You’re driving your new Chinese SUV when the dashboard goes dark. Ten minutes later, your phone rings. A stranger says they’ve got the digital key to your car, and would you like it back? Of course you would. That’ll be $550.
Meanwhile, three men have been charged over a scheme that used deepfakes of company bosses to steal around $130 million. Hear more about what happened, and the simple human trick that can foil the fakes.
All this and more in episode 492 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.
0:00
0:00
0:00
0:00
Enjoying the show? Listen in Apple Podcasts and hit Follow.Enjoying the show? Listen in Spotify and hit Follow.
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
How do you take a screenshot in a car?
You can take screenshots on a car if you press down the clutch pedal while inserting a thumb down the exhaust pipe. I think I'm not suggesting people try this.
And also, you'd have to be a bit like Mr. Tickle to reach so far around.
And also, you'd have to be a bit like Mr. Tickle to reach so far around.
Smashing Security, episode 492. How Hackers Turned Russian Cars into Pumpkins with Graham Cluley and special guest Danny Palmer.
Hello, hello, and welcome to Smashing Security episode 492. My name's Graham Cluley.
Hello, hello, and welcome to Smashing Security episode 492. My name's Graham Cluley.
And I'm Danny Palmer.
Danny, another busy week in cybersecurity. All the stories, they just keep on coming, don't they?
Loads of them. And I was away on a trip in Cornwall for the last few days as well, so I came back and checked what's happened. Turns out quite a lot.
Quite a lot's been going on, and we'll be talking about some of those things which have been going on this week, including some things which maybe haven't been making the headlines quite as much.
But before we kick off, let's thank this week's wonderful sponsors, HackTheBox, Dropzone AI, and Vanta. We'll be hearing more about them later on in the podcast.
But before we kick off, let's thank this week's wonderful sponsors, HackTheBox, Dropzone AI, and Vanta. We'll be hearing more about them later on in the podcast.
This week on Smashing Security.
We won't be talking about how Binance is warning users that an iOS flaw could leak their crypto wallet secrets.
You'll hear no discussion of—
How Donald Trump has chosen an executive from Palantir to head up the US Cybersecurity and Infrastructure Security Agency.
And we won't even mention—
How Wyndham Hotels exposed customer data after leaving a password inside the source code of its Android app. So Danny, what are you going to be talking about this week?
I'm going to be talking about how 3 men have been charged with using deepfake AI scams to steal millions of dollars from companies around the world.
And I'm going to be discussing how Russian cars are being turned into pumpkins — well, metaphorical pumpkins at least — and why a stranger on the phone is selling the owners their keys back.
All this and much more coming up on this episode of Smashing Security.
Somewhere in your security team right now, there's a worker who's never slept, never taken a holiday, never once said, I'll leave this until Monday.
All this and much more coming up on this episode of Smashing Security.
Somewhere in your security team right now, there's a worker who's never slept, never taken a holiday, never once said, I'll leave this until Monday.
Is this about Geoff?
No, Joe, it's not about Geoff.
Because Geoff actually does sleep. I've seen him do it.
It's not Geoff, Joe. It's an agent. Because your security team isn't just humans anymore. It's humans and AI agents working the same shifts, touching the same systems.
2 kinds of worker on the same team.
And here's the question no one's asking in the budget meeting. Do you actually know whether both of them can do the job?
You trust your analysts because they've got certifications, experience, a CV you have interviewed against.
And your agent? Got hired on a vibe after a product demo.
We've been letting it mark its homework this whole time.
This is where HackTheBox comes in. They help organisations build one connected cyber workforce strategy for humans and agents alike.
For the humans, it's hands-on training, the real skills needed to secure AI systems and fight back against AI-accelerated threats. Not slides, not theory — the actual job.
And for the agents, HackTheBox lets you appraise them, test them against realistic cybersecurity work the way you'd test a new hire, and reappraise them because the model changes, the tools change, the environments change, and what was good enough to pass last quarter might not pass this time.
So your security team now has 2 kinds of worker.
But do you actually know whether both of them can do the job?
HackTheBox — develop your people, appraise your agents.
Find out more right now at smashingsecurity.com/hackthebox.
That's smashingsecurity.com/hackthebox.
Now, chums, imagine you find yourself in this situation.
You've just bought yourself a rather lovely Chinese electric SUV, and you're driving it along, dumpty dumpty dum, singing a little song.
You've just bought yourself a rather lovely Chinese electric SUV, and you're driving it along, dumpty dumpty dum, singing a little song.
Is that your choice of music? You're driving along. That's what I like to —
I tune into Tumty Tumty Tum FM, as opposed to Tumty Tumty Tum Gold. Of course, I'm not so much into that era. But anyway, you're driving along.
Suddenly, the dashboard goes completely dark, and you think, "Oh, this is no good." And you assume it's some kind of glitch because it's scary these days, isn't it?
Driving a car and the electrics go. You think, "Oh, can I trust anything?" So you switch off the car and you switch it on again, and up pops on your dashboard a QR code.
With a Chinese message telling you to reactivate your car, and you've got one of these newfangled cars, which of course has an app.
Suddenly, the dashboard goes completely dark, and you think, "Oh, this is no good." And you assume it's some kind of glitch because it's scary these days, isn't it?
Driving a car and the electrics go. You think, "Oh, can I trust anything?" So you switch off the car and you switch it on again, and up pops on your dashboard a QR code.
With a Chinese message telling you to reactivate your car, and you've got one of these newfangled cars, which of course has an app.
Of course.
And you have it on your mobile phone. Of course. And what you discover when you open the app is that your car isn't listed in the app anymore, so you're not able to re-enable it.
And ten minutes later, your phone rings, and a stranger says, "Hello, hello, hello. I've got the digital key to your car. Would you like it back?"
And ten minutes later, your phone rings, and a stranger says, "Hello, hello, hello. I've got the digital key to your car. Would you like it back?"
Oh, yes, please.
Yes, please is the obvious answer. But then they ask for 45,000 rubles. Which sounds like an awful lot — well, it is quite a lot. It's $550.
And this is happening right now to owners of Li Auto cars in Russia.
Li Auto is a Chinese manufacturer of motor vehicles, and this is all according to a story in the Russian outlet Auto News. So here's how all of this works.
The key to one of these cars isn't really a key at all. It's actually an account in the app.
And this is happening right now to owners of Li Auto cars in Russia.
Li Auto is a Chinese manufacturer of motor vehicles, and this is all according to a story in the Russian outlet Auto News. So here's how all of this works.
The key to one of these cars isn't really a key at all. It's actually an account in the app.
So they get in the car by turning on the app. Is that like their keys, basically?
Well, you do actually get this these days, don't you? You get the ability to lock and unlock your car, or many cars these days, via an app, or turn on the heating.
Yes.
Start the engine, and things like that. So if you control that account, the car thinks that you are the owner rather than maybe the genuine owner.
So the criminals aren't hacking into the cars themselves. They're taking over the accounts. And those accounts with these particular cars are linked to a phone number.
