this is what this is referring to and a whole load of made-up confected nonsense, especially if you've misspelled one of the search terms.
And then way below, you can go down and maybe you'll actually find the website article you were looking for. Well, here's the thing.
If you do that search by hand, by actually putting the full search style URL, if you put google.com/search?q= The terms you want to search for.
Yes.
Ampersand UDM, that's Uniform Delta Mike, equals 14, 1-4.
Yes.
You get web results only. No AI, no, we made this up, no extra links.
So, okay, yeah, that is great, Duck.
No, it's not the Bowser, is it?
So I'm afraid, Duck, in episode 398 of Smashing Security, we told our listeners all about this particular thing.
So anyone who's listening back in episode 398 in December 2024 will know about that. But there may be people who've joined the podcast since then.
So anyone who's listening back in episode 398 in December 2024 will know about that. But there may be people who've joined the podcast since then.
Oh, well, so it was like the fuel gauge.
I'm sorry, it was actually my pick of the week back in December 2024.
Your pick of the week?
It was my pick of the week.
Okay, but it, yeah, it was only what, 100 and something episodes ago, so.
I just think, Duck, if you're gonna come on the podcast, if you're gonna be a professional about this, you should really go back through all of the past episodes and check out the picks of the week.
Yeah, but I didn't think I needed to go back 2 years. I thought this was a—
anyway.
Oh, I'm sorry. I feel bad now. I feel bad. But it is a very cool thing. I do love that there is a way to turn off those AI overviews.
There is a website that can help you with this that I don't know where— did you mention that last time? UDM14.com?
Oh, I can't remember if I mentioned that last time.
That is quite useful. It calls itself the Konami Code.
That's right. It's very cool.
Did you have Konami codes when you were a game author, Graham? When you did Jack around the gym and Humbug and Blocks and all of that stuff?
I think Konami codes, did they come from Nintendo or Atari or the MSX or something like that?
They came from Konami Games, I think, is they're named after.
Oh, it was Konami Games, was it?
Was it up, up, down, down, left, right, left, right, B, A, select?
Yeah. I was never very good at playing video games, which is probably why I tried writing them instead. Yeah.
So your Blocks didn't have a Konami code because your Blocks was a classic No, it had a very, very cool boss screen, I have to say. Oh yes.
You don't need boss screens in a windowing environment, do you? Because you just go Alt+Tab. So maybe you should just remind our younger listeners what a boss screen is.
And it was always Alt+B or Ctrl+B, wasn't it? B for boss.
You don't need boss screens in a windowing environment, do you? Because you just go Alt+Tab. So maybe you should just remind our younger listeners what a boss screen is.
And it was always Alt+B or Ctrl+B, wasn't it? B for boss.
That's right. It was something like that. So a boss screen would suddenly, instantly, just at the press of a key, change the game that you're playing.
on to go to something else, which made it look like you were working.
on to go to something else, which made it look like you were working.
It was always a spreadsheet. Yours was a spreadsheet, wasn't it?
Well, it was a spreadsheet.
Now, I wrote this, I wrote this particular game when I was at Bristol Poly, and the spreadsheet software which we used was VP Planner in the computer lessons.
So not only did I make it look like VP Planner, I actually wrote a little clone of VP Planner so you could move from cell to cell entering numbers.
So it really did look like you had A spreadsheet open, and then when the tutor walked away or whatever, you could switch back to playing Tetris.
So I put more effort probably into the spreadsheet boss screen than I did into the actual game.
Now, I wrote this, I wrote this particular game when I was at Bristol Poly, and the spreadsheet software which we used was VP Planner in the computer lessons.
So not only did I make it look like VP Planner, I actually wrote a little clone of VP Planner so you could move from cell to cell entering numbers.
So it really did look like you had A spreadsheet open, and then when the tutor walked away or whatever, you could switch back to playing Tetris.
So I put more effort probably into the spreadsheet boss screen than I did into the actual game.
Yes, because that was the problem, is it— if it was just a static screen, I think, was it Sidekick?
If you remember Ball and Sidekick, they had a boss screen and it popped up, I think, like a 1-2-3 spreadsheet, Lotus 1-2-3 spreadsheet. It was very recognizable.
