How a cybersecurity boss framed his own employee

0:03 [SPEAKER_02]: You know, you are fired, but at least you are in a well-car city where you have some extremely interesting tourist options you'll think of it. [SPEAKER_01]: Madam too swords, though it's very expensive, isn't it? [SPEAKER_01]: And probably overrated. [SPEAKER_01]: I'm not sure. [SPEAKER_01]: It listeners right into Graham, if you are.

0:18 [SPEAKER_02]: As furious as I am with us suggests, the Madam too swords. [SPEAKER_02]: It's overrated. [SPEAKER_01]: Heresy. [SPEAKER_01]: Now I'm going to get emails from the sea soap of Madam Toots Thoughts. [SPEAKER_00]: smashing security, episode 457. [SPEAKER_00]: How a cyber security boss framed his own employee, with grim, clueless and special guest Carl Miller.

0:46 [SPEAKER_01]: Hello, hello and welcome to smashing security episode 457. [SPEAKER_01]: My name's Graham Pluelly, an uncommitter. [SPEAKER_01]: Carl, welcome to the show first time on smashing security fantastic to have you here. [SPEAKER_02]: I know, I can't believe it's taken you 457 episodes greyem to finally have me on.

1:04 [SPEAKER_01]: It is rather outrageous, isn't it? [SPEAKER_01]: I do apologize. [SPEAKER_01]: Yeah, you must have had people on about five times by now. [SPEAKER_01]: Oh, some of them, oh my goodness, scores of times. [SPEAKER_01]: I think that page of my roller decks must have just, uh, that's actually aged me, hasn't it mentioned in roller decks of, uh, I must have just fallen out.

1:20 [SPEAKER_01]: Yeah, that's some horror another. [SPEAKER_01]: Now Carl, for anyone who hasn't encountered you before, [SPEAKER_01]: Who are you, and why might they have heard of you? [SPEAKER_02]: Well, I'm a technologist and a writer, I was kind of gel those two things together. [SPEAKER_02]: So I am a co-founder of an information integrity group of technologists to lab us, put it call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it, call it

1:53 [SPEAKER_01]: Now, kill list was quite a sensation, wasn't it? [SPEAKER_01]: I mean, it was a really popular podcast, and it was about a fascinating topic, which we have touched upon in the past sometimes, here on smashing security. [SPEAKER_01]: Do you want to share a little bit more about what that was about?

2:06 [SPEAKER_02]: Sure, why is the name hasn't completely given it away? [SPEAKER_02]: It was really about a kill list. [SPEAKER_02]: Genius. [SPEAKER_02]: Yeah, I know. [SPEAKER_02]: We'd like to describe things directly in the Kill List team. [SPEAKER_02]: It's about a assassination market sitting on a dark net, so it was a long investigation that mean colleagues did.

2:23 [SPEAKER_02]: Essentially working with a hacker called Chris who managed to gain access to site, broken, and found a way of intercepting all the orders being placed, and really the whole series of Kill List thereafter is about what we have to do with all of that. [SPEAKER_01]: Right, as a consequence, I believe people have been arrested who sort of ordered assassinations, didn't they?

2:43 [SPEAKER_01]: That's right. [SPEAKER_02]: Yeah, it turns into this kind of global freewheeling, sometimes quite hair-raising and often extremely surprising sort of investigation which ends up as kind of working with the FBI and working with law enforcement agencies around the world. [SPEAKER_02]: And I think we're up to about 28 or 29 convictions now and just just shy of like 200 years of convicted time.

3:04 [SPEAKER_02]: You know, [SPEAKER_01]: And one of my takeaways from all of these horror hitman website is you can't actually trust them, can you? [SPEAKER_02]: Well, I mean you certainly can't trust their cyber security. [SPEAKER_02]: I mean it was laughingly insecure the websites given what they were purporting to offer.

3:20 [SPEAKER_02]: You know, Chris DeHacker found essentially that by cycling through the numbers, the top of the onion, a dress he could bring up other people's orders. [SPEAKER_02]: and so through that essentially extract all the messages running through the site and that was as good as handing over to enforcement.

3:36 [SPEAKER_02]: It wasn't, I strongly suspect, an actual law enforcement honey part, right? [SPEAKER_02]: But it was so insecure that essentially allowed us to sit, kind of undetected in the middle of the site for years, essentially triaging them and gathering them in the ultimately working with law enforcement to try and identify the people that were not just taking [SPEAKER_01]: The thing is that I'm not sure there's strong evidence if you ever did pay for one of these things online that it would actually occur.

4:02 [SPEAKER_01]: It's just like you are being scammed, a bit like you could be scammed by the offer of a free Apple watch or something else or hand in over your fishing details equally. [SPEAKER_01]: You could be scammed thinking you are buying an assassination. [SPEAKER_01]: In fact, you'll just put in cryptocurrency into the pocket of a common scammer.

4:17 [SPEAKER_01]: Indeed. [SPEAKER_02]: Yeah, the people running the site and the people running these sites in general, I don't think have any interests and actually delivering any of the assassinations they're being paid to do. [SPEAKER_02]: They're have been a small number of documented assassinations that have originated from the dark.

4:33 [SPEAKER_02]: Okay, two, I think one Russian one in Finland to my knowledge, but they don't happen in these sites. [SPEAKER_02]: They actually happen somewhat more at kind of caotically or randomly actually in the margins of active serious drug sites. [SPEAKER_01]: And you also do some work with a group called Demos, don't you?

4:51 [SPEAKER_01]: And what do they all about? [SPEAKER_02]: I do, so yes, I mean, I'm a very long, the two think tanker, really. [SPEAKER_02]: Think tanking, I know it is an odd field for most people. [SPEAKER_02]: They probably wouldn't have heard of it or know what things tanks do, but they're essentially little boisterous, noisy universities that try and do really specific research that tries to inform policymaking.

5:13 [SPEAKER_02]: And I've always been really drawn to this kind of envelope of kind of technologically driven change in society and how government and policy and law and actually lots of different institutions across society have to continue adjust to adjust to that. [SPEAKER_02]: So one of the big things that I have been fascinated by and I'm now working with demos trying to do something about is digital democracy or essentially redesigning democratic processes fit for the shell age.

5:37 [SPEAKER_02]: and fit to be able to leverage and use emerging technology. [SPEAKER_02]: So we've got this project called Waves. [SPEAKER_02]: It's currently on the streets of Camden. [SPEAKER_02]: It's going to go to South Staffisher. [SPEAKER_02]: I'm really sure. [SPEAKER_02]: We're in about a month or so to basically create new ways of people participating in political decision making.