But you remember I said that these were Chinese SUVs?
So the criminals aren't hacking into the cars themselves. They're taking over the accounts. And those accounts with these particular cars are linked to a phone number.
But you remember I said that these were Chinese SUVs?
With the Chinese messaging on the app as well.
That's right. And many of these cars have actually been hardcoded, it turns out, to require, at least for the app, a Chinese phone number.
So these cars are often being grey imported into Russia and people are using them, but they don't have a Chinese phone number.
So what they do is they rent those Chinese phone numbers online, often through a middleman. So there is a Chinese phone number connected to this, yes.
Nobody yet knows how the criminals are breaking into these accounts, and even the owners who feel like they've done everything right to protect themselves seem to be getting hit.
And this same scam of basically messing around with people's cars is not actually that new.
So these cars are often being grey imported into Russia and people are using them, but they don't have a Chinese phone number.
So what they do is they rent those Chinese phone numbers online, often through a middleman. So there is a Chinese phone number connected to this, yes.
Nobody yet knows how the criminals are breaking into these accounts, and even the owners who feel like they've done everything right to protect themselves seem to be getting hit.
And this same scam of basically messing around with people's cars is not actually that new.
No.
It hit Li Auto owners in Russia last summer. So, Danny, is there anything which hackers aren't attacking at the moment? I mean, we've seen freezers being attacked.
We've seen blood banks being attacked.
We've seen blood banks being attacked.
Yeah.
I was reading a report today of electronic billboards being breached to show porn. What's going on?
Yeah, I think that's quite a common trick by pranksters, I think you call them.
As we've seen this week, so much is just connected now to the internet and everything is almost hackable.
Cars have been connected to the internet in one way or another for at least a decade now.
I seem to remember about 10 years ago, there was a story where some ethical hackers managed to, in a test environment, make an internet-connected car basically control the steering.
As we've seen this week, so much is just connected now to the internet and everything is almost hackable.
Cars have been connected to the internet in one way or another for at least a decade now.
I seem to remember about 10 years ago, there was a story where some ethical hackers managed to, in a test environment, make an internet-connected car basically control the steering.
Oh my goodness.
10 years ago, not much has changed apparently.
There's more internet now on your car, so that's good.
So back in 2025, when these particular attacks first started against the Li Auto cars, the criminals were asking for about 250,000 rubles to get a car back. That's about $3,500.
They've dropped their prices.
Well, they have. This is interesting, isn't it? So the official fix through the dealers back then cost about 18,000 rubles, which is about $220.
And some of those hackers were remotely opening windows and doors and starting engines, almost as if they were taunting the owners.
And some of those hackers were remotely opening windows and doors and starting engines, almost as if they were taunting the owners.
Like some sort of evil Brum. One for the kids there.
I think you're going to have to explain because Brum was kind of like a bit like Chitty Chitty Bang Bang, wasn't he?
It was live action back in the '90s and there was a model car. It was like an old style, you know, 1920s, '30s car.
Yes.
And he had headlights that looked like eyes and he went around and had little adventures.
Yeah. Anyway, back last year, Russian owners were told how to protect themselves. They were told, look, register your Chinese phone number in your own name. Don't use a middleman.
Keep it paid up. So keep on paying for the account. Don't let it expire in any way.
Make sure that you don't lose control over that account because the number is what the car's digital key relies upon.
The twist this year seems to have been that the attackers have moved on. So the car owners who followed the previous advice, they did everything right.
You know, they paid for their Chinese phone number, they registered it in their own name. They're still being hit. And the ransom demand has, as we mentioned, it's crashed in price.
So previously, rather than the equivalent of about $3,000, they're asking for $550 instead after they've been immobilised.
So I'm always kind of encouraged when the cybercriminals think, oh, market forces, bloody hell, we're gonna have to lower our prices. I mean, that's got to be good news, hasn't it?
Keep it paid up. So keep on paying for the account. Don't let it expire in any way.
Make sure that you don't lose control over that account because the number is what the car's digital key relies upon.
The twist this year seems to have been that the attackers have moved on. So the car owners who followed the previous advice, they did everything right.
You know, they paid for their Chinese phone number, they registered it in their own name. They're still being hit. And the ransom demand has, as we mentioned, it's crashed in price.
So previously, rather than the equivalent of about $3,000, they're asking for $550 instead after they've been immobilised.
So I'm always kind of encouraged when the cybercriminals think, oh, market forces, bloody hell, we're gonna have to lower our prices. I mean, that's got to be good news, hasn't it?
You'd hope so, because with things like ransomware, it's just been going the other way, is it?
I remember when ransomware cost you £500 for an attack, and now you're lucky if it's £5 million.
I remember when ransomware cost you £500 for an attack, and now you're lucky if it's £5 million.
Yes. So a story where it's actually reducing is good, but still, your screen on your car is going dark, the climate control stops.
Some drivers are saying they can't start their engines at all. Others say that they could still run the car if they used an old-fashioned physical key.
My goodness, who starts a car with a key? I think it's a bloody good idea if you keep your key, to be honest. As far as all the reports I've heard, nobody's car has been driven away.
But if they are able to remotely unlock it, I suppose there is the possibility if they work out where it's physically located, they could go round and pinch it as well.
Some drivers are saying they can't start their engines at all. Others say that they could still run the car if they used an old-fashioned physical key.
My goodness, who starts a car with a key? I think it's a bloody good idea if you keep your key, to be honest. As far as all the reports I've heard, nobody's car has been driven away.
But if they are able to remotely unlock it, I suppose there is the possibility if they work out where it's physically located, they could go round and pinch it as well.
That is a very interesting concept. Yeah.
But often it's just left sitting there like an expensive paperweight. One of the Russian headlines actually said it's kind of like being turned into Cinderella's pumpkin.
So how are the hackers doing this? Well, nobody knows.
The founder of the Owners Club thinks the attackers are looking up the VIN, the vehicle identification numbers, in leaked insurance documents and databases to find the owners.
He thinks it's unlikely to be a lone hacker because of the need for all of these Chinese SIM card details, the leaked data, and of course, having people to do the ransom negotiation.
But reports are also saying that these attacks are mostly happening at night. So it could be just someone's side hustle, for a bit of extra cash. I don't know.
The victims, though, they say that Li Auto aren't being helpful. They say the phone number providers aren't being any help either.
The company itself, they say they're building a fix that swaps out the requirement for a Chinese phone number for an email address.
So how are the hackers doing this? Well, nobody knows.
The founder of the Owners Club thinks the attackers are looking up the VIN, the vehicle identification numbers, in leaked insurance documents and databases to find the owners.
He thinks it's unlikely to be a lone hacker because of the need for all of these Chinese SIM card details, the leaked data, and of course, having people to do the ransom negotiation.
But reports are also saying that these attacks are mostly happening at night. So it could be just someone's side hustle, for a bit of extra cash. I don't know.
The victims, though, they say that Li Auto aren't being helpful. They say the phone number providers aren't being any help either.
The company itself, they say they're building a fix that swaps out the requirement for a Chinese phone number for an email address.
