I hacked the government, and your headphones are next

0:03 [SPEAKER_04]: that was always the criticism. [SPEAKER_04]: If you walk around downtown London or downtown New York City, you will see people with wireless headphones almost everywhere. [SPEAKER_04]: That's basically the standard. [SPEAKER_04]: But the number one criticism has always been that you could lose one.

0:16 [SPEAKER_06]: Yes. [SPEAKER_06]: So I can always find them because all I have to do is pull the buyer and they will come back to me. [SPEAKER_01]: smashing security, episode 451. [SPEAKER_01]: I hacked the government, and your headphones on next. [SPEAKER_01]: With Graham, clueless and special guest Ray Redacted.

0:41 [SPEAKER_06]: Hello, hello and welcome to smash and security episode 451. [SPEAKER_06]: My name's Graham clearly. [SPEAKER_06]: Then I'm Ray Redacted. [SPEAKER_06]: Hi Ray, thank you for coming back on the show. [SPEAKER_06]: It's been a few years. [SPEAKER_06]: I think it's been like four or maybe five years.

0:52 [SPEAKER_06]: Now it's actually even a couple. [SPEAKER_06]: How's it? [SPEAKER_06]: I think this is the third or fourth time. [SPEAKER_06]: Well, it's great to have you back on the show again. [SPEAKER_06]: For those people who don't remember [SPEAKER_06]: What do you do, how are you involved in this crazy world of cyber security?

1:07 [SPEAKER_04]: Well, it's interesting, Graham, because I had two personas, I had my corporate daytime job at a corporation, it's a Fortune 500 company, and then at night or in the weekends or whatever, I was just very redacted persona that's on Twitter, that does the blog post, and you know, it's been quoted around cyber security circles for many, many years.

1:23 [SPEAKER_04]: So it's like Batman, there's Bruce Wayne in this Batman, and there's... [SPEAKER_04]: I've been told very recently, it was that way though. [SPEAKER_04]: The two personas kind of stayed completely apart, right? [SPEAKER_04]: But I wasn't born, but it's a name very redacted, and this one wasn't my first name.

1:37 [SPEAKER_06]: Right. [SPEAKER_06]: One of the reason why people may hear you about you is because your son had a tremendous performance, didn't he? [SPEAKER_06]: At the Olympics, and I think he even got a world record. [SPEAKER_06]: Yes, that's correct. [SPEAKER_04]: So the very redacted anonymity kind of went out the window once, you know, billion people saw my son competing at the Olympics and everyone knew that it was very rejected son.

1:58 [SPEAKER_04]: He does not climb under the name Sam redacted. [SPEAKER_04]: So most people could put two and two and two and two and two and so there's really not much of a point to being redacted when it's absolutely known and was kind of plastered all over the world. [SPEAKER_04]: What's an incredible achievement?

2:09 [SPEAKER_04]: You must be very proud. [SPEAKER_06]: Oh, I am definitely proud father. [SPEAKER_06]: There's no question about that. [SPEAKER_06]: Well, before we kick off, let's thank this week's wonderful sponsors, ThreatLocker, Adaptive Security and Vanta. [SPEAKER_06]: We'll be hearing more about them later on in the podcast.

2:26 [SPEAKER_01]: This week on smashing security. [SPEAKER_06]: We're not going to be talking about how hundreds of gigabytes of data. [SPEAKER_06]: I've been stolen by hackers from the European Space Agency. [SPEAKER_06]: You'll hear no discussion of how food delivery firm [SPEAKER_06]: and we won't even mention how researchers have warned of serious security flaws in quantum computers.

2:53 [SPEAKER_06]: So Ray, what are you going to be talking about this week? [SPEAKER_06]: I'm in returling about whisper pair, which affects many many Bluetooth headphones. [SPEAKER_06]: And I'm going to be talking about how even hackers are looking for more Instagram followers. [SPEAKER_06]: All this and much more in this episode of Smashin Security.

3:16 [SPEAKER_06]: This episode of Smash and Security is supported by Adaptive Security. [SPEAKER_06]: OK, Jums, hands up if you've ever clicked a dodgy link and then immediately thought, oh no, I've just handed mine entire life over to a bloke in a tracksuit somewhere. [SPEAKER_06]: Don't worry, you're not alone.

3:30 [SPEAKER_06]: That's why Adaptive Security exists. [SPEAKER_06]: to stop your staff from doing precisely that. [SPEAKER_06]: Adaptive security is the first cybersecurity company backed by open AI and they provide proper security awareness training that doesn't feel like death by PowerPoint. [SPEAKER_06]: We're talking real world examples tailored to your company with fishing, fishing, fishing, smashing, and yes, even AI deep fake scams all covered.

3:56 [SPEAKER_06]: If someone tries to ring up accounts pretending to be the boss, your team will be ready. [SPEAKER_06]: And their fishing simulations aren't just any old click this fake delivery email malaki, you can help prepare your team for advanced social engineering attacks, bar email, voice, SMS and video, which take advantage of the sort of information attackers could actually dig up about you and your staff.

4:21 [SPEAKER_06]: And now, Adaptive's new AI content creator helps security teams instantly generate custom training by just placing in a news article where it's a breaking thread or an internal policy update Adaptive can spin it into interactive multilingual training in seconds [SPEAKER_06]: So, if you'd rather your employees didn't become the weakest link, head over to AdaptiveSecurity.com and then sit back with a nice cupper, knowing that next time a scammer comes calling, your team might just be clever enough to hang up on them.

4:53 [SPEAKER_06]: And thanks to AdaptiveSecurity for supporting the show. [SPEAKER_06]: Now, chums, chums, if you're going to commit a federal crime. [SPEAKER_06]: There are, I think, a few basic rules that you might want to follow. [SPEAKER_06]: Okay, all right, there are rules, right, there are rules. [SPEAKER_06]: What do you think would be the first rule?

5:14 [SPEAKER_06]: Well, I would say the first rule is Don't get caught. [SPEAKER_06]: Yeah, don't get... [SPEAKER_06]: I actually think there's a rule before that, right? [SPEAKER_06]: So a rule zero, in fact, rather than don't get caught, which is, don't do it in the first course, right? [SPEAKER_06]: Yes, don't do it.

5:28 [SPEAKER_06]: However, if you break that rule, don't get caught. [SPEAKER_06]: But there's a level rule, which is if you ignore the don't do it rule, maybe I'm just going on a hunch here, maybe don't post evidence of your crime on Instagram for everybody to say it is a good rule. [SPEAKER_06]: That is a very good rule.

