How not to steal $46 million from the US government

0:03 [SPEAKER_03]: I can't believe you've never heard of asterix. [SPEAKER_03]: I'm sorry, I was born way after you. [SPEAKER_03]: All right, all right. [SPEAKER_03]: Blimey. [SPEAKER_06]: Just kidding. [SPEAKER_00]: smashing security, episode 458, how not to steal 46 million dollars from the U.S. government, with grand, clueless and special guest Trisha Howard.

0:31 [SPEAKER_02]: Hello, hello and welcome to smash and security episode 458, my name's Grant Pluelly. [SPEAKER_04]: And I'm Trisha Howard. [SPEAKER_02]: Trisha welcome back to smash and security, lovely as always, to have you here, was being keeping you busy. [SPEAKER_04]: Well, I am currently at a company in stealth mode that will not be in stealth mode much longer.

0:48 [SPEAKER_04]: And so that's been kind of consuming most of my time. [SPEAKER_02]: Ah, getting ready for the big launch, eh? [SPEAKER_04]: Oh yeah, oh yeah. [SPEAKER_02]: That must be consuming hours and hours of your life every week. [SPEAKER_04]: It is. [SPEAKER_04]: It is. [SPEAKER_04]: I think it's important though to find time to have down time.

1:04 [SPEAKER_04]: And so when I do have, you know, minutes, so to speak of that, I have been enjoying very much playing GTA 5 with my partner starting from the beginning and going through the whole story. [SPEAKER_02]: Oh, grand theft all type by Rockstar Games. [SPEAKER_02]: Now I've never played it. [SPEAKER_02]: I'm not very good at these 3D games.

1:23 [SPEAKER_02]: I mean, I'm not very good at driving in real life. [SPEAKER_02]: And there's a fair amount of driving involved in that game. [SPEAKER_02]: But I have to say, they are extraordinarily immersive games, aren't they? [SPEAKER_04]: Oh my gosh. [SPEAKER_04]: Yes. [SPEAKER_04]: They're full-blown worlds.

1:36 [SPEAKER_04]: I mean, when they say open-world, they really mean it. [SPEAKER_04]: It feels like you're in L.A., when you're watching it, it's astounding. [SPEAKER_02]: No wonder they spend years making these games. [SPEAKER_04]: Oh yeah. [SPEAKER_02]: A game which is in a very similar vein. [SPEAKER_02]: From the same people, you can see that it's modeler on the same kind of principles I think is red-dead redemption, setting the wild west, which I thought was an extraordinary game.

1:58 [SPEAKER_04]: truly unbelievable. [SPEAKER_04]: I mean, from an actor's perspective, the production value, the acting value. [SPEAKER_04]: I mean, it is, it rivals Hollywood. [SPEAKER_04]: We have come a long way from Nintendo 64. [SPEAKER_04]: Let me just say that. [SPEAKER_02]: Yeah. [SPEAKER_02]: Hey, I used to play 3D Monster Maze on my ZX-81.

2:15 [SPEAKER_02]: So, I mean, we come even further than that. [SPEAKER_04]: Amazing. [SPEAKER_02]: Well, before we kick off, let's thank this week's wonderful sponsors, Mita Threat Locker and Vanta will be hearing more about them later on in the show. [SPEAKER_00]: this week on smashing security. [SPEAKER_02]: We won't be talking about how leak-based a cybercrime forum with over 100,000 members has been seized by law enforcement.

2:40 [SPEAKER_02]: You'll hear no discussion of how Ericsson is blaming a leak of more than 15,000 people's details. [SPEAKER_02]: On a service provider that was sweet-talked via the telephone. [SPEAKER_02]: and we won't even mention. [SPEAKER_02]: How hackers bypassed multi-factor authentication with a $120 fishing kit until multi-national law enforcement shut them down.

3:04 [SPEAKER_02]: So Trisha, what are you going to be talking about this week? [SPEAKER_04]: I'm going to be talking about when an attacker allegedly wink wink, stole $46 million from the government and then trolled the investigator on telegram. [SPEAKER_02]: And I'm going to be telling you how would he Woodpecker try to wipe out Wikipedia?

3:22 [SPEAKER_04]: Sorry, I'm giggling here. [SPEAKER_04]: What a mouthful. [SPEAKER_04]: What is the Woodpecker Wikipedia? [SPEAKER_02]: All this and much more coming up in this episode of Smashin Security. [SPEAKER_02]: Okay, well we've just got a bit of time now to talk about one of today's sponsors ThreatLocker.

3:42 [SPEAKER_02]: Now most cyber attacks don't start with sophisticated malware, they start with a misconfigured setting, a drifted policy or an exposed endpoint that nobody noticed. [SPEAKER_01]: And when you've got hundreds of endpoints keeping track of all that manually, basically impossible. [SPEAKER_02]: That's why Threat Locker built DAC Defence against configurations.

4:03 [SPEAKER_02]: It gives your real-time view of configuration weaknesses across your entire environment. [SPEAKER_01]: Every day DAC runs deep checks on every endpoint. [SPEAKER_01]: They scan operating system settings, application settings, and your Threat Locker policies like allow listing, ring-fensing, and more.

4:19 [SPEAKER_02]: And this is all on one dashboard, showing everything that's misconfigured, categorizes it with clear steps on how to fix it before attackers find the problems first. [SPEAKER_01]: You can even verify alignment with frameworks like CIS, NIST, HIPAA and ISO 27,000 of one. [SPEAKER_01]: So don't wait for a misconfiguration to become a breach, try D-A-C-3 for 30 days at ThreatLocker.com That's ThreatLocker.com and thanks for ThreatLocker for supporting the podcast.