I mean, that seems like a no-brainer really, because if you bought one of these cars in another country and you have to set up a Chinese phone number on a Chinese phone, that seems like a lot of extra steps.
I wonder if it was an attempt to prevent too much grey importing, to have a little bit more control over who might be selling the cars, to make sure that you went through official distributors instead of— I don't know.
I don't know what their thinking was.
I don't know what their thinking was.
No, we're not experts on the Russian or Chinese auto industry here.
Yes, you'll have to listen to another very niche podcast for that, I suspect.
Anyway, the advice, of course, is don't pay because paying doesn't actually guarantee you get access back to your car.
It looks like dealers are actually able to do this for less money than the blackmailers are requiring. But you should be reporting it to police.
And the other piece of advice that's just been given is take screenshots. I guess as evidence as to what's happened.
Anyway, the advice, of course, is don't pay because paying doesn't actually guarantee you get access back to your car.
It looks like dealers are actually able to do this for less money than the blackmailers are requiring. But you should be reporting it to police.
And the other piece of advice that's just been given is take screenshots. I guess as evidence as to what's happened.
How would you take a screenshot in a car?
You can take screenshots on a car. If you press down the clutch pedal while inserting a thumb down the exhaust pipe — I'm not suggesting people try this.
And also you'd have to be a bit like Mr. Tickle to reach so far around.
And also you'd have to be a bit like Mr. Tickle to reach so far around.
Or is that screenshot on the app?
I suppose screenshot of any messages you might receive, but maybe just a photograph. A shot of the screen in your car, yes, perhaps.
If a remote off switch for a car sounds like a brand new problem, it isn't.
For instance, back in 2010 in Austin, Texas, there was a dealership there which fitted some of its cars with a little sort of GPS box.
If a remote off switch for a car sounds like a brand new problem, it isn't.
For instance, back in 2010 in Austin, Texas, there was a dealership there which fitted some of its cars with a little sort of GPS box.
Oh.
And they had some control over things.
So if a buyer of the car fell behind on their payments, the dealer could actually remotely stop the car from starting and could even set off the horn.
So then repossession agents could find the car and retrieve it.
So if a buyer of the car fell behind on their payments, the dealer could actually remotely stop the car from starting and could even set off the horn.
So then repossession agents could find the car and retrieve it.
While annoying all your neighbours at the exact same time.
Yes. But from the car dealership's point of view, really handy. Until, of course, the wrong person got hold of the password.
And one day what happened was that more than 100 owners of these particular cars found their cars wouldn't start.
And in the middle of the night, all over Austin, horns were going off, which is obviously quite a problem. And some owners were disconnecting their batteries just to get some sleep.
And one day what happened was that more than 100 owners of these particular cars found their cars wouldn't start.
And in the middle of the night, all over Austin, horns were going off, which is obviously quite a problem. And some owners were disconnecting their batteries just to get some sleep.
Yes, I imagine. And if any of those owners had dogs or their dogs nearby, they wouldn't like it. They'd start barking.
Right. Anyway, it turned out a 20-year-old who'd lost his job at the dealership. This is a familiar story, isn't it?
Logged back into the system using a password and went down the customer list.
Logged back into the system using a password and went down the customer list.
Password still password1 as well, I assume.
All too common. It's that or they haven't reset the password. Now, interestingly, the criminals aren't the only ones with access to the car's off switch of these Li Autos.
In May 2025, Li Auto's Russian distributor said it was considering remotely blocking the screens of cars.
So they were actually thinking of doing it if those cars had been brought in via grey imports again. So they don't like the idea of these cars being imported into Russia on the sly.
And so that summer, Russian dealers claimed that a firmware update was turning some grey import Li Auto cars into bricks.
In May 2025, Li Auto's Russian distributor said it was considering remotely blocking the screens of cars.
So they were actually thinking of doing it if those cars had been brought in via grey imports again. So they don't like the idea of these cars being imported into Russia on the sly.
And so that summer, Russian dealers claimed that a firmware update was turning some grey import Li Auto cars into bricks.
Interesting.
And they worked on an unblock tool to deal with that. So it's pretty tough being the owner of one of these cars in Russia.
On one side, you've got a manufacturer who's talked about switching off your screen. On the other hand, you've got criminals who are stealing your digital keys.
It's causing all sorts of nuisance. Danny, should manufacturers of anything hold the ability to turn off your device remotely, do you think, on something you've bought?
On one side, you've got a manufacturer who's talked about switching off your screen. On the other hand, you've got criminals who are stealing your digital keys.
It's causing all sorts of nuisance. Danny, should manufacturers of anything hold the ability to turn off your device remotely, do you think, on something you've bought?
Sounds like it's asking for trouble. It's the way things are. It's annoying. You don't really need to own anything these days.
I mean, my wife recently passed a driving test and bought a car, and it's a Mini, and it's pre-smart stuff.
We're not having these problems here, but it's just — this whole thing's like people say, oh, you got your internet-connected fridge and it tells you when your milk's about to run out.
Well, I could do that myself by looking in the fridge. There's been a few cases where PlayStation games, the company's gone, oh wait, no, we're taking this game offline now.
Then all your stuff is gone.
I mean, my wife recently passed a driving test and bought a car, and it's a Mini, and it's pre-smart stuff.
We're not having these problems here, but it's just — this whole thing's like people say, oh, you got your internet-connected fridge and it tells you when your milk's about to run out.
Well, I could do that myself by looking in the fridge. There's been a few cases where PlayStation games, the company's gone, oh wait, no, we're taking this game offline now.
Then all your stuff is gone.
Yeah, I guess so.
Yeah. It's annoying for consumers that this is happening and even more so in the physical realm, I suspect.
What has me thinking in this story is there seems to be no indication as to who is conducting this campaign either, which is interesting because you don't often hear about cyberattacks targeting targets in Russia.
What has me thinking in this story is there seems to be no indication as to who is conducting this campaign either, which is interesting because you don't often hear about cyberattacks targeting targets in Russia.
You don't too much, do you?
No.
This episode of Smashing Security is sponsored by Dropzone AI.
Ladies and gentlemen, welcome to Alert Quiz. Our contestant today is Joe. Joe, are you ready?
I think so.
Right then. Question 1 for 10 points. What is a security alert?
It's a flag that something might be wrong.
Correct! Question 2: give me an example.
Someone's lost their lanyard?
Oh dear, oh dear, oh dear. Answers I would've accepted include an odd sign-in from abroad or someone clicking a dodgy-looking email.
Question 3: what does each alert need before anyone knows that it matters?
Question 3: what does each alert need before anyone knows that it matters?
Crumbs. A person pulling evidence from several different tools.
Correct! And when there are more alerts than hours in the day, some of them—
Get ignored?
Correct! Right, bonus question. What is Dropzone AI?
Ah, I know this. It's a collective of specialised AI agents that investigates every alert start to finish around the clock using the tools your team already has.
10 bonus points. And what do analysts get when they run Dropzone AI?
A vague something's up?
No, Joe, that's what they get now. With Dropzone AI, they get a finding with the reasoning and evidence already assembled. It shows its work.
So checking a finding becomes a decision rather than a second investigation. And who decides where the agents stop?
So checking a finding becomes a decision rather than a second investigation. And who decides where the agents stop?
The agents?
No, Joe. The team decides where the agents stop, and the analysts own every verdict. Now, final, final question. Finish this quote.
Kevin Turnbull, global IT director at Asala Energy, says, with Dropzone, we don't get, this is a problem. We get—
Kevin Turnbull, global IT director at Asala Energy, says, with Dropzone, we don't get, this is a problem. We get—
With Dropzone, we don't get, this is a problem. We get, this is a problem, and here's why.
Huzzah! Correct, Joe. You have won the self-guided demo, and what's more, so has everyone who's listening. To watch a real investigation unfold, go to smashingsecurity.com/dropzoneai.
That's smashingsecurity.com/dropzoneai.
Dropzone AI, reinforcements have arrived.
Nice demo, but can I swap it for a car?
No, Joe. Danny, what's your story for us this week?
As much as I am loath to admit it, when there are still so many issues around cybersecurity which come down to the basics not being done, it's impossible to ignore how the rise of AI has had an impact on cyberattacks.
Because, you know, who would have predicted that cybercriminals would almost immediately latch onto a new technology to do bad things?
Because, you know, who would have predicted that cybercriminals would almost immediately latch onto a new technology to do bad things?
As if.
As if. Yeah.
I mean, imagine the internet being used for crime, let alone write better, more convincing phishing emails or use ever more readily available deepfake tools to pose as celebrities, CEOs, and other well-known individuals to trick people, right?
Who'd have thought that could be a thing? Not possible. Alas, it is the case.
And last year alone, it's estimated that fraudsters used audio and video deepfakes to successfully steal over $1.5 billion in total. And that's just the cases we know about.
I mean, imagine the internet being used for crime, let alone write better, more convincing phishing emails or use ever more readily available deepfake tools to pose as celebrities, CEOs, and other well-known individuals to trick people, right?
Who'd have thought that could be a thing? Not possible. Alas, it is the case.
And last year alone, it's estimated that fraudsters used audio and video deepfakes to successfully steal over $1.5 billion in total. And that's just the cases we know about.
Hang on, this is just by deepfake audio and video?
Yep, just by deepfakes, $1.5 billion.
Wow, that is astonishing, isn't it? I didn't know it was at that kind of scale.
Yeah, that's just last year. It's likely going to be more this year as well. So yeah, it's tricky out there.
And one of the most common methods of this is known as CEO fraud, which I'm sure listeners of Smashing Security don't need me to explain.
But just in case, as a quick rundown, as the name suggests, it sees scammers using AI deepfakes to look or sound like the CEO, an executive, or someone else important at a major company, call up another executive or an employee with the voice and the face of the person they're impersonating and say, oh, could you make this urgent business transaction please to this bank account?
I mean, it's essentially the evolution of the old business email compromise attacks, which, you know, are very lucrative in themselves.
Except in this case, they're not just using email to coerce employees into making payments — they're also using the audio and video as well.
Often these requests come with claims that, oh, it's a secret but important deal, so you must not tell anyone about this in order to make sure it goes through.
There are two things here that make these work.
One is often they work because they're deepfakes of CEOs and other public figures who by their very nature are public-facing, so audio and video of them speaking is out there.
And one of the most common methods of this is known as CEO fraud, which I'm sure listeners of Smashing Security don't need me to explain.
But just in case, as a quick rundown, as the name suggests, it sees scammers using AI deepfakes to look or sound like the CEO, an executive, or someone else important at a major company, call up another executive or an employee with the voice and the face of the person they're impersonating and say, oh, could you make this urgent business transaction please to this bank account?
I mean, it's essentially the evolution of the old business email compromise attacks, which, you know, are very lucrative in themselves.
Except in this case, they're not just using email to coerce employees into making payments — they're also using the audio and video as well.
Often these requests come with claims that, oh, it's a secret but important deal, so you must not tell anyone about this in order to make sure it goes through.
There are two things here that make these work.
One is often they work because they're deepfakes of CEOs and other public figures who by their very nature are public-facing, so audio and video of them speaking is out there.
Yeah.
And attackers can use that information to do that. I mean, someone could audio deepfake us. Imagine.
The thing is, I'm sure most of our listeners know this, but they are astonishingly convincing these days.
They've really changed from just the last few years ago.
I saw something a friend of mine posted on LinkedIn — he was doing some work and he posted a deepfake of himself he'd made.
I've known this guy for 30 years and I couldn't tell the difference, which was scary.
I saw something a friend of mine posted on LinkedIn — he was doing some work and he posted a deepfake of himself he'd made.
I've known this guy for 30 years and I couldn't tell the difference, which was scary.
Yeah. I was over in Portugal the other week doing a cybersecurity awareness event for an organisation, and what they decided to do was they put up a video of the CEO.
Yes.
And she was apologising for not being able to be there in person. First of all, it seemed like a very standard kind of message.
And then she said, oh, while I'm here, I also want to tell you the new rules regarding the use of the coffee machine.
And it got more and more absurd over time with the things that she was saying, and people began to twig in the audience, hang on, this can't really be her.
And then she came out from behind the scenes, but it had been completely and utterly faked.
It was amusing, but it could have so easily been convincing and used for this kind of fraud.
And then she said, oh, while I'm here, I also want to tell you the new rules regarding the use of the coffee machine.
And it got more and more absurd over time with the things that she was saying, and people began to twig in the audience, hang on, this can't really be her.
And then she came out from behind the scenes, but it had been completely and utterly faked.
It was amusing, but it could have so easily been convincing and used for this kind of fraud.
Yeah, that's the problem with this now. A lot of this technology is so convincing, even just compared to a few years ago.
A lot of the software out there to be able to make it is more easily available, it doesn't take as long.
I mean, even just a few years ago, apparently it'd take a good few days to make a convincing deepfake. Now you can do it basically instantly.
But yes, one of the key problems here with this type of CEO fraud attack is that you mentioned the big boss there. If the big boss calls you and says, can you do this?
Most people aren't going to want to get in trouble for not doing an important task or questioning their boss.
So with all this in mind, this week the United States Department of Justice unsealed an indictment announcing that 3 men have been charged with stealing over $100 million from companies that they defrauded with the aid of deepfakes.
2 of the men were arrested in Spain, and one was arrested here in the UK, which shows this is a global problem as well. You can steal from anyone anywhere nowadays.
The US Department of Justice put out a press release on this.
In it, they refer to AI as superintelligence and SI, but I'm going to choose to ignore that because that's just ridiculous, isn't it?
A lot of the software out there to be able to make it is more easily available, it doesn't take as long.
I mean, even just a few years ago, apparently it'd take a good few days to make a convincing deepfake. Now you can do it basically instantly.
But yes, one of the key problems here with this type of CEO fraud attack is that you mentioned the big boss there. If the big boss calls you and says, can you do this?
Most people aren't going to want to get in trouble for not doing an important task or questioning their boss.
So with all this in mind, this week the United States Department of Justice unsealed an indictment announcing that 3 men have been charged with stealing over $100 million from companies that they defrauded with the aid of deepfakes.
2 of the men were arrested in Spain, and one was arrested here in the UK, which shows this is a global problem as well. You can steal from anyone anywhere nowadays.
The US Department of Justice put out a press release on this.
In it, they refer to AI as superintelligence and SI, but I'm going to choose to ignore that because that's just ridiculous, isn't it?
They're really trying, aren't they? They've got to keep the boss happy. Again, this is actually evidence of what we've just been talking about.
If the boss says something stupid, in many organisations, people think, well, we've got to go along with it, haven't we?
If the boss says something stupid, in many organisations, people think, well, we've got to go along with it, haven't we?
Excellent idea, sir. Yes. I'm saying AI instead of what they say, because it makes more sense to most of us.
Okay. Yes.
Speaking when the indictment was unsealed, US Attorney James McDonald said the accused abused groundbreaking technology to impersonate real people and deceive executives into sending them and their co-conspirators approximately $129 million, which obviously is quite a lot.
I'm not going to try and work out percentages of that $1.5 billion figure we mentioned earlier, but it's quite a significant chunk of that, really.
I'm not going to try and work out percentages of that $1.5 billion figure we mentioned earlier, but it's quite a significant chunk of that, really.
Yeah.
So how do the attacks operate?
Well, to begin with, the attackers used deepfakes to pretend they're the CEO of a company, and they called employees to say that, oh, I need your help with these confidential transactions.
So that could have been over the phone, or could have been on Teams or any other video call as well.
Well, to begin with, the attackers used deepfakes to pretend they're the CEO of a company, and they called employees to say that, oh, I need your help with these confidential transactions.
So that could have been over the phone, or could have been on Teams or any other video call as well.
Hmm.
The fake CEO would then tell the employee to contact lawyers at a real large international law firm to help conduct the deal.
Right.
Because everyone can trust lawyers, right? They know what's going on. But guess what? Those lawyers were fake too.
Also, they were deepfaked as well.
I don't know if they actually deepfaked lawyers because it doesn't actually mention that, but the people on the line were pretending to be lawyers.
Okay. It could just be a criminal call centre or something like that. Right. Okay.
But these people on the line would provide the victim with the information on how to make the transaction, which sends the money to a bank account owned by the fraudsters.
And I guess the problem here is for the victim organisations, by the time they've realised something was wrong, the money is already long gone, and $130 million stolen from victims across the United States and the wider world.
And I guess the problem here is for the victim organisations, by the time they've realised something was wrong, the money is already long gone, and $130 million stolen from victims across the United States and the wider world.
Yeah.
That's a significant chunk of coin for allegedly three guys running this scam.
So according to the US Department of Justice, some of the most lucrative attacks in this case — oh, here's some examples.
One resulted in over $5 million being stolen from a pet food company based in Florida. The same amount was stolen from a hospital and healthcare group in Missouri.
So according to the US Department of Justice, some of the most lucrative attacks in this case — oh, here's some examples.
One resulted in over $5 million being stolen from a pet food company based in Florida. The same amount was stolen from a hospital and healthcare group in Missouri.
Right.
The attackers also managed to steal $3 million from another hospital group and $2.5 million from a bank in Rhode Island, which I find interesting that they got more from the pet food company than a bank.
No, I suppose banks typically have more security policies and tests and checks in place, and maybe there's more limits.
You'd like to think that they're more experienced about defending against all kinds of fraud and theft.
You'd like to think that they're more experienced about defending against all kinds of fraud and theft.
Yeah.
The victim which the attackers stole the most from was from what's described as a financial technology company here in the UK, which lost over $11.5 million to the scammers, which works out in pounds £8.5 million, which is not an insignificant amount of money at all, is it?
The victim which the attackers stole the most from was from what's described as a financial technology company here in the UK, which lost over $11.5 million to the scammers, which works out in pounds £8.5 million, which is not an insignificant amount of money at all, is it?
Wow. Can you imagine being that employee who was duped? Are they going to still have a job after that?
It's a tricky one, isn't it? Just because, you know, if they really thought they were speaking to their CEO, it's hard.
I know, I know. But if word got round the company, the staff would obviously find out that there'd been a big scam going on inevitably.
And even if the company was very gracious and said, look, we're not going to name who it was, you would feel it on your shoulders, wouldn't you?
And even if the company was very gracious and said, look, we're not going to name who it was, you would feel it on your shoulders, wouldn't you?
I think something to consider here as well is these are large amounts of money, but it seems that the authorisation to make these payments just can be done by one person, which is maybe something to be looking at.
That's $11.5 million stolen from a fintech company in the UK, which has not been a good few weeks really for financial technology and cryptocurrency firms.
That's $11.5 million stolen from a fintech company in the UK, which has not been a good few weeks really for financial technology and cryptocurrency firms.
Oh yes. The Binance hack, for instance. Yeah, absolutely.
So yeah, it was the bank with its traditional security which had the least stolen from it, I suppose.
But anyway, those charged, if they're convicted, they'll be facing significant jail time. And I believe all of them are currently waiting for extradition to the United States.
Now, we're all innocent until proven guilty, but I suggest things might not be looking great for the defendants because, according to the court documents, one has previously boasted about being involved with money laundering — laundering hundreds of millions since 1994.
He's also previously convicted of fraud in 2008. I mean, innocent until proven guilty.
But anyway, those charged, if they're convicted, they'll be facing significant jail time. And I believe all of them are currently waiting for extradition to the United States.
Now, we're all innocent until proven guilty, but I suggest things might not be looking great for the defendants because, according to the court documents, one has previously boasted about being involved with money laundering — laundering hundreds of millions since 1994.
He's also previously convicted of fraud in 2008. I mean, innocent until proven guilty.
But not got the best background, potentially. Bit of a sticky wicket for them to begin to defend that chap from.
Despite the apparent anonymity the internet offers cyber fraudsters, it does always seem to be hubris and boasting which plays a part in them getting caught.
I don't think he was posing with wads of cash in front of a Lamborghini, this one.
I don't think he was posing with wads of cash in front of a Lamborghini, this one.
You know, that's a really good point because so often I hear about these hacks and sometimes they make the national newspapers.
We're seeing at the moment that there are all these hoax bomb threats going through to airlines. Planes are being diverted and things.
And I'm always thinking, firstly, what is the point of this? But also, it's not as though you can really boast about it to your mates.
It's not as though you can say, oh yeah, that was me who wrote that particular worm, or that was me who stole $6.5 billion from this company.
You know, even in your hacking circle, you've got to be really careful.
And it must eat away inside at you thinking, you know, oh, I did this thing, but I can't really tell anyone about it. At least it's not going to be safe if I do.
We're seeing at the moment that there are all these hoax bomb threats going through to airlines. Planes are being diverted and things.
And I'm always thinking, firstly, what is the point of this? But also, it's not as though you can really boast about it to your mates.
It's not as though you can say, oh yeah, that was me who wrote that particular worm, or that was me who stole $6.5 billion from this company.
You know, even in your hacking circle, you've got to be really careful.
And it must eat away inside at you thinking, you know, oh, I did this thing, but I can't really tell anyone about it. At least it's not going to be safe if I do.
That's why some people get caught, isn't it? Because they'll boast on the Discord channels and that sort of thing, even if they're using a pseudonym.
Absolutely.
Like a hacker name, that account will be able to trace to an email account, et cetera, et cetera.
There's always something you can track someone down with. But yeah, hubris gets you caught.
Thank goodness.
But I think this whole case is a reminder that AI technology like deepfakes — they're getting increasingly more powerful, hard to tell what is real and what is not, as their creators seemingly continue to put new, more advanced versions of these out into the world without really thinking about the consequences of doing that.
Oh, look, we can make these super powerful deepfakes, or look, our AI can now hack governments.
Oh, look, we can make these super powerful deepfakes, or look, our AI can now hack governments.
Have you really thought about if this is a good idea, putting this out there for everyone to use? But that's another story.
But yeah, it's becoming more difficult to identify the fakes. There are companies out there which say they can use technology to help businesses detect deepfakes.
But even as technology gets more powerful, it's still often the human which is the last line of defence.
But yeah, it's becoming more difficult to identify the fakes. There are companies out there which say they can use technology to help businesses detect deepfakes.
But even as technology gets more powerful, it's still often the human which is the last line of defence.
There was a story a while back about fraudsters who used deepfake phone calls to pose as a company executive of an auto manufacturer — in fact, call another member of the leadership team to try and trick them into making a major financial transaction.
The person on the receiving end said, okay then, what was the book you recommended to me last week? The attacker didn't know the answer to this, so the attack was thwarted.
So it was just a simple little human interaction.
The person on the receiving end said, okay then, what was the book you recommended to me last week? The attacker didn't know the answer to this, so the attack was thwarted.
So it was just a simple little human interaction.
Yes.
I think some of the advice that these companies give — like, do have those little backups, have those little phrases or questions to ask to just double-check things.
I mean, that might be difficult for an employee who feels like they're questioning their boss, but no, that's exactly what the attackers want.
They want the victim to feel they don't have any power to reject the request and transfer the money.
I mean, that might be difficult for an employee who feels like they're questioning their boss, but no, that's exactly what the attackers want.
They want the victim to feel they don't have any power to reject the request and transfer the money.
So you are saying that you could say to your boss, for instance, yeah, just before I transfer that $10 million, can you remember precisely what happened at the Christmas party?
Didn't you spill something over my jacket, or you insulted me in some fashion?
Didn't you spill something over my jacket, or you insulted me in some fashion?
Yes, exactly that sort of thing.
At a time when the technology is getting more powerful, it is still the little human intuition and connections that can help us defend against these.
It's going to become more important as deepfakes continue to evolve.
And I'm sure we'll probably end up seeing that they cost even more than $1.5 billion this year as the problem keeps going.
At a time when the technology is getting more powerful, it is still the little human intuition and connections that can help us defend against these.
It's going to become more important as deepfakes continue to evolve.
And I'm sure we'll probably end up seeing that they cost even more than $1.5 billion this year as the problem keeps going.
So yeah, fingers crossed for anyone out there and just be careful who might be telling you to do the thing.
And maybe Tom Cruise doesn't want you to transfer all that money to invest in some new cryptocurrency. This episode of Smashing Security is sponsored by Vanta.
And maybe Tom Cruise doesn't want you to transfer all that money to invest in some new cryptocurrency. This episode of Smashing Security is sponsored by Vanta.
It's 2 AM. Somewhere, a security team is drowning. Graham, the spreadsheets. There are so many spreadsheets. Vendor risk assessments unread.
Audit evidence scattered like ash in the wind. You've filled out the same questionnaire 4 times this week, Graham. 4 times! Some men choose to face this alone, but not tonight.
Audit evidence scattered like ash in the wind. You've filled out the same questionnaire 4 times this week, Graham. 4 times! Some men choose to face this alone, but not tonight.
Okay, Graham, this is a bit much.
Yeah, fair point. Anyway, Vanta — thank God. Vanta's a trust management platform that automates the mind-numbing stuff that makes you want to poke your eyes out with a fork.
No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit-ready for SOC 2, ISO 27001, HIPAA, GDPR, the works.
And it uses AI. Yes, Joe, it does.
No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit-ready for SOC 2, ISO 27001, HIPAA, GDPR, the works.
And it uses AI. Yes, Joe, it does.
To flag risks and streamline evidence collection so your whole security programme stays in shape, not just the week before an audit.
No more 2 AM dread. No more spreadsheet purgatory. Just peace.
And $1,000 off if you demo it right now.
$1,000?
vanta.com/smashing. Go now before it's too late.
That's vanta.com/smashing.
And thanks to Vanta for supporting the show.
And welcome back, and you join us at our favourite part of the show, the part of the show that we like to call Pick of the Week.
Pick of the Week. Pick of the Week.
Pick of the Week is the part of the show where everyone chooses something they like.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish.
It doesn't have to be security-related necessarily. Well, my Pick of the Week this week is not security-related. My Pick of the Week this week is a TV show.
I know some people will know from last week's episode that I've hurt my back a little bit. And so there's been a bit of TV being watched to try and distract myself from the pain.
And I've been watching a TV show called Lupin. It is a French TV show, the télévision, and it is about— I wish I hadn't started doing this French accent now.
You've committed now. Okay. It is a man. He set out to avenge his father who was accused of stealing a necklace, an incredibly valuable necklace.
And that happened years and years ago when he was a little boy. And it had a huge impact upon the rest of his life.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish.
It doesn't have to be security-related necessarily. Well, my Pick of the Week this week is not security-related. My Pick of the Week this week is a TV show.
I know some people will know from last week's episode that I've hurt my back a little bit. And so there's been a bit of TV being watched to try and distract myself from the pain.
And I've been watching a TV show called Lupin. It is a French TV show, the télévision, and it is about— I wish I hadn't started doing this French accent now.
You've committed now. Okay. It is a man. He set out to avenge his father who was accused of stealing a necklace, an incredibly valuable necklace.
And that happened years and years ago when he was a little boy. And it had a huge impact upon the rest of his life.
Oh.
And in the first episode, as a grown-up man, he ingeniously steals the necklace himself from the Louvre. And it's a great fun show.
He is apparently inspired by a fictional character called Arsène Lupin, who is a gentleman thief and master of disguise.
And it turns out this Arsène Lupin character, there really are books. These books exist. They were written by a chap called Maurice Leblanc.
This came out in the early 1900s, and they're sort of like the cornerstone of the TV show.
The TV show's full of action, it's full of heists, it's full of disguises, all sorts of shenanigans going on.
He is apparently inspired by a fictional character called Arsène Lupin, who is a gentleman thief and master of disguise.