5:44 [SPEAKER_06]: That's basic sort of up, second, isn't it? [SPEAKER_06]: These things shouldn't do that. [SPEAKER_06]: Now, unfortunately, there is a 24-year-old chap based in Springfield, Tennessee who didn't get that particular memo. [SPEAKER_06]: Because according to Documents' Foulding Court in the last week, a person called Nicholas Moore spent the second half of 2023, all a little spree of malicious criminal hacking.

6:13 [SPEAKER_06]: What he was ready to him was he was using stolen login credentials to what since the computer systems of them how not let me just let me check oh yeah it was just the US Supreme Court and America or in the top of an veteran affairs just [SPEAKER_06]: Big federal agencies. [SPEAKER_06]: No big deal.

6:31 [SPEAKER_06]: No big deal, right? [SPEAKER_06]: I mean everyone's got to have a bit of a hobby in the summer So that was his was he was breaking into these federal agencies and he was doing this while on Instagram Well, this is the thing he was doing this between the end of August [SPEAKER_06]: and ran back the end of October, 2023 for three months or so.

6:50 [SPEAKER_06]: He was accessing the Supreme Court's electronic file-in systems, and he went in on 25 different days. [SPEAKER_06]: Sometimes he went in multiple times in the same day. [SPEAKER_06]: It's like he was checking his emails at, oh, I won't if there's been an update on the Supreme Court server.

7:07 [SPEAKER_06]: You know, oh, it's lunch already. [SPEAKER_06]: Maybe I'll check again after tea. [SPEAKER_06]: And what did he steal? [SPEAKER_06]: Well, one victim, apparently, who's only been referred to by the initials G.S. [SPEAKER_06]: in court documents, but ever I see court documents and they just give initials.

7:23 [SPEAKER_06]: I always want to think, I wonder, how one who that could be? [SPEAKER_06]: And I'm looking at the letters GS, and I'm thinking of, you know, is that Gabriela Sabatini, if we're going to keep the sort of sporting theme of what we were talking about earlier, or could it be Gil Scott Herron or Gwen Stefani?

7:41 [SPEAKER_06]: I'm not sure who it's going to be, but this person GS, he stole their full name, their email address, their phone number, their home address, their data birth. [SPEAKER_06]: But the hack didn't stop there. [SPEAKER_06]: They also obtained the private answers that this mysterious G.S. [SPEAKER_06]: had given to three security questions.

8:03 [SPEAKER_06]: Now, Ray, I'm sure in your career you've come across this issue of those security questions on many occasions and how people respond to them. [SPEAKER_06]: These sort of, what was the name of your first petal or your mother's maid? [SPEAKER_04]: They're called knowledge-based answers, or KBA.

8:19 [SPEAKER_04]: Yeah. [SPEAKER_04]: Let's go out and thank she's them. [SPEAKER_04]: And even the Yahoo and those big websites always ask for a backup of the backup. [SPEAKER_04]: And then sort of the last resort if they can't text you on your cell phone, is to ask the KBA. [SPEAKER_04]: The problem is, is that most of those answers are somewhat easy to look up on the public internet, and certainly for someone in the Supreme Court.

8:38 [SPEAKER_04]: So, [SPEAKER_04]: It's not hard to figure out what a high school mascot was for what street they grew up on when they're the public figures, right? [SPEAKER_06]: Because I remember, for instance, I think it was Paris Hilton years ago. [SPEAKER_06]: This was before we really had smartphone.

8:51 [SPEAKER_06]: She had what was it called a side kick or something? [SPEAKER_04]: Yeah, it was that little device with a slide-out, steam over side. [SPEAKER_04]: That's right. [SPEAKER_04]: And she had one of those. [SPEAKER_04]: Yeah. [SPEAKER_06]: And her account, which got hacked. [SPEAKER_06]: was protected by one of the sort of knowledge-based answers the security question which was, what is the name of her pet dog?

9:07 [SPEAKER_06]: And it was, I think it was Tinkerbell or something. [SPEAKER_06]: But it was a famous dog, everyone knew the dog. [SPEAKER_06]: Yes. [SPEAKER_06]: Probably the most famous little T-cup-chair-wawa you'd ever been on earth. [SPEAKER_06]: Sure. [SPEAKER_06]: And similarly Sarah Pailin, she had a Yahoo account, way back when, which got hacked.

9:23 [SPEAKER_06]: And again, there were security questions, which were all pieces of information you could find out [SPEAKER_06]: Because a lot of people will answer those questions, honestly, so when they're asked by a bank or an online service to say your mother's maiden name, they will answer it truthfully, but of course, that's a matter of public records, that is something which he's possible if someone is determined to find out.

9:49 [SPEAKER_06]: And so that's why when sites ask me what my mother's maiden name is, I'm going to say something like Zay for Beablebrook, so Zani Boop or Xenawaria Princess. [SPEAKER_06]: I'm not going to give my joy. [SPEAKER_06]: I have just now given my fake question. [SPEAKER_04]: The problem of lying on those, because we use to advise folks, especially in the crypto currency space, we use to advise folks to lie on every single one of those questions.

10:11 [SPEAKER_04]: So even if you're putting in special characters and freedom is like separate passwords, [SPEAKER_04]: Are you going to remember what your life was and you could say, but I'll store them in my password manager, right? [SPEAKER_04]: Well, if your password manager was working at this time, you wouldn't need those reset questions and answers.

10:30 [SPEAKER_04]: So it's not necessarily a good idea to lie on them unless their life is memorable and you don't say it on the podcast. [SPEAKER_06]: Yeah, I guess that's the key thing is it don't say it on the podcast. [SPEAKER_06]: I mean, when I cite demands them. [SPEAKER_06]: I do store them in my password manager, but you're right, because I've got a password manager, I tend not to forget what my password is, so I don't need my security answers.

10:51 [SPEAKER_06]: But this chap, he was going around and he wasn't just hacking into the Supreme Court electronic file in system. [SPEAKER_06]: He was also hacking into other systems, so he hacked AmeriCorps, and for people who aren't in states, that's a US federal agency that runs volunteer programs. [SPEAKER_06]: and they connect, I believe, tens of thousands of Americans with community service opportunities and things.

11:13 [SPEAKER_06]: He broke into their portal. [SPEAKER_06]: Seven times, using some other stolen credentials and passwords, and he helped himself to people's dates of birth, social security numbers, email addresses, home addresses, phone numbers, veterans, status, service history, or kind of information.

11:29 [SPEAKER_06]: And then, he went on again to a third federal service, the Department of Veterans activities. [SPEAKER_06]: Specifically, a platform called MyHealthEvet, where veterans were managing their healthcare and could view their medical records and get prescriptions and things. [SPEAKER_06]: And he was accessed in the system so for now, for now, for again.