5:54 [SPEAKER_01]: Sounds interesting. [SPEAKER_01]: Well, technology is moving at an extraordinary pace, I mean, I've just been reading in recent days. [SPEAKER_01]: Some of the debacle regard in the Department of War over in the United States and their dealings with anthropic and open AI and how AI could be used by the military.

6:12 [SPEAKER_01]: some of the go-ins on over there. [SPEAKER_01]: Do you have any opinions on that? [SPEAKER_02]: I mean, to say that we will be able to prevent cutting-edge war fighters from leveraging cutting-edge AI, I think, is which for thinking more than anything else. [SPEAKER_02]: I mean, if there's any lessons that we can take from the battlefront in Ukraine, it's that every military has such a strong impetus now in pushing automations forwards as quickly as possible.

6:37 [SPEAKER_02]: I mean, I think there's two things that are really important. [SPEAKER_02]: One is that we do that in a way in hearing the UK and across our ally network that means that it's consistent and constant with our own kind of liberal democratic system of rights, but also that we do it actually in a way which is more innovative and faster than our adversary.

6:55 [SPEAKER_02]: I mean, [SPEAKER_02]: liberal democracies cannot seed the tenological playing field of war fighting to Russia or to China. [SPEAKER_02]: I think that is really great and you know we would wish it to be otherwise but that's not the world that we're living in. [SPEAKER_02]: So we actually need to become as democracies more innovative, not less when it comes to how to fight wars.

7:13 [SPEAKER_02]: We just have to do that in multiple fronts. [SPEAKER_02]: Not just how to fight wars, but how to fight wars which are right for respecting and casualty minimizing. [SPEAKER_01]: It's quite the topic, isn't it? [SPEAKER_01]: Well, let's move on with the rest of the show. [SPEAKER_01]: And before we kick off, let's thank this week's wonderful Sponters meter Action One inventor.

7:30 [SPEAKER_01]: We're here and about them later on in the podcast. [SPEAKER_01]: This week on smashing security. [SPEAKER_01]: We're not going to be talking about how AI can now link your anonymous posts to your real name. [SPEAKER_01]: You'll hear no discussion of. [SPEAKER_01]: How a hacked Iranian prayer app sent surrender messages to worshippers amid Israeli and U.S. missile strikes.

7:55 [SPEAKER_01]: And we won't even mention. [SPEAKER_01]: How streamers are worried the Amazon has just made wish lists a dox in risk. [SPEAKER_01]: So Carl, what are you going to be talking about this week? [SPEAKER_02]: I'm Graham, going to be talking about manipulation of elements. [SPEAKER_02]: Now, it's coming from a field known as phemic, which I promise is the only conkey govern acronym I'm going to throw anyone today.

8:20 [SPEAKER_02]: I won't promise, it might be more but I'm going to get into an absolute minimum. [SPEAKER_02]: Okay. [SPEAKER_01]: And I'm going to be talking about why you might not want to be invited to an off-site meeting. [SPEAKER_01]: All this and much more coming up in this episode of Smash In Security.

8:38 [SPEAKER_01]: Well, we've got time now to chat about one of the sponsors of this week's Show Action 1. [SPEAKER_01]: And lucky old me, I've got someone here to help me do the ad. [SPEAKER_01]: Say hello to everybody, Joe. [SPEAKER_01]: Hello, everybody. [SPEAKER_01]: Hello, Graham. [SPEAKER_01]: Hi, Joe.

8:52 [SPEAKER_01]: Now then, if you are a systems administrator, managing endpoints every day, you've probably postponed patching at least once. [SPEAKER_01]: Not because you forgot, but because you didn't feel like gambling with uptime. [SPEAKER_03]: Meanwhile, the backlog grows, vulnerabilities pile up and patching stays stuck in manual mode.

9:10 [SPEAKER_03]: Well, action one fixes that. [SPEAKER_01]: Action one is a cloud native patch management platform for windows, macOS, Linux, and third party apps, all from one place, no VPN needed. [SPEAKER_03]: Curious on how easy it is to start with action 1, while you can use it on your first 200 end points for free forever with no functional limits.

9:31 [SPEAKER_03]: First 200 end points for free forever, that's bonkers, incredible Joe. [SPEAKER_03]: So if you're looking to also wait, patching at scale and get weeks, even months of your time back, go to smashingsecurity.com-action1 and sign up for patching that just works. [SPEAKER_01]: That's right.

9:47 [SPEAKER_01]: It's not a disguise free trail. [SPEAKER_01]: There's no credit card required. [SPEAKER_01]: There's no hidden limits. [SPEAKER_01]: All you have to do is visit smashingsecurity.com slash action one and get started today and thanks to action one for supporting the show. [SPEAKER_01]: And also, thank you Joe for helping me with the ad.

10:04 [SPEAKER_01]: You're welcome. [SPEAKER_01]: Now, Carl, we've all heard stories about rogue insiders before, right? [SPEAKER_01]: We've got disgruntled Cisadmin's planting logic bombs on the network. [SPEAKER_01]: We've got contractors who copy the customer database onto USB sticks. [SPEAKER_01]: You know, often abled definitely not the customer database.

10:25 [SPEAKER_01]: This week, I'm going to be talking about something rather different at the scent of this story is a defense contractor called trenchant and trenchant is interesting because it specializes in cybersecurity stuff in particular exploiting zero day vulnerabilities the vulnerabilities that haven't yet been patched [SPEAKER_01]: that help governments and intelligence agencies, and potentially, of course, cybercriminal gangs, gain unauthorized access to systems.

10:57 [SPEAKER_01]: These are the kind of tools that governments will pay millions of dollars for. [SPEAKER_01]: And, well, rumors were spreading around that a Western defence contractor might have suffered a massive leak that was exposing these zero-day exploits. [SPEAKER_01]: They were thinking, is there a defence contractor who's got a bit of a leaky bottom and the vulnerabilities are falling out of them and rather than being held securely, are falling into the hands of maybe nation states you wouldn't want them to fall into or cybercriminal hackers, malicious hackers and the like.

11:32 [SPEAKER_01]: So people were whispering about this, but they couldn't narrow down the details. [SPEAKER_01]: They were effectively hunting for a bit of a ghost. [SPEAKER_01]: A mysterious individual that they knew only as John Taylor. [SPEAKER_01]: It's a fairly ordinary name, isn't it? [SPEAKER_01]: John Taylor?

11:48 [SPEAKER_01]: Very, very much. [SPEAKER_01]: This is going to be a lot of them around. [SPEAKER_01]: And this John Taylor was the name on the contracts which were being done with this operation called Operation Zero A Russian outfit that rather politely claims to sell its exploits and zero-day vulnerabilities only to non-NATO countries.