And it turns out this Arsène Lupin character, there really are books. These books exist. They were written by a chap called Maurice Leblanc.
This came out in the early 1900s, and they're sort of like the cornerstone of the TV show.
The TV show's full of action, it's full of heists, it's full of disguises, all sorts of shenanigans going on.
Is the TV show set in the modern day then, or is it a period piece?
Oh yes, sorry, I haven't explained that.
The TV show is set in the modern day, but this guy's a huge fan of the books, and they have inspired him and influenced his life in how he lives.
And he's the hero of the show because he's getting away with all these things, but he has actually got a good cause. It's not as though he's doing these things to profit himself.
He's actually righting wrongs with his thievery, with his pickpocketry, and his ability to inveigle his way into organisations. So it's all really entertaining stuff.
And by the way, in the books, apparently in an early one of these books in the early 1900s, Sherlock Holmes appears.
And what apparently happened is that Arthur Conan Doyle or his publishers or something weren't very happy about Sherlock Holmes appearing in someone else's books.
And so Maurice Leblanc, who was writing these books, apparently changed the character's name to Herlock Sholmes.
The TV show is set in the modern day, but this guy's a huge fan of the books, and they have inspired him and influenced his life in how he lives.
And he's the hero of the show because he's getting away with all these things, but he has actually got a good cause. It's not as though he's doing these things to profit himself.
He's actually righting wrongs with his thievery, with his pickpocketry, and his ability to inveigle his way into organisations. So it's all really entertaining stuff.
And by the way, in the books, apparently in an early one of these books in the early 1900s, Sherlock Holmes appears.
And what apparently happened is that Arthur Conan Doyle or his publishers or something weren't very happy about Sherlock Holmes appearing in someone else's books.
And so Maurice Leblanc, who was writing these books, apparently changed the character's name to Herlock Sholmes.
Sorry.
Which for someone who claimed to be the master of disguise was maybe not— taking the mickey a bit, was Maurice Leblanc.
But anyway, the TV show has now— I've only watched the first series. It's up on Netflix and elsewhere. But there are 4 series so far.
The 4th series has just been put out and it's good fun. I love a show with subtitles anyway, because I feel like—
But anyway, the TV show has now— I've only watched the first series. It's up on Netflix and elsewhere. But there are 4 series so far.
The 4th series has just been put out and it's good fun. I love a show with subtitles anyway, because I feel like—
I was going to ask that. Is it a French production with the subtitles on it? Yes.
That's the only way — you can't watch dubbed things. You have to watch them with subtitles.
I mean, I watch English things with subtitles, so I've got no problem watching a French thing with subtitles. It's called Lupin, L-U-P-I-N. Go and check it out.
I guarantee you'll have a fun time. It's a good fun watch. And that is my Pick of the Week. Danny, what's your Pick of the Week?
I mean, I watch English things with subtitles, so I've got no problem watching a French thing with subtitles. It's called Lupin, L-U-P-I-N. Go and check it out.
I guarantee you'll have a fun time. It's a good fun watch. And that is my Pick of the Week. Danny, what's your Pick of the Week?
My pick of the week is not cybersecurity related. I guess it's sort of related in a way, actually, weirdly. It's a video game. It's called Two Point Museum. It isn't new.
It first came out last year, but the premise is it's a management sandbox game where you're building a museum.
It first came out last year, but the premise is it's a management sandbox game where you're building a museum.
I love those kind of management games where you're building things.
Yeah. So you employ the staff, the security guards to stop thefts of necklaces and things as well. The burglars all come in.
You know, when they're detected, they are wearing black and white striped things with swag on and that sort of thing.
You find museum relics and artifacts, learn more about them in order to build the best museum possible, while also making money doing it.
It's by British game developers, Two Point Studios. It's very silly and it's kind of got a cartoony style and it's very Monty Python in the way it does humour.
You know, when they're detected, they are wearing black and white striped things with swag on and that sort of thing.
You find museum relics and artifacts, learn more about them in order to build the best museum possible, while also making money doing it.
It's by British game developers, Two Point Studios. It's very silly and it's kind of got a cartoony style and it's very Monty Python in the way it does humour.
Okay.
These are just some of the randomly generated names for some of the museum employees and visitors in a game I was playing last night. One of the visitors was called Horatio Fingers.
One was called Clementine Slime. And then Lionel Mayonnaise also came to pay a visit. I just love all the stupid names.
So it's good-natured, silly fun, as were the two previous titles by the studio, which were Two Point Hospital and Two Point Campus, which had you managing a hospital and university respectively.
Some of the team behind Two Point Museum and the other Two Point games worked on Theme Park and Theme Hospital back in the 1990s.
Fun fact, the lead programmer of Theme Park was a name listeners to Smashing Security might recognise.
It was one Demis Hassabis, who at 17 was the lead programmer of Theme Park, but he left Bullfrog to go to Cambridge University to study computer science.
Then went on to found some company called DeepMind or something.
One was called Clementine Slime. And then Lionel Mayonnaise also came to pay a visit. I just love all the stupid names.
So it's good-natured, silly fun, as were the two previous titles by the studio, which were Two Point Hospital and Two Point Campus, which had you managing a hospital and university respectively.
Some of the team behind Two Point Museum and the other Two Point games worked on Theme Park and Theme Hospital back in the 1990s.
Fun fact, the lead programmer of Theme Park was a name listeners to Smashing Security might recognise.
It was one Demis Hassabis, who at 17 was the lead programmer of Theme Park, but he left Bullfrog to go to Cambridge University to study computer science.
Then went on to found some company called DeepMind or something.
What a great trivia fact. That's fantastic.
Apparently he initially started working there even younger. He won a competition to basically get a job at a game company in the early '90s.
Getting a job was easier back then, I guess. But that's probably the reason I love this. It's nostalgic. It's fun. It's quite relaxing. There's no real jeopardy in it.
It's just a nice time and it's my pick of the week. So that's Two Point Museum developed by Two Point Studios, which is published by Sega.
Which is why there's a bunch of Sonic the Hedgehog stuff in my museum. And it's available on PC, PlayStation, Xbox, and Nintendo consoles.
Getting a job was easier back then, I guess. But that's probably the reason I love this. It's nostalgic. It's fun. It's quite relaxing. There's no real jeopardy in it.
It's just a nice time and it's my pick of the week. So that's Two Point Museum developed by Two Point Studios, which is published by Sega.
Which is why there's a bunch of Sonic the Hedgehog stuff in my museum. And it's available on PC, PlayStation, Xbox, and Nintendo consoles.
Sounds good fun. And that just about wraps up the show for this week. Thank you so much, Danny, for joining us.
Where can folks find you online and follow you to learn what you are up to?
Where can folks find you online and follow you to learn what you are up to?
All the usual social media places, as expected. Bluesky, LinkedIn, that sort of thing. One thing I probably should mention is—
Oh, you're on Substack now, aren't you?
Yes, annoyingly stereotypical of a freelance writer. Yeah, I set up a Substack which I called Lingua Cyberneticus.
