Smashing Security – Details, episodes & analysis

We unpack how some password managers can be tricked into coughing up your secrets, with a clickjacking sleight-of-hand, what website owners can do to prevent it, and how to lock down your personal password vault.

Then we time-hop to the post-quantum scramble: "harvest-now, decrypt later", Microsoft's 2033 quantum-safe pledge, and whether your printer will survive the update apocalypse.

All this, plus a gloriously dodgy URL “shadyfier,” and turning the iconic iMac G4 into a modern media hub.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veteran Graham Cluley, joined this week by special guest Thom Langford.

EPISODE LINKS:

• DOM-based Extension Clickjacking: Your Password Manager Data at Risk - Marek Tóth.
• Major password managers can leak logins in clickjacking attacks - Bleeping Computer.
• Microsoft to Make All Products Quantum Safe by 2033 - Infosecurity Magazine.
• Shady URL.
• DockLite G4 - Juicy Crumb.
• I perfected the iMac G4 - YouTube.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

In episode 431 of the "Smashing Security" podcast, a self-proclaimed crypto-influencer calling himself CP3O thought he had found a shortcut to riches — by racking up millions in unpaid cloud bills.

Meanwhile, we look at the growing threat of EDR-killer tools that can quietly switch off your endpoint protection before an attack even begins.

And for something a little different, we peek into the Internet Archive’s dystopian Wayforward Machine and take a detour to Mary Shelley’s resting place in Bournemouth.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Allan "Ransomware Sommelier" Liska.

Episode links:

• Crypto Influencer Sentenced to Prison for Multi-Million Dollar “Cryptojacking” Scheme - US Department of Justice.
• Ransomware crews don't care about your endpoint security – they've already killed it - The Register.
• Way Forward Machine - The Internet Archive.
• Mary Shelley’s grave - Atlas Obscura.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Proton Drive - Protect your files with end-to-end encryption in Switzerland’s secure cloud — only on Proton Drive.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

A GCHQ intern forgets the golden rule of spy school — don’t take the secrets home with you — and finds himself swapping Cheltenham for a cell. Meanwhile, an Australian hacker flies too close to the sun, hacks his way into a US indictment, and somehow walks free... only to get booted back Down Under.

Plus: flow states, Bob Mortimer, and the joys of pretending to carry an owl around on a cushion.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• The Cheltenham Doughnut - Wikipedia.
• Summer placements - GCHQ.
• Spy school dropout: GCHQ intern jailed for swiping classified data - The Register.
• Former GCHQ intern jailed for taking top secret files home - Crown Prosecution Service.
• United States government says it will deport Australian hacker David Kee Crees  - ABC News.
• Australian national known as “DR32” sentenced in U.S. federal court  – DataBreaches.
• ICE takes steps to deport the Australian hacker known as “DR32” – DataBreaches.
• Aussie Travel Cover has hundreds of thousands of records stolen in hacking, policy holders not informed - ABC News.
• Australian cybercriminal to be deported from US - Information Age.
• Government sites hit by Aussie Travel Cover hacker - ZDNET.
• Abdilo, Australia-based computer hacker, live streams attack on US education sites - ABC News.
• Bob Mortimer's Pet Owl - YouTube.
• And Away… by Bob Mortimer - Simon & Schuster.
• Flow by Mihaly Csikszentmihaly -  HarperCollins.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Flare - Uncover the latest threats across the dark web and Telegram. Start your free trial today.
• Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Carole takes us into the sinister side of Barbie, while Graham describes a stalkerware operation that has been spilling its secrets.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• SpyHide couldn’t hide forever - Maia arson crimew.
• Spyhide stalkerware is spying on tens of thousands of phones - ​TechCrunch.
• Coalition against Stalkerware.
• Use Google Play Protect to help keep your apps safe and your data private - Google.
• Eyeing Barbie movie download? Beware of online scam, says McAfee - Tech News.
• A Complete History of the Barbie Movie - Vanity Fair.
• 20 Things You Probably Didn't Know About Barbie - Readers Digest.
• Influencer's 'Honest Review' of 'Barbie' Goes Viral - Newsweek.
• How scammers are using ‘Barbie’ craze to steal personal information - The Hill.
• ‘Barbie’ Box Office to Blast Past $700M Globally After Record Week - The Hollywood Reporter.
• Scammers Love Barbie: Fake Videos Promote Bogus Ticket Offers That Steal Personal Info - McAfee.
• History vs Hollywood.
• Weird: The Al Yankovic story - History vs Hollywood.
• The News Meeting - Tortoise podcasts.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Kolide – Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Device Trust for Okta. Watch the demo today!
• Hunters – A SOC platform, built to empower your security team to reduce risk, complexity and costs.
• Moonlock - The cybersecurity wing of MacPaw. Developers of CleanMyMac X antimalware tech, Moonlock Engine.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Twitter at @SmashinSecurity, or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Dr 90210 finds himself in a sticky situation after his patients' plastic surgery photos AND more end up in the hands of hackers, emails to the US military end up in the wrong hands, and script kiddies salivate at the thought of Business Email Compromise powered by generative AI.

