Smashing Security

Dutch spies, Russian hackers and Jared Kushner’s iPhone. It sounds like the ingredients for a thriller, but according to claims in a new book the US President's son-in-law may have been hacked twice. Is any of it true, and what does it tell us about the phones in our pockets?

Meanwhile, James Ball explains that of the internet’s most trusted security keys were protected by numbers so small that one of them was... four. Yes, "4". And then, of course, to make the week worse we suffered a PHPocalpyse...

Plus, Chuck Randolph of 360 Privacy explains how the internet has made it scarily easy to put company executives and public officials in danger.

All this and more in episode 490 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

EPISODE LINKS:

Signal bug could let someone keep listening after you hang up - Malwarebytes.Post by @safety.bsky.app - Bluesky.How a Massive Chinese Crime Ring Hacked Staples to Steal Millions - 404 Media.How The Intercept might have helped unmask Reality Winner to the NSA - Graham Cluley.The Art of the Deal: Jared Kushner’s Hacked Phone Revealed His Secret Negotiations- Including More Than $700 Million in Transfers - Vanity Fair.Kushner iPhone hack claims: Dutch spies accessed GRU-compromised device - Cybernews.Tweet by Kim Zetter - X (formerly Twitter).Meet the seven people who hold the keys to worldwide internet security - The Guardian.The Internet goes on high alert after discovery of 8 compromised TLS certs - Ars Technica.Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’ - The Register.eMudhra to Exit global SSL/TLS Certificate Business - Emudhra.'Doing a Ratner' and other famous gaffes - The Telegraph.Websites taken down worldwide as critical PHP cyber-security update issued - BBC News.PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk - The Register.2023 Battagram cable car incident - Wikipedia.Hanging By A Wire.Watch Taskmaster- Channel 4.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!360 Privacy - End-to-end digital exposure reduction for organizations, executives, and families. Request a demo to reduce your digital footprint.

SUPPORT THE SHOW:

Tell your friends and colleagues about Smashing Security, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: 'Vinyl Memories' by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on... what could possibly be hiding inside? We break out a Geiger counter and a cat to find out.

Meanwhile, malicious ads are targeting journalists with zero-click attacks.

Plus, Origin’s Spencer Thompson reveals what AI agents are really getting up to on your employees’ laptops when nobody’s looking.

All this and more in episode 489 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lianne Potter.

EPISODE LINKS:

Atac informatic la Depozitarul Central, organism esențial pentru Bursă. Aplicația Depozitarului, unde sunt inclusiv datele "cuponarilor", blocată. Ce trebuie să facă investitorii, ceilalți utilizatori şi ce spune Depozitarul Central - Economica.ASTRA: «Черная искра» атаковала портал Рособрнадзора - Caliber.Police Say Scammers Used AI to Clone a Sheriff’s Voice - 404 Media.Who Is Planting Backdoors in Ledger Crypto Wallets? - Zero Day.Tweet by Ledger about funds being drained - X.Ledger asks sellers across Asia to halt sales after supply-chain attack - Bleeping Computer.Check that your Ledger device has a genuine secure element - Ledger.Targeted ads installed Candiru spyware in zero-click attacks - Bleeping Computer.Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab.Hope All's Well - Michael Spicer tour.Ken Russell’s The Devils - BFI.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!360 Privacy - End-to-end digital exposure reduction for organizations, executives, and families. Request a demo to reduce your digital footprint.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A ransomware negotiator attended a cybersecurity conference, only to be arrested by the FBI in connection with its investigation into the ShinyHunters gang.

Meanwhile, hackers get the keys to ASOS's app and the chance to message every single customer. What did they say? And how did the company respond? We have thoughts.

All this and more is discussed in episode 488 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

”123456” password used in massive Danish CPR data breach- The Copenhagen Post.‘You have a meeting’: the calendar phishing scam growing exponentially- The Guardian.Anthropic AI model submitted false tip about unsolved murder, Philadelphia police say- 6abc Philadelphia.FBI Arrests Executive at Ransomware Negotiation Firm- Krebs on Security.ASOS hack: If you could message every customer, what would YOU tell them?- SolCyber.Rooftops, penthouses, and urban living- Mike Tomlin on YouTube.I built ChatGPT with Minecraft redstone!- YouTube.&udm=14 - the disenshittification Konami code- Udm14.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Hack The Box - Develop, exercise and measure the capabilities of your human operators and AI agents.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Microsoft's Twitter account, with its 13 million followers, was hijacked by a paperclip. There was no ransomware or data theft, just Clippy, a dodgy crypto coin, and a corporate apology that wasn't from Microsoft either.

Meanwhile, UK losses from hacked email and social media accounts have rocketed by 417%, as scammers pose as your friends to flog you tickets to gigs that don't exist.

Plus, Hack The Box's Christine Bartlett joins us for a featured interview to ask what happens when AI agents join your security team, and whether anyone has thought to give them a performance review.

All this and more in episode 487 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

South Korean officials believe AI agents were used to hack several banks - The Record.Asos warns customer data may be compromised after ‘unauthorised’ app access - The Guardian.PixelLeak AI exposure of private developer data - Glow.Crypto Scammers Hijack Microsoft's Official X Account - SecurityWeek.Is everything ok Microsoft? - The Verge.Switch to passkeys: Report Fraud warning as email and social media account hacking sums stolen rise by more than 400 per cent - City of London police.Swiss railway clock - Wikipedia.The Witcher 3: Wild Hunt Remastered Trailer - YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Hack The Box - Develop, exercise and measure the capabilities of your human operators and AI agents.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A store in Auckland vibe-coded itself a new website. Within hours, its inventory had somehow expanded to include a pair of crusty socks, an $850 banana, and all of New Zealand's national parks. What could possibly have gone wrong?

Meanwhile, a hacker collective backed a truck into one of the license-plate-reading Flock safety cameras popping up on American street corners, and took a very close look inside.

All this and more in episode 486 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Dave Bittner.

EPISODE LINKS:

Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws- The Hacker News.Odido hackers mock police, threaten another Netherlands hack- Cybernews.North Korea's fake job interviews infected 30,000 devices- The Register.Ridiculous deals as store leaves website open for the public to edit- Stuff.Critical Vulnerability in AI Vibe Coding platform Base44- Wiz.Beautiful People: The dating site that FAKED getting hacked by a virus called Shrek- Graham Cluley on YouTube.Flock Camera Locations- Live Map of 150,000+ Flock Safety Cameras & ALPRs.Flock cameras are riddled with security vulnerabilities and hard-coded credentials- Micah Flee.Creve Coeur police in 'state of chaos' as former chief investigated for misconduct- WCBU Peoria.La La Land Filming Locations- Seeing Stars.Mrs Mills- Wikipedia.Let's Have a Party - The Piano Genius of Mrs. Mills- YouTube.Introducing the Originals Mrs Mills Piano from Abbey Road Studios & Spitfire Audio- Abbey Road.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.ThreatLocker - Book a demo today and start securing your organisation.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Researchers wanted to test if LG's smart TVs come with any security risks - but their lawyers noticed a snag: the terms and conditions would forbid it. So they came up with a solution. They got plastered before setting up the TV, on the reasoning that you can't be legally bound to a contract you agreed to while drunk. What they discovered will make you look at your TV rather differently...

Meanwhile, awful Android malware with the audacious name "Awesome" (in Indonesian) is doing the rounds, stealing your data, demanding a ransom, and then giving you a "jump scare"...

Plus, in our featured interview, Andy Hornegold of Intruder explains why the mid-market is where cybercriminals are having the most fun right now - and how AI is helping attackers get from "first foot in the door" to "full ransomware disaster" in less than a working day.

All this and more in episode 485 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lianne Potter.

EPISODE LINKS:

Revolut handed customer data to fraudsters using government email account - The Record.HBO Max Reddit account compromised to serve ClickFix attacks - The Register.U.S. and UK Launch First-of-Its-Kind Joint Alliance to Dismantle Global Scam Centers - US Dept of Justice.216,000,000 Spy TVs - The LG Smart TV Problem - YouTube.LG TVs Are Capable of Listening to More Than Your Screen, Report Claims - Gizmodo.New Android malware encrypts files, steals data, and harasses victims - Bleeping Computer.Search flags based on colors and attributes - FlagLookup.Killer In The Code podcast.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ThreatLocker - Book a demo today and start securing your organisation.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

When a chap called Matt noticed his Bluetooth headphones wouldn't switch to his phone, he was surprised to realise the reason was a single AliExpress webpage sitting open in his browser - playing nothing at all, at zero volume. And yet somehow his hardware could hear it. Audio fingerprinting is one of the sneakiest tracking tricks on the web.

Meanwhile, the intelligence agencies of the "Five Eyes" (not Five Guys) have got together and published advice on how companies should communicate after a cyber attack. The summary? For the love of God, stop calling every breach "sophisticated."

All this and more in episode 484 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

Hackers demand $2.3M in ransom after breaching Berlin government network- Anadolu.Deux suspects interpellés dans le cadre des enquêtes ouvertes après le piratage du fisc- France Info.Hackers are stealing Claude tokens from subscribers- TechCrunch.AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones- The Register.AliExpress webpage keeping multipoint Bluetooth headphones active with WebAudio fingerprinting- Matt Callaghan’s blog.Audio Fingerprinting: What It Is + How It Works with Web API- Fingerprint.Communicating Under Pressure: Best Practices for Service Providers- CISA.World Stone Skimming Championships.Mind games and a ‘toss master’: world stone skimming contest returns to Scotland after cheating scandal- The Guardian.World Stone Skimming Championships - Every Toss 2025- YouTube.”The Pirates’ Code: Laws and Life Aboard Ship”  by Rebecca Simon- Waterstones.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ThreatLocker - Book a demo today and start securing your organisation.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone.

Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open?

All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

EPISODE LINKS:

Hacker leaks GTA VI footage to push a crypto token before pulling off a $270,000 cash-out - Coindesk.ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions - The Hacker News.FulcrumSec claims Manchester Airports hack, theft of 86 GB of data - Bleeping Computer.Mugged for my phone, then locked out of my life - The Times.Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain - SOCRadar.AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes - Bleeping Computer.Investigating three real-world incidents in our cybersecurity evaluations - Anthropic.The Hugging Face incident and the road ahead - OpenAI.Irregular says ‘human oversight’ responsible for AI sandbox escape incidents - CyberScoop.Control. Ownership. Perspective - Ciaran Martin.Steno: Highly-Secure AI Notetaker for Government & Defence - Steno.Inside the Factory - BBC.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ThreatLocker - Book a demo today and start securing your organisation.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A hacker calling themselves "CYBERLEEK" has been leaking gameplay footage from GTA 6 ahead of its official reveal this week - but they're not asking Rockstar Games for a ransom. Instead, they've launched their own cryptocurrency, promising to release ever more juicy clips from a virtual strip club...

Meanwhile, your smart TV might be doing more than binge-watching Netflix while you sleep. We explore the shadowy world of "residential proxies" - how they end up inside home routers, smart TVs, and IoT devices, and why an entire criminal economy is quietly running through your internet connection.

All this and more in episode 482 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

Iranian hackers shut down UK power plant - The Telegraph.Ransomware crook poses as recovery firm to steal payments from fellow extortionists - The Register.The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile - Zimperium.Technical forensic research and provenance breakdown of the latest August 2026 GTA 6 gameplay leaks and map files. - GitHub.Everything we know about Cyberleek and his GTA VI build - Reddit.Who needs a laptop to hack when you have a Firestick? - Smashing Security.Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals - FBI.Busted! Rogue VPN provider who co-opted millions into cybercrime - Paul Ducklin.Disrupting the World's Largest Residential Proxy Network - Google Cloud Blog.Google’s Continued Disruption of Malicious Residential Proxy Networks - Google Cloud Blog.TimeGuessr.Scientific Curiosity by Cyril Aydon - Waterstones.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ThreatLocker - Book a demo today and start securing your organisation.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Black Kite - Read Black Kite's 2026 European Cyber Risk Report to explore the latest ransomware trends, top threat actors, and how supplier breaches are reshaping cyber risk across Europe.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

At Black Hat this month, a group of security researchers took a $9,000 robot dog, plugged Google's AI into its brain, and jailbroke it by telling it - with a completely straight face - that it was a Pokemon. What followed involved a wall, a blue ice chest, and anyone in the room wearing white shoes. Oh, and did we mention you can buy a flamethrower attachment?

