Smashing Security

Latest Episodes:

Shackled ankles, photo scrapes, and SIM card swaps May 15, 2019

Show notes

A bad software update causes big headaches for Dutch police, but brings temporary freedom to criminals. SIM swaps are in the news again as fraudsters steal millions. And does your cloud photo storage service have a dirty little secret?

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Rip Off Britain's David McClelland.

Visit https://www.smashingsecurity.com/128 to check out this episode’s show notes and episode links.

Follow the show on Twitter at @SmashinSecurity, or on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: David McClelland.

Sponsored By:

Support Smashing Security

Links:

Vote for Smashing Security in the EU Security Blogger Awards
Software update crashes police ankle monitors in the Netherlands — ZDNet.
Irishman facing more than 100 years in US prison for alleged $2.5m cryptocurrency fraud — Independent.ie
U.S. investor awarded $75 million in cryptocurrency crime case — Reuters.
The SIM Swap Fix That the US Isn't Using — Wired.
Everalbum Photo Organizing App — YouTube.
Facial recognition's 'dirty little secret': Millions of online photos scraped without consent — NBC News.
Everalbum Review — Good Housekeeping.
OverSimplified — YouTube.
CGP Grey — YouTube.
The Difference between the United Kingdom, Great Britain and England Explained — YouTube.
BBC One - Rip Off Britain, Series 11, Episode 3 — BBC iPlayer.
All The Stations.
Get a Spine! — This American Life.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

I do love the Dutch May 08, 2019

Show notes

Israel strikes back at Hamas's hacking HQ, a new sextortion email comes with a twist, and Carole saves the world with some help from hacked Roomba vacuum cleaners.

Visit https://www.smashingsecurity.com/127 to check out this episode’s show notes and episode links.

Follow the show on Twitter at @SmashinSecurity, or on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Ran Levi.

Sponsored By:

Support Smashing Security

Links:

New Extortion Email Scam Threatens to Release Your Sex Tape — Bleeping Computer.
Here's what an Ashley Madison blackmail letter looks like — Graham Cluley.
Suicide and Ashley Madison — Graham Cluley.
Israel bombs building containing alleged Hamas hackers — Graham Cluley.
IDF says it thwarted a Hamas cyber attack during weekend battle — Times of Israel.
Israel: Hamas Tried to Spy on Soldiers With Fake Dating Apps — Bloomberg.
Ransomware attack on Israeli users fails miserably due to coding error — ZDNet.
Michael Reeves on Twitter.
A Robot That Picks Tomatoes Out of Your Salad — YouTube.
A Robot That Shoots Energy Drink at You When You Get Tired — YouTube.
Consumption of Tide Pods — Wikipedia.
The Roomba That Screams When it Bumps Into Stuff — YouTube.
This Person Does Not Exist.
Have they faked me?
Drugslab — YouTube.
The Hows and Whys of Influencing People — Reddit.
How Master Manipulators Conceal Their Intentions — Kletische.
How to Win Friends and Influence People — Wikipedia.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

Zombie chickens and fast-food victims May 01, 2019

Show notes

What's the worst that can happen if you join a Hollywood hard man's Facebook page? What drove a man to hijack a website's name at gunpoint? And can you solve the mystery of the Canadian Hamburglar?

Visit https://www.smashingsecurity.com/126 to check out this episode’s show notes and episode links.

Follow the show on Twitter at @SmashinSecurity, on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Mark Stockley.

Sponsored By:

Support Smashing Security

Links:

Fraudster poses as Jason Statham to steal victim's money — BBC News.
Nine men arrested in United States for stealing millions through business email compromise and romance scams — Graham Cluley.
Twitter Hack: Part Of Broader Iranian Strategy — TechCrunch.
Hackers Hit Google Palestine and Defaced the Front Page — Gizmodo.
Gunpoint domain hijack turns out to have been a family affair — Naked Security.
Jury Convicts Social Media Entrepreneur in Plot to Hijack Internet Domain — Department of Justice.
Hamburglar strikes again, feasts on $2,000 in meals using customer's McDonald's app — CBC News.
McDonalds UK TV Advert 1983 featuring Hamburglar — YouTube.
How Animators Created the Spider-Verse | WIRED — YouTube.
How 'Spider-Man: Into The Spider-Verse' Was Animated | Movies Insider — YouTube.
Cool Math.
IQ Ball — Carole's favourite game on Cool Math.
CoolMath4Kids.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

Pick of the thief! Apr 24, 2019

Show notes

WannaCry's "accidental hero" pleads guilty to malware charges, Samsung and Nokia have fingerprint fumbles, the NCSC publishes a list of 100,000 dreadful passwords, and Apple finds itself at the centre of an identity mix-up.