11:52 [SPEAKER_06]: And he stole one individual's medication list, HW, I'm not sure who HW might be. [SPEAKER_06]: Henry Winkler, what other famous HWs that Harvey Weinstein, are we don't want to talk about him? [SPEAKER_06]: No, no, no, no, no, no, no, no. [SPEAKER_06]: Don't want him getting any medication.

12:08 [SPEAKER_06]: Anyway, he stole their list and he stole their home address and their email and their phone up. [SPEAKER_06]: And according to court documents, his blood type has a well. [SPEAKER_06]: Yeah. [SPEAKER_06]: Now, I can understand from a criminal's perspective why you might steal someone's social security number because that's useful for identity theft.

12:26 [SPEAKER_06]: I can understand stealing their address and their data birth or the security answers because that's all valuable data but blood type. [SPEAKER_06]: Why would someone want to know that a marine veteran is be positive or something? [SPEAKER_06]: Are they planning a black market or going traffic in operation?

12:43 [SPEAKER_06]: What is the reason for grabbing someone's bloodstone? [SPEAKER_04]: Well, it's, you know, the one possible reason is because of the fact that the folks that were storing this, they had no business storing this to the credentials in the same place as the blood type or even the KBA answers.

12:57 [SPEAKER_04]: right? [SPEAKER_04]: Yeah. [SPEAKER_04]: Typically you want doesn't completely isolate it in separate place so that if one is breached, at least they didn't get the other. [SPEAKER_04]: Right? [SPEAKER_06]: Yes. [SPEAKER_06]: You've got to separate out this sensitive deity. [SPEAKER_06]: Don't want it too easily to connect it so people can get the full picture of who you are and all of your sensitive information.

13:14 [SPEAKER_06]: And here's the thing, he didn't just steal this information like blood type. [SPEAKER_06]: He posted it to Instagram. [SPEAKER_06]: Oh, boy. [SPEAKER_06]: And he publicly shared screenshots showing this person's full name. [SPEAKER_06]: They're home address their service branch. [SPEAKER_06]: Jellini, felony, felony, felony, felony.

13:29 [SPEAKER_06]: You're just every single time you post someone's future. [SPEAKER_06]: Well, I'm thinking, what's the caption that he's posting here? [SPEAKER_06]: Oh, just hacked veterans affairs. [SPEAKER_06]: Here's a Marine's blood type double tap. [SPEAKER_06]: If you're also A.B. [SPEAKER_06]: negative, you know, it's... Yeah.

13:44 [SPEAKER_06]: So, I've been doing this podcast for years, but I don't think I'd ever come across a hacker who publicly posted someone's blood type to social media before passwords, yes. [SPEAKER_06]: Or address people are being doxed in that way, or credit card numbers. [SPEAKER_06]: But blood, this is a bit of a new one.

14:00 [SPEAKER_06]: So, I would imagine Ray that if you had done it, not that you're the sort of chap to do it, because you're a decent upstand in fellow who wouldn't break the law, and you wouldn't crack people's security. [SPEAKER_06]: I'd imagine most people would think, well, if I did do something about it, I'd keep quite about it.

14:14 [SPEAKER_06]: And I hope no one notices. [SPEAKER_06]: Sure. [SPEAKER_06]: But this chap Nicholas Moore, what he did was he posted it up as I said on Instagram. [SPEAKER_06]: He created an Instagram account and he called it, and I promise I am not making this up. [SPEAKER_06]: He called it. [SPEAKER_06]: I hacked the government.

14:31 [SPEAKER_06]: Was the name. [SPEAKER_06]: That's the end. [SPEAKER_06]: Yep. [SPEAKER_06]: Really flying under the radar. [SPEAKER_04]: I wonder if there's any reason to prove criminal intent with a user name. [SPEAKER_04]: I hacked the government. [SPEAKER_04]: That's a question. [SPEAKER_06]: Yes. [SPEAKER_06]: You can't really claim this was just an accidental posting or something like this.

14:46 [SPEAKER_06]: So he posted screenshots of the filing system of the Supreme Court. [SPEAKER_06]: His access to AmeriCorps service, the veterans names and information. [SPEAKER_06]: And yes, the blood type. [SPEAKER_06]: and he was posting this in July August to November 2023. [SPEAKER_06]: It turns out that one of his posts in July was before, according to the court documents he actually accessed the system, so maybe he did have access earlier than they think.

15:13 [SPEAKER_06]: But he still carried on even after they had closed down his access and he was no longer able to get to it. [SPEAKER_06]: So he was showing off, presumably so and look what I did everyone. [SPEAKER_06]: And I think this may have been a social media strategy to gain followers. [SPEAKER_06]: Oh, a teaser campaign.

15:32 [SPEAKER_06]: He's like teasing us and we're something is coming. [SPEAKER_06]: But as crime, it's crime. [SPEAKER_06]: Maybe he wanted to be a cyber criminal influencer. [SPEAKER_06]: But maybe he wanted other cyber criminals to follow him. [SPEAKER_06]: And then he would be able to sell them. [SPEAKER_06]: I don't know what cyber criminals want.

15:44 [SPEAKER_06]: Rolls, Royce, and Gold, Plate, Ball, Paper, and whatever the luxury item these cyber criminals want. [SPEAKER_06]: But, you know, it looks like that was what it was all about. [SPEAKER_06]: It wasn't ransom in the data. [SPEAKER_06]: Sure, there's no mention in the court documents of extortion demands.

16:01 [SPEAKER_06]: He wasn't selling it on the dark web as far as we know. [SPEAKER_06]: It wasn't working for a foreign intelligence agency. [SPEAKER_06]: He was just showing off on Instagram for the likes. [SPEAKER_04]: Now, Graham, that is stupidity. [SPEAKER_04]: And I'm literally, we talk about Opsech, and Opsech is very difficult, you know, both for professionals and amateurs alike.

16:20 [SPEAKER_04]: And so we don't usually shame people for making mistakes around Opsech, because it's very human. [SPEAKER_04]: Yeah. [SPEAKER_04]: To do so. [SPEAKER_04]: But in this case, this is actual stupidity. [SPEAKER_04]: And the reason why is because when celebrities make a faux pas, their first defense is to scream, I was hacked.

16:35 [SPEAKER_04]: I'm the victim. [SPEAKER_04]: But because his username was I hacked the government. [SPEAKER_04]: You can't exactly claim that that wasn't you at all, right? [SPEAKER_04]: And they can actually charge him once for each one of those elements. [SPEAKER_04]: Right, each high. [SPEAKER_04]: So you said, blood type, height, et cetera.

16:51 [SPEAKER_04]: Those each one of those fields is considered a separate crime. [SPEAKER_04]: When you take it, [SPEAKER_04]: And were you posted? [SPEAKER_04]: So think about that and imagine you were his lawyer. [SPEAKER_06]: Well, the interesting thing is, I thought they would be thrown the book at him over this.

17:05 [SPEAKER_06]: But you know, because it's the supreme court of the United States, right? [SPEAKER_06]: The highest court in the states, their system security appears to have been lacking in some ways because [SPEAKER_06]: Sure. [SPEAKER_06]: The anomalous login should be spotted, I think they should have seen this user normally logs in from Washington, DC.

17:21 [SPEAKER_06]: Why are they logging in from Tennessee or why someone logged in 14 times today? [SPEAKER_06]: That's a bit unusual. [SPEAKER_06]: They should have spotted that kind of thing. [SPEAKER_06]: But apparently according to the court documents, he is facing a maximum of just one year in prison.

17:35 [SPEAKER_06]: Really, [SPEAKER_06]: that this has been treated may be a little bit less seriously than if you'd downloaded a whole load of movies from short-horrent sites. [SPEAKER_06]: So this has been classified as a misdemeanor. [SPEAKER_06]: No, yes, it's the same category as shoplifting or a minor drug possession in most states.

17:59 [SPEAKER_04]: See, I would guess if not just felony, but multiple felonies. [SPEAKER_04]: I would have thought that it was like a dozen or so. [SPEAKER_04]: There's got to be something more to this story. [SPEAKER_04]: It was quite pretty on some other things or something. [SPEAKER_06]: Well, he did plead guilty.

18:12 [SPEAKER_06]: So I guess that works to his advantage in some fashion. [SPEAKER_06]: He's scheduled to be sentenced in April. [SPEAKER_06]: Let's wait to see what happens there. [SPEAKER_06]: Yes, 25 intrusions into the Supreme Court, seven into a medical five into the veterans affairs association. [SPEAKER_06]: Three victims whose personal information, including their medical records and blood types, splashed across the Instagram account called IHacked the government.

18:36 [SPEAKER_06]: I suppose if there's a lesson here, if you're going to hack federal government agencies and still veterans medical records don't make an Instagram account call to hack the government, don't post screenshots of your crimes, like you're showing off your breakfast photos on Instagram, don't do it to boost your social media followers.

18:56 [SPEAKER_06]: We're actually maybe if you are going to hack the government, maybe you should do all of those things because that's probably why he did eventually get called. [SPEAKER_06]: Before we go any further, I want to say a few words about one of our sponsors this week, threat locker. [SPEAKER_06]: Most cyber attacks don't start with some genius hacker writing custom malware, they start with something much simpler, like a misconfigured setting, an exposed service, or a security policy that quickly drifted out of line.

19:26 [SPEAKER_06]: And in large complex IT environments, those misconfigurations are everywhere and almost impossible to track manually. [SPEAKER_06]: And that's my threat locker built, defense against configurations, or DAC. [SPEAKER_06]: Threat locker DAC gives you a real-time view of configuration weaknesses across your entire environment.

19:47 [SPEAKER_06]: It runs deep checks across every endpoint, not just your threat locker policies, but your operating systems and application settings too. [SPEAKER_06]: All of it appears in one clean dashboard, showing what's misconfigured, how risky it is, and exactly how to fix it. [SPEAKER_06]: So no more discovering problems after the attackers do.

20:06 [SPEAKER_06]: With DAC, you see configuration drift as it happens. [SPEAKER_06]: You can also check alignment with major security frameworks and see which endpoints don't make the grade. [SPEAKER_06]: If you want to stop firefighting, harden your environment and catch hidden risks before they turn into breaches, you need DAC.

20:24 [SPEAKER_06]: Try for free for 30 days at ThreatLocker.com and find out what's misconfigured before it costs you. [SPEAKER_06]: Right, what are you going to talk to us about today? [SPEAKER_04]: So, Graham, do you remember way back in the day? [SPEAKER_04]: I think it was probably 2014 or so when a heart bleed was discovered.

20:45 [SPEAKER_04]: And one of the most memorable things about it, and I think you've blogged about this at the time. [SPEAKER_04]: I think the first discovery of your blog at this time was when heart bleed was disclosed, the researchers had this really cool logo already to go. [SPEAKER_04]: right it was a really groovy logo they had a heart and it was bleeding it was iconic pretty wasn't and I think they created a website as well all about it they're on the main name and the explanation and it was almost like they were marketing the disclosure now they were not marketing the actual vulnerability but they were certainly making it easier for the press and wanted to cover it [SPEAKER_06]: And following that, we saw a series of other vulnerabilities trying to out do each other.

21:22 [SPEAKER_06]: Sure. [SPEAKER_06]: As these things were discovered, they would come with grander and grander logos. [SPEAKER_06]: And I seem to remember, some even had like their own theme tune. [SPEAKER_06]: Well, sure. [SPEAKER_06]: Sure. [SPEAKER_06]: And it's like forget the techies who found this actual vulnerability.

21:36 [SPEAKER_06]: We're going to need a marketing and a PR agency to make sure people are writing about our vulnerability. [SPEAKER_06]: By giving it the sexiest name possible, rather than a CB. [SPEAKER_04]: So it seems to be completely ridiculous that people would put their time into that and there's been some criticism about it, but I will play this.

21:53 [SPEAKER_04]: If you follow responsible disclosure in most cases, once you tell the vendor and in confidentiality and under NDA, once you've tell the vendor, there's usually a waiting period of either 60, 90 or 150 days to give them time to react. [SPEAKER_04]: So you kind of have this law in time where you're literally the only person that knows this zero day, [SPEAKER_04]: And you basically, you're hoping that no one else discloses it before it hits the deadline, especially if it's a bug bounty or something like that.

22:20 [SPEAKER_04]: So that would be the time that you get the domain name and start preparing yourself for the onslaught of media and accolades and getting a hometown parade would further you're up. [SPEAKER_04]: Yes. [SPEAKER_04]: So in this story, this particular group of researchers, they didn't just get the domain name and get a logo, but they actually put up a website and they even made a movie.

22:41 [SPEAKER_04]: They made a movie where you can actually see the hack being demonstrated. [SPEAKER_04]: Now, it wasn't a university, so in fairness, I think they tapped into the theater department and maybe that film making department. [SPEAKER_04]: Right. [SPEAKER_04]: But they went to all this great length of disclosing this and you can find [SPEAKER_06]: So whisper pair is the name of the vulnerability.

23:01 [SPEAKER_06]: That's what they're choosing to call this particular problem. [SPEAKER_06]: Correct. [SPEAKER_06]: And what is whisper pair all about? [SPEAKER_04]: Okay, so this is going to bring you back to when we were talking about shell shot. [SPEAKER_04]: Because it was the same year or the same time frame, right?