Meanwhile, in Salzburg, 280 gold statuettes of Mozart have vanished from the streets. This has happened to the same artist before. Organised crime, or a publicity stunt? Jenny has thoughts - and some parallels for the world of cybersecurity.

All this and more in episode 481 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Jenny Radcliffe.

EPISODE LINKS:

Burnham exchanged messages with person posing as Trump's chief of staff- BBC News.New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges- Bleeping Computer.SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers- The Hacker News.macOS ‘Screen Sharing’ flaw exploited for crypto-mining- Hot for Security.Kinetic Prompt Injection: Agent Compromise With a Physical Blast- Greptalks.Kinetic Prompt Injection: Agent Compromise With a Physical Blast Radius- YouTube.More Than 200 Golden Mozart Statuettes Stolen From Salzburg Months After Famed Composer’s 270th Birthday- Smithsonian Magazine.An Art Installation of More Than 100 Wagner Figurines Outside a German Theater Has Mysteriously Disappeared- Artnet News.Ray Alan- Wikipedia.Ray Alan with "Lord Charles" - World's Greatest Ventriloquist- YouTube.Educating Archie- YouTube.Peter Brough- Wikipedia.No. 10: Full Confidence - A Game of Political Survival.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ThreatLocker - Book a demo today and start securing your organisation.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Black Kite - Read Black Kite's 2026 European Cyber Risk Report to explore the latest ransomware trends, top threat actors, and how supplier breaches are reshaping cyber risk across Europe.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Would you like access to Anthropic's Claude at 90% off the normal price? All you have to do is redirect your traffic to a mysterious service called "Poison Claude". Only problem is that it's run by fraudsters...

Meanwhile, a phishing-as-a-service platform called "Greatness" has come up with something rather nasty: a phishing attack that doesn't need a fake website, a suspicious URL, or your password. Just a real Microsoft login page and a moment of misplaced trust - and the attackers walk off with full access to your emails, your files, and your entire organisation.

All this and more in episode 480 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lianne Potter.

EPISODE LINKS:

US cloud 'kill switch' is as dangerous as ransomware, European businesses fear - IT Pro.Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M - Decrypt.Belarusian leader of international ransomware scheme known as “Ransom Cartel” sentenced to 16 years in prison - US Department of Justice.Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt - The Hacker News.Free tokens for sale: How fake signups drive AI fraud - Okta.Post by Rory Cellan-Jones - Bluesky.Inside Greatness: Telegram-Distributed M365 AiTM PhaaS - ZeroBEC.Tailscale.RustDesk.League of the Lexicon - Two Brothers Games.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Graham gets a phone call from the police. Well, someone who sounds convincingly like the police. There's just one small problem: what they really want is the 24-word seed key to Graham's cryptocurrency wallet.

Meanwhile, if you've stayed in a hotel recently, the free Wi-Fi you connected to might have come with an unexpected extra: an all-you-can-eat buffet of "Captive Crunch" for a Russian intelligence-linked hacking group.

And a group calling itself the "ExFilSquad" has walked off with 600,000 records of the UK's teachers and head teachers from the Department for Education - sending an unusually polite ransom demand.

All this and more in episode 479 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

Cryptocurrency mailing list compromised- Tweet by Trezor.Users’ seemingly private conversations with Anthropic’s Claude showed up in Google search results- Fortune.Sweeping cyberattack on water systems in multiple states has US officials on edge  - CNN.Minnesota not Iran to blame for state's water issues, says Trump- BBC News.Google pauses AI satellite images, after fears of deepfakes in the sky- NPR.CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft- Microsoft Security Blog.DNS Poisoning Tactics Expand to Hospitality Wi-Fi- ReliaQuest.Hackers steal sensitive data from UK Department for Education and police- The Guardian.University of Arts London on Securing Creativity Against Cyber Threats- Infosecurity Magazine.7 Things About Doctor Who I Learned From “When I Say Run, Run”- The Doctor Who Companion.What Stanley didn't say- The Guardian.Adrian Rigelsford- Wikipedia.Black Mesa: Re-visit the world that started the Half-Life continuum- Crowbar Collective.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

You've been headhunted for a great job in cryptocurrency. All you have to do is complete a short online assessment - with your webcam on, of course, so they can verify who you really are. Which is ironic, because the person recruiting you doesn't exist. And North Korean hackers using this trick have already made off with $643 million in crypto this year alone.

Meanwhile, researchers at UC San Diego have discovered that 2.2 million cars across the United States can be unlocked or immobilised by anyone with a bit of Bluetooth kit - thanks to one aftermarket car alarm that made a truly spectacular cryptographic blunder. The bug has been sitting there since 2017. Nobody noticed.

All this and more in episode 478 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

OpenAI's AI "goes rogue" and hacks Hugging Face: what you need to know- Hot for Security.Post by Graeme Bell- Linkedin.HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels- Group-IB.Ransom gang targets Dutch ice arena Thialf in cyberattack- Cybernews.No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE- Tokay0.DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews- SOCRadar.H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion- TRM Labs.2 Million Cars with Anti-Theft Systems Installed by Dealers are at Higher Risk of Theft- UC San Diego Today.2 Million Cars with Anti-Theft Systems Installed by Dealers are at Higher Risk of Theft- YouTube.Karr Security.Ann Droid- BBC iPlayer.North Leigh Roman Villa- English Heritage.Uffington White Horse- Wikipedia.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A Russian intelligence-linked hacker is arrested in Thailand while enjoying a beach holiday - and the trail of evidence that nailed him to the Russian government includes 14 separate orders of chicken McNuggets.

Meanwhile, AI music generator Suno has been hacked - and the stolen data appears to show exactly how much copyrighted music they hoovered up to train their models.

All this and more in episode 477 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

EPISODE LINKS:

Bengaluru triple murder: Accused allegedly used AI chatbot to plan killings, police say- The News Minute.Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days- Bleeping Computer.DO NOT BUY: LG’s Spyware TVs, Monitors, and Wiretapping Concerns- YouTube.New Russia-affiliated actor Void Blizzard targets critical sectors for espionage- Microsoft Security Blog.Russia Advises Citizens Wanted in U.S. Against Visiting Thailand- The Moscow Times.Alleged Russian cyber spy in Boston case previously worked for Kaspersky, source says and documents show- Reuters.Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links- Ctrl-Alt-Intel.Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius- 404 Media."Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack- Unit 42.Black Is The Color Of My Voice trailer- YouTube.Black Is The Color Of My Voice - Official Site- Black is the Colour of my Voice.Avatar: The Last Airbender (2007)  - Netflix.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

An app has appeared in India that lets anyone with a smartphone stop a passing e-rickshaw dead in its tracks - no login, no passwords, no permissions needed. 

Meanwhile, Geoff - swimming in money and Lamborghinis, as all published authors are - has been on the receiving end of a slew of AI-generated scam pitches from fake book marketing experts. Rather than ignore them, he's been playing them at their own game...

All this and more in episode 476 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Geoff White.

EPISODE LINKS:

The ransomware negotiator who was working for the other side- Hot for Security.LastPass, Bitwarden users targeted with fake security alerts- Bleeping Computer.German firm files for insolvency, blames cybercrims who shut down production for 6 weeks- The Register.BAT-BMS App: How A Chinese App Is Being Used To Hack E-Rickshaws All Over India; Viral Videos Show Drivers Crying Over Lost Earnings- Free Press Journal.Tirri control prank: Indians use China app to shut down e-rickshaws- The Print.Geoff describes his interactions with a book marketing scam- Linkedin.Smart Plugs- Tapo.Worst Patio Ever! Extreme ASMR Pressure Washing- YouTube.20 Years of Cracked Mud Covered This Massive Rug- YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A 15-year-old boy asked a chatbot for help - and cancelled nearly 47,000 anime streaming subscriptions in under four hours. Meanwhile, researchers have documented the first fully autonomous, agentic AI-driven ransomware attack, "JadePuffer". What does this tell us about the future of cybersecurity?

Also, Apple's "Hide My Email" feature turns out to hide rather less than it promises - despite Apple knowing it has a problem for over a year.

All this and more in this episode of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Zoë Rose.

EPISODE LINKS:

Politician who investigated spyware abuses had his phone hacked with Pegasus spyware - TechCrunch.Hackers breached DHS information-sharing network, people familiar say - Nextgov.Hackers Use Fake FIFA World Cup 2026 T-Shirt Offers to Spread Voidrift Malware - Hackread.Japanese teen arrested for cyberattack that unsubscribed over 46,000 anime accounts - The Straits Times.Police arrest high school student over cyberattack on net cafe operator - The Japan Times.Japanese teens arrested for using AI to create illegal phone contracts - The Peninsula Qatar.JADEPUFFER: Agentic ransomware for automated database extortion - Sysdig.Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses - 404 Media.Two people arrested in apparent marriage proposal atop Empire State Building - The Guardian.Skywalkers: A Love Story - Netflix.Thermomix - Vorwerk.Operation Safe Escape.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Arctic Wolf - See why 1 in 3 IT assets is missing a critical security control. Download the 2026 State of the Cybersecurity Attack Surface report.NordLayer - the network security platform for modern teams across different work environments. Use code NLSUMMER26 for up to 20% off annual plans.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Polymarket has built an entire business on predicting the future. So how did it manage to spectacularly fail to predict its own hack? Plus, the Google engineer with a million-dollar secret, and the curious case of the airport hairdryer.

Meanwhile, "FortiBleed" sees 75,000 Fortinet firewalls thrown wide open - and the real damage is going to roll on for years.

All this and more in episode 474 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Quentyn Taylor.

EPISODE LINKS:

Danish Police Raided Self-Described Privacy Activist. PM Lives at a Secret Address- State of Surveillance.Hospital probe after 40 staff access crocodile boy's medical records- Cybernews.Third Defendant Sentenced To Prison For Hacking Fantasy Sports And Betting Website- US Dept of Justice.Someone allegedly used a hairdryer to rig Polymarket weather bets- Engadget.Tweet by Polymarket Traders- XCancel.Polymarket says hackers stole users' funds- TechCrunch.Operation Cloud Hopper: China-based Hackers Target Managed Service Providers- SecurityWeek.The Full Story of the Stunning RSA Hack Can Finally Be Told- WIRED.Polymarket points to third-party login tool after users report account breaches- Coindesk.Polymarket Admin Wallet Exploited on Polygon, Says ZachXBT- CryptoPotato.Polymarket reportedly paid creators to post deceptive videos about fake bets- TechCrunch.‘Unbelievable how accurate’: How paid influencers hype Polymarket’s odds- POLITICO.Polymarket's $345 million Iran peace bet is stuck because nobody can agree on what "permanent" means- TNW.Alert: NCSC issues advice following global targeting of Fortinet firewalls and VPN gateways- National Cyber Security Centre.Analysis of Reported Credential Compromise of FortiGate Devices- Fortinet Blog.FortiBleed - Free FortiGate Exposure Checker- SOCRadar.The Boys of Dungeon Lane- Paul McCartney.A closer listen to Paul McCartney's new album 'The Boys of Dungeon Lane'- YouTube.The Summer Portraits- Ludovico Einaudi.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A polite caller from your bank says there is a problem with your account. Don't worry - they'll send someone round to help. They'll even take your cards away to keep them safe. The scam has run rampant, until Dutch police plastered blurred photos of 100 suspects across billboards, supermarkets, and TikTok, with a two-week ultimatum to turn themselves in... or else.

Meanwhile, a security researcher called Bob DaHacker got her hands on the live broadcast controls for every match of the 2026 FIFA World Cup. She could have Rickrolled the entire planet, but actually spent days trying to find anyone at FIFA who would pick up the phone.

Plus! Don't miss our featured interview with Black Kite's Jeffrey Wheatman exploring ransomware and extortion attacks across Europe.