12:09 [SPEAKER_01]: So they've worked out their niche. [SPEAKER_01]: They say we're not going to sell to NATO countries. [SPEAKER_01]: That is not our market. [SPEAKER_02]: It's kind of like an opposite KYC isn't it? [SPEAKER_01]: We only sell the bank, you don't take it. [SPEAKER_01]: But of course, John Taylor doesn't exist, at least this John Taylor doesn't exist.

12:25 [SPEAKER_01]: What we didn't know at the time was that he was just a pseudonym for someone else, so we shouldn't have been looking for a real John Taylor. [SPEAKER_01]: It turns out, it was someone who in reality, his colleagues, knew as Duggy and Duggy, was this cyber-espin art kingpin. [SPEAKER_01]: It sounds like someone who'd be at home, revising for his GCSE biology, but in fact, 2G, oh, because I still like and think of his Dugi-houser.

12:53 [SPEAKER_01]: But anyway, Dugi-houser was a big deal. [SPEAKER_01]: This Dugi-houser was a different Dugi. [SPEAKER_01]: He had access to these vulnerabilities, these powerful exploits, which could maybe crack into Android and iPhones, [SPEAKER_01]: Now, here's the thing. [SPEAKER_01]: When the defense contract to Trenton discovered that it had a leak, they didn't call the FBI immediately.

13:21 [SPEAKER_01]: They put one of their guys in charge of an investigation. [SPEAKER_01]: They put a guy called Peter Williams who headed up the US offices of Trenton. [SPEAKER_01]: He was known to his colleagues [SPEAKER_01]: his nickname is Doogie, that's what they call him in the office. [SPEAKER_01]: So the head of Trenchant USA, note by his mates as Doogie, was selling exploits on the side to the wrong sort of people, Operation Zero, the Russian exploit broker.

13:57 [SPEAKER_01]: And when Trenchant discovered that he had a leak, [SPEAKER_01]: They didn't call the FBI, they put Peter Williams the guy actually do in the leaking in charge of the internal investigation. [SPEAKER_01]: And of course this guy Peter Williams, he decides to save his own skin. [SPEAKER_01]: So what he did was he hand-picked a scapegoat on his team.

14:17 [SPEAKER_01]: He spotted that he had a talented iOS developer amongst his staff. [SPEAKER_01]: And [SPEAKER_01]: We're going to give them the nickname J Gibson. [SPEAKER_01]: That's the pseudonym which is being given to this person in reports. [SPEAKER_01]: Don't know what his real name is. [SPEAKER_01]: In February last year, the Trentian team, including this J Gibson guy, this innocent iOS developer, was sent to London for what Trentian called a team building exercise.

14:43 [SPEAKER_01]: In reality, it was an ambush. [SPEAKER_01]: Because while the team was in London, Peter Williams also known as Doogie, [SPEAKER_01]: Right, you're following this, Peter Williams also known as Dugi, also sometimes known as John Taylor, appears on a video link from the States, and with a straight face, accused Gibson of being the Leica.

15:03 [SPEAKER_01]: So this iOS developer was fired on the spot, while he was in London, his devices were seized, he was left stranded in a foreign country, branded a traitor, presumably left to make his own way home. [SPEAKER_01]: and to twist the knife. [SPEAKER_01]: Shortly after he was fired, his personal iPhone received a message from the guy's Apple and it gave him a notification that he had been targeted with some pretty serious state-sponsored spyware.

15:34 [SPEAKER_01]: You know how sometimes journalists and dissidents and people who generally aren't very popular with their government can receive messages saying you may well have been targeted by some serious spyware. [SPEAKER_01]: That's the message he got now. [SPEAKER_01]: I don't know who tried to infect his iPhone with spyware or why, but it does make you think doesn't it, since he had been working for a [SPEAKER_01]: as the possible leaker of the exploits by the person who was actually doing it.

16:08 [SPEAKER_02]: Why did they bring him to London? [SPEAKER_02]: I don't think I've really an explicable part of the story, was it was just a kind of making more inconvenient for him to get sacked? [SPEAKER_01]: I don't know, I mean, maybe, maybe, right, if they really do believe that someone is leaking something, which the main guy in charge didn't believe, because he knew who the real leaker was.

16:29 [SPEAKER_01]: Maybe it was to get him away from his other devices, maybe it was to get him away from his home network, or maybe it was to give them time to tip off the FBI perhaps if they wanted to do that, so it could be caught upon his return to America. [SPEAKER_01]: It certainly puts you in a more fragile position, doesn't it, being elsewhere?

16:47 [SPEAKER_02]: Yeah, it's a post-so. [SPEAKER_02]: It's suddenly making me think, you know, never trust team-building exercises. [SPEAKER_01]: Well, that's a general rule for life, Carl. [SPEAKER_02]: I mean, I noticed Team Bill's exercises at the best of times, but now that I know that that can actually be part of a insider threat detection workflow, it's made me even less likely to sign up for one.

17:10 [SPEAKER_01]: Okay, I'm thinking now, right? [SPEAKER_01]: If a company was firing me, which isn't beyond the brums of possibility to be perfectly honest. [SPEAKER_01]: If they're employing me, maybe it makes sense to send me elsewhere in the world. [SPEAKER_01]: To make it more difficult for me to login remotely, it may be cause damage inside the organisation.

17:30 [SPEAKER_01]: Maybe they've got some kind of IP block when people connect to say, well, are you logging in from your usual IP address, or are you suddenly logging in from London rather than Delaware or wherever it was you were? [SPEAKER_01]: I don't know. [SPEAKER_01]: speculating here I don't want to give anyone any ideas as to how they should fire me because I'm not the kind of chap who would do damage even if it was grossly unfair that you fired me.

17:51 [SPEAKER_01]: Let's stress that right now. [SPEAKER_01]: You equally curl, obviously, work for plenty of different people. [SPEAKER_01]: You're not going to get up to any shenanigans are you if you're fired. [SPEAKER_01]: I mean, maybe it was just soft in the blow. [SPEAKER_01]: Oh, that's kind. [SPEAKER_02]: You know, you are fired, but at least you are in a well-car city where you have some [SPEAKER_01]: Madam too swords, though it's very expensive, isn't it?

18:14 [SPEAKER_01]: And probably overrated. [SPEAKER_01]: I'm not sure. [SPEAKER_02]: It listeners right into Graham, if you are, as furious as I am with us suggest the Madam two swords is overrated. [SPEAKER_01]: Now I'm going to get emails from the CSO, but I'm too short. [SPEAKER_01]: Anyway, so just imagine you're being framed for a global espionage case.