23:11 [SPEAKER_04]: My goodness, that seems like century ago. [SPEAKER_04]: Around that same time, Apple introduced something proprietary to devices in their ecosystem. [SPEAKER_04]: So like it would work on an iPhone and a Mac, or a work on an Apple TV and an iPhone, and that was that they'd come up with a way for headphone pairing to be click-less.

23:29 [SPEAKER_04]: So you didn't have to put in a pen. [SPEAKER_04]: You didn't have to go through all the bumps because they called something hand-off and cotton duity, okay? [SPEAKER_04]: It was a great little feature because everyone hated having Bluetooth dances when they were trying to do Bluetooth pairing.

23:41 [SPEAKER_06]: And the truth is now, Ray, that this just works seamlessly now, doesn't it? [SPEAKER_06]: When you try and move between different devices. [SPEAKER_06]: So if you have some headphones and some ear for, oh, hang on a moment, I might refer into the 15 minutes we spent before we started recording.

23:56 [SPEAKER_04]: Well, you know, it's about the telead part of the story, but yeah, it's like, yeah. [SPEAKER_04]: So even in the lab, with a lot of devices and a lot of, a lot of wood too that I... [SPEAKER_04]: It was just playing real with some of it, but yes, you're absolutely right. [SPEAKER_04]: Seamless seamlessly.

24:06 [SPEAKER_06]: Sometimes there are still challenges with these things, because sometimes they connect too easily. [SPEAKER_04]: Correct, correct. [SPEAKER_04]: So at the time, that was a good advantage for Apple, and Google had to counter it, right? [SPEAKER_04]: So they didn't want their Android devices to not have this type of benefit.

24:21 [SPEAKER_04]: So they actually launched in 2017, a few years later, something called FastPare. [SPEAKER_04]: But FastPare is the same kind of equivalent as the way that Apple technology worked, where you didn't have to put in pens [SPEAKER_04]: Okay. [SPEAKER_04]: So, Google FastPair is sort of Google's version of the Apple continuity and hand-off works, right?

24:41 [SPEAKER_04]: You want me so far? [SPEAKER_04]: Yeah. [SPEAKER_04]: Okay. [SPEAKER_04]: Okay. [SPEAKER_04]: So, a group of Belgian resources at KU Lumen basically found that under the right conditions, or maybe I should say the wrong conditions, [SPEAKER_04]: Well, I guess it depends on whose viewpoint you're looking at, but under those conditions, you could also trigger fast pair to a complete stranger using off the shelf commodity hardware.

25:03 [SPEAKER_04]: Right? [SPEAKER_04]: You could do that without their permission, et cetera. [SPEAKER_04]: Of course. [SPEAKER_04]: Personally, therefore a criminal could do it on purpose. [SPEAKER_06]: But so if I were a criminal, and someone else was listening to a conversation with their headphones or listening to some recording or something, [SPEAKER_06]: I could in a way hijack the pairing, so that I could listen to the recording instead, or I would be the one on the conversation, rather than that, is that right?

25:25 [SPEAKER_06]: Correct. [SPEAKER_04]: So like on the continuum of harm, so to speak. [SPEAKER_04]: At one side, you could just listen to it, and you could get their death or a tall music, and listen to them, not knowing, or whatever. [SPEAKER_04]: Yes. [SPEAKER_04]: Don't do no one like playing the flute.

25:37 [SPEAKER_04]: And next level, you could actually be on their microphone, right? [SPEAKER_04]: So you could imagine if someone was on a conference call, you could say something ridiculous. [SPEAKER_04]: Yes, here to be from them. [SPEAKER_04]: This is the voice of God. [SPEAKER_04]: Yes. [SPEAKER_03]: Yes.

25:47 [SPEAKER_04]: Bursherty. [SPEAKER_04]: One level up above that is you could actually do a man in the middle type attack where you actually sat in the middle and heard things like password resets or whatever people were talking about on their phones. [SPEAKER_04]: But it even goes beyond that because what they proved was in addition to the pairing of headphones.

26:05 [SPEAKER_04]: Google also has an entire ecosystem. [SPEAKER_04]: The equivalent of Apple's find my phone and find my friends, et cetera. [SPEAKER_04]: Yeah. [SPEAKER_04]: So if someone takes your headphones, you can follow them on the map, right? [SPEAKER_04]: It's follow them so speak. [SPEAKER_06]: So this is why this is why Ray, all headphones should be on a wire.

26:23 [SPEAKER_06]: My earphones are on a wire, my headphones are on a wire. [SPEAKER_06]: Because I want to be able to find them. [SPEAKER_04]: So I can always find them because all I have to do is pull the buyer and they will come back to me Well, that's interesting because that was always the criticism if you walk around downtown London or downtown New York City Right, you will see people with wireless headphones almost everywhere.

26:43 [SPEAKER_04]: That's basically the standard But the number one criticism has always been that you could lose one and be under the couch You know, wherever there that was and so that's why they came up with this technology [SPEAKER_04]: So beeps and walk around the hotel room or whatever you are. [SPEAKER_06]: Just tell a better string to it.

27:00 [SPEAKER_06]: Just tell a bit of string between the headphones and you and you're fine or have a wire. [SPEAKER_06]: Yes, correct. [SPEAKER_06]: That's what I would suggest. [SPEAKER_06]: Anyway, okay. [SPEAKER_06]: So I've got this sort of find my device technology in Google, which can be used to find these devices.

27:13 [SPEAKER_06]: So that can be exploited as well through this vulnerability. [SPEAKER_06]: Correct. [SPEAKER_06]: So I've got a question for you, Ray, which is, what is the range? [SPEAKER_06]: of this, you know, how far away can you be to exploit this particular thing? [SPEAKER_06]: Do you have to be basically breathing down someone's neck or what?

27:30 [SPEAKER_04]: Well, okay, and that was my first question as well. [SPEAKER_04]: Uh, and the second that I heard about this, I set up a lab to try to replicate experiment with it and see if I can push it a little further. [SPEAKER_04]: And then when the white paper was published, [SPEAKER_04]: I tried it.

27:42 [SPEAKER_04]: And now the researcher said it could get up to 14 meters. [SPEAKER_04]: There's experience. [SPEAKER_04]: I got up to about seven or eight, right? [SPEAKER_04]: So that's the theoretical distance. [SPEAKER_04]: But my guess is that their lab is probably a little bit more orderly than mine is and has a lot less interference.

27:58 [SPEAKER_04]: But the bottom line is, no matter what that is, it could be boosted using SDRs or software to find radio. [SPEAKER_04]: And we know that because every year at DEF CON somebody comes up with something and really, really annoying like this. [SPEAKER_06]: Yeah, so even if they do have to be relatively close, I mean, this is still more than a theoretical threat.