All this and more in episode 473 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

Suspected cyberattack triggers false emergency alerts across parts of Brazil - The Record.Gizmodo readers hit with ClickFix malware prompts after account compromise - The Register.Two men plead guilty over £39m Transport for London cyber attack - BBC News.Helpdesk scammers are making house calls to make their lies feel more real - The Register.Dutch cops’ shame games nets 74 wanted fraudsters - The Register.Omgebrachte vrouw (80) in Amsterdam vermoedelijk slachtoffer van nepagenten - NU.Mr Benn - Wikipedia.I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID - Bobdahacker.Bug in FIFA World Cup internal system gave anyone ability to modify TV stream - TechCrunch.Iceberger - Draw an iceberg and see how it will float.Fallout: London - GOG.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Black Kite - Read Black Kite's 2026 European Cyber Risk Report to explore the latest ransomware trends, top threat actors, and how supplier breaches are reshaping cyber risk across Europe.Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

What if your AI coding assistant could be tricked into stealing your own company's secrets - by reading a single booby-trapped bug report? No phishing email. No malware. No password ever stolen. Just an AI doing exactly what it was told.

Meanwhile, someone calling themselves Nightmare Eclipse has decided to teach Microsoft a lesson. The result? Three zero-days dropped on the internet, one of which lets a thief with a USB stick walk straight past BitLocker. Microsoft is furious.

Plus don't miss our featured interview with Son Nguyen Kim of Proton Pass, who explains why plugging AI agents into your email and calendar without thinking twice is rather like hiring a new employee with the keys to everything - and skipping the background check.

All this and more in episode 472 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

ShinyHunters claims 61M Sysco records - Cybernews.Derbyshire police officer under investigation for using AI to create evidence - Derbyshire Times.Maine forced to take down data breach portal after fake notices filed with authorities - Hot for Security.A Fake Bug Report Hijacks Your AI Coding Agent - and Nothing Catches It. - Tenet Security.Agentjacking: a fake bug report hijacks AI coding agents - TNW.When anti-virus goes rogue - A trifecta of Defender zero-days - SolCyber.BitLocker in crisis? The "YellowKey" zero-day in plain English - SolCyber.Microsoft versus Full Disclosure: The ongoing Nightmare Eclipse saga - SolCyber.BitLocker, Defender, zero-days, and bragging rights: More MS nightmares - SolCyber.Inside the FBI’s Kinetic Cyber Range - FBI.Inside the FBI's Kinetic Cyber Range - YouTube.Computer worm strikes International Space Station - Graham Cluley.Raspberry Pi Zero W - Raspberry Pi.There’s still life in old technology.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Researchers at the University of Toronto have built a worm that thinks for itself. Using free off-the-shelf AI models it works out how to break into each new computer it encounters, and hijacks the powerful ones to host its own AI brain. And then the researchers discovered their creation had quietly removed the list of machines it wasn't supposed to attack.

Meanwhile, Meta's shiny new AI customer support agent has been cheerfully helping hackers help themselves to other people's Instagram accounts. Just keep asking, politely but firmly, to have a password reset sent to a different email address - and the AI will eventually agree.

All this and more in episode 471 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

EPISODE LINKS:

Emmys data leak: update exposes access to award submissions- Cybernews.A $1,000 AI agent found 21 zero-days in FFmpeg, some 23 years old- Martin Cid Magazine.Hackers steal $1.7M condom shipment​- Cybernews.AI Agents Enable Adaptive Computer Worms- ArXiv.21 Zero-Days in FFmpeg- Depthfirst.Meta confirms thousands of Instagram accounts were hacked by abusing its AI chatbot- ~this week in security~.Hackers trick Meta AI support bot to infiltrate Obama White House Instagram account- The Guardian.Look-In Star Portrait Challenge- Monkeon.Final Fantasy VII Remake- Square Enix.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!XBOW - The autonomous offensive security platform that helps security teams scale. Start a pentest today.OPSWAT - Read Benny Czarny's book, "Cybersecurity Upside Down", to rethink how you protect your organization from file-based threats, including those powered by AI.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A website called "UK visa portal" has been quietly collecting passport scans, selfies, and personal data from thousands of travellers who thought they were applying through official channels. They weren't. And when a journalist tried to warn the company, it was lawyers who responded.

Meanwhile, a paper from Cornell suggests that prompt injection - the technique malicious actors use to trick AI agents into doing things they really shouldn't - may be fundamentally unsolvable. Which is err... awkward, because everyone is rushing to plug AI agents into their email, files, and corporate networks.

Plus don't miss our featured interview with Andrea Sivieri of CoreView, who tells us how hackers can lock your entire organisation out of its Microsoft 365 environment... without having to trick you into running a single piece of malicious code or handing over a password.

All this and more in episode 470 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Tanya Janca.

EPISODE LINKS:

Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked- 404 Media.Canon Printer Vulnerability Leaks Plaintext Credentials- Praetorian.Password manager Dashlane says hackers stole some customers' password vaults- TechCrunch.UK Visa Portal exposed thousands of applicants’ passports and selfies — then called the lawyers on us- TechCrunch.AI Agents May Always Fall for Prompt Injections- ArXiv.MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure- Cloud Security Alliance.From Preventive to Reactive: How AI Coding Assistants Transform Developers' Security Awareness- ArXiv.Design details that feel like magic- Design Spells.Singing lessons.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.ESET - 30 years of threat research behind unique global telemetry, AI-native technology, and human expertise working together to keep your business protected.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

CISA, the US government agency whose entire job is keeping America's critical infrastructure safe from hackers, has had a contractor publish dozens of plain-text credentials to a public GitHub profile.

Meanwhile, your Oura ring is quietly transmitting some of its data unencrypted - and when one journalist asked the company how often it hands user data to law enforcement, the answer was quite telling.

Plus don't miss our featured interview with OPSWAT's Benny Czarny about his new book "Cybersecurity Upside Down."

All this and more in episode 469 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lesley Carhart.

EPISODE LINKS:

Canadian man arrested by international authorities, charged with administrating KimWolf DDoS botnet- US Dept of Justice.700+ education and tech websites hijacked in huge ClickFix malware campaign- Malwarebytes.Leaked Documents Reveal Russian ‘Cognitive Strikes’ Against the West - Including Islamophobic ‘Pig Head’ Attacks in Paris- OCCRP.Lawmakers Demand Answers as CISA Tries to Contain Data Leak- Krebs On Security.US cybersecurity agency CISA reportedly in dire shape amid Trump cuts and layoffs- TechCrunch.Oura says it gets government demands for user data. Will it share how many?- This Week In Security.Privacy and transparency of fitness tracking devices- Whyli.Upfest- Europe’s largest street-art festival.Magnets Are Bad For Hardware Again- Hackaday.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!XBOW - The autonomous offensive security platform that helps security teams scale. Start a pentest today.OPSWAT - Read Benny Czarny's book, "Cybersecurity Upside Down", to rethink how you protect your organization from file-based threats, including those powered by AI.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us onBlueskyorMastodon, or on theSmashing Security subreddit, andvisit our websitefor more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A 23-year-old radio enthusiast spent £300 on a piece of kit from the internet, and used it to bring four packed high-speed trains to a screeching halt. His defence in court? Possibly the most creative excuse we've heard all year.

Meanwhile, owners of $4,000 robot lawnmowers are discovering that their gadget can be hijacked over the internet, redirected at journalists who foolishly lie down in front of it, and used to harvest Wi-Fi passwords, email addresses, and GPS coordinates. Change the default password? Sure - until the next firmware update silently resets it back.

Plus - don't miss our featured interview with XBOW's Brendan Dolan-Gavitt about how AI is transforming penetration testing.

All this and more in episode 468 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Geoff White.

EPISODE LINKS:

Open source tool maker Grafana Labs says hackers stole its code, refuses to pay ransom - TechCrunch.Man accused of stealing Beyoncé’s unreleased music takes guilty plea - ABC News.Shai-Hulud code drop: Open season for supply chain attacks- ReversingLabs.Student hacked Taiwan high-speed rail to trigger emergency brakes - BleepingComputer.Polish teen derails tram after hacking train network - The Register.The Cheap Radio Hack That Disrupted Poland's Railway System - WIRED.The man with an army of Yarbo robot lawn mowers - The Verge.Ever been run over by a robot? I have - for science! - TikTok.RD280UA 28” WQXGA BenQ Programming Monitor with Backlight and Flexible Arm - BenQ.Kai Shun DM-0708 combination sharpening stone, grain 300/1000 - Knives and Tools.AI-Assisted ICS Attack on a Water Utility - Dragos.Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access - Google Cloud Blog.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!XBOW - The autonomous offensive security platform that helps security teams scale. Start a pentest today.OPSWAT - Read Benny Czarny's book, "Cybersecurity Upside Down", to rethink how you protect your organization from file-based threats, including those powered by AI.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Welcome to the largest educational data breach in history - affecting nearly 9,000 institutions, every Ivy League university, and 30 million students mid-finals. When Canvas's parent company refused to pay and announced they had deployed "security patches" instead, the hackers were less than impressed. So they came back through the cat flap.

Meanwhile, a famous finance expert's face has been showing up on Facebook adverts promising hot stock tips and exclusive WhatsApp investment groups. Spoiler: it isn't him, the tips aren't real, and you're about to be scammed.

Plus we chat to Mike Nichols of Elastic, about how the SOC isn't dying, attackers and defenders are both deploying AI agents, and how the real security crisis is no longer human users - it's the bots acting on their behalf.

All this and more in episode 467 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

ICO fines South Staffordshire £963K over 2022 breach - The Register.US bank reports itself after AI customer data mishap - The Register.Hackers abuse Google ads, Claude.ai chats to push Mac malware - Bleeping Computer.Canvas hack: What we know about apparent cyberattack that impacted thousands of schools - CNN.Canvas hack: Company pays criminals to delete students' stolen data - BBC News.Post by @amosmagliocco.bsky.social - Bluesky.Post by @sethcotlar.bsky.social - Bluesky.The Architecture of Deception: How a $187 Million Fraud Ecosystem Exploits Trust Across Australia and the United States - Group IB.The Fake Nobel that Duped the Romanian Academy - Scena9.A (Very) Short History of Life On Earth by Henry Gee - Waterstones.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Elastic – AI is transforming security operations, but security is still a data problem. Learn how context-rich data drives faster, more reliable defence.CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Meta's smart glasses promise privacy "designed for you" - but everything they record was being beamed off to workers in Nairobi to label by hand. When those workers blew the whistle, Meta sacked all 1,108 of them.

Meanwhile, the IT press is in a frenzy over a new Linux bug called "Copy Fail" - complete with logo, dedicated website, and a marketing-friendly name. But is it really the disaster everyone's making it out to be?

And in our featured interview, Jake Moore of ESET explains how he tricked a company into offering his deepfake clone a job - after a perfectly normal-looking video interview.

All this and more in episode 466 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest Paul Ducklin.

EPISODE LINKS:

Anti-DDoS Firm Heaped Attacks on Brazilian ISPs - Krebs On Security.Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha - Bleeping Computer.Trellix confirms data breach after hack of 'a portion' of its source code - TechRadar.Meta’s AI Smart Glasses and Data Privacy Concerns: Workers Say “We See Everything” - Svd.Dispute over fate of Kenyan workers who saw Meta AI glasses films - BBC News.Copy Fail - CVE-2026-31431.Copy Fail: Hype versus reality - the full story - SolCyber.Flight into Danger: The Original Airplane! - BBC Sounds.The Luton writer behind the original Airplane! - BBC News.Code Dependent by Madhumita Murgia - Pan Macmillan.The Code Book - Simon Singh.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!ESET - 30 years of threat research behind unique global telemetry, AI-native technology, and human expertise working together to keep your business protected.Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A developer at an AI startup wanted to cheat at Roblox. They downloaded a dodgy script on their work laptop. That one decision triggered a cascade of failures that ended with a $2 million data breach affecting hundreds of thousands of organisations. All for some free in-game currency.

Meanwhile, there's a 1980s phone protocol called SS7 that lets shadowy surveillance companies track anyone, anywhere, via their mobile phone. Governments know about it. Telecoms know about it. Nobody's fixing it.