18:35 [SPEAKER_01]: It's all the drama going on while the real culprit is sitting in the boss's chair watching your life collapse. [SPEAKER_01]: through a webcam on Microsoft Teams and he's called Duggy and he's called Duggy, which is the ultimate slap in the face with a rusty macro isn't it? [SPEAKER_01]: It's very kind of dubious, isn't it?

18:54 [SPEAKER_01]: It's very, it's very, it's very, it's very, it's very, it's very, Cambridge for it. [SPEAKER_01]: Now look who's dating themselves, Carl. [SPEAKER_01]: So, Peter Williams, the real head of the US branch of Trenton, he has now pleaded guilty, right? [SPEAKER_01]: He was sentenced last week to 87 months in prison.

19:12 [SPEAKER_01]: They've uncovered that it was really him, leaking these exports to this Russia-linked exploit factory. [SPEAKER_01]: Prosecutors estimate that his actions [SPEAKER_01]: Cost about $35 million worth of losses for trenchant, I wonder how much, additionally they may have caused in terms of damages to other organisations who may have been hacked, whether it be by ransomware attackers or industrial espionage or spies or kinder possibilities here.

19:39 [SPEAKER_01]: Because here's the thing, we still don't know precisely which zero days he sold to these Russian exploit brokers or where they then got sold on to. [SPEAKER_01]: We know that they target Android and iOS, and we know that Operation Zero didn't keep them to themselves. [SPEAKER_01]: They were selling to buyers across the Middle Eastern Asia and [SPEAKER_01]: We also know that some of these vulnerabilities had previously been used by hackers in South Korea, as well as also being sold to the Russian.

20:07 [SPEAKER_01]: So, likely it's ended up in the hands of everybody from foreign spies to ransomware SARS. [SPEAKER_01]: The most unsettling thing I think about all of this isn't so much the technology. [SPEAKER_01]: It's how ordinary it's become these trusted insiders. [SPEAKER_01]: It's about greed, it's very human, this even had a support contract with this Russian exploit broker as well.

20:29 [SPEAKER_01]: I'll help you with some of these vulnerabilities don't work properly. [SPEAKER_01]: This was all contracted down, and boring aliases like John Taylor can disguise all kinds of dramatic activities going on outside, so it's often not a bond style villain stroking [SPEAKER_01]: and a nickname that makes him sound like a kids TV presenter, but it's real people's lives which get turned upside down or put in danger because that accounts are being hacked by cybercriminals or dodgy regimes are breaking in and doing damaging instead.

21:03 [SPEAKER_01]: It's another extraordinary story. [SPEAKER_02]: It is an extraordinary story. [SPEAKER_02]: I mean, what's really interesting as well is it's this kind of intersection between economically motivated cybercrime and geopolitics, because it sounds like duty is in it for the money. [SPEAKER_02]: For him to really be targeting sanctioned entities, nominator countries as a whiff of the geopolitics in there as well as in it, it's not simply to the highest bidder.

21:28 [SPEAKER_02]: It's also to a kind of countries or actors that are lined up to confront the West. [SPEAKER_02]: And it's often like that, isn't it, Graham? [SPEAKER_02]: Where you're not quite sure what is motivating anyone in these sorts of places. [SPEAKER_02]: but where politics and money and geopolitical confrontation often all swept up in ways which quite hard to untangle.

21:46 [SPEAKER_01]: Yep, it may well be quite a cocktail for it, from my understanding for reading of this, he was living something of the luxury lifestyle, so he was making plenty of cash out of doing this, because I'm in some of these exploits, you can sell for well over a million dollars, so there is a lot of money to be made when everyone wants to crack into the latest iPhones.

22:05 [SPEAKER_01]: and steel information ideally with a zero-click exploit, but yeah, there may also have been something more geopolitical going on, or maybe there was some political motivation as well. [SPEAKER_01]: Or simply they just didn't give a damn, and they just wanted an awful lot of cash. [SPEAKER_02]: For sure, I mean, since time immemorial, the idea that a traitor or a turns by turning up to the office in a Ferrari, you know, we've got a bunch of ways in which, yeah, what?

22:32 [SPEAKER_02]: You can make our networks more sophisticated, but so often, you know, human greed and even error. [SPEAKER_02]: Yes. [SPEAKER_01]: I will finally catch people. [SPEAKER_01]: I'd just rather not turn up to the office in a feet punto. [SPEAKER_01]: And that was my big mistake. [SPEAKER_01]: Well, we've just got a little bit of time now to chat about one of today's sponsors meter.

22:56 [SPEAKER_01]: So, you know how setting up a network for a new office location involves about 17 different headaches, you know, dealing with ISPs, designing floor plans, racking hardware, configuring everything. [SPEAKER_03]: It sounds like an absolute joy. [SPEAKER_03]: I can't imagine the fun I'd have, chasing an ISP for three weeks, only to find those spot my company's name wrong on the contract.

23:18 [SPEAKER_03]: Yeah, that's exactly what goes on, right? [SPEAKER_01]: But meet what they do is, they basically say, what if none of that was your problem anymore? [SPEAKER_01]: Tell me more. [SPEAKER_01]: So Meta is a network as a service company, but a proper end to end one. [SPEAKER_01]: You give them a physical address and a floor plan.

23:36 [SPEAKER_01]: They sought out the ISP, they designed and deployed the network, they turned up on site, they rack the hardware, which is their own hardware, by the way, not just reselling someone else's kit, and they get everything running. [SPEAKER_03]: So you get to skip the fun part where you're on hold with the telecom's company, 45 minutes.

23:53 [SPEAKER_03]: Yeah, exactly. [SPEAKER_01]: And hey, you get a single dashboard for monitoring, management, security, V-Lound, Firewall, DNS security, SD1, the works. [SPEAKER_01]: You keep visibility in control via their dashboard without having to do any of the tedious groundwork. [SPEAKER_01]: That sounds genuinely useful.

24:12 [SPEAKER_01]: What's the catch? [SPEAKER_01]: No nasty surprises, Joe, just a straightforward subscription model. [SPEAKER_01]: They even have a hardware buy-back program if you've already spent money on equipment from another vendor. [SPEAKER_01]: Sounds cool. [SPEAKER_01]: Where do I find out more?

24:27 [SPEAKER_01]: Just go to meter.com slash smashing. [SPEAKER_01]: Go and have a look there today. [SPEAKER_03]: That's METER.com slash smashing, and thanks to meter for supporting the show. [SPEAKER_02]: Carl, what's your story for us this week? [SPEAKER_02]: My story, Graham, is about large language models AI and Femi.