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by T-Minus Space Daily’s Maria Varmazis.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• 90210 plastic surgeon Dr Gary Motykie.
• Dr Gary Motykie videos - YouTube.
• More plastic surgery patients have their nude photos and information leaked - DataBreaches.net.
• Typo watch: 'Millions of emails' for US military sent to .ml addresses in error - The Register.
• Hundreds of thousands of US military e-mails wind up in Mali - Le Monde.
• Beware of WormGPT: AI Tool Enables Cyber Attacks and Impersonation Scams - IB Times.
• WormGPT: a generative AI tool to compromise business emails - CSO Online.
• WormGPT - The Generative AI Tool Cybercriminals Are Using to Launch BEC Attacks - SlashNext.
• “Who shat on the floor at my wedding?”
• Futurama - Wikipedia.
• Radiooooo.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Kolide – Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Device Trust for Okta. Watch the demo today!
• ClearVPN - Hide your IP address, browse without geo-restrictions, and stay private online with a 30 day free trial of its premium plan.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Twitter at @SmashinSecurity, or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Former Prime Minister Boris Johnson wants to hand over his WhatsApp messages - or does he? And a couple of fun-loving girls from Aberdeen have come up with a sinister twist on sextortion scams.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley (from a mystery location) and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• The UK Covid-19 Inquiry.
• Court orders ministers to hand Boris Johnson’s WhatsApps to Covid inquiry - The Guardian.
• Boris Johnson ‘has forgotten’ passcode for phone wanted by Covid inquiry - The Guardian.
• The Lockdown Files: Matt Hancock rejected expert advice on care home testing, WhatsApp messages reveal - The Telegraph.
• Boris Johnson's Personal Phone Number Has Been Hiding in Plain Sight Online For 15 Years - Vice.
• Party girls netted £120,000 from terrified men in ‘sextortion’ scam -The Times.
• Exclusive: Women posed as underage girls to blackmail men out of nearly £122000 -Press and Journal.
• Musicless music video of Lionel Richie’s “Hello” - YouTube.
• Musicless music video of Rolling Stones performing live in 1964 - YouTube.
• Intrigue: Burning Sun - BBC podcast.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Kolide – Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Device Trust for Okta. Watch the demo today!
• Drata – With over 14 frameworks including SOC2, GDPR, HIPAA, and ISO 27001, Drata gets you audit-ready for crucial security standards needed to scale your business. As a listener to Smashing Security you can save 10% off Drata and have implementation fees waived.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Twitter at @SmashinSecurity, or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Going for a jog can be bad for your privacy (but even worse for your health), and Britain's consumer finance champion finds his face is being faked.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• Russian commander shot dead after posting runs on Strava running app - Kyiv Post.
• Martin Lewis felt 'sick' seeing deepfake scam ad on Facebook - BBC News.
• How synthetic media, or deepfakes, could soon change our worldeing deepfake scam ad on Facebook - 60 Minutes on YouTube.
• Nicki Minaj wants to delete the “whole internet” after viral AI deepfake video -Technology Inquirer.
• Fears grow of deepfake ID scams following Progress hack - Ars Technica.
• “Deep Fake Neighbour Wars”: ITV’s comedy shows how AI can transform popular culture -The Conversation.
• ”My Old School” - BBC Scotland.
• ”My Old School” trailer - YouTube.
• MP doesn’t know whether she attended Downing St Party - YouTube.
• ”Non-Censored” with Rosie Holt podcast - Audioboom.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Kolide - Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Device Trust for Okta. Watch the demo today!
• Sysdig - Is your cloud secure? Not without runtime insights! Sysdig delivers the industry's ONLY complete, consolidated Cloud-Native Application Protection Platform (CNAPP) - powered by runtime insights - to prioritize critical risks and stay ahead of unknown threats. Learn how runtime insights reduces fatigue so developers can focus on delivering software and your security teams can focus on other demands.
• Drata – With over 14 frameworks including SOC2, GDPR, HIPAA, and ISO 27001, Drata gets you audit-ready for crucial security standards needed to scale your business. As a listener to Smashing Security you can save 10% off Drata and have implementation fees waived.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Twitter at @SmashinSecurity, or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Just how much do porn websites know about your sexual peccadillos? How are Barbie dolls involved in identity scams? And would you trust a completely free telly?