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by John Hawes.

Follow the show on Twitter at @SmashinSecurity, on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: John Hawes.

Sponsored By:

Support Smashing Security

Links:

"Gents! Stop airdropping your pics!" — Smashing Security episode 038, where we discussed the arrest of Marcus Hutchins.
Marcus Hutchins plea agreement — PDF
Statement from Marcus Hutchins (aka MalwareTech)
"Stick to the good side." — Marcus Hutchins on Twitter.
The Samsung Galaxy S10's ultrasonic fingerprint scanner is hacked — Graham Cluley.
Video of Nokia 9's fingerprint sensor failure — Decoded Pixel on Twitter.
Nokia 9 buggy update lets anyone bypass fingerprint scanner with a pack of gum — ZDNet.
Most hacked passwords revealed as UK cyber survey exposes gaps in online security — NCSC.
Facebook hoovered up 1.5 million users' email contacts without permission... "unintentionally" — Graham Cluley.
Facebook: we logged 100x more Instagram plaintext passwords than we thought — Naked Security.
Second Payment Services Directive (PSD2): 8 things businesses needs to know — Information Age.
Teen sues Apple over accusations of Apple Store thefts — 9to5Mac
Student Sues Apple for $1 Billion, Blames Face-Recognition Tech for False Arrest — Insurance Journal.
Thunderbirds - 50th Anniversary Specials — Century 21 films
Thunderbirds 1965 - Documentary — YouTube.
Clash Royale: Enter the Arena.
Oxfordshire Artweeks.
Details of Carole and John's exhibition — Oxfordshire Artweeks.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

Poisoned porn ads, the A word, and why why why Wipro? Apr 17, 2019

Show notes

The hacker who lived the high life after spreading malware via porn sites, Wipro demonstrates how to turn a cybersecurity crisis into a PR disaster, and why are humans listening in to your Alexa conversations?

Follow the show on Twitter at @SmashinSecurity, on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Brian Honan.

Sponsored By:

Support Smashing Security

Links:

Hacker from Russian crime group jailed for multi-million pound global blackmail conspiracy — NCA.
The No More Ransom Project.
Experts: Breach at IT Outsourcing Giant Wipro — Krebs on Security.
Statement from Wipro Limited confirming security breach.
TalkTalk phone scams: arrests made at Indian call center — Graham Cluley.
How Not to Acknowledge a Data Breach — Krebs on Security.
"The Wipro quarterly earnings call would have gone really well if that pesky @briankrebs hadn't shown up... " — Graham Cluley on Twitter.
Smart speaker recordings reviewed by humans — BBC News.
Is Anyone Listening to You on Alexa? A Global Team Reviews Audio — Bloomberg.
How to stop Amazon from listening to what you say to Alexa — CNBC.
Judge orders Amazon to turn over Echo recordings in double murder case — TechCrunch.
Klokken minutt for minutt — NRK TV.
3-year-old's password fail locks iPad for 25,536,442 minutes — UPI.
Nominate your favourite security podcast/blog/tweeter etc — EU Security Blogger Awards 2019.
Nudes mug — The Unemployed Philosophers Guild.
Bob Ross mug — The Unemployed Philosophers Guild.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

Backups - a necessary evil? (replay) Apr 10, 2019

Show notes

With Graham incapacitated, we drag an episode out from the archives. In this special "splinter" episode of the "Smashing Security" podcast from September 2017 we tackle the tricky subject of backups - When did you last backup your data? How and what should you backup? And where should you store them?

Lots of questions and Graham gets to do his Tina Turner impression.

All this and more is discussed in this edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Maria Varmazis.

Follow the show on Twitter at @SmashinSecurity, on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Maria Varmazis.

Sponsored By:

Support Smashing Security

Links:

Privacy & Opt-Out: https://redcircle.com/privacy

The big fat con at Office Depot Apr 03, 2019

Show notes

Office Depot and OfficeMax are fined millions for tricking customers into thinking their computers were infected with malware, car alarms can make your vehicle less secure, and facial recognition in apartment blocks comes under the microscope.

Follow the show on Twitter at @SmashinSecurity, on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Dave Bittner.