24:47 [SPEAKER_02]: Femi stands for foreign information manipulation interference. [SPEAKER_02]: Oh, all right. [SPEAKER_02]: Okay, and it is essentially information warfare. [SPEAKER_02]: It is this strange new kind of conflict, which is opened up kind of within information spaces. [SPEAKER_02]: but it's kind of recent origin is recognition that militaries made in the mid-Norties, where they kind of reconceptualise of information as being not just a kind of tool of war, but in fact a theatre of war.

25:16 [SPEAKER_02]: Now the specific story is towards the end of last year as in the Guardian and it basically reports on this whole network of strange websites. [SPEAKER_02]: that counter disinformation, counter-fini researchers had kind of found. [SPEAKER_02]: They were hundreds of websites, aggregating millions and millions and millions of individual news articles.

25:40 [SPEAKER_02]: All of which were basically about Russia or pro-Russian in some way. [SPEAKER_02]: Lots were drawn from Russian state media and was odds. [SPEAKER_02]: And what researchers were kind of scratching their heads about. [SPEAKER_02]: was despite the kind of eye-watering size of this kind of huge pile of mainstream reporting.

25:58 [SPEAKER_02]: And you know, it was on everything. [SPEAKER_02]: Those stories about Ukraine and domestic stories about Russia and there was things to do with Russian pop stars and there's quite a lot of culture and traditional values. [SPEAKER_02]: It was not selective and it was certainly not filtered.

26:14 [SPEAKER_02]: But despite this kind of huge aggregation of all this repal charge across all these websites, it didn't seem and it was a network. [SPEAKER_02]: It was called a Praved in that work. [SPEAKER_02]: Yes. [SPEAKER_02]: It didn't seem this network was making any effort to make itself seen. [SPEAKER_02]: There wasn't any kind of real attempt to make it more visible.

26:36 [SPEAKER_02]: you know, to link it to target audiences. [SPEAKER_02]: So there was one thing that we knew one thing that we didn't know initially. [SPEAKER_02]: What we did know, what researchers were concluding was that this is part of information warfare. [SPEAKER_02]: This is part of Femi. [SPEAKER_02]: Since the naughties and certainly I think supercharged by the invasion of Ukraine, we have seen in information spaces states become much, much more active and muscular.

27:00 [SPEAKER_02]: The redding and weave together, the trade craft of cyber offensive activity with the trade craft of shadowy influence. [SPEAKER_02]: So partly it's technical, partly it's cyber, partly it's to do with understanding about how influence work, how humans think. [SPEAKER_02]: psychology and sociology.

27:18 [SPEAKER_02]: We've seen all these things kind of weaving together to mean that states will now, but certainly all the crats will now, systematically try and manipulate information spaces to have an effect, you know, to change what we see, what we think, who we are, I was censored belonging and how we fit into society, loads of things.

27:36 [SPEAKER_02]: It was recognizably a themey campaign. [SPEAKER_01]: Yeah, because this isn't about hacking the AI directly, is this is about stuffing the internet full of rubbish or something which matches your particular agenda. [SPEAKER_01]: This is about subtly trying to bend reality over time in people's minds by slowly seeding this misinformation into AI because people will now go to AI for so much, well, [SPEAKER_02]: You're right, and I think that's a start point realisation of that's why I wanted a foreground, this story for you, which is there.

28:16 [SPEAKER_02]: As soon as I saw this, I began to think, it is absolutely inevitable that manipulating elements is going to become a whole new and perhaps the dominating new battlefront in information warfare. [SPEAKER_02]: they're going to be the lens through which we see society, and not only that, and then there's going to be some of the most precious and treasured relationships that many people have.

28:38 [SPEAKER_02]: This isn't just actually BT and unbroken, you know, we're talking about hundreds of therapy bots. [SPEAKER_02]: Yes, boyfriend and girlfriend bots, pen pals, creative writing partners, you know, people are going to create their redeep meaningful relationships with AI, and all of that is on the tax surface.

28:54 [SPEAKER_02]: and I think that was the first in what is going to be an accumulating and intensifying conflict where the overall aims of information warfare to have influence begin to intersect with the kind of technical realities of how do you manipulate LLMs in order to change their responsive for people in.

29:15 [SPEAKER_02]: short-term ways, long-term ways, tactically, strategically, um, fact-based, non-fact-based, you know, changing how people feel emotionally, how they view the world as well as what they see. [SPEAKER_02]: You know, all of that is now what for grabs, and what you began to do, Graham, is exactly what I began to do, which has begun to kind of rumenate on how this might happen, and the provident, [SPEAKER_02]: probably wasn't that successful, but what it was probably doing was seeding the internet with vast amount of text that it was hoping was going to get swept up in the training cycles.

29:49 [SPEAKER_02]: So for AI to begin to create new semantic patterns on the basis of all of it that will become more pro-Russian over time. [SPEAKER_01]: Yeah, I mean, for the past, I don't know, 10 years or more, we've all been worried about missing information on the internet and we've seen the bots posting on Twitter and on Facebook and manipulating people's opinions that way.

30:10 [SPEAKER_01]: But what would be fascinating is, if instead of individuals being targeted with this misinformation, if it's the AI being targeted, [SPEAKER_01]: and us humans go to the AI for advice and we get our opinions and we get our news and all the rest of it via this AI lens. [SPEAKER_01]: We as individuals are going to be producing content as well, which has been poisoned somewhat if the AI has been poisoned.

30:35 [SPEAKER_01]: So we'll be legitimate people that are spreading misinformation, perhaps unknowingly because it's been fed to them by an AI which has been misinformed as well. [SPEAKER_01]: Is that right? [SPEAKER_01]: Yeah, of course. [SPEAKER_02]: We as we change, the kind of agents ourselves are social change.

30:49 [SPEAKER_02]: Yeah, I mean, let's not sugarcoat this. [SPEAKER_02]: It is conceivable that state's developing sophisticated scaled ways of covertly being able to manipulate an exert influence over LLM responses might be able to exact long term deep cultural changes on a target population. [SPEAKER_02]: This is as serious a threat, not just to an election or an event, or a particular moment, but to long-term senses of our culture and our ways of doing things, as I think you can have an information space.

31:26 [SPEAKER_02]: If I was a Russian information warfare officer, I would be doing nothing else. [SPEAKER_02]: This is what I would be trying to develop and build ways of doing. [SPEAKER_02]: That means that [SPEAKER_02]: into this kind of neutral, you know, a 1993 Google's just indexing the web. [SPEAKER_02]: This is also great.

31:44 [SPEAKER_02]: Ha ha ha, how fun environment. [SPEAKER_02]: They're stepping into basically a battlefield. [SPEAKER_02]: And I don't think anyone has realized that yet. [SPEAKER_02]: And the battle over information integrity and then over our culture, society, integrity, polarization, basically everything.

32:00 [SPEAKER_02]: Part of that will now be a battle over security's elegance, and if there's one thing we've learned from social media, which is what I've spent the last ten years of my life also, you know, researching and trying to understand, this is not a battle that we can leave simply to the technology providers and platform providers to fight and win and the honest about by themselves.

32:17 [SPEAKER_01]: But can we leave it to regulators? [SPEAKER_01]: Can we leave it to politicians? [SPEAKER_01]: They always feel like they're about ten years behind where the technological curve is as well. [SPEAKER_02]: uh... regulators probably not know i don't know if it's anything in the online safety act that will create an envelope for uh... off come to act and i don't think off come as acted fast enough when it's come to obviously and clearly legal content so to know i'd i think regulators are already far behind [SPEAKER_02]: Politicians, I think, are now via the bruising experience of trying to get social media companies to take responsibility and the bruising experience of seeing the last 10 years of kind of warfare, conflict rate across information spaces, I think, are now more aware.

32:55 [SPEAKER_02]: So, I'm not actually defeated, but no, of course, there's a constituency that's going to be part of the solution that we have a mention and that is, of course, the knowledgeists. [SPEAKER_02]: You know, so we're going to have to build defensive barricades that can detect [SPEAKER_02]: attempts to manipulate can disrupt them.

33:10 [SPEAKER_02]: I think the future is essentially going to be, different largely automated systems, trying to find vulnerabilities to interdict into manipulate elements, and similarly other systems try to spot those attempts and trying to defang them. [SPEAKER_01]: That's the thing, if someone did manage to poison an AI, would we even know that that happened?

33:31 [SPEAKER_01]: Would answers just drift slowly away from accepted norms? [SPEAKER_01]: Yeah, I think I think a lot would be obvious because there's suddenly promoting Russian pop stars. [SPEAKER_01]: I mean, I remember that band tattooed. [SPEAKER_01]: Yeah. [SPEAKER_01]: Are they were unnaturally popular?

33:45 [SPEAKER_01]: Was that an early example? [SPEAKER_02]: Well, some people, some people suspected it was. [SPEAKER_02]: Yeah, in fact, um, I spoke to the economists who wrote an article that was acting fact actually digging exactly into whether they were a Russian information operation. [SPEAKER_01]: Not just the Russian popstar, but there were the cheeky girls as well from Romania.

34:02 [SPEAKER_02]: Well, I mean, that was talent shining through, I think we can all agree that it was absolutely nothing and organic about the cheeky girls. [SPEAKER_01]: But, but you know, you're talking about this prouvet and network, obviously, the Russian links. [SPEAKER_01]: If the Russians are doing it, [SPEAKER_01]: Surely everyone's doing this.

34:17 [SPEAKER_01]: I mean, he's America doing this. [SPEAKER_01]: Yes, I mean, they already are. [SPEAKER_02]: So, the thing that really worries me is that there is a whole private sector industry called generative engine optimization or GEO that is basically now spring up. [SPEAKER_02]: If you go to a web summit, you go to one of these big, [SPEAKER_02]: kind of like global conferences as I do, you will now see a kind of little section of one of the huge echoing exhibition halls basically crammed with geo companies.

34:44 [SPEAKER_02]: They're taking VC, you know, they're beginning to grow and they're basically building themselves as a kind of honest and direct extension of the search engine optimization world. [SPEAKER_02]: So what they're doing is their building, what they would argue is just a new way of doing SEO in the age of 11.

35:00 [SPEAKER_02]: Yeah. [SPEAKER_02]: When that conjoins with Russia or China or Iran, that is when we have a problem, because you can SEO all you want if you are a brand. [SPEAKER_02]: Yeah. [SPEAKER_02]: SEO, I think, is always being the kind of weird dirty secrets of marketing. [SPEAKER_02]: And then there's no one's ever wanted to talk about it.

35:16 [SPEAKER_02]: But the reality is that loads of companies [SPEAKER_02]: all over the world basically engage in quite serious, scaled online manipulation in order to get visibility. [SPEAKER_02]: But that is going to, I think, when bundled into an LM present us with a whole new batch of really quite serious problems, especially when it's being done for geopolitics, or we'd like more nefarious aims in mind.

35:37 [SPEAKER_01]: Yeah, particularly as we see search engines being used less and less and more people using an AI. [SPEAKER_01]: What one things I do is I do a lot of keynote speaking. [SPEAKER_01]: I was on this bootcamp thing for speakers. [SPEAKER_01]: One of their things they said to me was, well, are you optimising yourself for LLMs?

35:53 [SPEAKER_01]: Are you writing content? [SPEAKER_01]: So the LLM will scoop it up. [SPEAKER_01]: and say, oh, Graham Pluly is a wonderful keynote speaker and very recently priced. [SPEAKER_01]: You should go and hire him in particular industry sectors. [SPEAKER_01]: And I thought, this is like SEO 15, 20 years later.

36:08 [SPEAKER_01]: And now this will be the accepted wisdom as to what is truth because people trust these things so much. [SPEAKER_01]: And as you said, people's relationship with the chatGPTs and the clords of this world are very personal sometimes. [SPEAKER_01]: You know, this is their friend they're speaking to or their advisor.

36:26 [SPEAKER_02]: And, you know, there's the chat GPTs and there's the chords and, you know, I know some of the people to work in threat intelligence in these large foundation of all the companies that they're very clever. [SPEAKER_02]: And I think the huge companies will build some kind of reasonable defensive response.

36:42 [SPEAKER_02]: Will it be enough? [SPEAKER_02]: I don't know, but I'm far more at about the kind of character AI's spicy AR's of the world, right? [SPEAKER_02]: There are hundreds and hundreds of foundational models that are now being built, many of them being open-source, there are there are thousands of companies that are taking these models tweaking them, working on their own.

37:00 [SPEAKER_02]: You know, many of which, you know, see their route to success to be about creating a product which creates a much deeper, more emotional [SPEAKER_02]: more intense relationship between the AI and the human user. [SPEAKER_02]: You know, you ask any sociologist how influence really works and it's through your social ties.

37:21 [SPEAKER_02]: But that is what really changes us. [SPEAKER_02]: It's not randomly seeing something on the internet. [SPEAKER_02]: It's who you're surrounded by and what they're like. [SPEAKER_02]: We are so formed by social ties grand that so on that you don't even know that your friends know quits smoking, you're more likely to quit smoking.

37:37 [SPEAKER_02]: But that's how powerful this is and it's also inevitable that our social network in the years ahead for some people want to know this sounds odd to some people listening to this But people social networks will include nonhuman AI models. [SPEAKER_02]: Yeah, we can see this. [SPEAKER_02]: This is already the case.

37:53 [SPEAKER_02]: So all the people that are marrying their AI and there's tons of people that are developing some kind of [SPEAKER_02]: To them, reading meaningful relationships, they are that is the attack service the most word of. [SPEAKER_02]: If I was Russia, that is what I would target and these do not have the hundreds and millions of capitalisation that an open AI has to defend themselves.

38:12 [SPEAKER_02]: They actually have no real interests in looking for this as a problem because once it comes to problem, then you have to do something about it and that will cost money. [SPEAKER_01]: Boy, you're depressing, Carl, aren't you? [SPEAKER_02]: Sorry, I have that effect on people. [SPEAKER_02]: Once I gave a talk, and afterwards the host came on stage and then called for calm.

38:31 [SPEAKER_01]: You're... Don't panic! [SPEAKER_01]: Don't panic! [SPEAKER_01]: Yeah exactly. [SPEAKER_01]: Okay, before we go any further, Joe and I have got times to say, Vanta! [SPEAKER_03]: So, we've got a question for our listeners. [SPEAKER_03]: What do you worry about at 2 o'clock in the morning when it comes to your company's cybersecurity?

38:50 [SPEAKER_01]: Is it? [SPEAKER_01]: Do you actually have the right controls in place? [SPEAKER_01]: Is it? [SPEAKER_01]: Have our suppliers been hacked? [SPEAKER_01]: Is it? [SPEAKER_01]: The truly terrifying one, why we still trying to do everything with spreadsheets for goodness sake? [SPEAKER_03]: Well, if that sounds like you, enter Vanta.

39:04 [SPEAKER_03]: Vanta takes all that painful manual security work like chasing all the evidence, filling out questionnaires, updating the same spreadsheet for the thousandth time, and it automates it. [SPEAKER_01]: That's right, their trust management platform continuously monitors your systems, pulls everything into one place, and helps keep your security program audit ready all of the time.

39:25 [SPEAKER_01]: And yes, it uses AI, but in the useful way, flag in risks, streamline in evidence collection, and fit in neatly into the tools you already use. [SPEAKER_01]: All of this, so you can move faster through the night. [SPEAKER_03]: Learn more and get started today, vanted.com slash smashing.

39:42 [SPEAKER_01]: That's V-A-N-T-A dot com slash smashing, and thanks to Venta for supporting the show. [SPEAKER_01]: And welcome back and you join us at our favourite part of the show, the part of the show that we like to call, pick of the week. [SPEAKER_01]: Take a look at the week. [SPEAKER_01]: Pick up the week, it's the part of the show where everyone chooses something that I could be a funny story of, because they've read a TV show, maybe a record of podcast or website, or an app.

40:08 [SPEAKER_01]: Whatever they wish, it doesn't have to be security-relatedness, certainly. [SPEAKER_01]: Well, my pick the week this week is not security related. [SPEAKER_01]: There I was, the overnight with my lovely wife, and we somehow got chatting about movies that scared us as kids, and I played my top Trump card.

40:24 [SPEAKER_01]: No, not that scary. [SPEAKER_01]: My top card, which was the incredible shrinking man. [SPEAKER_01]: From 1957, now Carl, I'm not suggesting you watched it at the time. [SPEAKER_01]: Leave the day, I wasn't around then. [SPEAKER_01]: Have you ever heard of a movie called the Incredible Shrinking Man?

40:40 [SPEAKER_02]: Oh, I had to watch it the time to get over my shock of seeing the Cambridge Five being being made. [SPEAKER_01]: It used to be on BBC 2 all the time. [SPEAKER_01]: It's a very simple premise. [SPEAKER_01]: Ordinary chap is relaxing on his boat. [SPEAKER_01]: These enveloped in a mysterious radioactive mist.

40:57 [SPEAKER_01]: And a few months later he realised it is close and no longer fitting. [SPEAKER_01]: They're getting a bit baggy. [SPEAKER_01]: And he's losing weight and the doctors are baffled and they're doing tests. [SPEAKER_01]: And he starts shrinking and shrinking and shrinking. [SPEAKER_01]: Before you know it, he's like a teenage boy and then he's just like a little nine-year-old.

41:12 [SPEAKER_01]: Well, as he gets smaller, his life is collapsing around him. [SPEAKER_01]: He loses his job, his marriage is under strain. [SPEAKER_01]: Eventually, he's living in a dull house and is terrorised by the family cat. [SPEAKER_01]: Very frightening. [SPEAKER_01]: I mean, we've all been there.

41:27 [SPEAKER_01]: I've certainly terrorised by the family cat. [SPEAKER_01]: One thing leads to another and he ends up in the basement and his wife thinks that the cat has eaten him. [SPEAKER_01]: And the rest of the film is really the story of how he tries to battle his way out of the cellar. [SPEAKER_01]: There's a great big house spider.

41:44 [SPEAKER_01]: The effects, by the way, in this movie for 1957 for Black and White 1957 movie are tremendous. [SPEAKER_01]: Every day objects are towering over him, thread becomes climb in rope, there are drips of water threading to drown him. [SPEAKER_01]: I mean, this is 70 years old this movie, and it really scared the wits out of me when I was a kid, and so I wondered, is it still gonna work?

42:07 [SPEAKER_01]: So I set my wife down, so look, we're gonna find this. [SPEAKER_01]: I tried to find it online, and I eventually found it on the internet web archive, so I'll put a link in the show notes if you want to watch it. [SPEAKER_01]: I think it pretty much stands up, I think it's still a good movie.

42:20 [SPEAKER_01]: The end, though, wasn't really the best to my mind. [SPEAKER_01]: I'm not gonna spoil it if you after all, it's a 70-year-old movie, some of you may not have got around to watch any yet, but I would recommend the incredible shrinking man if you're in the mood for classic sci-fi, it's tense, it's inventive, extraordinary effects for the time, so give the incredible shrinking man a watch, as it is my pick of the week.

42:46 [SPEAKER_01]: Carl, what's your pick of the week? [SPEAKER_02]: Well, I was worried before coming on that picking a book would be kind of too keen and earnest. [SPEAKER_02]: Bad pick book. [SPEAKER_02]: Is it a brilliant book? [SPEAKER_02]: And it will be a shame not to take up the opportunity to mention it to everyone.