You couldn't do anything with it. It just had like quarterly sales figures for 3—
If you remember Ball and Sidekick, they had a boss screen and it popped up, I think, like a 1-2-3 spreadsheet, Lotus 1-2-3 spreadsheet. It was very recognizable.
You couldn't do anything with it. It just had like quarterly sales figures for 3—
Which is no good, no use, not going to fool anyone.
And it was so recognizable that you could see it across the room and no one ever wrote a spreadsheet like that. So you actually made yours work a bit.
That's right.
Yeah. Could it do sums and everything?
It couldn't do sums.
And if anyone wants to actually try out the boss screen, I can tell you If you go to the National Museum of Computing at Bletchley Park, that game Blocks, which I wrote, is on the Amstrad 1512 at the National Museum of Computing, and you can try out the boss screen.
And if anyone wants to actually try out the boss screen, I can tell you If you go to the National Museum of Computing at Bletchley Park, that game Blocks, which I wrote, is on the Amstrad 1512 at the National Museum of Computing, and you can try out the boss screen.
Alt+B?
I think it's, it might be Tab or Escape. I'm trying to remember. I can't remember, but it'll be, it'll be one of those.
But it tells you when you start the game.
It will tell you. It will tell you. Yeah. You'll find it.
That's a good reason to go to Bletchley Park, Graham.
Well, there are many good reasons.
Apart from the Enigmata and the whole— and the Colossus and the bomb bays and all of that stuff. You can check out Graham's Bosky.
There we go.
Oh, dear.
Anyway, no, that is a good pick of the week, Duck. I'm sorry if I'm making fun. Well, that just about wraps up the show for this week. Thank you so much, Duck, for joining us.
I'm sure lots of our listeners would love to follow you and find out what you're up to and getting in touch, what is the best way for them to do that?
I'm sure lots of our listeners would love to follow you and find out what you're up to and getting in touch, what is the best way for them to do that?
You can find me and all my contact details on the various social media platforms at pducklin.com/about, or just search for me, Paul Ducklin, on LinkedIn, Facebook, Mastodon, and for my sins, still on X.
And of course you can find me directly— Someone's gotta keep it honest.
Honest, Graham.
You're doing a fine job up there, I'm sure.
Thank you.
And of course, you can find me, Graham Cluley, on LinkedIn, Bluesky, Mastodon, Instagram, TikTok. The list goes on. Or you can—
Graham, you're complaining that I'm on X and there are you doing—
Or you can follow Smashing Security on Bluesky, Mastodon, or Reddit. And don't forget to ensure you never miss another episode.
Follow Smashing Security in your favorite podcast app, such as Apple Podcasts.
Apple Podcasts, Spotify, and Pocket Casts for episode show notes, sponsorship info, guest lists, and the entire back catalog of 488 or so episodes. Check out smashingsecurity.com.
Until next time, cheerio. Bye-bye.
Follow Smashing Security in your favorite podcast app, such as Apple Podcasts.
Apple Podcasts, Spotify, and Pocket Casts for episode show notes, sponsorship info, guest lists, and the entire back catalog of 488 or so episodes. Check out smashingsecurity.com.
Until next time, cheerio. Bye-bye.
Bye everyone.
You have been listening to Smashing Security with me, Graham Cluley, and a huge thank you to Duck, of course, for joining me this week, and to this week's sponsors, HackTheBox, Origin, and Vanta.
Do go and check out their offerings because they help keep the show afloat. Plus, big thanks this week to the following patrons whose names have been plucked out of the hat.
We've got Steve Lupton, who probably brews a gorgeous cup of tea. Lisa, as in have you seen Lisa? Yes, I've seen Lisa. Do do do do do do diddly dee dee.
I wonder if anyone else gets the reference. Dave Ellefson, who sounds like he plays bass for a thrash metal band. Butterfly Skies, who makes my heart go all aflutter.
Panda Bear, accept no substitutes. Not brown bears, not polar bears, a panda bear. JBSK, just the 4 lowercase letters. Whose name looks like the start of an API key.
Christophe Goossens, a name you'd expect to see on the back of a Belgian cyclist. And finally for this week, Mark Henk, reassuringly solid like a well-made bookshelf.
Thank you all so much for your support.