Sponsored By:

Support Smashing Security

Links:

Is Office Depot diagnosing non-existent computer problems? — YouTube.
Office Depot and Tech Support Firm Will Pay $35 Million to Settle FTC Allegations That They Tricked Consumers into Buying Costly Computer Repair Services — FTC.
Alarming vulnerabilities in automotive security systems — The Cyberwire.
Gone in six seconds? Exploiting car alarms — Pen Test Partners.
The Landlord Wants Facial Recognition in Its Rent-Stabilized Buildings. Why? — New York Times.
Brooklyn Landlord Wants To Install Facial Recognition Tech At Rent-Stabilized Complex — Gothamist.
New key-less Moscow apartments use facial recognition to open doors and elevators — Achinect.
Study finds gender and skin-type bias in commercial artificial-intelligence systems — MIT News.
The woman who doesn't feel pain — BBC News.
TVR Exploring — YouTube.
Lost Dutchman's Gold — BBC Games Archive.
Dirty John: The Dirty Truth — Netflix.
A Complete Timeline of the Events of Dirty John — Harper's Bazaar.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

Hijacked motel rooms, ASUS PCs, and leaky apps Mar 27, 2019

Show notes

An app leaking private conversations and intimate photographs is ignoring requests to fix the problem, hackers poison a security update sent to ASUS PCs, and how to protect your privacy in motel rooms.

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Maria Varmazis.

Follow the show on Twitter at @SmashinSecurity, on the Smashing Security subreddit, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Maria Varmazis.

Sponsored By:

Support Smashing Security

Links:

Varmazis.gr - The hot sauce factory.
This Spyware Data Leak Is So Bad We Can't Even Tell You About It — Motherboard.
A family tracking app was leaking real-time location data — TechCrunch.
Popular family tracking app exposed real-time location data onto the internet – no password required — Hot for Security.
Hosting Provider Finally Takes Down Spyware Leak of Thousands of Photos and Phone Calls — Motherboard.
security.txt | A proposed standard which allows websites to define security policies.
Hackers Hijacked ASUS Software Updates to Install Backdoors on Thousands of Computers — Motherboard.
Operation ShadowHammer — Kaspersky.
Shadow Hammer APT MAC Check.
ASUS Settles FTC Charges That Insecure Home Routers and “Cloud” Services Put Consumers’ Privacy At Risk — Federal Trade Commission.
ASUSFourceUpdater.exe is trying to do some mystery update, but it won't say what... — Reddit.
Asus implements fix for malware attack — Reuters.
ASUS response to the recent media reports regarding ASUS Live Update tool attack by Advanced Persistent Threat (APT) groups.
Passion for life: Self-expansion and passionate love across the life span — Journal of Social and Personal Relationships.
So THAT'S Why Hotel Sex Is So Much Better Than At Home — Huffington Post.
South Korea arrests two for spy cameras that livestreamed 1,600 motel guests — Reuters.
Zach King magic tricks — YouTube.
Killed by Google - The Google Graveyard & Cemetery.
Outline - Read & annotate without distractions.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

Silk Road with Deliveroo Mar 20, 2019

Show notes

Online drug dealers get busted due to poor OPSEC! People are still failing to wipe their USB sticks properly! A potential presidential candidate is outed as a former hacker! Flat Earthers! Pi! Empathy!

All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Paul Ducklin.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: Paul Ducklin.

Sponsored By:

Support Smashing Security

Links:

'It's like Uber, but for weed': Meet the man who revolutionized Israel's pot trade — Haaretz.
Israel Police arrest top members of Telegrass online drug ring — Haaretz.
Sources: Telegrass head cooperating with police — YNet News.
You left WHAT on that USB drive?! — Naked Security.
Cult of the Dead Cow — Wikipedia.
Back Orifice — Wikipedia.
Beto O’Rourke’s secret membership in America’s oldest hacking group — Reuters.
Beto O’Rourke acknowledges involvement with hacking group as teen — The Texas Tribune.
Behind the Curve.
Behind the Curve - Official Release Trailer — YouTube.
Serious Security: What we can all learn from PiDay — Naked Security.
Drawabox — A free, exercise based approach to learning the fundamentals of drawing.
Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Privacy & Opt-Out: https://redcircle.com/privacy

Hijacked homes, porn passports, and ransomware regret Mar 13, 2019

Show notes

A $150 million mansion is hijacked online, Brits will soon have to scan their passport to watch internet porn, and are organisations right to pay up when hit by ransomware?

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Special Guest: David McClelland.

Sponsored By:

Support Smashing Security

Links: