The dark web's worst assassins, and Pegasus in the dock

0:03 [SPEAKER_02]: and I spoke to the police about this and I said what you can do about this and he says we haven't had any complaints so there's no victims. [SPEAKER_02]: Perfect crime. [SPEAKER_02]: Wow. [SPEAKER_00]: smashing security, episode 452, the dark web's worst assassins, and Pegasus in the dock, with Graham, Kluely, and Special Guest Joe Tidy.

0:34 [SPEAKER_01]: Hello, hello and welcome to smashing security episode 452, my name's Graham Kluely, and I'm Joe Tidy. [SPEAKER_01]: Joe, welcome back to the show, lovely to have you on again. [SPEAKER_01]: Of course you are the author of Control Alt Chaos, the book which we were talking about last year, about some of the astonishing hacking, particularly that case which happened with the Vastamo Psychotherapy Clinic over in Finland and the chap who was behind all of that.

0:59 [SPEAKER_02]: For my money, the cruelest cyber attack in history, I just think, you know, there hasn't been one that's been so nasty and serious and, you know, the fact that he, Julius Kivimaki, went directly after the patients and emailed them and said, I've got your therapy notes pay me or I'll publish them online.

1:15 [SPEAKER_02]: You know, the impact that had on people was absolutely enormous and that's what the book addresses and also this, this kind of cycle that we're in where young boys fall down a dark path towards cyber crime. [SPEAKER_01]: Yeah, it's a really interesting book. [SPEAKER_01]: I've greatly enjoyed reading it and it's coming out in the United States.

1:30 [SPEAKER_02]: Yeah, North America, so United States and Canada came out last year in the UK in Europe and I think other places Australia as well. [SPEAKER_02]: But yeah, big launch in the U.S. and Canada now this week. [SPEAKER_02]: very excited but that's not the only thing I've been keeping you busy because of course you are the cyber correspondent over on the BBC and you've also been pumping out some episodes recently of the cyber hack podcast too yeah it's evil core so I'm sure the listeners of smashing security will know evil core the infamous Russian cyber gang I described them as kind of like the cockroaches of cyber because they just won't die [SPEAKER_02]: sort of evolved as the cybercrime underworld has changed and shifted.

2:10 [SPEAKER_02]: So they started off in like banking trotions in the early day, sort of 2009, 10, and then moved into ransomware. [SPEAKER_02]: Now, there's pretty decent evidence that they could be working directly with the Russian state. [SPEAKER_02]: So we've done a whole podcast series all about it called as you say, cyber hack evil core.

2:26 [SPEAKER_01]: Amazing, isn't it? [SPEAKER_01]: And I think these are the guys who have, they've got Lamborghinis and they're sort of going round Moscow. [SPEAKER_01]: You've got it. [SPEAKER_01]: Am I writing remembering that you may actually have gone to Moscow to try and hunt one of them down and knocking on?

2:39 [SPEAKER_02]: That's right. [SPEAKER_01]: The front door of the father of one of them. [SPEAKER_01]: Yes. [SPEAKER_02]: You're absolutely right. [SPEAKER_02]: So it was just before the four-scale invasion. [SPEAKER_02]: So it was in the 2021. [SPEAKER_02]: And actually, I'm a bit very vividly lying on the sun lounger, my hammock and my guard and one summit.

2:55 [SPEAKER_02]: Huh, there's another load of Russians here that have been named and shamed by the West as being cyber criminals. [SPEAKER_02]: We never hear from these individuals, and it was Maxim Yakobet's was doing the rounds and you've got to assure these names, their pictures everywhere saying these are guys responsible for hundreds of millions of dollars worth of damage.

3:12 [SPEAKER_02]: Let's go there and try and find them. [SPEAKER_02]: A stupid idea, obviously. [SPEAKER_02]: But you're a braver man in the me, I believe you see, let me do it and there was all sorts of safety concerns or rest of it. [SPEAKER_02]: Yes, it was not an eye-sacignment. [SPEAKER_02]: I found it intimidating.

3:25 [SPEAKER_02]: I really did not enjoy it at all. [SPEAKER_02]: But we got pretty close, so we managed to knock on lots and lots of doors around Moscow looking for these guys and elsewhere into a place called Yoshikahala as well. [SPEAKER_02]: A thousand kilometers to the east of Moscow, she shows how big Russia is, and we spoke to the father.

3:42 [SPEAKER_02]: So that's actually we've kind of dug up some of that material for this latest series that we've done on BBC World Service, but we've done some new stuff as well, and we've told the story in much more depth and detail about this family. [SPEAKER_02]: And I co-presented it with Sarah Reinsford, who's the former Moscow correspondent, BBC, speaks slow Russian, she's an awesome lady, and we had a great time.

4:03 [SPEAKER_01]: Well, before we kick off, let's thank this week's wonderful sponsors, [SPEAKER_01]: This week on smashing security, we're not going to be talking about how Windows PCs have been refusing to shut down after a buggy patch Tuesday update. [SPEAKER_01]: You'll hear no discussion of how Russian link tacos are being blamed for an attack on the Polish power grid.

4:33 [SPEAKER_01]: And we won't even mention. [SPEAKER_01]: How 31 more people have been arrested in connection with a malware scheme designed to steal money from ATMs. [SPEAKER_02]: So Joe, what are you going to be talking about this week? [SPEAKER_02]: I'm going to talk about how Saudi Arabia is being asked to cough up after being found to hack a dissident living in the UK.

4:53 [SPEAKER_01]: And I'm going to be going on the hunt for online hitmen. [SPEAKER_01]: All this and much more coming up on this episode of smashing security. [SPEAKER_01]: Well, we've got time right now to hear from one of our sponsors, Passwork. [SPEAKER_01]: If you work in cybersecurity, you already know this.

5:11 [SPEAKER_01]: Most secrets don't get stolen, they leak. [SPEAKER_01]: Passwords placed into chat tools, shared admin accounts. [SPEAKER_01]: Those spreadsheets, everyone pretends don't exist. [SPEAKER_01]: Passwork is built to stop that. [SPEAKER_01]: It's a password manager and secrets management platform designed for organizations that want on-premise deployment.

5:29 [SPEAKER_01]: Meaning, your sensitive data stays on your own infrastructure under your control. [SPEAKER_01]: That matters if you're dealing with regulatory requirements, data sovereignty, or simply don't want your most critical secrets, living in someone else's cloud. [SPEAKER_01]: From a security perspective, password uses a zero-knowledge architecture with strong, openly documented encryption, and its design is regularly tested by independent security researchers.