Oh, and Graham has some opinions to share about "Indiana Jones and the Dial of Destiny".

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Matt Davey from the "Random but Memorable" podcast.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• Pornhub Is Being Accused of Illegal Data Collection - Wired.
• StopDataPorn brings Pornhub to court for abusing users’ personal data with GDPR complaints - StopDataPorn.
• The Password Game - Neal.fun.
• The True Cost of a Free TV - Wired.
• Telly dual-screen TV first look: it’s free and may be the future - The Verge.
• Swindlers Used Barbie Dolls to Rob COVID Relief Program - The Messenger.
• How rampant abuse by fintech fueled covid relief fraud - The Washington Post.
• 'Biggest fraud in a generation': The looting of the Covid relief plan known as PPP - NBC News.
• "We Are Not the Fraud Police": How Fintechs Facilitated Fraud in the Paycheck Protection Program - Fox News.
• ‘The Dial Of Destiny’ Is Now The Worst-Reviewed ‘Indiana Jones’ Movie - Forbes.
• “Jury Duty” TV series - Wikipedia.
• “Jury Duty” trailer - YouTube.
• Spray Cork: What Is It? - Build with Rise.
• CorkSol.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Kolide – Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Zero Trust for Okta. Watch a demo today!
• NordLayer – NordLayer safeguards your company’s network, securing and protecting remote workforces as well as business data. It can even help you ensure security compliance. Get your first month free.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Twitter at @SmashinSecurity, or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

UPS delivers some smishing advice (but have they kept something under wraps?), we ask ChatGPT to take a long hard look at itself, and we debate what the penalty should be for taking national secrets home with you.

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Host Unknown's sole founder Thom Langford.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• UPS discloses data breach after exposed customer info used in SMS phishing - Bleeping Computer.
• Example of UPS SMS phishing message related to Lego order - Twitter.
• Another example of a Lego-related UPS phishing message - Twitter.
• Former FBI Analyst Sentenced for Retaining Classified Documents - US Department of Justice.
• How The Intercept might have helped unmask Reality Winner to the NSA - Graham Cluley.
• Bad adverts leave people scratching their heads - MSN.
• How Cybercriminals Can Perform Virtual Kidnapping Scams Using AI Voice Cloning Tools and ChatGPT - Trend Micro.
• Which Jobs Will Be Most Impacted by ChatGPT? - Visual Capitalist.
• Unraveling an AI Scam with AI - Imperva.
• 100,000 Hacked ChatGPT Accounts Discovered on Dark Web - Hackread.
• 97+ ChatGPT Statistics & User Numbers In June 2023 (New Data)  - Nerdy Nav.
• “Speed Cubers” - Netflix.
• Trailer for “Speed Cubers” - YouTube.
• KBDcraft.
• ”How to Win Friends and Disappear People” - Qcode Podcasts.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Bitwarden – Password security you can trust. Bitwarden is an open source password manager trusted by millions of individuals, teams, and organizations worldwide for secure password storage and sharing.
• Kolide – Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Zero Trust for Okta. Watch a demo today!
• Drata – With over 14 frameworks including SOC2, GDPR, HIPAA, and ISO 27001, Drata gets you audit-ready for crucial security standards needed to scale your business. As a listener to Smashing Security you can save 10% off Drata and have implementation fees waived.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Twitter at @SmashinSecurity, or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

There's some funny business going on on Google, and Zuckerberg's $14 billion bet on the metaverse is beginning to look a little childish...

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

• Google sues alleged scammer over fake business and review scheme - The Verge.
• Meta to Lower Age for Users of Virtual Reality Headset to 10 From 13 - New York Times.
• Introducing New Parent-Managed Meta Accounts for Families - Meta Blog.
• Keep Connected - ages 10–14 - Keep Connected.
• The Metaverse Police: A VR content moderator shares his insights - Mixed News.
• “Untold: The Girlfriend Who Didn't Exist” - Netflix.
• Tommy Siegel - Some candy hearts comics I drew, a thread - Twitter.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

• Bitwarden – Password security you can trust. Bitwarden is an open source password manager trusted by millions of individuals, teams, and organizations worldwide for secure password storage and sharing.
• Kolide – Kolide ensures that if your device isn’t secure it can’t access your cloud apps. It’s Zero Trust for Okta. Watch a demo today!
• Drata – With over 14 frameworks including SOC2, GDPR, HIPAA, and ISO 27001, Drata gets you audit-ready for crucial security standards needed to scale your business. As a listener to Smashing Security you can save 10% off Drata and have implementation fees waived.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Twitter at @SmashinSecurity, or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.