4:53 [SPEAKER_02]: Look, we all love Wikipedia, don't we? [SPEAKER_02]: Wikipedia is amazing, where you go to settle arguments, to do your research at 11pm, you know, often I'll be thinking, oh, is Alan all the data is he still alive? [SPEAKER_02]: I'm not sure. [SPEAKER_02]: You know, in your go to Wikipedia to find out.

5:08 [SPEAKER_02]: Or if you're unsure how old somebody is, you'll go there instantly. [SPEAKER_02]: And, [SPEAKER_02]: It's also, let's be honest, a place where significant percentage of students have been plagiarised in their essays about, oh, I don't all grind to carry as the topics like the South Sea bubble for the past two decades, so it's an incredible resource.

5:26 [SPEAKER_02]: I kind of like Wikipedia. [SPEAKER_02]: I know we can't completely trust it, but I kind of like Wikipedia. [SPEAKER_04]: It's gotten so much better. [SPEAKER_04]: I remember back in college it was banned as a source because of that. [SPEAKER_04]: But it's come a long way. [SPEAKER_02]: Yeah, it's the world's largest in sakpida.

5:40 [SPEAKER_02]: It's maintained by an army of very passionate, fervent volunteers. [SPEAKER_02]: They happily spend hours arguing about the correct capitalization of a fictional spacecraft in some sci-fi TV series. [SPEAKER_02]: It is a genuine marvel of the internet age and something which we should be grateful for because it's not monetized, you don't get ads on it, it is purely supported by donations.

6:07 [SPEAKER_02]: So it was with some alarm that on the fifth of March this year. [SPEAKER_02]: Projects at Wikimedia, that's the foundation which [SPEAKER_02]: So pages were being vandalised and deleted. [SPEAKER_02]: And when they got messed around with, there'd be a final Russian edit summary. [SPEAKER_02]: So someone left a little bit of a summary as to why they said it occurred, well, here it is in Russian.

6:37 [SPEAKER_02]: It translated rather ominously to closing the project. [SPEAKER_02]: And at the same time, enormous, and I don't mean enormous. [SPEAKER_02]: I'm talking 5,000 pixels wide, which is probably wider than every other screen here. [SPEAKER_02]: 5,000 pixel wide images of woodpeckers were being embedded across random articles on Wikipedia.

7:03 [SPEAKER_03]: Oh, I shouldn't laugh, but I'll make a shit. [SPEAKER_02]: That noise you just made, that sounded a little bit like Woody Woodpecker. [SPEAKER_02]: Him and Scrappy do, just things which should have been strangled at birth in my opinion. [SPEAKER_02]: You know, you have good cartoon characters, like Danger Mouse and Bugs Bunny and Daffy Duck, and then you have the rubbish ones, like Woody Woodpecker and Mickey Mouse, and there goes the Disney sponsorship, you know, this folk horn leg horn, I like him, you know.

7:33 [SPEAKER_02]: Yeah, anyway. [SPEAKER_02]: So, you might be wondering, who managed to unleash a self-replicating JavaScript worm across the Wikipedia universe? [SPEAKER_02]: You might be wondering, was it a shadowy hacking gang? [SPEAKER_02]: Uh-uh. [SPEAKER_02]: Was it a rogue insider? [SPEAKER_02]: Was it a disgruntled editor with a grudge against Woody Woodpecker?

8:00 [SPEAKER_02]: But no, the person who triggered the worm outbreak was a Wikipedia security engineer. [SPEAKER_02]: Oh no, I'm afraid so. [SPEAKER_02]: And the reason it happened, it pains for me to say, was surprisingly straightforward. [SPEAKER_02]: So this engineer was apparently reviewing user written scripts on the platform.

8:21 [SPEAKER_02]: So if you are one of these administrators, one of these people who's really, really keen on Wikipedia, you can create yourself an account for, [SPEAKER_02]: Editing pages, and you can also, if you don't like the standard editor, which is built into Wikipedia, you can have a little user script to set it up exactly as you want it, right?

8:38 [SPEAKER_02]: Which makes sense. [SPEAKER_02]: So you can upload a script to it. [SPEAKER_02]: And what it seems happened is that [SPEAKER_02]: While this Wikimedia security engineer was reviewing some of the user written scripts on the platform, they accidentally executed a piece of dormant malicious code that had been sitting silently on a user's test page since 2024.

9:02 [SPEAKER_03]: Oh boy. [SPEAKER_02]: Yeah, not good at all. [SPEAKER_02]: It's the equivalent of, you come across a dusty box or something, which is labelled definitely not a snake in here, right? [SPEAKER_04]: Definitely not a woodpecker in here. [SPEAKER_02]: Definitely not a pecker pecking away, definitely not that.

9:20 [SPEAKER_02]: And when you open it up, surprise surprise, there it is. [SPEAKER_02]: And so this scripting question has been sitting there under the username, now I'm going to probably make a little mistake here. [SPEAKER_02]: Oh, no, Noshka, five, six, two was a user on Russian Wikipedia, so it was just sat there like a cold spring in a dusty old filing cabinet, no one had opened in years, they opened it up and it sprung out.

9:48 [SPEAKER_02]: And what made it much worse is that the account that it was executed under was a staff account, a highly privileged Wikimedia Foundation staff account, which had low-level editing access. [SPEAKER_02]: So, someone with permissions to edit the global Java script that runs across all Wikimedia projects on every page for every single user.

10:10 [SPEAKER_04]: You can't see my face right now, but my jar is on the floor. [SPEAKER_04]: Yikes! [SPEAKER_02]: Yikes, not good at all. [SPEAKER_02]: So we can need your own post-incident statement. [SPEAKER_02]: It was, I think the best you can say is diplomatically vague. [SPEAKER_02]: I mean, there's been a lot of diplomatic vagueness in the world in recent weeks, but this was also diplomatically vague about the exact sequence of events.

10:32 [SPEAKER_02]: So they said, staff had been [SPEAKER_02]: conducting a security review of user authored code and had inadvertently activated this dormant code. [SPEAKER_02]: And I think the inadvertently is doing a lot of the heavy lifting there. [SPEAKER_02]: We don't know how nicely what happened. [SPEAKER_02]: Whether it was a slip-up or a misclick, you know, it's like they thought they were clicking on one thing and they opened another.

10:58 [SPEAKER_02]: We don't know what it was, but the result was significant because the script woke up. [SPEAKER_02]: It was activated immediately got to work. [SPEAKER_02]: It injected itself into the common.js file on media wiki. [SPEAKER_02]: Every logged in user across the entire Wikimedia ecosystem, including Wikimedia Commons, including Wichnery, which is a dictionary for Wichner's, I believe, including Wikidata, all of them.

11:28 [SPEAKER_02]: In other words, this worm didn't just vandalize pages. [SPEAKER_02]: It managed to plant code in the one place that could potentially execute in every editor's browser across the platform. [SPEAKER_04]: no idea at all. [SPEAKER_04]: I mean, I guess if you're going to do it, do it big, right?

11:49 [SPEAKER_04]: You know, it's astounding too because this is an unfortunate reality that we deal with in security a lot is that so, so many things are actually just caused by accidents. [SPEAKER_04]: I guess. [SPEAKER_04]: We love to talk about, you know, the big scary stuff, and we should be, of course, their interesting stories of nothing else.

12:07 [SPEAKER_04]: But the truth of the matter is, this is the reality of security people every day. [SPEAKER_04]: They're dealing with somebody who accidentally clicks on something and sends Woody the Woodpecker across the Wicked Life. [SPEAKER_02]: And just to be thorough, it also embedded a copy of itself into the individual script files of about 85 other users.

12:26 [SPEAKER_02]: So it's a backup. [SPEAKER_02]: If you like, in case someone found and cleaned up the global file, it's real built some braces kind of approach. [SPEAKER_04]: a little overachiever. [SPEAKER_02]: But I'll infect these other people because maybe one day someone else will blunder into those and activate the code there and off we go again.

12:45 [SPEAKER_02]: So thousands of pages were vandalised, they were plastered with that 5,000 pixel wide woodpecker image and hidden script tags spread in itself to other users. [SPEAKER_02]: He also tried to phone home to remote Russian web server, [SPEAKER_02]: Um, presumably to try and fetch further instructions.

13:09 [SPEAKER_02]: Now, I don't know if that domain was live or defunct or simply abandoned by whoever created it. [SPEAKER_02]: Thankfully, it looks like the callback didn't appear to cause an additional hammer in theory. [SPEAKER_02]: That could have grabbed more malicious code or instructions which could have caused an even bigger problem.

13:26 [SPEAKER_02]: You can imagine how something like this could have become a much, much bigger threat, maybe stealing data from users as well, or maybe trying to run something else malicious on their actual computers. [SPEAKER_04]: Well, and honestly, the fact that it was the woodpecker that they chose is also kind of a nice thing, because it could have been much worse than that, too.

13:48 [SPEAKER_02]: Paul Kipig, you think it? [SPEAKER_04]: Yeah, correct. [SPEAKER_04]: Yeah. [SPEAKER_04]: Got it. [SPEAKER_02]: So we can be grateful for that. [SPEAKER_02]: Now, this whole rampage lasted just 23 minutes. [SPEAKER_02]: So, again, some credit there to the guys that we can media. [SPEAKER_02]: Oh, that's cool.

14:01 [SPEAKER_02]: Yeah, their engineers realized what was happening. [SPEAKER_02]: They'd locked down everything into read-only mode. [SPEAKER_02]: They'd realized, whoa, whoa, whoa, something bad happening. [SPEAKER_02]: Paul'd a big red lever, suddenly everything is locked down. [SPEAKER_02]: It then took a couple of hours to investigate and contain the infection.

14:15 [SPEAKER_02]: They began scrubbing the code from thousands of files. [SPEAKER_02]: By the end of the day, all the affected pages have been restored, and no personal data as far as we know has been breached in any way. [SPEAKER_02]: So that's good. [SPEAKER_02]: So most of the visible vandalism, by the way, that landed on Meta Wiki, which isn't the encyclopedia that you use every day online, but it's rather like the back office of Wikimedia, where the volunteer community hangs out and debates policy and gets very [SPEAKER_02]: Um, probably highly political, I expect.

14:48 [SPEAKER_02]: Most members of the public have never heard of it, but potentially, you know, that injected job script ran across the entire ecosystem, including Wikipedia itself. [SPEAKER_02]: So while your average reader looking up the history of the Roman Empire, probably noticed nothing, any logged in editor active during those 23 minutes was potentially exposed.

15:10 [SPEAKER_02]: I'm trying to remember in the Terminator movies, don't they plug in the chip or give it autonomy in it and it takes about 23 minutes or something to become self-aware and decide we don't need the humans and I can't remember what the actual figure is, but you know, 23 minutes can sometimes in this day and age be long enough to cause an awful lot of damage.

15:29 [SPEAKER_04]: Oh, yeah. [SPEAKER_04]: I mean, 23 minutes in the tech world is is an eternity, but 23 minutes in the world of AI is effectively an heon. [SPEAKER_04]: Go to them for finding it that quick and being able to contain it in the way that they did. [SPEAKER_04]: That's a really good point when we're dealing with something like that.

15:46 [SPEAKER_04]: It's not just the initial infection that you have to deal with. [SPEAKER_04]: It's the repercussions that come after it and the collateral damage, frankly, like these additional editors. [SPEAKER_02]: Yeah. [SPEAKER_02]: It's a big problem now. [SPEAKER_02]: I was wondering what the lessons that we can learn from this.

15:59 [SPEAKER_02]: An obvious one is the principle of least privilege, right? [SPEAKER_02]: That exists for a reason. [SPEAKER_02]: Right. [SPEAKER_02]: So even well-intentioned security teams can take actions on an over-privileged account that can have serious consequences. [SPEAKER_02]: So all of us need to be careful about how we are actually logged in.

16:18 [SPEAKER_02]: What rights we have? [SPEAKER_02]: If we don't need them for a particular thing that we are doing, then maybe you shouldn't be logged into them in certainly. [SPEAKER_02]: You probably shouldn't be clicking on other people's scripts. [SPEAKER_02]: If you're inside something which had that much power, also if you're on a platform which has scripts or has user generated content, maybe you need to audit it from time to time for dormant malicious scripts because it turns out something can sit undetected for the better part of a couple of years [SPEAKER_02]: and maybe just use a test environment as well as the damage can be limited as to what you can do.

16:56 [SPEAKER_02]: So there's good news, everything's now being cleaned up, it seems. [SPEAKER_02]: Nothing was permanently lost. [SPEAKER_02]: That's great. [SPEAKER_02]: We can media says it is working on further security mitigations as well. [SPEAKER_02]: So hopefully there'll be better protect against this kind of problem in the future.

17:15 [SPEAKER_02]: Right, before we crack on any further, Joe and I want to take a moment to tell you about one of today's sponsors, Vaneter. [SPEAKER_01]: We've got a question for you. [SPEAKER_01]: What's the thing that keeps you staring at the ceiling at two AM when it comes to your company's security?

17:28 [SPEAKER_01]: Is it wondering whether you've actually got the right controls in place? [SPEAKER_02]: Whether one of your suppliers has been quietly compromised or is it the truly sole destroying one? [SPEAKER_02]: One earth, are we still running our entire security program out of a spreadsheet? [SPEAKER_01]: If any of that hit a little too close to home, that's where Vanter comes in.

17:47 [SPEAKER_01]: Vanter takes all that tedious manual security grind, chasing down evidence, wrestling with questionnaires updating the same sales for a thousandth time and automates the whole thing. [SPEAKER_02]: Their trust management platform keeps a continuous eye on your systems, it pulls everything into one central place and keeps your security program all day ready around the clock.

18:06 [SPEAKER_02]: Yes, it uses AI, but the genuinely useful kind, flag in risks, streamline in evidence collection and slot in into the tools your team already relies on. [SPEAKER_02]: The upshot of this is, you move faster, scale without the usual headaches, and maybe just just baby, actually get a decent night's sleep.

18:25 [SPEAKER_01]: That's V-A-N-T-A dot com slash smashing and a big thank you to Venta for supporting the show. [SPEAKER_04]: All right. [SPEAKER_04]: Well, I mean, it isn't a similar vein of a tack path, I guess. [SPEAKER_04]: So I'm going to start my story with a little bit of backstory if for literally no other reason than to show off what I learned.

18:55 [SPEAKER_04]: Okay. [SPEAKER_04]: Because I apparently have no idea what the US marshals do or who they are. [SPEAKER_06]: Okay. [SPEAKER_04]: So when a crime gets busted, right, like something bad happens, they come in, they find all of the seized assets that were obtained through some type of legal means.

19:13 [SPEAKER_04]: This could be money, houses, cars, anything in GTA, actually, what a nice little crowback that is. [SPEAKER_02]: Okay, so the U.S. marshals, they go in and they gather up the cash and the assets and not yet. [SPEAKER_02]: Okay, right. [SPEAKER_04]: So the law enforcement people who bust it, they do the raid, they find all this dust.

19:32 [SPEAKER_04]: Then the marshals are responsible for managing that stuff. [SPEAKER_04]: So they are like the go between the initial, we caught you to, all right, we're gonna put you in prison now and here's why. [SPEAKER_04]: Right. [SPEAKER_04]: So, shocker, a big portion of these assets that they obtain are crypto.

19:54 [SPEAKER_04]: I mean, who knew that crypto was used for sketchy stuff? [SPEAKER_02]: What a surprise. [SPEAKER_04]: I know. [SPEAKER_04]: And when I say a lot, I mean a lot, like $3.4 billion lot. [SPEAKER_04]: That was the last like hard number that I saw it's probably different now, but that came directly from them that at one point they were managing $3.4 billion just in crypto assets that were obtained.

20:16 [SPEAKER_04]: with crypto now I'm not part of the crypto scene so this may be old news to everybody was news to me. [SPEAKER_04]: There's a lot of technical stuff in the back end that has to happen to make sure that these transitions between the illegal means to legal means happen above board. [SPEAKER_04]: Right.

20:32 [SPEAKER_04]: So the US Marshall service is shockingly not a crypto expert first and foremost. [SPEAKER_04]: So when they bust these things and get these assets, they will bring in third party contractors who are experts in crypto. [SPEAKER_04]: Sure. [SPEAKER_04]: You can see where this has gone. [SPEAKER_02]: Oh, sensory Simone.

20:50 [SPEAKER_04]: Um, no, that's fine. [SPEAKER_04]: I mean, third parties are often your partners, but they can also be another example of inciders, right? [SPEAKER_04]: It's an extended insider risk. [SPEAKER_04]: And that's all well and good until it gets stolen. [SPEAKER_06]: Oh. [SPEAKER_04]: Now, I'm going to say this, Graham.

21:08 [SPEAKER_04]: If law-norder SVU is to be used as a trusted source of how law enforcement works, and I'm very willing to believe that that's true. [SPEAKER_04]: When they don't have a named perpetrator, they call them John or Jane Doe, so I literally laughed. [SPEAKER_04]: almost out of my chair because the alleged perpetrator is literally named John D. So it was a John Digita, I'm not sure if I'm pronouncing that correctly, he allegedly has stolen $46 million worth of crypto directly from wallets managed by the U.S. Marshalls.

21:44 [SPEAKER_02]: And he's a guy who was brought in by the U.S. Marshalls to help them with the handling of this. [SPEAKER_04]: Yeah. [SPEAKER_04]: So his dad owns one of the firms that have an active contract with the U.S. Marshalls. [SPEAKER_04]: And that is theoretically how he got in. [SPEAKER_04]: Now there were some mixed reporting on this that John himself had an active contract.

22:08 [SPEAKER_04]: I know that I saw actually implicated the father in this in any other way other [SPEAKER_02]: Oh, that's his, like, online handle, you mean, yeah? [SPEAKER_04]: Yeah, um, Nick. [SPEAKER_04]: John, Nick. [SPEAKER_04]: Uh-huh. [SPEAKER_04]: So he, uh, was recently arrested actually this past week.

22:30 [SPEAKER_04]: As part of a dual operation between the FBI and France's version of the FBI, which I will not insult the French language at trying to pronounce. [SPEAKER_02]: So, Nick is now in the Nick. [SPEAKER_04]: Oh, boy. [SPEAKER_04]: Yes, correct. [SPEAKER_02]: Right. [SPEAKER_04]: While he was recently arrested, this actually all started back in January when a blockchain investigator who apparently got wrecked before and then decided to become an investigator as a result of that, which is pretty cool.

22:58 [SPEAKER_04]: His Twitter handle is Zach XBT. [SPEAKER_02]: Ah, yes, we've spoken about him before. [SPEAKER_02]: Yes. [SPEAKER_02]: He's extraordinary. [SPEAKER_02]: He has uncovered so much shadiness going on on the blockchain. [SPEAKER_02]: Yeah. [SPEAKER_04]: He's very good. [SPEAKER_04]: Yes. [SPEAKER_04]: So back in January of this year, he noticed about $23 million dollars in shady transactions that were directly tied to these wallets that were known to be associated with the U.S. Marshall Service.

23:26 [SPEAKER_04]: And some of the funds in these wallets, by the way, were connected to the infamous bitfinex attack in 2016. [SPEAKER_04]: The largest crypto scandal. [SPEAKER_04]: Yeah, so naturally, when things like this happen, you have to ask like how, how did not only the initial thing occur, but how did they get caught?

23:45 [SPEAKER_04]: Yes. [SPEAKER_04]: And this is where I, I'm not going to lie, Graham. [SPEAKER_04]: I giggled really, really hard at the shot in Florida of all of this. [SPEAKER_04]: Okay. [SPEAKER_04]: happiness at the misfortune of others, which I usually try not to do, but whenever they're less than savory individuals, which if the transcripts of this person is to be believed, I would argue he's very less than savory.

24:07 [SPEAKER_04]: It's just kind of funny, especially when they do it to themselves. [SPEAKER_04]: All right. [SPEAKER_04]: So there was the initial thing that Zach found. [SPEAKER_04]: And then, Zack started reporting on it like he does, and John started trolling him by sending little what I now know is a term called dust transactions.

24:28 [SPEAKER_02]: What's a dust transaction? [SPEAKER_04]: So dusting or a dust transaction is something known in the crypto community as kind of like a virtual hand wave to say, yep, this is me because it's, you know, anonymized and all that stuff. [SPEAKER_04]: So John started sending them two zax wallets and what is problematic about that is [SPEAKER_04]: because this was associated with illegal activity.

24:54 [SPEAKER_04]: Theoretically, Zack's wallets could be affected negatively. [SPEAKER_04]: She could be banned from exchange platforms. [SPEAKER_04]: Like, it could be actually quite bad. [SPEAKER_04]: Also, having the association with the illegal stuff is usually not people's thing that they want to do.

25:10 [SPEAKER_04]: It's not really good op-sec to start trolling the person who's investigating you. [SPEAKER_04]: I don't know. [SPEAKER_04]: Maybe not the strongest one. [SPEAKER_04]: But a worse op-sec strategy than that is getting on a recorded call and telling on yourself. [SPEAKER_02]: He did what? [SPEAKER_04]: So, you know, thread actors turns out not the most savory individuals, as we recently discovered, they also like to brag a lot.

25:37 [SPEAKER_04]: So not only was he a thief, he was a braggard and got on a telegram call with another known thread actor who was calling John out and saying that John didn't actually have access that his claims were false. [SPEAKER_04]: And so, he proved that he had access to these wallets, and that was recorded.

25:55 [SPEAKER_04]: You can actually watch the recordings on Zack's Twitter thread where he talks about this, a language warning, by the way, if you've watched them. [SPEAKER_05]: Holy f**k, you just opened up a second hardware wallet. [SPEAKER_05]: Hi, baby, man. [SPEAKER_05]: Now, Loki, this is actually going to be funny as hell for all of us.

26:14 [SPEAKER_05]: Like, after I climb this f**k, he shows all his money. [SPEAKER_05]: I just served like two times more. [SPEAKER_05]: I love that, I love that, I love that, all into. [SPEAKER_05]: All of them aren't there. [SPEAKER_05]: That's really embarrassing. [SPEAKER_05]: So all of them aren't there.

26:33 [SPEAKER_05]: You might actually be a f**k it. [SPEAKER_05]: So let's see, if I just threw it in line for a line, keep saving them bro. [SPEAKER_05]: I know you got them f**k it. [SPEAKER_05]: F**k that ass fingers. [SPEAKER_04]: She literally just told on himself on screen record. [SPEAKER_04]: I'm sorry, it's just so funny to me, Graham.

26:50 [SPEAKER_04]: Literally told on yourself. [SPEAKER_04]: So let's just recap here, right? [SPEAKER_04]: You have tens of millions of dollars in seized crypto assets, sitting in a government managed wallet. [SPEAKER_04]: Those wallets are handled by outside contractors. [SPEAKER_04]: This guy's dad is one of those contractors, and he, himself, may have had direct access.

27:11 [SPEAKER_04]: He steals those funds, then trolls the investigator who calls him out for it, and then brags about it online, proving that he did all of this. [SPEAKER_04]: How 2026 is that? [SPEAKER_02]: The education system has got a lot to answer for, isn't it? [SPEAKER_02]: I mean, in some ways, we're grateful because it makes it easier to catch, I mean, this guy, you know, these are allegations at this point.

27:36 [SPEAKER_02]: Of course. [SPEAKER_02]: He'll have his day in court, but frankly, we have to be grateful that sometimes the cyber criminals are caught out by their own dumb behavior, but it also leaves you with your head in your hands thinking, oh, for goodness sake, couldn't you have done a bit better than that?

27:51 [SPEAKER_04]: Yeah, you know, it's astounding actually when when I worked at Akami in the research organization we actually saw this a fair amount where the thread actors would be proud of what they were doing not unlike we are proud of things that we do at work and they would get called out and said no you don't actually have this and they would prove it themselves.

28:10 [SPEAKER_04]: It's an interesting tactic. [SPEAKER_04]: I guess make them tell on themselves by playing to their ego. [SPEAKER_04]: Huh, who knew that would work? [SPEAKER_02]: Right, let's take a moment to talk about one of today's sponsors, META. [SPEAKER_02]: So, picture this. [SPEAKER_02]: You need to set up a network for a new office.

28:31 [SPEAKER_02]: Suddenly, you're juggling ISPs, floor plans, hardware, configuration. [SPEAKER_02]: Oh, what a headache. [SPEAKER_02]: It's basically a second job. [SPEAKER_01]: Oh, yes, the classic experience of paying a contractor to arrive on the wrong day at the wrong address to install the wrong thing.

28:45 [SPEAKER_02]: Right. [SPEAKER_02]: Well, meet as entire pitch is this, what if that just wasn't your problem? [SPEAKER_02]: Huh. [SPEAKER_02]: Tell me more. [SPEAKER_02]: They are a network as a service company. [SPEAKER_02]: They are genuinely end to end. [SPEAKER_02]: You hand them a physical address.

28:59 [SPEAKER_02]: and a floor plan, and they had to live or think they sought out the ISP, they designed the network, they shop on site, they rack their own hardware, not reselling someone else's kit, and they get the whole thing running. [SPEAKER_01]: So I don't have to spend 45 or minutes on hold with a company who's holding music as a 15 second loop of pan-loop that I've committed to harm.

29:18 [SPEAKER_02]: No, you don't, and once you're up and running, you get a single dashboard, covering monitoring, management, security, v-lands, farble, DNS security, SD-WAN, all of it, full visibility and control, none of the tedious legwork. [SPEAKER_02]: Oh, it sounds actually useful. [SPEAKER_02]: But what's the catch?

29:39 [SPEAKER_02]: No catch, Joe, just a subscription model with no nasty surprises. [SPEAKER_02]: They've even got a hardware buy-back program if you've already invested in kit from another vendor. [SPEAKER_02]: Very sensible. [SPEAKER_02]: Where do we send people? [SPEAKER_02]: Go to meter.com slash smashing.

29:55 [SPEAKER_01]: God, do it right now. [SPEAKER_01]: Take a look. [SPEAKER_01]: That's m-e-t-e-r.com slash smashing. [SPEAKER_01]: Thanks to meter for supporting the show. [SPEAKER_02]: and welcome back to join us at our favourite part of the show, the part of the show that we like to call because of the week.

30:15 [SPEAKER_02]: Big of the week is the part of the show everyone chooses something that could be a funny story a book that they've read a TV show of movie or record a podcast or website or an app. [SPEAKER_02]: Whatever they wish it doesn't have to be security related necessarily. [SPEAKER_02]: Well, my pick of the week this week is not security related.

30:28 [SPEAKER_02]: My pick of the week this week is a blast back to my childhood. [SPEAKER_02]: Yes, I remember the 1870s when all we had to enjoy. [SPEAKER_02]: was a hoop and a stick. [SPEAKER_02]: We had fun in those days. [SPEAKER_02]: That's all we needed a case need. [SPEAKER_02]: We know we'd go out into the garden.

30:44 [SPEAKER_02]: We might find a pebble under rock to bash together as well and try and make some sparks. [SPEAKER_02]: Not quite that old for goodness sake. [SPEAKER_02]: No more reason than that. [SPEAKER_02]: Astrix, Astrix the goal. [SPEAKER_02]: Are you familiar with Astrix the goal? [SPEAKER_02]: Trisha.

30:57 [SPEAKER_04]: I am not. [SPEAKER_02]: Oh, for goodness sake. [SPEAKER_02]: I know. [SPEAKER_02]: Are you familiar with Tintin? [SPEAKER_02]: Her Jay's adventure. [SPEAKER_02]: Oh, no. [SPEAKER_02]: Good. [SPEAKER_02]: Because Tintin's rubbish compared to Astrix, I was going to say Astrix is a much, much better version.

31:10 [SPEAKER_02]: So Astrix is a plucky little goal in the, I think it's like 50 AD is when he's living and always at 50 BC doesn't matter. [SPEAKER_02]: It's like 2,000 years ago. [SPEAKER_02]: He lives in a village, which is holding out against the Roman Empire, it's the final bit of what would later become France, everywhere else has been conquered.

31:33 [SPEAKER_02]: And he's living in this little village, and it's a small stubborn place, they're holding out against the Roman Empire, they are armed with nothing more than their wits and magic potion which gives them super strength. [SPEAKER_02]: And this is a cartoon strip book. [SPEAKER_02]: I guess you would call it a graphic novel these days.

31:52 [SPEAKER_02]: I think it's called a graphic album is what the French used to call it. [SPEAKER_02]: These were originally in French. [SPEAKER_02]: They've been translated around the world. [SPEAKER_02]: They are very, very funny. [SPEAKER_02]: Okay, well they've got great characters. [SPEAKER_02]: They made movies of them.

32:05 [SPEAKER_02]: I've never seen the movies. [SPEAKER_02]: I mean, that just seems wrong to me. [SPEAKER_02]: I think they're Gerard Dipper derr as obliques. [SPEAKER_02]: So when it carries the meners everywhere, there's even a theme park I think in France as well. [SPEAKER_02]: But forget all of those.

32:17 [SPEAKER_02]: I'm talking about the classic Astrix books. [SPEAKER_02]: made from about 1960 until about 1977 by Gossini and Udazo. [SPEAKER_02]: They're still making the book said we're not those two because they're dead, but the books are still being cranked out. [SPEAKER_02]: And here's some of the reasons I can't believe you've never heard of Astrix.

32:37 [SPEAKER_03]: I'm sorry, I'm sorry, I was born way after you. [SPEAKER_02]: Okay, all right, all right. [SPEAKER_02]: I mean... [SPEAKER_02]: But just kidding, but Astrix is an absolute institution, so these are very funny books first of all, so they're a lot of puns and the puns survive being translated, so the translators who have translated Astrix from the original French and other languages, they are absolutely unsung heroes.

33:00 [SPEAKER_02]: Yeah, so you get characters like there's a druid called get-a-fix, there's the chief of the village called vital statistics, there's a barred called cacophonics, there's even a village postman called postal districts, there's slapstick, there's also political satire in there, adults will get a lot out of it, there are districts books which are probably thinly veiled discussions as to whether Britain should become members of the European Union, look what happened [SPEAKER_02]: see how old some of these books are.

33:30 [SPEAKER_02]: They are genuinely a joy, however old you are. [SPEAKER_02]: There's some gentle mocking of national stereotypes, so when Astrix goes to Britain, for instance, to meet a tribe over there, there's warm British bear and there's boiled food, there's Roman bureaucracy, when he goes to Switzerland, there's lots of thundoo things like this.

33:50 [SPEAKER_02]: But there's real affection, it's never cruel, apart from, of course, to the Roman legionaires who keep them getting bashed up by these plucky little villagers on their magic potion. [SPEAKER_02]: The artwork is fantastic. [SPEAKER_02]: You've got a Google image, Asterix, the goal right now to see some of this magnificent battle scenes dozens of Romans flying through the air.

34:10 [SPEAKER_02]: If you need an excuse, buy the Asterix books for your kids, but I'm sure you will love them too. [SPEAKER_02]: You can use the kids as an excuse, but they're really, really great. [SPEAKER_02]: And as I said, it's much better than tinting. [SPEAKER_02]: So Asterix is my pick of the week.

34:26 [SPEAKER_04]: Amazing. [SPEAKER_04]: I cannot wait to go through this. [SPEAKER_04]: If for no other reason, then the ability to maintain the puns. [SPEAKER_04]: That is honestly, wow. [SPEAKER_04]: Unsung heroes is certainly the correct term for that. [SPEAKER_02]: It's it's lovely, lovely fun stuff.

34:40 [SPEAKER_02]: Trisha, what's your pick of the week? [SPEAKER_04]: Okay. [SPEAKER_04]: My pick of the week is the author, Robin Hobb. [SPEAKER_04]: Are you familiar with Robin Hobb? [SPEAKER_02]: No, no, I'm not. [SPEAKER_02]: Trisha, because I've spent my time. [SPEAKER_02]: learning about all the things which are important.

34:55 [SPEAKER_02]: Like, that's great. [SPEAKER_02]: Princess is not heard of Robin Hobb. [SPEAKER_04]: Well, she is a British writer who is- I'm so sorry for not knowing. [SPEAKER_02]: No, that's okay. [SPEAKER_02]: That's um, she- I'm so sorry for not knowing. [SPEAKER_04]: She is unbelievable, she is an incredible fantasy writer, and I was going to choose a specific trilogy of hers to be my pick of the week, but I could not decide between them because they are also good.

35:21 [SPEAKER_04]: So for reference on how amazing Robin Hobb is, she has been publicly appraised by none other than the god of fantasy himself, George R. R. Martin, don't know if you can. [SPEAKER_04]: Oh, yes, Game of Thrones, yes. [SPEAKER_04]: Robin Hobb writes fantasy the way fantasy should be written astounding.