5:53 [SPEAKER_01]: Operation is built for real teams, role-based access control, integration with existing identity systems, support for MFA, highly available architecture, designed to keep things running when parts of your environment fail. [SPEAKER_01]: I'm like those tools that look cheap and to start paying for them in time and stress.

6:10 [SPEAKER_01]: Passwork focuses on long-term stability, a public development roadmap and a lower total cost of ownership. [SPEAKER_01]: Passwork. [SPEAKER_01]: It's not just a password management platform, it's just a secure adaptable secrets manager built to meet your business needs. [SPEAKER_01]: To find out more, go to smashinsacurity.com slash passwork.

6:31 [SPEAKER_01]: That's smashinscurity.com, slash password. [SPEAKER_01]: So, Joe, I've got a question for you. [SPEAKER_01]: Do you have a nemesis? [SPEAKER_01]: Plenty. [SPEAKER_02]: How long have you got? [SPEAKER_02]: Ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha

6:55 [SPEAKER_02]: There's no one you'd actually like to discipline at all, you know, like a cartel person. [SPEAKER_02]: And go swim in with the fish. [SPEAKER_02]: Yeah, give them an offer they can't refuse. [SPEAKER_02]: No, no, I'm, I'm pleased to say, I don't. [SPEAKER_02]: Ah, do you? [SPEAKER_01]: Well, you know, I'm asking the question for you, Joe.

7:12 [SPEAKER_01]: You have to generally start with this, so it goes. [SPEAKER_01]: But if you did want to hire a hitman, where would you go? [SPEAKER_01]: Well, I'd go the dot net. [SPEAKER_01]: Surely the darkness. [SPEAKER_01]: The obvious place to go is no. [SPEAKER_01]: And if you went on the dark note, you may well stumble across a number of websites.

7:30 [SPEAKER_01]: There are websites called things like Bessermaphia, Camora Hitman, or my personal favorite, that delightfully unimaginatively named number one hitman marketplace. [SPEAKER_01]: Yeah, exactly. [SPEAKER_01]: All right, this has great search engine optimisation. [SPEAKER_01]: Yeah, true. [SPEAKER_01]: It sounds like the kind of place you'd find the high street, you know, between cartridge world and cartridge UK in a cabab shop and pound land.

7:54 [SPEAKER_01]: Number one hitman park it place. [SPEAKER_01]: You could have mentioned this. [SPEAKER_01]: And these websites, they promise to connect you with professional assassins. [SPEAKER_01]: Because you don't want an amateur assassin. [SPEAKER_01]: If you're going to pay for the job, you want it done properly.

8:09 [SPEAKER_01]: Right? [SPEAKER_01]: Well you'd hope so. [SPEAKER_01]: And the way in which it works is you upload a photograph of your target, so you hope that you've chosen the right image in your camera role, rather a selfie of yourself. [SPEAKER_01]: You provide them with the address of the target, maybe their daily routine, you specify, how would you like them dispatched?

8:28 [SPEAKER_01]: So a typical one would be, make it look like a robbery gone wrong. [SPEAKER_01]: Um, none usual one would be, I want it to look like a steam roller, [SPEAKER_02]: Carried down the high street and flattened them whatever it may be in my head now I'm just imagining that Austin Powers scene with the steam roller and it's moving really really slowly And the guard saying stop please stop and he just could walk out the way but he doesn't do it [SPEAKER_02]: of all the things a steam roll or you wouldn't choose that.

8:56 [SPEAKER_01]: What is there is of course the payment. [SPEAKER_01]: And on these websites you are asked to pay between five and $20,000 in crypto currency. [SPEAKER_01]: Of course some people feel like they're going to get scammed. [SPEAKER_01]: It's like, oh, you know, this may be a conhead. [SPEAKER_01]: I mean, you guys are criminals.

9:11 [SPEAKER_01]: How do I know if I give you all this Bitcoin that you're not just going to run away with it? [SPEAKER_01]: And these sites can have escrow systems because even legitimate murder for hire operations are keen on protecting their customers and their consumers. [SPEAKER_01]: And so they say, well, where we will keep it in a scroll.

9:29 [SPEAKER_01]: And so we won't get our hands on it until the job is done properly, which is [SPEAKER_01]: obviously marvellous right customer service admirable isn't it so it even gets better than that though these sites have referral programs so if you have a friend who wants someone murdered you can get them to sign up on these sites and you will earn a 10% commission apparently so you can hand out links to people and say oh you're looking for an assassin [SPEAKER_01]: I can't help you, try this link, and you will then eventually get this payment.

10:01 [SPEAKER_01]: And if you go to this site, you'll even find customer reviews. [SPEAKER_01]: I don't think they're on Trust pilot, but you'll see them there, but you'll see them listed on the actual website, saying what a great job which they've done. [SPEAKER_01]: And these whole operations are being promoted.

10:17 [SPEAKER_01]: By freelance, search engine optimization experts, based in India, they've been hired to make sure that better mafia appears that the top of the Google search results if you look for hitman fire and these other sites or pages which then tell you to install the tour browser and go and visit.

10:34 [SPEAKER_02]: I was going to say so that if they're advertising on the clear web, but there must be links to click through and find them. [SPEAKER_01]: Yes. [SPEAKER_01]: So they'll have to walk you through the process of how you're actually going to get there. [SPEAKER_02]: I suppose Google would accept a paid for ad in that new to hope not, but they can use SEO to get to the top through other means.

10:52 [SPEAKER_02]: Yes. [SPEAKER_01]: Yes. [SPEAKER_01]: Yes. [SPEAKER_01]: We would like to think that Google would not accept a ad. [SPEAKER_01]: Yeah, and then some of the stuff you see, I mean... [SPEAKER_01]: It's messed now. [SPEAKER_01]: I mean, they no longer say do no evil. [SPEAKER_01]: But yeah, I would like to think that they wouldn't.

11:07 [SPEAKER_01]: That's probably against the rules. [SPEAKER_01]: So, this is going on. [SPEAKER_01]: And what's just happened is that some authorities in Romania have just conducted rates in Bucharest and Ramliku Vulicia. [SPEAKER_01]: a city which is so notorious for cybercrime that it is literally nicknamed Hackerville.

11:26 [SPEAKER_02]: I've heard of this place. [SPEAKER_02]: That's what it's called. [SPEAKER_01]: Yes, there's your next destination, Joe. [SPEAKER_01]: I know. [SPEAKER_01]: Come to the summer holidays, head over to Hackerville, bit of a bustle and taller day. [SPEAKER_01]: For my subordinate with the kids and the family.