Now, those magnificent, generous, and only slightly suspicious individuals are proud members of Smashing Security Plus, which gets them ad-free episodes early.
And a shout out to our patrons on Patreon.
Early access before the great unwashed masses, and most crucially of all, the honor of having their names read out at the end of the show, accompanied by a dollop of light mockery.
If you would like to join this glittering fellowship, waltz on over to smashingsecurity.com/plus, where for a very modest sum, you too can help prop up the podcast and earn yourself a spot on the roll call of the gently ribbed.
Do go and check out their offerings because they help keep the show afloat. Plus, big thanks this week to the following patrons whose names have been plucked out of the hat.
We've got Steve Lupton, who probably brews a gorgeous cup of tea. Lisa, as in have you seen Lisa? Yes, I've seen Lisa. Do do do do do do diddly dee dee.
I wonder if anyone else gets the reference. Dave Ellefson, who sounds like he plays bass for a thrash metal band. Butterfly Skies, who makes my heart go all aflutter.
Panda Bear, accept no substitutes. Not brown bears, not polar bears, a panda bear. JBSK, just the 4 lowercase letters. Whose name looks like the start of an API key.
Christophe Goossens, a name you'd expect to see on the back of a Belgian cyclist. And finally for this week, Mark Henk, reassuringly solid like a well-made bookshelf.
Thank you all so much for your support.
Now, those magnificent, generous, and only slightly suspicious individuals are proud members of Smashing Security Plus, which gets them ad-free episodes early.
And a shout out to our patrons on Patreon.
Early access before the great unwashed masses, and most crucially of all, the honor of having their names read out at the end of the show, accompanied by a dollop of light mockery.
If you would like to join this glittering fellowship, waltz on over to smashingsecurity.com/plus, where for a very modest sum, you too can help prop up the podcast and earn yourself a spot on the roll call of the gently ribbed.
But.
If parting with cash feels like a bridge too far, fear not. There are plenty of ways to support the show that cost precisely zero pennies.
You can like us, you can subscribe to us, you can leave a glowing 5-star review wherever you get your podcast.
You can tell your friends, go on, tell your enemies, tell strangers at the bus stop, shout about the show in the pub until the landlord gently guides you towards the door.
Whatever it takes, go on, tell Tell people. Every little bit helps, and genuinely, truly, it makes all the sleepless nights and existential dread worth it.
And so, until next time, cheerio, bye-bye.
You can like us, you can subscribe to us, you can leave a glowing 5-star review wherever you get your podcast.
You can tell your friends, go on, tell your enemies, tell strangers at the bus stop, shout about the show in the pub until the landlord gently guides you towards the door.
Whatever it takes, go on, tell Tell people. Every little bit helps, and genuinely, truly, it makes all the sleepless nights and existential dread worth it.
And so, until next time, cheerio, bye-bye.
Host:
Graham Cluley:
@grahamcluley.com
@
/ grahamcluley
Guest:
Paul Ducklin:
@
/ pducklin
Episode links:
- “123456” password used in massive Danish CPR data breach – The Copenhagen Post.
- ‘You have a meeting’: the calendar phishing scam growing exponentially – The Guardian.
- Anthropic AI model submitted false tip about unsolved murder, Philadelphia police say – 6abc Philadelphia.
- FBI Arrests Executive at Ransomware Negotiation Firm – Krebs on Security.
- ASOS hack: If you could message every customer, what would YOU tell them? – SolCyber.
- Rooftops, penthouses, and urban living – Mike Tomlin on YouTube.
- I built ChatGPT with Minecraft redstone! – YouTube.
- &udm=14 – the disenshittification Konami code – Udm14.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
Sponsored by:
- Hack The Box – Develop, exercise and measure the capabilities of your human operators and AI agents.
- Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
- Origin – Endpoint AI observability. Put your AI agent on the record, and request a demo.
Support the show:
You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.
Join Smashing Security PLUS for ad-free episodes and our early-release feed!
Follow us:
Follow the show on Bluesky, or join us on the Smashing Security subreddit, or visit our website for more episodes.
Thanks:
Theme tune: “Vinyl Memories” by Mikael Manvelyan.
Assorted sound effects: AudioBlocks.