All this and more in episode 465 of the "Smashing Security" podcast with cybersecurity keynote speaker and industry veteran Graham Cluley, joined this week by special guest James Ball.

Plus! Don't miss our featured interview with Rob Edmondson of CoreView, discussing how to lock down Microsoft 365 before it's too late.

EPISODE LINKS:

Burglar alarm biz gets burgled, ShinyHunters pursues ransom - The Register.Ransomware negotiator pleads guilty after leaking victims' insurance details to 'BlackCat' hackers - Tom’s Hardware.Grok tells researchers pretending to be delusional ‘drive an iron nail through the mirror while reciting Psalm 91 backwards’ - The Guardian.Vercel April 2026 security incident - Vercel.App host Vercel says it was hacked and customer data stolen - TechCrunch.Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials - Hacker News.Sorry for the Nazi spam from my Twitter account - Graham Cluley.Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors - Citizen Lab.Surveillance vendors caught abusing access to telcos to track people's phone locations, researchers say - TechCrunch.The rapid rise of phone surveillance firms - The Bureau of Investigative Journalism.Please shut up about your Spotify Wrapped - The New World.Think For Yourself - Beatles Song Identification Game.Nodes: Free Connection Puzzle & Vertex Game Alternative.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Elastic – AI is transforming security operations, but security is still a data problem. Learn how context-rich data drives faster, more reliable defence.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A company that ran anonymous tip lines for 35,000 American schools - handling reports of bullying, weapons, and self-harm - boasted on its website that it had suffered zero security breaches in over 20 years. A hacker called Internet Yiff Machine thought that sounded like a challenge, with predictable results...

Meanwhile, Rockstar Games gets hacked again - and the stolen data turns out to be less embarrassing than the financial secrets it accidentally revealed. GTA Online is still making half a billion dollars a year. Red Dead Redemption is not.

All this and more in episode 464 of the "Smashing Security" podcast with cybersecurity keynote speaker and industry veteran Graham Cluley, joined this week by special guest BBC cybersecurity correspondent Joe Tidy.

Plus! Don't miss our featured interview with Ryan Benson of Meter.

EPISODE LINKS:

Grinex exchange blames "Western intelligence" for $13.7M crypto hack - Bleeping Computer.Are Former Black Basta Affiliates Automating Executive Targeting? - Reliaquest.Apple is working on passcode bug locking out iPhone users - The Register.Hackers who stole crime tip records offering data cache for $10k - San.P3 Advertised 20+ Years and 0 Security Breaches. You Can Guess What Happened Next - Databreaches.net.Portland police urge residents to avoid Crime Stoppers following hack - San.GTA-maker Rockstar Games hacked again but downplays impact - BBC News.Rockstar hackers release their stolen data, reveal that Rockstar was right to not pay them anything for it - PC Gamer.XCancel.”We Are Anonymous” by Parmy Olson - Penguin.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Elastic – AI is transforming security operations, but security is still a data problem. Learn how context-rich data drives faster, more reliable defence.Meter – Network infrastructure for the enterprise. Get a free personalised demo.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A hacking group claims to have broken into the flood defence system protecting Venice's Piazza San Marco - and is offering to sell access to whoever wants it. The asking price? A frankly insulting $600.

Meanwhile, Anthropic accidentally leaked the source code for Claude Code via a basic packaging mistake. Oh, and by the way, they've also just revealed they've built an AI model called Mythos that can find and chain together software vulnerabilities faster than any human. Sleep well.

All this and more in episode 463 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest Tanya Janca.

EPISODE LINKS:

Booking.com warns customers of hack that exposed their data- The Guardian.GTA-maker Rockstar Games hacked again but downplays impact- BBC News.Meta removes ads for social media addiction litigation- Axios.Hackers claim control over Venice San Marco anti-flood pumps- Security Affairs.Venezia, attacco hacker al sistema di pompe che difende piazza San Marco dall'acqua: «Abbiamo i codici, possiamo disattivarlo»- Corriere del Veneto. Digging into the Claude Code source- Dave Schumaker’s write-up of Anthropic leaking data in February 2025.Anthropic goes nude, exposes Claude Code source by accident- The Register.Assessing Claude Mythos Preview’s cybersecurity capabilities- Anthropic.Smashing Security transcripts!Shrinking- Apple TV. Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Meter - Network infrastructure for the enterprise. Get a free personalised demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

LinkedIn has been secretly scanning your browser for over 6,000 installed extensions — on every single click you make. It can tell if you're job hunting, what religion you are, and whether you have ADHD. And none of this is mentioned anywhere in their privacy policy.

Meanwhile, California's crypto millionaires are learning that no amount of encryption can protect you from someone who knocks on your door pretending to deliver a pizza.

All this and more in episode 462 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest Dave Bittner.

EPISODE LINKS:

Russian government hackers broke into thousands of home routers to steal passwords - TechCrunch.Refusal to Give the Government Passwords to Personal Mobile Device Criminalized in Hong Kong - US Consulate in Hong Kong."I didn't think millions would see this..." Russians are calling each other through a cat feeder - GUBDaily.BrowserGate.Scanned extensions database - BrowserGate.LinkedIn secretly scans for 6,000+ Chrome extensions, collects data - Bleeping Computer.Translate into LinkedIn speak - Kagi.Security - xkcd.Wealthy California crypto holders targeted in violent ‘wrench attacks’ - KTLA 5.Lost Doctor Who episodes to be released this week - BBC News.Doctor Who: The Daleks’ Master Plan - The Nightmare Begins - BBC iPlayer.Doctor Who: The Daleks’ Master Plan - Devil’s Planet - BBC iPlayer.Milton Bradley Grandmaster Robotic Chess Computer - YouTube.Robot Chess - One-armed gambit - Techmoan on YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ESET - 30 years of threat research behind unique global telemetry, AI-native technology, and human expertise working together to keep your business protected.Meter - Network infrastructure for the enterprise. Get a free personalised demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A cannabis-growing, beekeeping, gyrocopter-flying Irishman invested his drug money in Bitcoin back in 2011 - and now sits on a fortune worth $400 million. There's just one small problem: the access codes were tucked inside his fishing rod case, which has mysteriously vanished. Or has it? Because this week, one of his frozen wallets suddenly woke up and moved $35 million - and someone had to identify themselves to do it.

Meanwhile, Ajax Football Club scores a spectacular cyber own-goal, as a data breach that the club claimed affected "a few hundred" fans turns out to may have exposed the personal details of 300,000 supporters - along with the ability to steal match tickets and quietly remove people from the stadium ban list.

All this and much more in episode 461 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, joined this week by special guest journalist Danny Palmer.

EPISODE LINKS:

Iran-linked hackers breach FBI director's personal email, publish photos and documents - Reuters.Windows PCs crash three times as often as Macs, report says - TechSpot.Wife used CCTV to steal $176M of husband’s crypto, UK court told - Coin Telegraph.Gardaí open €30m bitcoin virtual wallet, first of 12 accessed since seizure in 2019 - Irish Times.Irish Drug Dealer’s Lost BTC Stack Worth $400m Has Woken Up - Arkham.Ajax FC data breach exposes 300,000 fans, hacker steals tickets an stadium ban details - Cybernews.Small Prophets - BBC iPlayer.RPG Taverns - Dungeons and Dragons tavern in London.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.Meter - Network infrastructure for the enterprise. Get a free personalised demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A disgruntled data analyst decides that the best response to losing his contract is to steal the entire company payroll database and demand $2.5 million in Bitcoin - signing his extortion emails from a company called "Loot."

Meanwhile, two people drive up to the entrance of the UK's nuclear submarine base at Faslane and politely ask if they can have a look around. Tourists? Spies? Something in between?

Plus: Female Muslim punk rock group, and a little red book that might save your sanity in a post-truth world.

All this and more in episode 460 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Jenny Radcliffe.

EPISODE LINKS:

A Top Google Search Result for Claude Plugins Was Planted by Hackers - 404 Media.Iowa-based Intoxalock cyberattack disrupts calibration service for interlock users - DysruptionHub.China hacker group leaks $7M crypto theft operation targeting wallet supply chains​ - Crypto News.Federal Jury Convicts Charlotte Man For Cyber Extortion Scheme That Targeted International Technology Company - DOJ.Iranian and Romanian charged after allegedly trying to enter UK nuclear naval base - Sky News.LadyParts - Spotify.On Disinformation: How to Fight for Truth and Protect Democracy - Lee McIntyre.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

In episode 459 of Smashing Security, we dive into a chillingly clever account takeover attempt targeting WordPress co-founder Matt Mullenweg - involving MFA fatigue, real Apple alerts, a convincing support call, and a phishing page that oh-so-nearly worked. If a famous techie could have this happen to you, can you be sure you're immune?

Plus: would you donate your lifetime medical history to science if you were promised anonymity? We unpack serious concerns around UK Biobank, where “de-identified” data may not be as anonymous as you think — and how surprisingly little information it takes to reveal everything.

And! Human-powered “AI”, and a punishment worse than prison: eight hours on the RSA expo floor...

All this, and much more, in episode 459 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Paul Ducklin.

EPISODE LINKS:

DOGE employee stole Social Security data and put it on a thumb drive, report says- TechCrunch.Foreign hacker in 2023 compromised Epstein files held by FBI, source and documents show- Reuters.New font-rendering trick hides malicious commands from AI tools- Bleeping Computer.Lockdown Mode- Apple support.Gone (Almost) Phishin’- Matt Mullenweg.Listen to the Live Scam Call Targeting Matt Mullenweg’s Apple Account- YouTube.Confidential health records from UK BioBank project exposed online- The Guardian.A message from Professor Sir Rory Collins, Chief Executive and Principal Investigator of UK Biobank- UK BioBank.Psychotherapy data breach blackmailer sent to prison- Paul Ducklin.Your AI slop bores me.Post by Vaughan Shanks- LinkedIn.Judge Sentences CISO to 8 Consecutive Hours on RSA Expo Floor as Formal Punishment for Security Breach- The Exploit.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Adaptive Security - request a custom demo featuring a real CEO deepfake simulation.Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A Wikipedia security engineer accidentally wakes a dormant JavaScript worm that hadn't stirred since 2024 - and within minutes, giant woodpecker images are plastered across the internet's favourite encyclopaedia.

Meanwhile, a crypto contractor hired to help the US Marshals manage seized digital assets allegedly decides to help himself to $46 million of it - and then brags about it on a recorded Telegram call.

Plus: Graham champions Asterix, Trisha discovers the fantasy novels of Robin Hobb, and someone called "Lick" ends up in the nick.

All this, and much more, in episode 458 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Tricia Howard.

EPISODE LINKS:

Major data leak forum dismantled in global action against cybercrime forum- Europol.Ericsson blames vendor vishing slip-up for breach exposing thousands of records- The Register.How hackers bypassed MFA with a $120 phishing kit – until law enforcement  shut them down- Hot for Security.Wikipedia hit by self-propagating JavaScript worm that vandalized pages- Bleeping Computer.FBI arrests crypto thief accused of stealing $46 million from seized government wallet- Tom’s Hardware.Twitter thread by ZachXBT about John Daghita’s arrest- Twitter.Asterix- Wikipedia.Robin Hobb.The Complete Farseer trilogy- Harper Collins.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

When a top cybersecurity firm discovered it had a leak, you would expect the FBI to be called. Instead, the person put in charge of the investigation was the actual leaker... who promptly sent an innocent colleague into a career-ending ambush.

In this episode, we unravel the jaw-dropping tale of a defence contractor caught selling zero-day exploits to a Russia-linked broker.

Plus: are nation states quietly poisoning AI models to bend reality itself? We explore how “foreign information manipulation interference” could target not just social media users, but the large language models we increasingly trust for answers — and what that might mean for truth, trust, and the future of online influence.

All this, and much more, in episode 457 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Carl Miller.

EPISODE LINKS:

Large-Scale Online Deanonymization with LLMs - Simon Lermen.Hacked Prayer App Sends ‘Surrender’ Messages to Iranians Amid Israeli and US Strikes - Wired.“Stay safe out there gamers”: Streamers say Amazon just made Wishlists a doxxing risk - Daily Dot.Apple alerts exploit developer that his iPhone was targeted with government spyware - TechCrunch.Former General Manager for U.S. Defense Contractor Sentenced to 87 Months for Selling Stolen Trade Secrets to Russian Broker - US Department of Justice.Treasury Sanctions Exploit Broker Network for Theft and Sale of U.S. Government Cyber Tools - US Department of Treasury.Inside the story of the US defense contractor who leaked hacking tools to Russia - TechCrunch.​​Hundreds of English-language websites link to pro-Kremlin propaganda - Guardian.The Incredible Shrinking Man - Internet Archive.“The Immortalists” by Aleks Kortoski - Penguin Books.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.Meter - Network infrastructure for the enterprise. Get a free personalised demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

When the mysterious operator of an internet archiving-service decided to silence a curious Finnish blogger, they didn’t just send a stroppy email - they allegedly weaponised their own CAPTCHA page to launch a DDoS attack, threatened to invent an entirely new genre of AI porn, and tampered with parts of their own archive to smear the blogger's name.

In this episode, we unravel how a website designed to preserve history may have trashed its own credibility - and how Wikipedia responded when trust went out the window.

Plus a ransomware gang shoots itself in the foot with a classic case of buffoonery, accidentally corrupting the very keys victims would need to decrypt their data. When even the criminals can’t unlock your files, what happens next?

All this, a surprisingly zen Pick of the Week, and a gloriously splenetic rant against web forms, on episode 456 of the award-winning "Smashing Security" podcast, with cybersecurity veteran Graham Cluley and special guest Paul Ducklin.

EPISODE LINKS:

This App Will Detect People Wearing Smart Glasses Near You- Lifehacker.Patients listed as dead after major NZ health app MediMap hacked- 1News.Why fake AI videos of UK urban decline are taking over social media- BBC News.FBI orders domain registrar to reveal who runs mysterious Archive.is site- Ars Technica.Archive.today CAPTCHA page executes DDoS; Wikipedia considers banning site- Ars Technica.Archive.today is directing a DDOS attack against my blog- Gyrovague.Critical buffer overflow bug - in ESXi ransomware- SolCyber.Yoga with Adriene- YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Could America turn off Europe's internet?

That’s one of the questions that Graham and special guest James Ball will be exploring as they discuss tech sovereignty. Could Gmail, cloud services, and critical infrastructure really become geopolitical leverage? And is anyone actually building a Plan B?

Plus we explore if Meta is quietly plotting to turn its smart glasses into face-recognising surveillance specs? With reports of internal memos suggesting they plan to launch controversial features while everyone’s distracted by political chaos, we ask: is this innovation really wanted by the public... or something far creepier?

All of this, and much more, in episode 455 of the award-winning "Smashing Security" podcast with cybersecurity veteran Graham Cluley, joined this week by journalist and author James Ball.

EPISODE LINKS:

IcedID malware developer fakes his own death to escape the FBI- Risky Business.Sex toys maker Tenga says hacker stole customer information - TechCrunch.Dutch police arrest man for "hacking" after accidentally sending him confidential files - Hot for Security.Meta Plans to Add Facial Recognition Technology to Its Smart Glasses - New York Times.Trading Sovereignty for Scale? The Costs of the US - UK Tech Prosperity Deal - Just Security.Just Mercy- Wikipedia.Just Mercy trailer - YouTube.Bryan Stevenson’s TED talk: We need to talk about an injustice - YouTube.The Residence - Netflix.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Passwork - a reliable secrets manager and password management solution.Adaptive Security - request a custom demo featuring a real CEO deepfake simulation.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

AI bots are having existential crises, inventing religions, and allegedly plotting against humanity... or so the internet would have you believe.

We dig into Moltbook, the “AI-only” social network that sent Twitter into a meltdown, attracted breathless talk of the singularity, and turned out to be far less Terminator and far more humans role-playing as bots.

Plus we discuss why "vibe coding" your app might be a catastrophically bad idea, when security researchers can easily peek inside rifle through your private messages, API keys, and databases.

Also this week we learn that pro-Russian hackers are circling the Winter Olympics - or is it the Jamaican Bobsleigh team?

All this and more is discussed in episode 454 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Iain Thomson.

EPISODE LINKS:

AI Agents Created Their Own Religion, Crustafarianism, On An Agent-Only Social Network - Forbes.I Infiltrated Moltbook, the AI-Only Social Network Where Humans Aren’t Allowed - Wired.'Moltbook' social media site for AI agents had big security hole, cyber firm Wiz says - Reuters.Italy blames Russia-linked hackers for cyberattacks ahead of Winter Olympics - The Record.Italy says railways hit by 'serious sabotage' as Winter Olympics begin - BBC News.EpsteIN - GitHub.Private Eye.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Meter - Network infrastructure for the enterprise. Get a free personalised demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Passwork - a reliable secrets manager and password management solution.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Supposedly redacted Jeffrey Epstein files can still reveal exactly who they’re talking about - especially when AI, LinkedIn, and a few biographical breadcrumbs do the heavy lifting.

Sloppy redaction leads to explosive claims, and difficult reputational consequences for cybersecurity vendors, and we learn how trust - once cracked - can be almost impossible to fully restore.

Elsewhere, the spotlight turns to insider threat in the age of AI, after a senior US cybersecurity official uploads sensitive government material into the public version of ChatGPT. Oops.

All this, and much more, in episode 453 of Smashing Security with cybersecurity veteran Graham Cluley and special guest Tricia Howard.

EPISODE LINKS:

Notepad++ hijacked to serve malware in targeted attacks - Notepad++.Porn-quitting app caught leaking users’ sexual habits - 404 Media.MicroWorld Technologies’ eScan anti-virus update turned into a malware delivery system - Morphisec.Jmail.World.Informant told FBI that Jeffrey Epstein had a ‘personal hacker’ - Techcrunch.Confidential informant statement given to FBI - US Department of Justice.Post by Graham Cluley - LinkedIn.Trump’s acting cyber chief uploaded sensitive files into a public version of ChatGPT - Politico.We are Lady Parts - Channel 4.We are Lady Parts trailer - YouTube.“Bashir with a good beard” by We are Lady Parts - YouTube.“Voldermort under my headscarf” by We are Lady Parts - YouTube.Doctor Who: The Shakespeare Notebooks - Penguin.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Passwork - a reliable secrets manager and password management solution.Meter - Network infrastructure for the enterprise. Get a free personalised demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

In episode 452, a London-based YouTuber wins a landmark court case against Saudi Arabia after his phone was hacked with Pegasus spyware — exposing how a single, seemingly harmless text message can turn a smartphone into a round-the-clock surveillance device.

Plus, we go looking for professional hitmen online - only to uncover uncomfortable questions about why some crimes attract customers but very few complaints.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veteran Graham Cluley, joined this week by special guest Joe Tidy.

EPISODE LINKS:

Sorry Dave, I’m afraid I can’t do that! PCs refuse to shut down after Microsoft patch - The Register.Russian state hackers likely behind wiper malware attack on Poland’s power grid - The Record.US charges 31 more suspects linked to ATM malware attacks - Bleeping Computer.Dark web arrests in Romania linked to portal which offered services including murder - ROCU.Romanian scammers ran fake hitman-for-hire site, lured desperate perpetrators as 'incompetent assassins' - Fox News.This Fake Hitman Site Is the Most Elaborate, Twisted Dark Web Scam Yet - VICE.Unlikely Assassin, The Murder of Amy Allwine - Rooster.Saudi dissident awarded $4.1 million by UK court for hacking, assault 'by Saudi Arabia' - Reuters.Stalkerware: The software that spies on your partner - BBC News.Using 'stalkerware' to spy on a colleague's phone - YouTube.“Polite Society” trailer - YouTube.Elegoo Saturn 3 3D printer - Elegoo.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Passwork - a reliable secrets manager and password management solution.Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

In episode 451 of "Smashing Security," we meet the cybercriminal who hacked the US Supreme Court, Veterans Affairs, and more - and then helpfully posted screenshots (and even someone’s blood type) on an account called "I hacked the government."

Plus we discuss how researchers uncovered a creepy flaw that lets attackers hijack wireless headphones, listen in on calls, inject audio, and even turn your earbuds into a stalking device - all without you noticing.

All this, and much more, in this episode of the "Smashing Security" podcast with Graham Cluley, and special guest Ray [REDACTED]

EPISODE LINKS:

Tennessee Man Pleads in Hacking U.S. Supreme Court, AmeriCorps, and VA Health System - US Department of Justice.Paris Hilton’s hacker sentenced to 57 months in prison - Graham Cluley.WhisperPair.One Tap To Hijack Them All - A Security Analysis of the Google Fast Pair Protocol - YouTube.Hundreds of Millions of Audio Devices Need a Patch to Prevent Wireless Hacking and Tracking - Wired.Line of Duty - Wikipedia.Line of Duty - BBC iPlayer.Forgive the haters - YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.Adaptive Security - request a custom demo featuring a real CEO deepfake simulation today from adaptivesecurity.com.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Confusion reigns after claims that data linked to 17.5 million Instagram accounts is up for sale - sparked by a vague post, contradictory statements, and a flood of password reset emails nobody asked for.

And we dig into Grok, Elon Musk’s AI chatbot, after it started generating sexualised images of women and children - raising uncomfortable questions about guardrails, accountability, and why playing the censorship card doesn’t make the problem go away.

All this, and much more, in this episode of the "Smashing Security" podcast with Graham Cluley, and special guest Monica Verma.

EPISODE LINKS:

Free Speech Union website down after alleged funders exposed by trans hackers - Pink News.Illinois Man Charged in Snapchat Hacking Investigation - US Dept of Justice.Hackers get hacked, as BreachForums database is leaked - Hot for Security.Post by Malwarebytes - Bluesky.Post by Instagram - Twitter.Instagram denies breach amid claims of 17 million account data leak - Bleeping Computer.Ofcom asks X about reports its Grok AI makes sexualised images of children - BBC News.Musk’s Grok blocked by Indonesia, Malaysia over sexualized images in world first - CNN.Elon Musk shares AI images of Starmer in bikini in row over grim Grok deepfakes - Mirror.Soul Music - BBC Sounds.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Romance scammers have apparently discovered astrology... and Taurus is their secret weapon.

In episode 449 of "Smashing Security", we take a look inside an actual romance-fraud handbook - complete with scripts, personality “types”, corporate jargon, and a seven-day plan to get victims from hello to hand over the crypto.

Then Lesley "hacks4pancakes" Carhart delivers a reality check on the dire cybersecurity jobs market for juniors: why entry-level roles are evaporating, how automated CV screening is chewing candidates up, and what hopeful newcomers (and weary veterans) can do about it.

Plus, Graham talks to ThreatLocker CEO Danny Jenkins about why misconfigurations are behind an uncomfortable number of breaches, how default-deny security actually works in practice, and why detecting attacks after they’ve started is already too late.

All this, and much more, in this episode of the "Smashing Security" podcast with Graham Cluley, and special guest Lesley Carhart.

EPISODE LINKS:

Millions of Android Powered TVs and Streaming Devices Infected by Kimwolf Botnet - Hackread.Ilya Lichtenstein, Bitcoin hacker behind massive crypto theft, credits Trump for early prison release - CNBC.How Fake BSODs and Trusted Build Tools Are Used to Construct a Malware Infection - Securonix.A scammer's guide: How cybercriminals plot to rob a target in a week - Reuters.Game of Wool: Britian’s Best Knitter - Channel 4.Game of Wool trailer - YouTube.Earthrise One: Melbourne's Premier Sci-Fi Escape Room Adventure.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.Meter - Network infrastructure for the enterprise. Get a free personalised demo.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Think your Kindle is harmless? Think again! In this episode, Graham and special guest Danny Palmer unpack a Black Hat Europe talk revealing how a boobytrapped audiobook could exploit the Amazon eBook reader - potentially letting an attacker break into your account and seize control of your credit card.

Plus a blast from 2021's "summer of ransomware" returns to haunt Ireland's Health Service Executive, as victims are offered €750 each.

And because it's the last show before the Christmas break, there's also a Pick of the Week that veers from cosy rom-com comfort to pointy-polygon nostalgia. 

All this, and more, in episode 448 of the "Smashing Security" podcast with Graham Cluley, and special guest Danny Palmer.

🎅 🎄 Thanks to everyone for listening to "Smashing Security" during 2025 - we look forward to being back in your ear'oles in early January. Stay safe!🎅 🎄

EPISODE LINKS:

Password manager provider fined £1.2m by ICO for data breach affecting up to 1.6 million people in the UK - ICO.Trump Administration Turning to Private Firms in Cyber Offensive - Bloomberg.Russian ban on Roblox gaming platform sparks rare protest - Reuters.Once upon an exploit: how fake audiobook led to Kindle takeover - Cybernews.Four years later, Irish health service offers €750 to victims of ransomware attack - Bitdefender.When Harry Met Sally - Wikipedia.When Harry Met Sally trailer - YouTube.Tomb Raider 1-3 Remastered review - you were never going to smooth these games out - Eurogamer.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!ThreatLocker - Start your free trial and book a demo of ThreatLocker today to see how you can implement Zero Trust in your environment.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

On this week's show we learn that AI really can be a stalker’s best friend, as we explore a strange tale that starts with a manatee-shaped mailbox on a millionaire's lawn and ends with Grok happily doxxing real people, mapping out stalking "strategies," and handing out revenge-porn tips.

Then we go inside the Louvre heist, where thieves in hi-vis and a hire van waltzed off with the French crown jewels in broad daylight, exploiting our assumptions about what "looks normal" - the same kind of bias we’re now baking into security AIs.

Plus, Graham chats with Rob Edmondson from CoreView about why misconfigurations and over-privileged accounts can make Microsoft 365 dangerously vulnerable.

All this, and more, in episode 447 of the "Smashing Security" podcast with Graham Cluley, and special guest Jenny Radcliffe.

EPISODE LINKS:

Khashoggi widow files complaint in France alleging Saudi government infected devices with spyware - The Record.US Posts $10 Million Bounty for Iranian Hackers - Security Week.Infostealer has entered the chat - Kaspersky.Dave Portnoy posts a photo of his lawn (including a manatee-shaped mailbox) - Twitter.Elon Musk’s Grok AI Is Doxxing Home Addresses of Everyday People - Futurism.Elon Musk’s Grok Is Providing Extremely Detailed and Creepy Instructions for Stalking - Futurism.How the Louvre thieves exploited human psychology to avoid suspicion – and what it reveals about AI - The Conversation.Outrageous (TV series) - Wikipedia.Outrageous trailer - YouTube.Man charged with theft after allegedly swallowing Fabergé pendant in jewellery store - The Guardian.Free Microsoft 365 Tenant Security Scanner - CoreView.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Horizon3.ai - Get an autonomous pentest demo and see your network the way attackers do. Visit Horizon3.ai.CoreView - Benchmark your Microsoft 365 tenant security against the Center for Internet Security (CIS) controls. 

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

A teenage cybercriminal posts a smug screenshot to mock a sextortion scammer... and accidentally hands over the keys to his real-world identity. Meanwhile, we look into the crystal ball for 2026 and consider how stolen data is now the jet fuel of cybercrime – and how next year could be even nastier than 2025.

Plus, Graham rants about recipe sites that won’t shut up, and there's even more love for Lily Allen's album "West End Girl" album.

All this and more is discussed in episode 446 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Rik Ferguson.

EPISODE LINKS:

Europol nukes Cryptomixer laundering hub, seizing €25M in Bitcoin - The Register.4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign - Koi.Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts - Push Security.Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’ - Krebs on Security.Jonathan Ross email goof highlights Twitter security issue - Graham Cluley.VIDEO: Mark Zuckerberg’s password choices are dadada-dumb! - Graham Cluley.Password to Louvre’s video surveillance system was 'Louvre', according to employee - ABC News.Just the Recipe.West End Girl - Wikipedia.West End Girl - Spotify.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

1Password - Take the first step to better security by securing your team’s credentials.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

America's airwaves are haunted by zombies again, as we dig into a decade of broadcasters leaving their hardware open to attack, giving hackers the chance to hijack TV shows, blast out fake emergency alerts, and even replace religious sermons with explicit furry podcasts.

Meanwhile, we look at how a worker at a cybersecurity firm allegedly leaked internal information to a hacking gang - raising big questions about insider threats.

Plus: Frankenstein on Netflix, Vine nostalgia, and why Barney the Dinosaur may be the true criminal mastermind behind it all.

All this and more is discussed in episode 445 of the “Smashing Security” podcast with cybersecurity veteran Graham Cluley, and special guest Dan Raywood.

EPISODE LINKS:

Fake adult websites pop realistic Windows Update screen to deliver stealers via ClickFix - Acronis.Tokyo Court Finds Cloudflare Liable For Manga Piracy in Long-Running Lawsuit - TorrentFreak.Former Google chief accused of spying on employees through account ‘backdoor’ - LA Times.Bogus zombie apocalypse warnings undermine US emergency alert system - Ars Technica.2013 EAS Zombie Hoax - Emergency Alert System Wiki.The 1987 Max Headroom incident - YouTube.Nation-wide radio station hack airs hours of vulgar “furry sex” ramblings - Ars Technica.ESPN 97.5 Houston Victim Of Barix Hack - Radio Insight.ESPN Houston apologises to viewers - Facebook.CrowdStrike fires ‘suspicious insider’ who passed information to hackers - TechCrunch.Frankenstein official trailer - YouTube.Frankenstein - Netflix.Vine: Six Seconds that changed the world - Global Player.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Horizon3.ai - Get an autonomous pentest demo and see your network the way attackers do. Visit Horizon3.ai.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Stop the press - a company has actually said "sorry" after a data breach, and hotels are helping hackers phish their own guests.

In episode 444 of "Smashing Security" we examine a refreshingly honest breach response (and why legacy systems are still going to ruin your week), dig into a nasty hotel-booking malware campaign that abuses trust in apps and CAPTCHAs, and chat about autonomous pen testing, AI-turbocharged cybercrime, and what CISOs should really be asking on Monday morning.

And lost Doctor Who is brought back to life by one very dedicated animator, and we take a look at Eddie Murphy’s career.

All this and more is discussed in episode 444 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Tricia Howard.

Plus - don't miss our featured interview with Snehal Antani from Horizon3.ai!

EPISODE LINKS:

A Simple WhatsApp Security Flaw Exposed 3.5 Billion Phone Numbers - Wired.British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News.Cloudflare experiences a massive outage - LifeHacker.Protecting our Merchants: Standing up to Extortion - Checkout.A miracle: A company says sorry after a cyber attack - and donates the ransom to cybersecurity research - Hot for Security.Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware - The Hacker News.Unmasking a Sophisticated Phishing Campaign That Targets Hotel Guests - Akamai.Doctor Who Animation: Daleks' Master Plan - The Nightmare Begins. Part 1 - YouTube.Doctor Who Animation: Daleks' Master Plan - The Nightmare Begins. Part 2 - YouTube.Being Eddie - Netflix.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Horizon3.ai - Get an autonomous pentest demo and see your network the way attackers do. Visit Horizon3.ai.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Tinder has got a plan to rummage through your camera roll, and Warren Buffett keeps popping up in convincing deepfakes dishing "number one investment tips."

Meanwhile, will agentic AI replace your co-hosts before you can say "EDR for robots"? and why you should still read books.

All this, plus Lily Allen's new album and Claude Code come up for discussion in episode 443 of the "Smashing Security" podcast, with special guest Ron Eddings.

EPISODE LINKS:

‘Landfall’ spyware abused zero-day to hack Samsung Galaxy phones - TechCrunch.Cyber insurers paid out over twice as much for UK ransomware attacks last year - The Register.Lost iPhone? Don’t fall for phishing texts saying it was found - Bleeping Computer.Tinder to use AI to get to know users, tap into their Camera Roll photos - TechCrunch.Facebook’s AI can now suggest edits to the photos still on your phone - TechCrunch.Berkshire warns of AI deepfakes impersonating Warren Buffett - Reuters.West End Girl - Wikipedia.West End Girl - Spotify.Claude Code.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Time itself comes under attack as a state-backed hacking gang spends two years tunnelling toward a nation’s master clock — with chaos potentially only a tick away.

Plus when ransomware negotiators turn to the dark side, what could possibly go wrong?

All this and more is discussed in episode 442 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Dave Bittner.

EPISODE LINKS:

Alleged Meduza Stealer malware admins arrested after hacking Russian org - Bleeping Computer.Tap-and-Steal: The Rise of NFC Relay Malware on Mobile Devices - Zimperium.Postcode Lottery's lucky dip turns into data slip as players draw each other's info - The Register.Chinese Ministry of State Security MSS WeChat post - WeChat.China blames US for cyber break-in, claims America is world's biggest bit burglar - The Register.Chicago firm that resolves ransomware attacks had rogue workers carrying out their own hacks, FBI says - Chicago Sun Times.MicroMacro: Crime City.Star Wars 3.5 foot animated LED R2-D2 - Home Depot.TrackaLacker.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Material - Email security that covers the full threat landscape – stopping new flavors of phishing and pretexting attacks in their tracks, while also protecting accounts and data from exploit or exposure.Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Basketball stars have allegedly joined forces with the mafia to fleece high-rollers in a poker scam involving hacked shufflers, covert cameras, and an X-ray card table.

Meanwhile, researchers have found they could poke around an FIA driver portal to pull up the personal details of Formula 1 megastars.

Plus: Graham’s “Pick of the Week” turns CAPTCHA hell into a delightfully deranged browser game that will make you question vegetables, geometry, and your life choices, while Danny takes a trip to ancient Africa...

All this and more is discussed in episode 441 of "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

Baohuo, the gray eminence. Android backdoor hijacks Telegram accounts, gaining complete control over them - Dr Web.Cyberattack on Russia’s food safety agency reportedly disrupts product shipments - The Record.Dissecting YouTube's malware distribution network - Check Point.31 Defendants, Including Members and Associates of Organized Crime Families and National Basketball Association Coach Chauncey Billups, Charged in Schemes to Rig Illegal Poker Games - US Department of Justice.How Hacked Card Shufflers Allegedly Enabled a Mob-Fueled Poker Scam That Rocked the NBA - Wired.Every Formula 1 driver on the grid just had their passport and license details leaked - but it could have been so much worse - TechRadar.I’m not a robot - Neal.fun.Can I Beat The CAPTCHA Game? - YouTube.An African History of Africa by Zeinab Badawi - Penguin.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Action1 - Keep your systems safe (and your sanity intact) with the patch management platform that just works. The best part? Your first 200 endpoints are free, forever, with no functional limits.SecAlerts- SecAlerts makes your job easier by matching vulnerabilities to your software, using information as soon as it’s released. Use code SMASHING for 50% off a year subscription.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

A literal insider threat: we head to a Romanian prison where “self-service” web kiosks allowed inmates to run wild. Then we head to the checkout aisle to ask why JavaScript on payment pages went feral, and how new PCI DSS rules are finally muzzling Magecart-style skimmers.

Plus: Graham reveals his new-found superpower with Keyboard Maestro, and Scott describes a slick new way to whip up beautiful how-to videos with Screen Studio.

All this and more is discussed in episode 440 of "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Scott Helme.

EPISODE LINKS:

What caused the AWS outage - and why did it make the internet fall apart? - BBC News.China blames US for cyber break-in, claims America is world's biggest bit burglar - The Register.Nintendo allegedly hacked by Crimson Collective hacking group - screenshot shows leaked folders, production assets, developer files, and backups - Tom’s Hardware.Romanian inmate hacks into prison IT system, modifies sentences for others - Romania Insider.New Version of PCI DSS Designed to Tackle Emerging Payment Threats - Infosecurity Magazine.What is Magecart? How this hacker group steals payment card data - CSO.Keyboard Maestro.Screen Studio.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

ANON - Find, monitor and remove data about yourself online. Manage your digital footprint with ease. Use code SMASHING for a 25% discount.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

A critical infrastructure hack hits the headlines - involving default passwords, boasts on Telegram, and a finale that will make a few cyber-crooks wish the ground would swallow them whole. 

Meanwhile we dig into the bit we don't talk about enough: the human cost of defending companies from hackers - stress, burnout, and how better leadership culture can help make security teams safer and saner.

Plus we say a heartfelt "la di dah" to Diane Keaton, and tune in to a freshly re-released slice of pre-Fleetwood Mac history for the music-obsessed amongst us. 

All this and more is discussed in episode 439 of "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and his special guest Annabel Berry.

EPISODE LINKS:

Cyber-attacks rise by 50% in past year, UK security agency says - The Guardian.What does the end of free support for Windows 10 mean for its users? - The Guardian.Satellites found exposing unencrypted data, including phone calls and some military comms - TechCrunch.Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS - Forescout.Caught in the act: Ransomware attack sticks to our AI-created honeypot - Forescout.Human Performance in Security Operations: A Survey on Burnout, Wellbeing and Flow State Among Practitioners - NDSS Symposium.State of the Security Profession 23/24 - Chartered Institute of Information Security.Leading Cyber.Mental Health in Cybersecurity Foundation.“Play it Again, Sam” - IMDB.“Play it Again, Sam” clip - YouTube.“Buckingham Nicks” - Spotify.Fleetwood Mac - Silver Springs (Live, 1997) - YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

If anything we've discussed today has resonated with you, or if you're going through a tough time, please know you are not alone. There is always someone ready to listen, without judgment. Here are a few of the available resources:

Shout - text 85258 (24x7)Samaritans - tel 116123 (24x7)Suicide prevention - tel 0800 689 5652 (6pm - 3.30am)SANEline - tel 0300 304 7000 (4.30pm - 10.30pm)

SPONSORS:

SecAlerts - SecAlerts makes your job easier by matching vulnerabilities to your software, using information as soon as it’s released. Use code SMASHING for 50% off a year subscription.ANON - Find, monitor and remove data about yourself online. Manage your digital footprint with ease. Use code SMASHING for a 25% discount.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Your computer's mouse might not be as innocent as it looks - and one ransomware crew has a crisis of conscience that nobody saw coming.

We talk about how something as ordinary as a web page could turn your mouse into a surprisingly nosey neighbour, and why ransomware gangs need to think carefully about their reputation.

Meanwhile, Graham reveals a baked potato hack that might just change your life, and we take an unexpected detour to South America for a bit of literary adventure involving inflatable pigs.

All this and more is discussed in episode 438 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and his special guest Geoff White.

EPISODE LINKS:

Discord users' data stolen by hackers in third-party data breach - Bitdefender.North Korean hackers increasingly targeting wealthy crypto holders - BBC News.Scattered Lapsus$ Hunters offering $10 in Bitcoin to 'endlessly harass' execs - The Register.Vacanti mouse - Wikipedia.Mic-E-Mouse.Invisible Ears at Your Fingertips: Acoustic Eavesdropping via Mouse Sensors - Arvix.Mic-E-Mouse Pipeline Demonstration - YouTube.Hackers say they have deleted children's pictures and data after nursery attack backlash - BBC News.Baked Potato - Wikipedia.“At the Tomb of the Inflatable Pig: Travels through Paraguay” - Penguin.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation... while saving time and money. Smashing Security listeners get $1000 off.Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Researchers uncovered a security flaw in Salesforce’s shiny new Agentforce. The vulnerability, dubbed "ForcedLeak", let them smuggle AI-read instructions in via humble Web-to-Lead form... and ended up spilling data for the low, low price of five dollars.

And we discuss why data breach communications still default to "we take security seriously" while quietly implying "assume no breach" - until the inevitable walk-back.

Plus, we take a look at ITV's phone-hacking drama with David Tennant, and take a crack at decoding the history of the Rosetta Stone.

Hear all this and more in episode 437 of the "Smashing Security" podcast by cybersecurity veteran Graham Cluley, joined this week by special guest Paul Ducklin.

EPISODE LINKS:

Harrods suffers new data breach exposing 430,000 customer records - Bleeping Computer.Caméras dissimulées : la CNIL sanctionne la Samaritaine - CNIL.‘Total internet blackout’ in Afghanistan sparks panic after Taliban vowed to stamp out immoral activities - CNN.ForcedLeak: AI Agent risks exposed in Salesforce AgentForce - Noma.The Hack - itvX.The Hack - YouTube.The Rosetta Stone: The Story of the Decoding of Hieroglyphics - Amazon.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

SecAlerts - SecAlerts makes your job easier by matching vulnerabilities to your software, using information as soon as it’s released. Use code SMASHING for 50% off a year subscription.ANON - Find, monitor and remove data about yourself online. Manage your digital footprint with ease. Use code SMASHING for a 25% discount.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Ransomware doesn’t just freeze computers - it can silence alarms too. And when the Natural History Museum in Paris went dark, thieves helped themselves to €600,000 worth of gold in a daring late-night heist. Meanwhile, developers have a new headache: a worm dubbed “Shai Hulud” has wriggled its way through more than 180 npm packages, quietly stealing secrets.

But it’s not all doom and gloom - unless you count your kitchen appliances turning into ad billboards.

All this and more is discussed in episode 436 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and his special guest Zoë Rose.

EPISODE LINKS:

EU cyber agency says airport software held to ransom by criminals - BBC News.Teenagers charged over cyber attack on TfL costing millions of pounds - Sky News.Teen arrested on suspicion of Vegas Strip attack that cost $100M - SF Gate.Paris: cyber-attack hits Natural History Museum, cancels exhibition - Sortira Paris.Cybersécurité : le Grand Palais et plusieurs musées dont le Louvre victimes d’une attaque par rançongiciel - Le Parisien."Des pièces de collection nationale": le directeur du Muséum d'histoire naturelle de Paris indique que les pépites d'or volées ont "une valeur inestimable" - BFMTV.Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit - Security Week.Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware - Wiz.180+ NPM Packages Hit in Major Supply Chain Attack - Ox.Samsung confirms ads will now be shown on its $1,800+ fridges - UniLad.Bosch Cordless Multifunction Tool - Bosch.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORED BY:

Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

When "bad actors" stop being hackers and start being... actual actors.

This week, Graham and special guest Jenny Radcliffe play “Hacker or Ham?” (yes, Steven Seagal, we’re looking at you), before diving into a campaign which saw an Iranian gang luring Israeli performers with fake casting calls for a serious film. We unpack why positive lures can short-circuit scepticism just as effectively as fear.

Plus, the UK's ICO says students are increasingly hacking their own schools.

Meanwhile, Graham heads to 1960s Oxford with Endeavour, while Jenny investigates the Wirral’s mysterious "Catman".

All this, and more, in episode 435 of the "Smashing Security" podcast.

EPISODE LINKS:

Shai-Hulud Worm Compromises npm Ecosystem in Supply Chain Attack - Unit 42.Jaguar Land Rover extends production shutdown after cyber-attack - The Guardian.AI-Driven Deepfake Military ID Fraud Campaign by Kimsuky APT - Genians.Israel says suspected Iranian hackers targeted actors in phishing attack - Iran International.Iranian Educated Manticore Targets Leading Tech Academics - Check Point.Children hacking their own schools for 'fun', watchdog warns - BBC News.Endeavour - ITVx.Crowds armed with torches hunt the “cat man” every night - Liverpool Echo.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

Vanta - Expand the scope of your security program with market-leading compliance automation... while saving time and money. Smashing Security listeners get $1000 off!Adaptive Security - request a custom demo featuring a real CEO deepfake simulation today from adaptivesecurity.com.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Ever wondered what would happen if Burger King left the keys to the kingdom lying around for anyone to use? Ethical hackers did - and uncovered drive-thru recordings, hard-coded passwords, and even the power to open a Whopper outlet on the moon.

Meanwhile, over in Silicon Valley, one AI wunderkind managed to turn a $7 million payday into a career-ending lawsuit by allegedly walking trade secrets straight out the door as he jumped ship for a rival.

All this and much more is discussed in episode 434 of the award-winning “Smashing Security” podcast with computer security veteran Graham Cluley, joined this week by special guest Lianne Potter. Hear them they chew over catastrophic fast-food security, insider threats with extra fries, and why even the biggest brains in AI can't stop themselves from doing something utterly stupid.

EPISODE LINKS:

We Hacked Burger King: How Authentication Bypass Led to Drive-Thru Audio Surveillance - Internet archive wayback machine.DMCA notice - Bobdahacker.xAI sues former engineer, alleging he stole trade secrets after being paid $7M - San Francisco Standard.xAI vs Xuechen Li - Court documents.Classic Reload.Digger - Classic Reload.Kingdom of Kroz - Classic Reload.The Bad Movie Bible - YouTube.Shark Attack 3: Megalodon - YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORED BY:

Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.Vanta - Expand the scope of your security program with market-leading compliance automation... while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Your AI reads the small print, and that's a problem. This week in episode 433 of "Smashing Security" we dig into LegalPwn - malicious instructions tucked into code comments and disclaimers that sweet-talks AI into rubber-stamping dangerous payloads (or even pretending they’re a harmless calculator).

Meanwhile, new research from Anthropic reveals that hackers have already used AI agents to break into networks, steal passwords, sift through stolen data, and even write custom ransom notes. In other words, one hacker with an AI helper can work like an entire team of cybercriminals.

Plus: a joyous geek detour into keyboard history, and the most diabolically annoying, fully functional AI-generated CAPTCHA that you will love to inflict on your friends.

EPISODE LINKS:

LegalPwn: Abusing Legal Disclaimers to Trigger Prompt Injections - Pangea Labs.LegalPwn: Tricking LLMs by burying badness in lawyerly fine print - The Register.LegalPwn Attack Tricks GenAI Tools Into Misclassifying Malware as Safe Code - HackRead.One long sentence is all it takes to make LLMs misbehave - The Register.Londoners give up eldest children in public Wi-Fi security horror show - The Guardian.Targeted social engineering is en vogue as ransom payment sizes increase - Coveware.State of Malware 2025 - ThreatDown.Cybercrime in the Age of AI - ThreatDown.Threat Intelligence Report: August 2025 - Anthropic.The Day Return Became Enter - Marcin Wichary.Ethan Mollick’s terrible AI-generated CAPTCHAs - Twitter.The very worst AI-generated CAPTCHA? - Claude.ai.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORED BY:

Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

We unpack how some password managers can be tricked into coughing up your secrets, with a clickjacking sleight-of-hand, what website owners can do to prevent it, and how to lock down your personal password vault.

Then we time-hop to the post-quantum scramble: "harvest-now, decrypt later", Microsoft's 2033 quantum-safe pledge, and whether your printer will survive the update apocalypse.

All this, plus a gloriously dodgy URL “shadyfier,” and turning the iconic iMac G4 into a modern media hub.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veteran Graham Cluley, joined this week by special guest Thom Langford.

EPISODE LINKS:

DOM-based Extension Clickjacking: Your Password Manager Data at Risk - Marek Tóth.Major password managers can leak logins in clickjacking attacks - Bleeping Computer.Microsoft to Make All Products Quantum Safe by 2033 - Infosecurity Magazine.Shady URL.DockLite G4 - Juicy Crumb.I perfected the iMac G4 - YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

In episode 431 of the "Smashing Security" podcast, a self-proclaimed crypto-influencer calling himself CP3O thought he had found a shortcut to riches — by racking up millions in unpaid cloud bills.

Meanwhile, we look at the growing threat of EDR-killer tools that can quietly switch off your endpoint protection before an attack even begins.

And for something a little different, we peek into the Internet Archive’s dystopian Wayforward Machine and take a detour to Mary Shelley’s resting place in Bournemouth.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Allan "Ransomware Sommelier" Liska.