28:16 [SPEAKER_04]: Yes, if you're in a subway car, for example, I mean, you could be anywhere in a subway car, or on an airplane, it would certainly be almost anywhere in that particular airplane. [SPEAKER_04]: But the victim has no idea that you're even tapping into that particular data stream, right? [SPEAKER_04]: And this is the real kicker.

28:31 [SPEAKER_04]: The victim has no idea when you tag that device as yours, and it's only works if they haven't registered it already, okay? [SPEAKER_04]: When you tag it as yours in the cloud, then after you get off that plane or you get off that subway, you can track everywhere they go, says that stalking feature.

28:47 [SPEAKER_06]: Oh boy. [SPEAKER_04]: Yes. [SPEAKER_04]: So you can follow where they are. [SPEAKER_04]: Now, all of this stuff is laid out in details in a wired article by Andy Greenberg and Lily Newman, but one of the things that they said it's so compelling in this research is, if you think about that escalation of power, et cetera, once that person has that paired to that device, they can then use the Google in that work to find them because it's crowdsourced.

29:09 [SPEAKER_04]: To millions or even billions of people, but get this gram. [SPEAKER_04]: Here's the real kicker, Apple and Google. [SPEAKER_04]: Yeah. [SPEAKER_04]: have both in order to mitigate this kind of danger, have come up with this feature where they warn you all the time, something is connecting to your phone, something is following you, something is connecting to your phone.

29:24 [SPEAKER_04]: Have you ever seen those before? [SPEAKER_04]: Yes, yes, yes, yes, people complain about it. [SPEAKER_06]: It's like, oh, what's that beeping, yeah? [SPEAKER_04]: Yeah, so it happens all the time, right? [SPEAKER_04]: And if you go to a crowded gym or something, you'll hear these go off and everyone is super duper annoyed.

29:36 [SPEAKER_04]: In this case, and it's usually two or three days once it first sees an unknown device that's following you around, [SPEAKER_04]: the warning will point you to your own headphones, so it'll say there's a device tracking you but it points you to your own headphones and you're just confused by that because of course that's what you wanted to do with your device by design and that's exactly what the victims would do is try to turn that feature off or try to modify that.

29:58 [SPEAKER_04]: So ultimately, there really wasn't any solution to this prior to this disclosure, but the students that actually wrote this exploit and wrote this proof of concept did come up with a fix and they also published that in a responsible disclosure. [SPEAKER_06]: Oh, great. [SPEAKER_04]: So there is a software patch that people come up with right now.

30:16 [SPEAKER_04]: Here's the thing. [SPEAKER_04]: You don't apply it to your Android phone. [SPEAKER_04]: It has to be applied to the right headphones. [SPEAKER_04]: Most people do have no idea how to update the firmware on their headphones. [SPEAKER_04]: Oh, yeah. [SPEAKER_04]: Okay. [SPEAKER_04]: So may not be trivial to do.

30:29 [SPEAKER_04]: Well, it's just a little bit non-intuitive, right? [SPEAKER_04]: So most people are, most people are data-fountains, and that's a good security practice, but we didn't normally think of headphones or something that you have to constantly keep firmware updated on, because some of them don't even do updates at all, right?

30:42 [SPEAKER_06]: Right. [SPEAKER_06]: So if you are prompted for an update on your headphones or something, probably it is worth considering doing. [SPEAKER_04]: If your headphones were good, they probably will be prompting you because some companies have already patched. [SPEAKER_04]: But all companies that can should patch because otherwise the victim is exposed and it's really not a way for them not to be.

31:06 [SPEAKER_06]: Okay, before we go any further, I need to share a quick word with you about one of our sponsors today, Vanta. [SPEAKER_06]: You know how everyone's got an AI assistant these days. [SPEAKER_06]: Well, imagine one that doesn't just write high coos about zero-dane vulnerabilities, but actually does your audit work for you.

31:23 [SPEAKER_06]: That is Vanta. [SPEAKER_06]: It connects to all of your tools, gathers evidence, tracks, compliance, and quietly helps you prove that, yes, you do take [SPEAKER_06]: banter, automates, all of that. [SPEAKER_06]: It pulls everything together, keeps an eye on your systems and basically make sure you're ready for an audit at any time, which means no last minute panic for screenshots and policies.

31:46 [SPEAKER_06]: It also plugs into the tools you're already using and flags up issues before they become a right-old mess. [SPEAKER_06]: So if that sounds like something that might save you from a few sleepless nights, check out vanta.com slash smashing. [SPEAKER_06]: And if you use that link, you'll get $1,000 off.

32:04 [SPEAKER_06]: So don't forget, vanta.com slash smashing, and thanks to vanta for sponsoring this week's episode. [SPEAKER_06]: On with the show. [SPEAKER_06]: and welcome back and you join us at our favourite part of the show, the part of the show that we liked! [SPEAKER_06]: Cool! [SPEAKER_06]: Pick the week!

32:22 [SPEAKER_06]: Pick up the week! [SPEAKER_06]: Pick of the week is the part of the show where everyone chooses some that like could be a funny story a book that they read CV show a movie a record of podcast or website or an app. [SPEAKER_06]: Whatever they wish it doesn't have to be security-related necessarily.

32:35 [SPEAKER_06]: Oh, it shouldn't be. [SPEAKER_06]: Well, my pick of the week this week is not security-related. [SPEAKER_06]: My pick of the week this week is a BBC drama series, which has been on TV for quite some time, but I've been bingeing on it lately. [SPEAKER_06]: Okay, because apparently they are recording a brand new series.

32:53 [SPEAKER_06]: Have you ever heard Ray of a show called Line of Duty? [SPEAKER_04]: Yes, I actually have. [SPEAKER_04]: So if you're binging the old ones to get prepared for the newest? [SPEAKER_04]: Exactly so. [SPEAKER_06]: Okay, one of the new ones must be out. [SPEAKER_06]: I think they can start filming it in a few months, so maybe it'll be out into the year early next year, not sure.

33:12 [SPEAKER_06]: Who knows how long these things will be? [SPEAKER_06]: We have watched all the back-lock back there. [SPEAKER_06]: My wife is a serial binge-a-she can binge-for-brit and let me tell you, she does it. [SPEAKER_06]: So I'm not watching all of them with her, but I'm so glad I see. [SPEAKER_06]: I'm occasionally in the room and singing, and all this is Johnny Good.

33:28 [SPEAKER_06]: I should really watch some more of this, but unfortunately, he got some work to do. [SPEAKER_06]: Oh, so I'll leave you to it darling. [SPEAKER_06]: So yeah, I'll catch up with her later on, but it is fantastic. [SPEAKER_06]: Line of duty is a show, which follows AC12, it's a police anti-corruption unit, whose job is to investigate bent coppers, which means lots of tense interview room scenes, plenty of twists and turns that you try to work out who the good guys are and who isn't a good guy.