42:58 [SPEAKER_02]: So it's the immortalist by Alex Kotowski. [SPEAKER_02]: She's a brilliant technology reporter and writer and in fact, podcaster and broadcaster. [SPEAKER_02]: and she's just written a new book, basically looking at the contemporary human attempts to try and defeat the ravages of time and that mortality itself.

43:19 [SPEAKER_02]: And of course, you know, it's not just generally the people are doing this, but in fact, one particular community that you might be able to guess it's the 10 or just a Silicon Valley and so they'd [SPEAKER_02]: reconceived of the body as an engineering problem and cellular decay as an information theory problem and it kind of follows different tribes, different groups, you know, that are attempting to do this, you know, which involve grifters and strangely like kind of anti-science almost like anti-vaxxing groups and certainly people that are praying on other people's vulnerabilities, but then also, [SPEAKER_02]: individuals that are genuinely now beginning to demonstrate that they are slowing down the process of aging, according to a series of objectively measured biomarkers.

44:04 [SPEAKER_02]: There's one individual in the book that Alex thinks might actually have genuinely stopped aging. [SPEAKER_02]: Right. [SPEAKER_02]: I think for almost everyone, we think that death and aging is an inevitability and to resist that is a, is a heresy. [SPEAKER_02]: And to know that there is a group of people out there, you know, to transhumanists and the long termists who fundamentally reject that.

44:25 [SPEAKER_02]: that would see working on the problem of aging to be right up there with Mars colonization and the other kind of preoccupations of the valley. [SPEAKER_02]: I think it's, to me, completely fascinating. [SPEAKER_02]: I've never really seen like bio-science and bio-engineering to kind of go hand in hand with the PayPal Mafia and crypto, but they do and it was totally engrossing to me and Alex is a brilliant writer.

44:55 [SPEAKER_01]: You [SPEAKER_01]: Fantastic. [SPEAKER_01]: Now you mentioned Mars colonization and when you started talking about this first person I thought of was of course Elon Musk of course. [SPEAKER_01]: And it does feel like he would rather like to be immortal. [SPEAKER_02]: He is certainly mentioned in the book as is pure and a series of other Silicon Valley billionaires and a process called Plasma Thorecese which is basically pumping young blood into an older body.

45:21 [SPEAKER_02]: I mean if there's an image that I might leave people with [SPEAKER_02]: One of the lab experiments that really kick off is where they literally stitch an old mouse to a young mouse. [SPEAKER_02]: And in doing so, and this is a panier thing, like that you can do in biological experimentation, the blood systems fuse together.

45:45 [SPEAKER_02]: And as they fuse together, of course, you've got young blood kind of being pumped into the older mouse. [SPEAKER_02]: And you can see the generation of the organs begin to slow down as in the actual organs in the older mouse get younger. [SPEAKER_02]: And that's what really spurs plasma freezes for it.

46:03 [SPEAKER_02]: So there we go, two mice, sutures together to form one mouse. [SPEAKER_02]: Good evening everyone. [SPEAKER_01]: I said, okay, yeah, Carl, do people invite you to parties very often? [SPEAKER_02]: The influence of dropping off grand, I'm not going to like to you. [SPEAKER_02]: We're not like talk about the nice being suited together.

46:22 [SPEAKER_02]: The lecture London seems to want me to be there. [SPEAKER_01]: Well, that just about wraps up the show for this week. [SPEAKER_01]: Thank you so much, Carl, for joining us. [SPEAKER_01]: I'm sure lots of our listeners have loved to find out what you're up to, follow you online and all the rest of that.

46:36 [SPEAKER_01]: What's the best way for them to do it? [SPEAKER_02]: Hit the up on LinkedIn, everyone. [SPEAKER_02]: Yeah, yeah, and some of your message. [SPEAKER_02]: And if everyone wants to talk about eliminate pollution, they think it's happening, they've got an idea of how it might happen. [SPEAKER_02]: It's happened to them, they want to confront it.

46:47 [SPEAKER_02]: Let me know, because I want to really do something about that over the next year. [SPEAKER_01]: Fantastic, and I'm up on LinkedIn as well, Graham clearly, and you can follow smashing security on Reddit, Macedon, and Blue Sky as well. [SPEAKER_01]: Don't forget to ensure you never miss another episode follow smashing security in your favourite podcast apps such as Apple Podcasts, Spotify, and Pocketcasts.

47:05 [SPEAKER_01]: The episode showed no sponsorship info, guest lists, and the entire back catalogue of 457 or so episodes, check out smashingscurity.com. [SPEAKER_01]: Until next time, Cheerio, bye, bye, bye. [SPEAKER_01]: Bye, everyone. [SPEAKER_01]: Well, you've been listening to Smashing Security with me, Grand Clearly, thanks so much to our guest Carl Miller for joining us this week, and to this episode's Bonsers Action 1 Vanta and Meter.

47:43 [SPEAKER_01]: And of course, to the Chums who signed up for Smashing Security Plus over on Patreon, as members of Smashing Security Plus, they not only get episodes of the pod earlier, [SPEAKER_01]: than the great unwashed public, and they get ad-free episodes as well, but they also get the chance to be pulled out of the hat to be thanked here at the tail end of the show.

48:02 [SPEAKER_01]: So let's pick some of them out of that metaphorical hat right now to thank them. [SPEAKER_01]: Let's see here we've got Mark [SPEAKER_01]: rich, economical in both his syllables and probably spreadsheets. [SPEAKER_01]: Dimitri, John Morris, Urs, shall I always have problems with this one?

48:31 [SPEAKER_01]: Urs, Shone, Urs, Shone, Horses, Sori, Urs, Matt Cotton, who has a soft name, that hard encryption. [SPEAKER_01]: If you'd like to join Smashing Security Plus, just head over to [SPEAKER_01]: and you can become a member of our merry little band for as little as five dollars a month. [SPEAKER_01]: Of course not everyone can stretch that, that's absolutely fine, there's no pressure to become a patron, and equally there's no pressure to go and buy some t-shirts and mugs and other stuff over on the smashing security merch store.

49:07 [SPEAKER_01]: The truth is you can support the show in plenty of ways, don't cost a penny, you can like, you can subscribe, you can leave a five star review, but most importantly of all, go and tell your friends about the show. [SPEAKER_01]: Spread the word, go on why not, tell other people to go listen to smashing security it would warm the little cockles of my heart.

49:25 [SPEAKER_01]: Until next time, Cheerio, bye bye.