11:37 [SPEAKER_01]: Sounds good. [SPEAKER_01]: Exactly. [SPEAKER_01]: To a little bit of work. [SPEAKER_01]: Yeah, why do you're out there? [SPEAKER_01]: Why not? [SPEAKER_01]: So these cops they've seized about $650,000 in cryptocurrency and they're questioning two men, aged 33 and 35, who they say are connected to a website called Online Killers Marketplace.

12:01 [SPEAKER_01]: and this was done at the request of UK authorities who are investigating charges, including Insightment Murder and Money Laundering as well. [SPEAKER_01]: And this is where it gets interesting, right? [SPEAKER_01]: These websites are making money, they have customers, but also these websites are all my certainly scams.

12:21 [SPEAKER_01]: So when you go online, I'm afraid to anyone who did want to hire a hitman and if you go online looking for a hitman, bad, bad news. [SPEAKER_01]: Because you're almost certainly going to actually be going to a scam website, which is calling you out of money. [SPEAKER_01]: So no actual hitman are ever dispatched.

12:41 [SPEAKER_02]: This sounds a lot like, do you remember that story about the kill list? [SPEAKER_02]: Yes, I saw a TED talk about it from the journalists it was involved in it. [SPEAKER_02]: Oh, Miller was his next guy. [SPEAKER_02]: Yeah, I bet you've had him on it. [SPEAKER_02]: I haven't had him on, but I should get him on.

12:52 [SPEAKER_02]: Oh, he'll be next. [SPEAKER_02]: He'll be next. [SPEAKER_02]: Yeah, so I remember with that one, a cybersecurity researcher found that the hitman website on the dot net was really badly secured, so he could read all the messages. [SPEAKER_01]: So the researcher, his name was Christopher Monterero, he managed to get into the back end of the best semaphysite way back in 2016, found hundreds of names of what is known as the kill list.

13:12 [SPEAKER_01]: He exposed this person, known as Yura, who would string along customers with excuses, so you'd pay your money for the assassination, then he said, well, look, the assassins being a bit busy, [SPEAKER_01]: He's got problems getting a flight. [SPEAKER_01]: Maybe you can hand over a bit more money.

13:27 [SPEAKER_01]: He's just been arrested for cocaine possession But I've got this other assassin who can step in but he's going to require a larger payment and so they would Oh, well, con you out of further amounts of cash rather like the romance scammers. [SPEAKER_01]: Yeah, big butchering. [SPEAKER_01]: Yeah, exactly.

13:43 [SPEAKER_01]: So it's a clever scam Operational bit somewhat niche in terms of who it's targeting and of course the victims [SPEAKER_01]: I put them in quotes, the victims, the people who are trying to hire Hitman, it's not as though they're going to go to the police survey. [SPEAKER_01]: No. [SPEAKER_02]: No.

14:00 [SPEAKER_02]: It reminds me and not to bring this back to my book, but it didn't genuinely remind me of this. [SPEAKER_02]: So the main cyber criminal in my book is Julius Kivomaki, this guy that hacked the Stamo psychotherapy chain, but he also did lots of other cyber crimes when he was a teenager. [SPEAKER_02]: And the most recent thing he's been accused of is super smart, and it's almost like the perfect crime, the similar to what you're describing here is, [SPEAKER_02]: So what he did was he hijacked the the Google pages for drugs marketplaces on the darknet, changed those tour addresses to ones that he controlled.

14:31 [SPEAKER_02]: It's all a legit, hasn't been proven in court. [SPEAKER_02]: And then so people would search to clean it for better buy their drugs, the gone the darknet links, it all looks the same as the actual real marketplaces that are in inverted comms, legitimately selling drugs, but of course all the money that people are paying for the cannabis and MDMA and cocaine is going straight to him.

14:49 [SPEAKER_03]: Yeah. [SPEAKER_02]: And I spoke to the police about this and I said what you can do about this and he says we haven't had any complaints. [SPEAKER_02]: So there's no victims. [SPEAKER_02]: Perfect crime. [SPEAKER_01]: Wow. [SPEAKER_01]: Absolutely astonishing isn't it? [SPEAKER_01]: So yeah, I guess this is a problem with this one as well is who's actually going to complain.

15:06 [SPEAKER_01]: So as I said, this researcher, he exposed this person called Yura. [SPEAKER_01]: So he was outed. [SPEAKER_01]: But then the researcher was on the receiving end of threats from [SPEAKER_01]: So this person who claimed to be running a hitman for higher sight started threatening the researcher.

15:26 [SPEAKER_01]: He hired freelancers to create fake websites and blog posts claiming that Montero himself was actually running. [SPEAKER_01]: this hitman for higher website. [SPEAKER_01]: And in fact, back in February 2017, apparently was eating pumpkin soup in his London flat, so it kind of detail which I enjoy.

15:45 [SPEAKER_01]: We need that. [SPEAKER_01]: And of all the soups, he was eating pumpkin soup and armed police smashed through his door and they arrested him. [SPEAKER_01]: for running the very murder for higher website that he was trying to expose. [SPEAKER_01]: And now he was eventually released. [SPEAKER_01]: He can match it.

16:02 [SPEAKER_01]: Spending years being on the hunt and masking a cyber scammer and then find yourself arrested and being accused of the person who was actually doing it. [SPEAKER_01]: It's a bit like if it happened to you, wrote a joke. [SPEAKER_02]: Yeah, as a journalist, I look at some pretty dark stuff online and sometimes I have to be careful that we don't have the police knocking on my door.

16:27 [SPEAKER_01]: Now, the team who exposed this and the journalist who wrote about as well, they eventually identified 175 live paid for kill orders. [SPEAKER_01]: And the investigation eventually led to a roundabout 30 convictions around the world. [SPEAKER_01]: People were put in prison as a result of doing this, although it has since been claimed in fact quite recently, I believe, there may have been an additional 2,000 kill orders which had gone through that website, tragically, in at least one case, where a hired hitman predictably never materialized, the customer actually took matters into their own hands.

17:03 [SPEAKER_01]: There was a Minnesota man, [SPEAKER_01]: named Stephen All-Wine, Church Deacon, he paid $12,000 to have his wife Amy killed through the Bessar Mafia website. [SPEAKER_01]: What he didn't know was that the site had been hacked by the security researcher and was passing the information to the FBI.

17:22 [SPEAKER_01]: The FBI went round to his house to warn his wife, they sat down with his wife, with him in the room and said we want you to know that someone has been on the internet trying to hire a hitman to kill you. [SPEAKER_01]: The FBI didn't know that the actual person who'd done the [SPEAKER_01]: absolutely ghastly.

17:45 [SPEAKER_01]: The FBI saying, or you want to beef up your home security, what they didn't know was there was the person right there and then who was ultimately going to commit the crime. [SPEAKER_01]: Well, turned out he was also an active user of Ashley Madison. [SPEAKER_01]: I don't know what we can read into that as well, but [SPEAKER_01]: There's a Venn diagram there somewhere.

18:01 [SPEAKER_01]: I think there is, isn't there? [SPEAKER_01]: So we've got this bizarre situation where a criminal scam designed to steal money from would be murderers actually saved some lives by taking their cash and doing nothing. [SPEAKER_01]: But [SPEAKER_01]: We also saw the researcher exposed it getting arrested thanks to the scammer superior SEO skills and the FBI warning murder victims about their potential impending death while the killer sat behind her is just ghastly and now we've had these latest raids in Romania [SPEAKER_01]: encouraged by the UK authorities, it really sounds like the same scam is happening once again.

18:39 [SPEAKER_01]: Just as it happened before, other websites are being created claiming you can hire a hitman. [SPEAKER_01]: And in fact, it's a scam. [SPEAKER_01]: Like you said, this is a cybercrime where there may be no reports of a scam actually happening because why would people ever do this? [SPEAKER_01]: So if you're all listening to this [SPEAKER_01]: You're almost suddenly going to get scammed.

19:04 [SPEAKER_01]: I'm quite frankly, I'm pleased that you're going to get scammed. [SPEAKER_02]: As a venn diagram there as well, smash your security listeners and people who want to hire Hitman. [SPEAKER_01]: Yeah, so your details are probably being logged. [SPEAKER_01]: There's a chance that a researcher or a journalist or the cops are actually going to come knocking on your door.

19:22 [SPEAKER_02]: Well, famously, in the Silk Road case, the Russell Bright one, that was a case of Hitman being hired by [SPEAKER_02]: that's right. [SPEAKER_02]: With or without the coercion of the U.S. police, very controversial tactics were used in that case, but you know, he wanted someone dead, I think, from memory, maybe it had been two people and he went through the process of hiring them and paying the money and then the hitmen who were the police sent pictures back, faking the murder.

19:50 [SPEAKER_02]: Yeah, I don't know why people are trusting it online hitmen to carry out the job you paid them for because there's an absolutely enormous history of this going back now What was so crowed twenty eleven twenty twelve and he's now out now, of course. [SPEAKER_01]: He got pardoned didn't he?

20:04 [SPEAKER_01]: I believe by the the Trump administration. [SPEAKER_02]: Yes, he's on a sort of victory lap tour and he's become a hero So to sort of the Bitcoin community and yeah, it's a very fascinating sort of arc that's all for him. [SPEAKER_01]: No, don't ever podcast next [SPEAKER_02]: Oh, that ear already does.

20:19 [SPEAKER_02]: I'm sure yes. [SPEAKER_01]: This episode of Smashing Security is sponsored by Corview. [SPEAKER_01]: Now most security teams like to think they've got Microsoft 365 covered, they can spot suspicious logins, they can see dodgy activity, they get the alerts, but here's the problem. [SPEAKER_01]: Detection isn't enough, because when an attacker gets into your Microsoft 365 tenant and starts quietly changing the settings, like [SPEAKER_01]: Disabling conditional access, weakening defender policies, elevating admin roles, the noise often stops, and that's when the real damage begins.

20:53 [SPEAKER_01]: This is how Microsoft 365 Tenant takeovers actually happen. [SPEAKER_01]: According to Corview, 63% of tenants are still handing out broad admin rights. [SPEAKER_01]: One compromised account, and suddenly the attacker has the keys to the kingdom. [SPEAKER_01]: And if those configurations get tampered with, your backups won't save you, you could spend weeks trying to rebuild tenants settings by hand, because Microsoft doesn't give you a native way to roll back tenant level changes.

21:21 [SPEAKER_01]: attackers know this, they counten it, and that's why Corview has published a new white paper called Total Tenant Takeover, the Microsoft 365 Disaster, no one is ready for. [SPEAKER_01]: It looks at how these attacks unfold in the real world, where least privilege breaks down, and what it actually takes to recover a Microsoft 365 tenant, not just files, but the whole [SPEAKER_01]: That's smashinscurity.com slash covid.

21:54 [SPEAKER_01]: So Joe, what are you going to talk to us about this week? [SPEAKER_02]: I'm going to talk to you about a story that's just landed about four hours ago, and I've been looking into it for the BBC, right? [SPEAKER_02]: It's about a Saudi Arabian dissident called Garnham Al-Massaria, and he has been very successful in a UK high court in getting the judge to order Saudi Arabia to pay him more than three million quid, [SPEAKER_02]: So I'm sure you know about Pegasus spyware, Graham, it's the one that's made by the NSO group.

22:29 [SPEAKER_02]: This is Rayleigh firm and all the time NSO have said, look, we made this spyware, but it's only being sold to governments and it's only going to be used to bring down terrorists and organize criminals, that kind of thing. [SPEAKER_02]: But we know now after so much evidence over that [SPEAKER_02]: that NSO Group has been selling to places that have been misusing it.

22:50 [SPEAKER_02]: And it's been governments around the world, repressive regimes, that have used NSO Group's Pegasus spyware to infect the phones of dissidents, political opponents, journalists, human rights activists, that kind of thing. [SPEAKER_02]: So we know this has been happening and it's just absolutely fascinating to me that here is a kind of really solid case that's gone through the courts and Saudi Arabia has now got this unprecedented fine of more than three million quid to pay to this guy and it also brought back to me some reporting I did on Pegasus's back in or would have been about four years ago now.

23:22 [SPEAKER_02]: where I got one of my producers, brilliant producer called Joe Warley, I asked her to spy on me through my phones because I'm managed to get hold of some spyware that was like Pegasus. [SPEAKER_02]: So Pegasus is absolutely incredible and it's kind of like the most invasive malware that you could ever imagine.

23:43 [SPEAKER_02]: Because it can see everything that you're doing, right? [SPEAKER_02]: It's amazing. [SPEAKER_01]: Yes, but such you're going to listen to your conversations. [SPEAKER_02]: It's like they're over your shoulder. [SPEAKER_02]: they can see whatever's on your screen. [SPEAKER_02]: So I put some spyware that has Pegasus-like powers on my phone, and the thing is that on an android phone, this malware is there, you can buy it, may pretend that they're selling it to parents to look out for their children.

24:08 [SPEAKER_02]: In some cases like people buy it legitimately, instantly, I don't know if it is just one or not, but one of the use cases that they claim is that workers can be spied on and be monitored by their managers. [SPEAKER_02]: But, of course, people use this stalkerware to spy on their spouses and things like that.

24:24 [SPEAKER_02]: So I put it on my phone following a really lengthy and pain in the bum process. [SPEAKER_02]: It took me over two hours, I remember. [SPEAKER_02]: That's a call-up customer support for this nasty company that was selling it. [SPEAKER_02]: Anyway, got it on my phone, nice. [SPEAKER_01]: So it's not like you can just pinch someone's phone for 30 seconds and you know, maybe if you have the practice, would you have been able to do that or is it still quite involved?

24:45 [SPEAKER_02]: Okay. [SPEAKER_02]: It is very involved and that is a thing about Pegasus. [SPEAKER_02]: Pegasus can do all the things about to describe, but also Pegasus can infect a phone, just by clicking on a link, and in some cases it can be zero click, so you can just make a phone call to somebody.

24:58 [SPEAKER_02]: They don't even have to connect with the phone call just to make a connection, and then the phone gets infect with the Pegasus, that is the secret source, that is the power of Pegasus, but all the other things that run my phone actually, you know, scarily is out there if you have enough time with the device.

25:11 [SPEAKER_02]: So Joe Borley was able to see exact it was on my screen. [SPEAKER_02]: We made a video about it where she watched me in my pajamas, sat there watching TV playing candy crush. [SPEAKER_02]: And then she saw through the cameras and listened to the microphones when I was in a shop buying stuff from a stationary.

25:25 [SPEAKER_02]: She managed to see me on a map and a little dot on a map where I was when I was cycling around London. [SPEAKER_02]: I mean, you name it. [SPEAKER_02]: that phone to do it. [SPEAKER_02]: It became the ultimate espionage tool. [SPEAKER_02]: And that's what happened to this Saudi YouTuber, because as well as being a dissident, Ghanim started a YouTube channel in about I think it was 2015.

25:46 [SPEAKER_02]: He's been living in the UK since 2003 and he's a British citizen, but he started YouTube channel where he took the Mick out of the Saudi royal family and criticised [SPEAKER_02]: and then in 2018 that's when he had that infection with Pegasus and things started getting really, really weird for him.

26:05 [SPEAKER_02]: And I've got here the court documents and I was going to show you exactly what happened and how he got infected. [SPEAKER_02]: So I think the listeners, the smash discrepancy would be interested now, wouldn't they? [SPEAKER_02]: Oh yeah, absolutely. [SPEAKER_02]: So, between the 20th June 2018 and 24th June 2018, the claimant received and clicked on the following text messages.

26:23 [SPEAKER_02]: The message he received as iPhone 7 was reported from someone called Nickel Edge, which is apparently a Middle Eastern newspaper. [SPEAKER_02]: The text message stated, in translation it would have been an Arabic of course. [SPEAKER_02]: Yeah. [SPEAKER_02]: Now it's read to subscribe to our college newspaper's text messaging service and continue to link to a webpage with the URL mid east hyphen today.com and then slash and then lots of numbers and letters and that was enough.

26:51 [SPEAKER_02]: So we clicked on that and that installed Pegasus and the second round just the good measure I think that did it twice. [SPEAKER_02]: Oh no, there's a different phone. [SPEAKER_02]: That's why it was an iPhone X this time and that is sent out a few days later. [SPEAKER_02]: And it was a classic one that we get all the time from Scammers.

27:04 [SPEAKER_02]: Dear customer, your DHL shipment number, isn't it? [SPEAKER_02]: Oh, no. [SPEAKER_02]: Yeah, I hope you didn't click on that one. [SPEAKER_02]: I'm afraid it did. [SPEAKER_02]: Oh, but it was 2018. [SPEAKER_02]: So, you know, I mean, it wasn't as known to was it back then. [SPEAKER_02]: And this is the clever bit as well.

27:17 [SPEAKER_02]: It was you can manage your delivery at http4slashbubber. [SPEAKER_02]: TinyURl.com forward slash, that's smart. [SPEAKER_02]: And it contained a link to web page with the URL sundaydeals.com. [SPEAKER_02]: And that was it for this man, unfortunately. [SPEAKER_02]: That was how he got infected with Pegasus.

27:36 [SPEAKER_02]: And, you know, in some cases, it's a kind of really interesting cybersawed story, cybersawed story. [SPEAKER_02]: But it's also a human story as well, because this guy, his YouTube channel, was enormous, and his enormous, he's like, you know, done really, really well, 300 million views since he started it.

27:49 [SPEAKER_02]: But it's also since 2018, he started noticing there were people turning up where he was. [SPEAKER_02]: So, for example, strange incidents where at one stage someone was, he walked out of a shop in London and there was a little kid singing a song about Saudi Arabia and how wonderful it is and saying that critics will be punished and then someone filming her singing at him and then other instances as well where people just happen to be exactly where he was and shouting things at him He's not that famous, you know, he's not a famous enough people stopping in the street [SPEAKER_01]: It sounds like a deliberate attempt to maybe make content which could be posted online, taking the Mickey out of him.

28:28 [SPEAKER_02]: Yes, and there were hashtags devoted to bringing him down and discrediting him and worse, you know, some threats to him. [SPEAKER_02]: And then there was a really nasty incident in 2018 where he came out of a cafe in night's bridge, again, you know, how did they know he was there? [SPEAKER_02]: And he was assaulted by two men, punched and beaten up, and they shouted slogans at him and things like that.

28:50 [SPEAKER_02]: And one of them was wearing an earpiece. [SPEAKER_02]: So I think what's interesting for me is, you know, this is a really nasty story and I spoke to him and he said, you know, having that spy where on my phone was like a shadow hanging over me. [SPEAKER_02]: Yeah. [SPEAKER_02]: All times I felt watched and listened to, he scared to go to central London.

29:06 [SPEAKER_02]: He hasn't been back in central London. [SPEAKER_02]: But it's also a case, now that it's been through all these caught hearings, and now we've got this definitive ruling from the judge, it feels like, wow, okay, here's a real kind of evidence picture of what it's like to have Pegasus on your phone and to be stalked and harassed, and in some cases assaulted, you know, this is rare, this is a rare thing.

29:26 [SPEAKER_02]: I have interviewed someone before who had Pegasus on his phone as well, and African political opponent. [SPEAKER_02]: But here's someone who lives in the UK, lives in normal life as a British citizen, but is being hacked and having their life really impacted by a government half across the world.

29:44 [SPEAKER_01]: Do we know how they found out that their phone had been hacked at what point they realized? [SPEAKER_02]: Yeah, well, that's a group called Citizen Lab. [SPEAKER_02]: Yes, they've really famous for being able to find out whether or not someone has Pegasus on their phone. [SPEAKER_02]: When you hear these stories about journalists and people having Pegasus on their phone, [SPEAKER_02]: It's citizen lab who will take the device and they will do a search and they will scan it and they'll find it.

30:07 [SPEAKER_02]: And that's how you get this trail of the text message here led to all these URLs being accessed and and all this data about export traded all that sort of stuff. [SPEAKER_02]: So they confirmed it. [SPEAKER_01]: So he presumably was suspicious that maybe his own could have been come from right.

30:21 [SPEAKER_01]: Okay, that's that's what I was wondering right. [SPEAKER_02]: And what's interesting is the judge, although the judge can never be 1,000% sure that this is true. [SPEAKER_02]: They said, based on the evidence that's been presented, I'm convinced that the Kingdom of Saudi Arabia or agents on its behalf carried out not only the hack, but also the assault on him as well.

30:41 [SPEAKER_01]: Boy, no, boy. [SPEAKER_01]: So there's been this rule in now in a British court and how much money was it? [SPEAKER_02]: Three million hang on. [SPEAKER_02]: I'll get the exact number. [SPEAKER_02]: I can actually go to the the copy that I wrote earlier. [SPEAKER_02]: Let's see. [SPEAKER_02]: This is unpublished at the moment Graham.

30:57 [SPEAKER_02]: So you've got a sneak peak of my unpublished reporting. [SPEAKER_02]: Okay. [SPEAKER_02]: So the total damages awarded by the court are three million and 25,662 pounds and 83 [SPEAKER_02]: Wow, why did they put that in? [SPEAKER_01]: I don't understand. [SPEAKER_01]: And anyway, the 83-pence that is pocket money for the Saudi royal family, I suspect.

31:21 [SPEAKER_01]: But what are the actual chances that this is ever going to actually be paid? [SPEAKER_01]: I mean, it's great that the judgment has happened. [SPEAKER_02]: This is the problem. [SPEAKER_02]: So Saudi Arabia tried to get political immunity from this core case way back in. [SPEAKER_02]: I think it began in 2019.

31:35 [SPEAKER_02]: But in 2022, that was overall. [SPEAKER_02]: And since then, since their political immunity has been removed, Saudi Arabia has not participated in any of the court hearings. [SPEAKER_02]: So the judge said that everything that's been decided is because Saudi Arabia doesn't seem to have any defense and doesn't seem to want to defend itself in any way.

31:53 [SPEAKER_02]: Certainly, you know, we're going to as other journalists have reached out to them and see if they got anything to say on this. [SPEAKER_02]: But they've just remained silent ever since that immunity's been taken away. [SPEAKER_02]: And I spoke to Ghana and I said, you know, congratulations, you've got, you've got the compensation potentially coming more importantly, you know, you've got this ruling, but you really think you're going to get paid and he said he has no idea the Saudi Arabian government is very unpredictable as how he described it.

32:17 [SPEAKER_02]: But he said that there are other mechanisms he can use. [SPEAKER_02]: So for example, he will try and go to the international courts if Saudi Arabia doesn't pay. [SPEAKER_02]: You're right, it's peanuts, it's peanuts, but does it in some way it's still important. [SPEAKER_02]: you know it's bad pressed in a sense if they if they pay isn't it but what we will see we will see how it goes I suppose one thing Ganem can feel a little bit pleased about it's at least the Saudis no his bank account details if they want to make the transfer they could still automatically that's right it'll just wake up one morning it's there [SPEAKER_01]: Okay, before we go any further, I need to share a quick word with you about one of our sponsors today, Vanta.

32:55 [SPEAKER_01]: You know how everyone's got an AI assistant these days. [SPEAKER_01]: Well, imagine one that doesn't just write high-cours about zero-day modern abilities, but actually does your audit work for you. [SPEAKER_01]: That is Vanta. [SPEAKER_01]: It connects to all of your tools, gather's evidence, tracks, compliance, and quietly helps you prove that [SPEAKER_01]: Vanta automates all of that.

33:18 [SPEAKER_01]: It pulls everything together, keeps an eye on your systems and basically make sure you're ready for an audit at any time, which means no last minute panic for screenshots and policies. [SPEAKER_01]: It also plugs into the tools you're already using and flags up issues before they become a right-ordnest.

33:35 [SPEAKER_01]: So if that sounds like something that might save you from a few sleepless nights, check out vantar.com slash smashing. [SPEAKER_01]: And if you use that link, you'll get $1,000 off. [SPEAKER_01]: So don't forget, vantar.com slash smashing, and thanks to vantar for sponsoring this week's episode.

33:55 [SPEAKER_01]: On with the show. [SPEAKER_01]: And welcome back and you join us at our favourite part of the show, the part of the show that we like to call Pick of the Week. [SPEAKER_01]: Pick of the Week is the part of the show, everyone chooses something that I could be a funny story, a book that they've read a TV show, a movie or record a podcast or website or an app.

34:13 [SPEAKER_01]: Whatever they wish, it doesn't have to be security-related necessarily. [SPEAKER_01]: Well, my Pick of the Week this week is not security-related. [SPEAKER_01]: I was on the channel 4 on demand streaming service and I found this movie, came out a few years ago. [SPEAKER_01]: and it is a comedy drama martial arts coming of age fantasy.

34:31 [SPEAKER_01]: What else could you need? [SPEAKER_01]: You said, again, comedy drama martial arts coming of age fantasy. [SPEAKER_01]: Wow, it's got everything. [SPEAKER_01]: It's got everything. [SPEAKER_01]: It is set in the present day UK, features two young sisters and it is called polite society.

34:45 [SPEAKER_01]: Have you seen polite society, Joe? [SPEAKER_02]: I have not, but now I want to see this coming of age drama, comedy singing in my Bob with a sci-fi elements. [SPEAKER_01]: Well, it's rather fun. [SPEAKER_01]: I have to say this British movie. [SPEAKER_01]: One of the sisters her name is Riyashi wants to be a stunt woman.

35:01 [SPEAKER_01]: Her older sister Lena is an art school dropout and she's seduced into a marriage with a smart me get. [SPEAKER_01]: and her little sister is not at all happy about this and so spurred on by her rather overactive imagination as to what this man might be like who is wooing her sister. [SPEAKER_01]: She comes up with devious machinations as to how to ruin their relationship and she tries to engineer a breakup with the help of her school friends.

35:29 [SPEAKER_01]: This movie is utterly bonkers. [SPEAKER_01]: And I promise you, you will watch it with an enormous smile on your face. [SPEAKER_01]: I found it incredibly charming. [SPEAKER_01]: And just when you think this cannot get, I mean, there is not some martial arts. [SPEAKER_01]: It's an amazing kick, you know, it's all like, and that's just us together.

35:47 [SPEAKER_01]: And all the rest of it, it's very funny, very stylishly done. [SPEAKER_01]: A bit like a Bollywood movie in some ways. [SPEAKER_01]: And then in the third act of the movie, the last third, things go, don't give it away. [SPEAKER_01]: Well, I say his things go absolutely bad, crazy. [SPEAKER_00]: Nice.

36:04 [SPEAKER_01]: And you just think, wow, I thought this was just a comedy drama martial arts coming of age fantasy. [SPEAKER_01]: I was not expecting it to be a comedy drama martial arts coming of age fantasy with, be [SPEAKER_01]: Yep, elements in it as well. [SPEAKER_01]: Okay, so there's a bit of genre bust in all the way through intrigued.

36:22 [SPEAKER_01]: It's really outlandish. [SPEAKER_01]: It's unexpected, but go with it. [SPEAKER_01]: I did and I really enjoyed it. [SPEAKER_01]: I found it charming. [SPEAKER_01]: I looked up on Wikipedia. [SPEAKER_01]: I had great reviews, but hardly made any money at all. [SPEAKER_01]: Yeah, I've never heard of it.

36:35 [SPEAKER_01]: I just think, I don't know if it was the title, polite society, maybe that didn't work. [SPEAKER_01]: It's ridiculous fun so I would recommend polite society if you can't see it anywhere else It is currently on channel 4's 4 player or whatever they call it and I enjoyed a great deal So that is my pick of the week [SPEAKER_02]: How does it rank Graham in the list of films that suddenly take a real U-turn?

37:00 [SPEAKER_02]: Oh, do you remember the film from Dust Till Dawn? [SPEAKER_02]: Yes. [SPEAKER_02]: For me, that is the one that you just go, what? [SPEAKER_02]: Yep. [SPEAKER_02]: I mean, you obviously, you go into it knowing there's vampires in it, but if you didn't, if you didn't know it, you didn't really.

37:10 [SPEAKER_01]: Oh, wow. [SPEAKER_01]: You mustn't let it experience. [SPEAKER_01]: I went to the cinema to see from Dusk Tool Dawn, and I just made of mine, and we just said, oh, let's go to the cinema. [SPEAKER_01]: So we went to sit, we didn't ever want to watch. [SPEAKER_01]: Went to see Dusk Tool Dawn, and we thought it was just a road movie.

37:22 [SPEAKER_01]: And then, oh, my flipping god. [SPEAKER_01]: Yeah, Apple. [SPEAKER_02]: Soon as the Anaconda comes out, it all changes. [SPEAKER_02]: It's so bizarre. [SPEAKER_02]: It's a really good sort of tense, as you say, like a getaway road movie with two criminals. [SPEAKER_02]: then they find themselves with their victims inside a barn in the middle of the US countryside and then suddenly there's vampires everywhere.

37:44 [SPEAKER_01]: Have you seen sinners yet, which is Oscar-nominated? [SPEAKER_02]: I was thinking, just think about sinners, yeah. [SPEAKER_02]: It does the same thing, it does. [SPEAKER_02]: Although it's sort of like, it's a bit creepy throughout, isn't it? [SPEAKER_02]: So you know something's coming, but yeah, you have to get probably what?

37:59 [SPEAKER_02]: 45 minutes in until there's some actual vampire action. [SPEAKER_01]: At least, but yeah, I'd recommend sinners as well. [SPEAKER_02]: I hated the ending of sinners though. [SPEAKER_02]: Did you? [SPEAKER_02]: I won't say that because it all annoyed people who haven't seen it. [SPEAKER_02]: I'm sure I'm in the wrong.

38:11 [SPEAKER_02]: It's going to win at every Oscar going so I'm in the wrong. [SPEAKER_01]: Well, it may well do. [SPEAKER_01]: But in the meantime, go and check out polite society my pick of the week. [SPEAKER_01]: Joe, what's your pick of the week? [SPEAKER_02]: My pick of the week is very random. [SPEAKER_02]: So I've been on your show twice before, and I've picked maybe three times, and I've picked extremely random things.

38:33 [SPEAKER_02]: So I think I chose my pond once, and a wildlife camera, where I managed to get a rat on camera. [SPEAKER_02]: So this one's equally as random. [SPEAKER_02]: I have become a 3D printing geek. [SPEAKER_02]: Ooh. [SPEAKER_02]: Over Christmas, I got myself a 3D printer. [SPEAKER_02]: Yeah. [SPEAKER_02]: It's a quite cheap one, actually.

38:52 [SPEAKER_02]: Like four, four generations ago, type thing. [SPEAKER_02]: Yeah. [SPEAKER_02]: And I just, I've loved it. [SPEAKER_02]: So the amazing thing is I even sort of clock this until my wife pointed out that she wishes she'd have known about this about me. [SPEAKER_02]: I used to be a real geek at sort of games workshop and Warhammer.

39:09 [SPEAKER_02]: Oh yeah, I used to buy it as well. [SPEAKER_02]: I used to pester my parents to buy me those little figurines and then I would sit and paint them. [SPEAKER_02]: I never actually played them, but me and my kids [SPEAKER_02]: for the last sort of six months have been coming up with an idea for a board game based around you know, little miniatures.

39:24 [SPEAKER_02]: And I thought instead of sending them off to be printed from someone else, I'm going to make them myself. [SPEAKER_02]: And I've just loved it. [SPEAKER_02]: I've loved every second of it. [SPEAKER_02]: In fact, I've banned myself the last few days from using this really printed because I've just been so obsessed.

39:38 [SPEAKER_02]: There's something about it like you just said it going and then two hours later you come back and [SPEAKER_02]: Has it worked? [SPEAKER_02]: Has it worked? [SPEAKER_02]: Yes. [SPEAKER_02]: The learning curve is obscene. [SPEAKER_02]: Right. [SPEAKER_02]: And some of my first few days of trying to successfully resin 3D print with just a shambles.

39:53 [SPEAKER_02]: and it gets everywhere and it's really like bad for you and it's toxic and stuff, the kids are well away from it. [SPEAKER_02]: But I sort of hit a groove and now I've got my little army of these little miniatures which I've been setting out like a complete dog. [SPEAKER_02]: But I love it.

40:07 [SPEAKER_02]: I absolutely love it. [SPEAKER_02]: And what's been a really interesting part of the process has been the use of AI. [SPEAKER_02]: So, [SPEAKER_02]: And in the BBC, and I'm sure it's the same in many places, there's a very cautious outlook on using AI because it's potentially security risk, going to make some mistakes and stuff.

40:23 [SPEAKER_02]: Yeah, but in on my own, just unleashing the creativity, it's been absolutely incredible. [SPEAKER_02]: So I've asked Google Gemini to create an alien soldier. [SPEAKER_02]: Then I've asked another program called Meshie. [SPEAKER_02]: to create that 2D image into a 3D model. [SPEAKER_02]: Then I've gone into another one that actually allows you to build the models in the 3D printing software.

40:44 [SPEAKER_02]: Right. [SPEAKER_02]: All day high and I've got zero knowledge and I can do all of these things and it's actually in form my reporting a little bit because we talk about AI quite often we talk about the downsides. [SPEAKER_02]: But then actually it's opened up. [SPEAKER_02]: I wouldn't have been able to do this two years ago.

40:59 [SPEAKER_01]: There's no way I can appreciate that that's great and obviously you'll have fun with your kids and that's terrific and not a level of that But don't you feel like you're not learning, you know, it's like if it does too much for years Could your brain turn into the kind of mush which was being produced by your 3D printer in those early experiments?

41:17 [SPEAKER_02]: Well it's you late for that anyway Graham My brain is already mushroom and mushroom on time But no you're right, I think Would I get more out of it if I actually did the illustrations for these things myself? [SPEAKER_02]: Yes [SPEAKER_02]: would I get more out of it if I somehow turned a 2D image into a 3D model?

41:34 [SPEAKER_02]: Yes, that would make me so much more computer-skilled for, you know, I don't know how to do me how you do it. [SPEAKER_02]: But would I do it? [SPEAKER_02]: No. [SPEAKER_03]: Right. [SPEAKER_02]: I don't have the time, I don't know the inclination to do it. [SPEAKER_02]: But here's a process now which has been completely opened up.

41:51 [SPEAKER_02]: And I look back, and I think about my poor parents, and the hundreds and hundreds of pounds of their money, their hard-owned cash that I spent on these stupid little figurines, which I'm now knocking out in the space of a couple of hours in my garage, and it's just fascinating to me, and I strongly recommend it.

42:09 [SPEAKER_02]: It's not crazy money. [SPEAKER_02]: I think 3D printer was about 250 quid. [SPEAKER_01]: Which maker of 3D printer did you get? [SPEAKER_01]: I know he said it was a few generations old. [SPEAKER_02]: Yeah, I got an L.A. Gu's Saturn III. [SPEAKER_02]: So I think L.A. Gu is a big Chinese firm.

42:22 [SPEAKER_02]: They're on like Jupiter series or whatever. [SPEAKER_02]: My one is a Saturn. [SPEAKER_02]: I'm not doing an algorithm. [SPEAKER_01]: You recommend it if someone's where you would have to speak that into. [SPEAKER_01]: Yeah. [SPEAKER_02]: But there are lots of others. [SPEAKER_02]: And I'm sure you can get way better.

42:36 [SPEAKER_02]: And I'm sure they're a better mix. [SPEAKER_02]: But it's proving to be really fun. [SPEAKER_02]: And I'm really enjoying it. [SPEAKER_01]: Oh, that's good. [SPEAKER_01]: Fantastic. [SPEAKER_01]: And that just about wraps up the show for this week. [SPEAKER_01]: Thank you so much. [SPEAKER_01]: Joe for joining us.

42:48 [SPEAKER_01]: Really appreciate you coming on. [SPEAKER_01]: I'll spend your time with us. [SPEAKER_01]: Sure lots of our listeners would love to find out what you're up to and follow you online. [SPEAKER_01]: What's the best way for them to do that? [SPEAKER_02]: Well, I am one of the Twitter Exodus people.

42:59 [SPEAKER_02]: So you won't really find me on there. [SPEAKER_02]: I'm on Blue Sky, LinkedIn, Threads, Instagram, TikTok, I mean basically everything except Twitter these days. [SPEAKER_02]: And you can find out about my book, control lock chaos, just give it a Google. [SPEAKER_02]: And I see Graham behind you on the bookshelf.

43:15 [SPEAKER_02]: I see my book and it makes me very, very happy. [SPEAKER_01]: Thank you very much. [SPEAKER_01]: There you are. [SPEAKER_02]: Very, very lovely. [SPEAKER_01]: Well, and we can follow Smash and Security on social media as well. [SPEAKER_01]: Find me, Grand Clearly, on LinkedIn, or follow Smash and Security on Blue Sky and Reddit.

43:31 [SPEAKER_01]: And don't forget to ensure you never miss an other episode follow Smash and Security in your favourite podcast app, such as Apple Podcasts, Spotify and Pocketcasts for episode show notes, sponsorship info, guest lists, and the entire back catalog of over 450 episodes. [SPEAKER_01]: Check out Smash and Security.com.

43:47 [SPEAKER_01]: Until next time, cheer you up, bye, bye, bye, bye. [SPEAKER_01]: Now, there you've been listening to Smash and Security with me, Grand Clearly, thanks so much to Joe Tidey for joining us this week, and to this episode's Sponsors Vanta Passwork and Call of You, and, of course, to all of you, Chums who've signed up for Smash and Security Plus, over on Patreon.

44:13 [SPEAKER_01]: They get the benefit of Adfree episodes, an early access to new episodes of Smash and Security, as well of course, those people include Henry Walshaw, who sounds like you should [SPEAKER_01]: Christophe Gussons, who all my certainly has strong opinions about beer, Sunky Von Rapel, which feels like a Bond villain.

44:34 [SPEAKER_01]: Jay, who's decided to remain gloriously minimalist with just the one character, Maya has brought her own explanation mark for emphasis. [SPEAKER_01]: Ragnar Carson, who arrives wielding an axe and demand in better multi-factor authentication, meanwhile Richard Mortner owns a very serious fountain pen and Mark Norman finishes things off, like a man who's definitely reset your router, at least once.

44:58 [SPEAKER_01]: Would you like to hear your name read out the end of the show from time to time? [SPEAKER_01]: Well, smashing security plus may just be for you. [SPEAKER_01]: Of course, I know not everyone can stretch to $5 per month, and that's perfectly fine if you can't afford to sign up for smashing security plus.

45:14 [SPEAKER_01]: It's absolutely no pressure to become a patron where you could do, as you could tell your friends that you really like smashing security instead every little bit helps, and it really does make all the effort worthwhile. [SPEAKER_01]: Well, I hope you've enjoyed this week's episode, and I'll go to tune in for next week as well.

45:28 [SPEAKER_03]: Until then, Cheerio, bye-bye.