35:43 [SPEAKER_04]: The two that I'm in the middle of right now are the live-ship traders and the far-seeer trilogy, far-seeer, came first, and then the live-ship traders came afterward. [SPEAKER_04]: They are thick books. [SPEAKER_04]: It's certainly a commitment, but oh my goodness. [SPEAKER_04]: I am somebody who loves to get swept away in the story.

36:02 [SPEAKER_04]: And she has an unbelievable way of not only telling these stories, I mean, she's got incredible mind, but the way that she paints pictures, I mean, you can tell she's lived, all right? [SPEAKER_04]: She's been through some stuff, and it comes through very, very clearly. [SPEAKER_02]: What's the sort of background to the story?

36:20 [SPEAKER_02]: When you say fantasy, obviously, my mind didn't instantly turn to like 50 shades of what it or something. [SPEAKER_02]: We're not talking that kind of fantasy. [SPEAKER_04]: precisely. [SPEAKER_04]: So the first year trilogy I believe was actually her first trilogy and it follows a rogue assassin from childhood and he's like the bastard child of the prince who's going to become the king and the kid gets dumped at the palace and he becomes an assassin or what is known as a king's man and it is my goodness grandma it's it's really astounding I will say though [SPEAKER_04]: you need to dedicate time to read them because you cannot put it down after a certain amount of time, the pages fly through really, really, really lovely.

37:07 [SPEAKER_02]: So if people are intrigued about this, what book do you recommend that they start with? [SPEAKER_04]: Oh, see, this is why I didn't know which one to pick. [SPEAKER_04]: I would, I started with the live-ship traders and I think that's a strong one to start with because it introduces her world because both of them take place in the same world just [SPEAKER_04]: So start with that, because it's a stand alone.

37:29 [SPEAKER_04]: The far-sear trilogy has a couple of other offshoots of it. [SPEAKER_04]: So if you're just looking for a quick quote unquote trilogy to get introduced to her and her style, I would say the live-ship traders is the one to go with. [SPEAKER_04]: It follows a family of sailors that have been traders for many, many years.

37:51 [SPEAKER_04]: And that stuff happens to them. [SPEAKER_02]: Okay, well, I feel like we've both had rather cultural picks of the week. [SPEAKER_04]: I agree. [SPEAKER_04]: I agree. [SPEAKER_02]: I feel like we've both introduced each other to something which we weren't previously familiar with. [SPEAKER_02]: And I feel, are you having a drink?

38:10 [SPEAKER_04]: I was, yeah. [SPEAKER_04]: Yep. [SPEAKER_04]: It's the American Way, man. [SPEAKER_02]: Right. [SPEAKER_02]: Well, that just about wraps up the show for this week. [SPEAKER_02]: Thank you so much, Trisha for joining us. [SPEAKER_02]: I'm sure a lot of our listeners would love to find out what you're up to and follow you online.

38:26 [SPEAKER_02]: We'll see the best way to do that. [SPEAKER_04]: The way to find me is on LinkedIn. [SPEAKER_04]: So, LinkedIn.com slash in slash Trisha kicks south. [SPEAKER_04]: That's S-A-A-S is easiest way to find me. [SPEAKER_02]: And you can find me, Grand Cloly on LinkedIn as well, or follow Smash and Security on Blue Sky, or Master Dawn on places like that.

38:42 [SPEAKER_02]: And don't get too insured. [SPEAKER_02]: The Unever miss an Ever episode, follow Smash and Security in your favorite podcast apps, such as Apple Podcasts, Pocketcasts, and Spotify. [SPEAKER_02]: For episode show notes, sponsorship info, guest lists and the entire back catalogue of 458 odd episodes with the emphasis on odd.

38:58 [SPEAKER_02]: Check out Smash and Security.com Until next time. [SPEAKER_02]: Cheerio, bye, bye, bye. [SPEAKER_04]: Sabranara! [SPEAKER_02]: You've been listened to Smashing Security with me, Graham Kluley, and thanks so much to Trisha for joining us this week, and to this episode's sponsors Threat Locker Vanta and Meeta, and of course to the following chums, who support Smashing Security Varp Hatri on.

39:31 [SPEAKER_02]: We're going to grab a few names out of the hat, to give it up for JBSK, who we can only assume is too cool to have a full name, Bashora. [SPEAKER_02]: the nerd who named themselves after a shell terminal, William Reddig, the very soft and breathable Matt Cotton, the positively electric Bobby Hendrix, Matt H, presumably because the username Matt was already taken perhaps by Matt Cotton, Frankie Guzzy Kowski, Mansway Dijon, Alexander Huiguis, [SPEAKER_02]: It sounds less like a person and more like a very grand Dutch country estate, and finally they're meat-tree.

40:08 [SPEAKER_02]: Just Demy3 no last name, very mysterious, we respect you Demy3, and all the rest of you as well. [SPEAKER_02]: If you fancy having your name read out at the end of the show, [SPEAKER_02]: And you fancy having add free episodes of smashing security we have to do supporters at smashingsecurity.com slash plus that will take you to the page where you can sign up and maybe you'll get thanked in a future episode as well.

40:36 [SPEAKER_02]: Of course not everyone can stretch to, supporting the show financially, that's absolutely fine. [SPEAKER_02]: I get it. [SPEAKER_02]: There's absolutely no pressure to do that instead what you can do. [SPEAKER_02]: You can go and tell your friends, there's lots of pressure on you to do that.

40:49 [SPEAKER_02]: Go and tell your friends about smashing security and encourage them to tune in to some of our past episodes as well as the future ones too. [SPEAKER_02]: Thank you everybody who supports the show leaves five star reviews like subscribers and spreads a word It really do appreciate it and until our next episode I will now sign off.

41:09 [SPEAKER_02]: So to loot from me. [SPEAKER_02]: Bye bye