33:54 [SPEAKER_04]: And does the AC stand for anti-corruption? [SPEAKER_04]: I believe it does. [SPEAKER_04]: Okay, so to that mean that there's 11 other divisions of anti-corruption, and this is the 12? [SPEAKER_06]: very good question and one that I've never had satisfactorily answered during the program because like you are clearly right we are of a similar mind because I keep looking at that thinking well why is that why is that 12 why why is are there different ones around the country maybe there are different ones around the country [SPEAKER_06]: I don't know.

34:17 [SPEAKER_06]: Anyway, this was a huge hit line of duty in the UK, and as I said, they recently announced them a new series so I'm bingeing on it on BBC iPlayer, and I'm desperately trying to remind myself who H is, who is the senior corrupt police officer or we know is this codename. [SPEAKER_06]: H who could it be?

34:35 [SPEAKER_06]: He's believed to be him. [SPEAKER_06]: bedded within the force, working with organised criminal gangs. [SPEAKER_04]: Now do you think H is short for his first name? [SPEAKER_04]: Like would you do in the redacted documents? [SPEAKER_06]: Well, well, this is the thing. [SPEAKER_06]: There is a suggestion during the program.

34:46 [SPEAKER_06]: That term H could be the first letter of the surname of the individual who is the body. [SPEAKER_06]: And unfortunately, there are a whole bunch of characters who do have a surname beginning with H. So the writer deliberately won't be in lots of characters. [SPEAKER_06]: So, how many characters have the agent?

35:07 [SPEAKER_06]: Oh, at least being a half a dozen, I think. [SPEAKER_06]: Including the star of the show whose Adrian Dunbar, he is super-intent Ted Hastings, the head of AC12, could it be him? [SPEAKER_06]: Now, he's marvelous. [SPEAKER_06]: Hastings, he's got a fine-lining catchphrases. [SPEAKER_06]: He says, oh, there's nothing to do.

35:23 [SPEAKER_06]: When he gets some good information, there he goes. [SPEAKER_06]: She's a smile and Joseph and all he's done. [SPEAKER_06]: When he's in disbelief about some new evidence which has come to light, but the thing is it's very very well done It's brilliantly acted. [SPEAKER_06]: It's marvellously edited.

35:36 [SPEAKER_06]: It's absolutely gripping. [SPEAKER_06]: It really is sort of oh, I've got to watch the next one of this So if you enjoy paranoia and some procedural drama and shouting, I'm only interested in one thing and one thing only and that's Ben Cobbers [SPEAKER_06]: If that's your kind of TV, line of duty is well worth your time.

35:55 [SPEAKER_06]: I will put in a link to the BBC I player in the show notes and the weed hockey and the weed donkey as well. [SPEAKER_06]: Ray, what's your pick of the week? [SPEAKER_04]: Well, Graham, I think we may have broken a world record for a security podcast because I don't think we've mentioned the word AI one single time.

36:12 [SPEAKER_04]: Oh, you've ruined it, you've ruined it. [SPEAKER_04]: It's the topic that everyone seems to be talking about, and it's very polarizing in the security community. [SPEAKER_04]: You're a T in general, but I'm going to be talking about something a little bit different. [SPEAKER_04]: Okay. [SPEAKER_04]: It is actually a short film called Forgive The Haters, and it's going to be about AI, and it will make at least one person in your single group get very, very upset one way of the [SPEAKER_04]: Here's the story about forgive the haters and I said it's a film but Graham it's really more like a music video right and it actually is made by a guy named Matt Zine and I'm thinking for now seeing that name correctly, but there's you might be Zion I apologize if it's Matt size and Matt

36:52 [SPEAKER_04]: spent a dozen years working on an Emmy-winning series and a lot of documentaries and it eventually formed a studio that I think is pronounced kingmaker because the way that it's actually listed filed is K-N-G-M-K-R. Oh no, no fouls. [SPEAKER_06]: Right. [SPEAKER_04]: how do you feel about that right i'm not a big fan of leaving out letters well there's a couple of reasons you might want to do that if you wanted to get a domain name or something like that right or you're being cute um but anyway i thought of the the kng and kr either sounds like um uh a wifi password that the restaurant might give you yes [SPEAKER_06]: could be.

37:31 [SPEAKER_04]: Or maybe the noise of your keyboard makes when you feel something on it or something like that. [SPEAKER_04]: But it's really about the intersection of cinema and AI. [SPEAKER_04]: Okay. [SPEAKER_04]: So forgive the haters. [SPEAKER_04]: It's a satire. [SPEAKER_04]: It's making fun of the battles that are kind of happening or will be happening in the front lines between filmmakers, stars, and VFX artists who are watching AI completely [SPEAKER_04]: So, this music video is quite compelling because what happened was, now, stay with me here on this.

38:02 [SPEAKER_04]: Zean who actually works both with and without AI, he took some of the worst hateful comments that had been made about AI filmmaking, really vicious stuff, and he fed it to a large language model, but here's the twist. [SPEAKER_04]: He fed those comments to Claude and he told Claude those were his own thoughts.

38:22 [SPEAKER_06]: Okay, so Claude, which is the AI from Anthropic, now believes that Zine isn't a huge fan of this AI-generated content. [SPEAKER_04]: Correct. [SPEAKER_04]: Correct. [SPEAKER_04]: So it's very, very hateful. [SPEAKER_04]: And Claude is basically hearing these things that say, Wow, this is what you believe.

38:38 [SPEAKER_04]: Now Claude took these AI takes. [SPEAKER_04]: And you know how the LLMs can be very sick of phantica. [SPEAKER_04]: They can always try to please you and try to tell you that you're beautiful and all these people. [SPEAKER_04]: Oh, yes. [SPEAKER_04]: to try to please you so that you chat with them more often, right?

38:50 [SPEAKER_04]: That's sort of the way that those were done. [SPEAKER_04]: But Claude took this and said, you know what, these are your authentic thoughts. [SPEAKER_04]: Let me start generating even nastier ones. [SPEAKER_04]: It starts feeding him even harsher. [SPEAKER_04]: Oh, meaner nastier ones than the ones he'd already found on the internet.

39:04 [SPEAKER_04]: Okay, so Claude is actually helping someone who's a hater who's really, really mean with new comments that they can put on someone else's YouTube channels, et cetera, basically escalating the war between AI proponents and AI skeptics. [SPEAKER_04]: Right. [SPEAKER_04]: Right. [SPEAKER_04]: Now, they were not critiquing AI.

39:21 [SPEAKER_04]: It was actually weaponizing the comments field. [SPEAKER_04]: So this is where it gets weird, okay? [SPEAKER_04]: So it wasn't the result about just dunking on the critics. [SPEAKER_04]: It was the fact that it was basically saying that that rage is grief. [SPEAKER_04]: That rage is grief because if you spend time around a lot of folks in this industry, a lot of folks are worried about their jobs.

39:41 [SPEAKER_04]: Yeah, what impact will this have in the future on screenwriting, for example? [SPEAKER_04]: And they're not just mad. [SPEAKER_04]: I mean, they're terrified. [SPEAKER_04]: As many of us should be because of the revolutionary impact of this. [SPEAKER_04]: And so, ultimately, if they're watching the floor shift and there's a great deal of uncertainty and uncertainty leads to fear.

40:02 [SPEAKER_06]: So, what am I supposed to feel from this? [SPEAKER_06]: So, I've just been playing the video in the background midly with the sound turned off. [SPEAKER_06]: It looks very AI-generated and there are comments coming up on the screen. [SPEAKER_06]: I mean, it was sure. [SPEAKER_06]: So, that's the film.

40:16 [SPEAKER_04]: The film is actually escalating these kind of this kind of cheesy, you know, some people call it Slop. [SPEAKER_04]: right? [SPEAKER_03]: Yeah. [SPEAKER_04]: The AI slot where you can totally tell that it's AI and it's not just because it doesn't look realistic to your eye. [SPEAKER_04]: It's just the general way that being being behaved, et cetera.

40:30 [SPEAKER_04]: And by the way, I will tell you it's a very interesting film and the reaction to the reaction in the film, which was a reaction to other films, which was really interesting, it's almost like hateception. [SPEAKER_06]: I was about to say, this is like when I watched the film [SPEAKER_06]: I mean, multiple players deep now, I'm getting confused.

40:50 [SPEAKER_06]: Anyway, how do you feel about all this AI stuff, right? [SPEAKER_06]: Well, I've said I could see both sides of it. [SPEAKER_04]: The work that I do every day, and there, it definitely is revolutionary and it's completely chase a game, even since the last time that we've talked on this podcast.

41:04 [SPEAKER_04]: Yeah. [SPEAKER_04]: You have to admit that the last 15 months have been really unpredictable and every single day things continue to be less predictable. [SPEAKER_06]: It is astonishing isn't it the speed of development, and I'm not sure the world is really ready for it all. [SPEAKER_06]: I feel like society is struggling to keep up, government is struggling to keep up certainly.

41:22 [SPEAKER_06]: It feels like the billionaires are in charge, and the rest of us maybe don't have much for saying the way in which we're going. [SPEAKER_04]: There's a lot of elements here that are just kind of kind of weird. [SPEAKER_04]: It almost looks like a comic book, the folks that are really behind these, the billionaires that are kind of driving it.

41:36 [SPEAKER_04]: And some of the things the AIs are doing, which I mean, again, they're trying on that March towards AGI, et cetera. [SPEAKER_04]: Some of the things that they do are just plain creepy, but then there's also human beings that are using it in creative ways that I'm not quite sure that we've really thought about the implications of that either.

41:52 [SPEAKER_04]: So it's floppy, it's messy, it's uncomfortable, [SPEAKER_06]: And it's your pick of the week! [SPEAKER_06]: Forgive the haters by Matt Zene. [SPEAKER_06]: Well, that just about wraps up the show for this week. [SPEAKER_06]: Thank you so much, Ray, for joining us. [SPEAKER_06]: I'm sure lots of listeners loved to find out what you're up to and follow you online.

42:10 [SPEAKER_06]: What's the best way to do that? [SPEAKER_04]: Oh, so I am Ray Redacted.com, that'll take you to either Twitter or Blue Sky, depending on where you're dialing in from. [SPEAKER_04]: And my son is Sam Watson.Social. [SPEAKER_06]: fantastic. [SPEAKER_06]: And of course, we're on social media too.

42:24 [SPEAKER_06]: You can find me, ground clearly on LinkedIn or follow smashing security on blue sky or mastodon. [SPEAKER_06]: And don't forget to ensure you never miss another episode follow smashing security in your favorite podcast apps such as Apple Podcasts, Spotify and Pocketcasts. [SPEAKER_06]: The episode shown out a bunch of info, guest lists, and the entire back catalogue of 451 episodes.

42:43 [SPEAKER_06]: Check out smashingscurity.com. [SPEAKER_06]: Until next time, [SPEAKER_06]: You've been listened to a smashing security of me, Graham Pluely, and thanks so much to Ray Redacted for joining us this week, very much appreciate that, and to this episode's sponsors, Adaptive Security Threat Locker, and Fanta, and of course to the chums who've signed up for smashing security plus over on Patreon.

43:16 [SPEAKER_06]: They include amongst their number Richard Van Leeson, which sounds less like a name and more like a European castle owning villain. [SPEAKER_06]: Billy, no surname needed, just Billy, but like Madonna or Cher I guess, Alex grew, who I assumed had to leave early and didn't have time to finish their name.

43:33 [SPEAKER_06]: Heisenberg, who's either a patreon sporter or the world's least subtle, breaking bad reference, Jeff A. [SPEAKER_06]: who's forever cursed to be first in the address book and lost in people remembering their full name, a brie bustle, a name that has beautifully with crackers, SMY, proof that vows are optional in 2026, or bruce, which sounds like a particularly rare Pokemon, uh, Ragnar Colson, legally obliged to arrive by longboat, and Sunky Von Repel, who sounds like he absolutely does not [SPEAKER_06]: Anyway, thanks to all of them, and to everyone else who supports me on Smash and Security Plus, and would you like to hear your name read out the end of the show?

44:19 [SPEAKER_06]: From time to time, maybe have a little bit of fun made out of your name at the same time, if so, consider joining Smash and Security Plus. [SPEAKER_06]: You will get early access to episodes without the annoying ads just head over to Smash and Security.com slash plus for all of the details.

44:46 [SPEAKER_00]: In overs. [SPEAKER_02]: Big, listen to the biggie. [SPEAKER_02]: Just give me the ultimate break for finally. [SPEAKER_00]: Yeah, page and our sights at last. [SPEAKER_00]: We need to lay all this. [SPEAKER_02]: I've got to be an easy ride. [SPEAKER_00]: No, we need to break DC Tolla. [SPEAKER_00]: He was caught in an artier with an NDIU.

45:00 [SPEAKER_00]: Hopefully he can help AC12 establish links with the O.C.J. [SPEAKER_02]: Great, wow. [SPEAKER_02]: Get some rest last night. [SPEAKER_00]: Yeah, listen to our EM on my MP3, then watch the ROI or so as on the BBC. [SPEAKER_00]: Let's do it.