Now when I'm saying it out loud, it's probably not that easy to Google.
Or you can just find me on social media because I'm spamming links to it like there's no tomorrow at the moment.
Now when I'm saying it out loud, it's probably not that easy to Google.
Or you can just find me on social media because I'm spamming links to it like there's no tomorrow at the moment.
Good man.
I'll be at various cybersecurity shows coming up here in London over the next few weeks. So yeah, say hi if you see me, I guess.
And of course you can find me, Graham Cluley, on LinkedIn, Bluesky, Mastodon, Instagram, and even on the talk of TikTok.
The list goes on, or follow Smashing Security on Bluesky, Mastodon, or Reddit. And don't forget to ensure that you never miss another episode.
Follow Smashing Security in your favourite podcast app, such as Apple Podcasts, Spotify, and Pocket Casts.
The episode show notes, sponsorship info, guest lists, and the entire back catalogue of 492-ish episodes. Check out smashingsecurity.com. Until next time. Cheerio, bye-bye.
The list goes on, or follow Smashing Security on Bluesky, Mastodon, or Reddit. And don't forget to ensure that you never miss another episode.
Follow Smashing Security in your favourite podcast app, such as Apple Podcasts, Spotify, and Pocket Casts.
The episode show notes, sponsorship info, guest lists, and the entire back catalogue of 492-ish episodes. Check out smashingsecurity.com. Until next time. Cheerio, bye-bye.
Bye everyone.
You've been listening to Smashing Security with me, Graham Cluley, and a huge thank you to Danny for joining me this week, and of course to this week's sponsors, Dropzone AI, Hack the Box, and Vanta.
Also thanks to Joe for helping out with the ads. And not being too upset whenever someone writes in accusing him of being an AI. He's not an AI. Joe does really exist.
And huge thanks to the delightful Amanda, who did 95% of the editing this week because of, well, you know, I mustn't keep boring you with stories of how I've done something terrible to my back.
Oops, there I go again.
Anyway, seriously, thanks to all the listeners who dropped me a line about it with their suggestions of what medication I should or should not be taking, what stretch exercises I absolutely must do or absolutely must not do, many of which intersected to add to the challenge.
But it really is lovely to know there are so many kind folks out there prepared to share their war stories of sciatica.
And speaking of lovely people, huge thanks to these brilliant Smashing Security patrons who I plucked out of the hat this week.
The effortlessly cool Jane with a Y — I mean, the Y is in the middle of her name, not at the start. Otherwise, she'd be a Yane.
Vladimir Jirasek, the kind of name that would strike fear into me at a chess tournament.
Ragnar Karlsson, normally found captaining a longboat along the crinkly coastline of Scandinavia. Skadone, whose name reads like a cryptic crossword clue.
Heisenberg, either a physicist or a drug kingpin, or maybe both. We're not asking.
Darryl Green sounds like a reassuring weatherman on a regional news programme and a much more sensible name, if you ask me, than all of the other ones we've had so far today.
And finally, Sital, or is it Sital? All in lowercase. Very, very mysterious.
Anyway, those fine, upstanding individuals are members of Smashing Security Plus, which means that they get their episodes ad-free, earlier than the general public, and perhaps most importantly, get their names read out at the end of the show.
If you would like to join them, all you've got to do is head over to smashingsecurity.com/plus, where for the cost of maybe a fancy coffee every month, you too can be publicly mocked by me.
And so all that's left for me to do is to say thank you very much, and I hope you'll tune in again next week for another episode of Smashing Security. Thank you.
Also thanks to Joe for helping out with the ads. And not being too upset whenever someone writes in accusing him of being an AI. He's not an AI. Joe does really exist.
And huge thanks to the delightful Amanda, who did 95% of the editing this week because of, well, you know, I mustn't keep boring you with stories of how I've done something terrible to my back.
Oops, there I go again.
Anyway, seriously, thanks to all the listeners who dropped me a line about it with their suggestions of what medication I should or should not be taking, what stretch exercises I absolutely must do or absolutely must not do, many of which intersected to add to the challenge.
But it really is lovely to know there are so many kind folks out there prepared to share their war stories of sciatica.
And speaking of lovely people, huge thanks to these brilliant Smashing Security patrons who I plucked out of the hat this week.
The effortlessly cool Jane with a Y — I mean, the Y is in the middle of her name, not at the start. Otherwise, she'd be a Yane.
Vladimir Jirasek, the kind of name that would strike fear into me at a chess tournament.
Ragnar Karlsson, normally found captaining a longboat along the crinkly coastline of Scandinavia. Skadone, whose name reads like a cryptic crossword clue.
Heisenberg, either a physicist or a drug kingpin, or maybe both. We're not asking.
Darryl Green sounds like a reassuring weatherman on a regional news programme and a much more sensible name, if you ask me, than all of the other ones we've had so far today.
And finally, Sital, or is it Sital? All in lowercase. Very, very mysterious.
Anyway, those fine, upstanding individuals are members of Smashing Security Plus, which means that they get their episodes ad-free, earlier than the general public, and perhaps most importantly, get their names read out at the end of the show.
If you would like to join them, all you've got to do is head over to smashingsecurity.com/plus, where for the cost of maybe a fancy coffee every month, you too can be publicly mocked by me.
And so all that's left for me to do is to say thank you very much, and I hope you'll tune in again next week for another episode of Smashing Security. Thank you.
Host:
Graham Cluley:
@grahamcluley.com
@
/ grahamcluley
Guest:
Danny Palmer
/ dannypalmerwriter
Lingua Cyberneticus
Episode links:
- Binance warns of iOS flaw that could leak crypto wallet secrets – Bleeping Computer.
- Palantir exec nominated to lead CISA; lame-duck Senate vote is uncertain – The Record.
- Hotel giant Wyndham exposed customer data after app security lapse – TechCrunch.
- Взлом кроссоверов Li Auto в России. Схема, защита, последствия – Autonews.
- Cyber thieves Remotely block Luxury Chinese cars for Ransom – Известия.
- Кроссовер за миллионы превратился в тыкву. Хакеры блокируют Li Auto и требуют выкуп – Securitylab.
- Man accused of disabling 100 cars over Internet – NBC News.
- Russian dealer threatens to block multimedia in cars imported via gray schemes – Kursiv Media Kazakhstan.
- Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million – US Department of Justice.
- Arsène Lupin – Wikipedia.
- Lupin- Netflix.
- Lupin Official Trailer – YouTube.
- Two Point Museum – Steam Store.
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
Sponsored by:
- Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
- Hack The Box – Develop, exercise and measure the capabilities of your human operators and AI agents.
- Dropzone AI – See how AI SOC agents investigate every alert with this self-guided demo.
Support the show:
You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.
Join Smashing Security PLUS for ad-free episodes and our early-release feed!
Follow us:
Follow the show on Bluesky, or join us on the Smashing Security subreddit, or visit our website for more episodes.
Thanks:
Theme tune: “Vinyl Memories” by Mikael Manvelyan.
Assorted sound effects: AudioBlocks.