Episode links:

Crypto Influencer Sentenced to Prison for Multi-Million Dollar “Cryptojacking” Scheme - US Department of Justice.Ransomware crews don't care about your endpoint security – they've already killed it - The Register.Way Forward Machine - The Internet Archive.Mary Shelley’s grave - Atlas Obscura.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Proton Drive - Protect your files with end-to-end encryption in Switzerland’s secure cloud — only on Proton Drive.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

A poisoned Google Calendar invite that can hijack your smart home, a man is hospitalised after ChatGPT told him to season his food with… pesticide, and some thoughts on Superman’s latest cinematic outing.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Dave Bittner from The Cyberwire.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Invitation Is All You Need: Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite - SafeBreach.Invitation attack curses - YouTube.Invitation attack opens shutters - YouTube.Guy Gives Himself 19th Century Psychiatric Illness After Consulting With ChatGPT - 404 Media.Superman (2025) trailer - YouTube.Billy Joel: And so it goes - HBO Max.Billy Joel: And so it goes trailer - YouTube.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Proton - Break free from Gmail. You should be able to choose what happens to your data. With Proton, only you can read your emails.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

Those of you who tuned in to last week's episode (#428) will have heard the big news from my podcast pal Carole that she's decided to move on from her co-hosting duties on the show.

There have been some lovely messages of support sent through for Carole, and indeed for me too. Thank you very much to all of you - it's really heatywarming to hear how much the last 428 episodes have meant to you all, and how much you want the show to go on.

And so - as I said last week - it will carry on. Next week there will be a regular edition of "Smashing Security" with a special guest well known to all of you, and I plan to carry on as normal every week with guests after that...

This week though I felt like I needed to catch my breath, and take a break. But I didn't want to leave you without something to listen to...

So, here is a special edition of "Smashing Security" with a couple of clips from recent episodes of its sister show "The AI Fix", which I co-host with Mark Stockley.

If you enjoy "The AI Fix," please do follow it in your favourite podcast apps and tell your friends!

Until next week, cheerio bye bye.

Episode links:

The AI Fix.The AI Fix on Apple Podcasts.The AI Fix on Spotify.The AI Fix on Pocketcasts.The AI Fix on Overcast.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

ENJOYED THE SHOW?

Make sure to check out our sister podcast, "The AI Fix".

Privacy & Opt-Out: https://redcircle.com/privacy

The viral women-only dating safety app Tea, built to flag red flags, gets flagged itself - after leaking over 70,000 private images and chat logs. We are talking full-on selfies, ID docs, private DMs, and a dash of 4chan creepiness. Yikes.

Plus, Carole takes us down memory lane as she hangs up her co-host mic after 428 glorious episodes. Expect tea, tears, and Tom Lehrer.

All this is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Update regarding cybersecurity incident - Tea.Hackers steal images from women's dating safety app that vets men - BBC News.A Second Tea Breach Reveals Users’ DMs About Abortions and Cheating - 404 Media.American musical satirist Tom Lehrer dies at 97 - BBC News.Tom Lehrer website.Tom Lehrer sings The Elements, live in Copenhagen, 1967 - YouTube.Tom Lehrer sings “New Math” (animated) - YouTube.Carole’s Substack.Libby - Library app.Shokz UK.Two Birds Yoga - YouTube.Thermapen.BBC Sounds.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

In this episode, Graham warns why it is high time we said goodbye to 2G - the outdated mobile network being exploited by cybercriminals with suitcase-sized SMS blasters. From New Zealand to London, scammers are driving around cities like dodgy Uber drivers, spewing phishing texts to thousands at once.

Meanwhile, Carole unpacks a painfully awkward tale of amour fou, as a 76-year-old Belgian man drives 476 miles to meet his dream woman... only to be greeted by her very-much-still-husband at the gate.

Plus: Sky Arts painting competitions get a thumbs up, Mark Zuckerberg never loses at board games, and the scandalous Facebook memoir Meta tried to silence.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Teen arrested for 'smishing scam' using technology never before seen in New Zealand - RNZ.Op Orca — smishing scam smashed - New Zealand police.SMS blasting incidents are rising - Risky Bulletin.Bangkok busts SMS Blaster sending 1 million scam texts from a van - Bleeping Computer.Police warn of SMS scams as ‘blaster’ is used to send thousands of texts - The Guardian.Reports of SMS Messages Sent by Fake Base Stations - Commsrisk.Keeping your Android device safe from text message fraud - Google Security blog.What is Paris syndrome? How culture shock can kill a trip - The Independent.Belgian man crushed after driving nearly 500 miles to meet French model he believed was his 'future wife' - Fox News. French is the language of love: myth, reality, and romance - ICLS.Romance scam victim travels 700km 'to marry French beauty queen' - BBC News.Un homme se présente chez moi pour être mon futur mari… - YouTube. Sky Artist of the Year.Careless People  - The Guardian Bookshop. Careless People: We read the book that Mark Zuckerberg doesn’t want you to read - Slate. Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

Hackers are blackmailing cosmetic surgery patients, and threatening to release their naked photos. A British Airways IT snafu causes travel chaos for thousands. And Germany is threatening to throw hefty fines at Facebook if it can't police its content properly.

All this and "Covfefe" is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest John Hawes.

Show notes:

Cosmetic surgery hacked. Nude photos and data exposed on the dark web, as hackers blackmail patients - Bitdefender. Lithuanian cosmetic surgery firm's website - Grožio Chirurgija. British Airways: Chaos continues at Heathrow - BBC News. What went wrong at BA? - BBC News. Delta finally explained how one power outage grounded an entire airline - BGR. Facebook said Germany's plan to tackle fake news would make social media companies delete legal content - Business Insider. Sgt. Pepper's Lonely Hearts Club Band - The Beatles. Spanish art restorer, 82, who turned Jesus into a 'hairy monkey' in clumsy restoration of famous work signs merchandising deal as image gets imprinted on T-shirts - Daily Mail. Clash of Clans - Supercell. This is what Candy Crush does to your brain - The Guardian. Sweet Sweet - Reverb Nation. Help Sweet Sweet - Bonnaroo Bound! - GoFundMe.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

 

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: John Hawes.

Sponsored By:

iovation: iovation is offering Smashing Security listeners a free demonstration of its mobile multifactor solution product, LaunchKey, which can be built into your mobile apps, websites and online services to provide a simple, streamlined remote login function.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

The Samsung Galaxy S8 claims that its iris recognition technology provides "airtight security", but the Chaos Computer Club knows better and shows how it can be easily bypassed. Australian researchers create a wearable gizmo that authenticates you through your walk, but is it ever going to be practical? Mac malware reportedly wastes no time stealing information from a software developer. And the boss of the Bank of England is smart enough not to fall for an email prankster.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Paul "Duck" Ducklin.

Show notes:

Chaos Computer Clubs breaks iris recognition system of the Samsung Galaxy S8 - Chaos Computer Club. Breaking the iris scanner locking Samsung’s Galaxy S8 is laughably easy - Ars Technica. New technology uses the way you walk as a password - CNet. Hofmeister - follow the bear TV advert - YouTube. Monty Python's Flying Circus's Ministry of Silly Walks sketch - YouTube. Source Code for Several Panic Apps Stolen via HandBrake Malware Attack - MacRumors. Bank of England accused of airbrushing Jane Austen on the new £10 note - Liverpool Echo. Bank of England governor falls for email prank but maintains his composure - The Guardian.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Paul Ducklin.

Sponsored By:

iovation: iovation is offering Smashing Security listeners a free demonstration of its mobile multifactor solution product, LaunchKey, which can be built into your mobile apps, websites and online services to provide a simple, streamlined remote login function.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

The WannaCry ransomware has struck! But before we tackle that subject, and who we should blame for one of the highest profile malware attacks for years, we discuss how HP has been unwittingly capturing the keystrokes of its laptop users. Then we briefly discuss what might be the worst cinema date in history, before rounding things off with a discussion of hackers extorting money out of movie studios.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Paul "Pob" Baccas.

Show notes:

Hello to Jason Isaacs - Witterpedia. Unintended/Covert Storage Channel for sensitive data in Conexant HD Audio Driver Package - modzero Security Advisory. Keylogger Found in Audio Driver of HP Laptops - Bleeping Computer. HP responds to laptop keylogger fiasco, promises ‘fix shortly' - Trusted Reviews. Tweet from @ths - Twitter. Backin Up Song - YouTube. The Sobig Worm - Wikipedia. Customer Guidance for WannaCrypt attacks - Microsoft. Microsoft Security Bulletin MS17-010 - Microsoft. Microsoft: WannaCry outbreak reveals why governments shouldn't hoard vulnerabilities - Graham Cluley. ‘THIS IS CRAZY’: Austin man sues date for texting during movie - Statesman. Hackers Seem to Dump Pirates of the Caribbean on Torrent Sites Ahead of Premiere - Softpedia.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Paul Baccas.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Gizmodo's attempt to reveal Donald Trump's administration ineptitude when it comes to cybersecurity fails to impress. Mac users are warned that the HandBrake DVD-ripping app has been compromised by malware.  And will the US Army insist IT security professionals spend months ironing their bedsheets..?

All this and more is discussed by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Paul Ducklin from Sophos.

Show notes:

Here's How Easy It Is to Get Trump Officials to Click on a Fake Link in Email - Gizmodo. Opinion: Some thoughts about Gizmodo's Phishing story - CSO Online. Mac video app HandBrake – now with free spyware - Naked Security. OS X malware spread via signed Transmission app... again - Graham Cluley. DOD’s new Internet strategy boosts role in defending “US interests” - Ars Technica.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Paul Ducklin.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

On May 4th 2000, the Love Bug virus (also known as ILOVEYOU or LoveLetter) rapidly spread around the world, clogging up email systems.

Computer security veterans Graham Cluley and Carole Theriault are joined this week by special guest John Hawes for a trip down memory lane.

 Show notes:

Memories of the Love Bug worm - Naked Security "Subject: I Love You" movie trailer - YouTube

 

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: John Hawes.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Security firm Webroot drops a clanger when it declared Windows was malicious and borked customers' PCs, millennials are streaming a lot of movies illegally, and blackmailers are targeting members of the Ashley Madison cheating site again.

All this and more is discussed by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Michael Hucks from PC Matic.

Show notes:

Webroot antivirus goes bananas, starts trashing Windows system files - The Register. Webroot causes massive headaches after falsely flagging Windows files as malicious - Graham Cluley. Tweet by Webroot user Bob Ripley - @M5_Driver. W32.Trojan.Gen false positive - advice for home users - Webroot. W32.Trojan.Gen false positive - advice for business users - Webroot. Most millennials regularly stream pirated content, survey finds - Torrent Freak. Malware, data theft, and scams: researchers expose risks of free livestreaming websites - Ku Leuven. File sharer hit with $675,000 fine - Digital Trends. Ashley Madison blackmail roars back to life - ZDNet.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Michael Hucks.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Hotel malware has been stealing guests' payment card details... again, should businesses relay delay rolling out vulnerability patches, and Burger King's Whopper TV ad campaign tries to take advantage of viewers' Google Home devices with predictable results.

All this and more is discussed by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Paul Ducklin.

Show notes:

InterContinental Hotels Group (IHG) Notifies Guests of Payment Card Incident at IHG-Branded Franchise Hotel Locations in the Americas Region - IHG. Affected hotel look-up tool - IHG. Been to one of these 1170 IHG hotels? Your credit card details may have been stolen by malware - Bitdefender. Microsoft patches Word zero-day booby-trap exploit - Naked Security. Microsoft zero-day vulnerability was being exploited for cyber-espionage - Graham Cluley. The Shadow Brokers - Wikipedia. Burger King's 'OK Google' sad ad saga somehow gets worse - The Register. Burger King Connected Whopper ad - YouTube.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Paul Ducklin.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Spyware companies are filmed plotting to break global sanctions to ship surveillance and spying equipment to dodgy authoritarian regimes, an unsecured database exposed diabetics’ sensitive data, and a massive data breach leaves hundreds of thousands of current and former Wonga customers at risk.

All this and more is discussed by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Lisa Vaas.

Show notes:

Spyware firms in breach of global sanctions - Al Jazeera. Al Jazeera Investigations - Spy Merchants - YouTube. Mounties admit to using cellphone-snooping ‘stingrays’ - Sophos Naked Security. A huge trove of patient data leaks, thanks to telemarketers' bad security - ZDNet. Leak of diabetic patients’ data highlights risks of giving info to telemarketers - DataBreaches.net. Unsecured database exposed diabetics’ sensitive data - Sophos Naked Security. Fraudsters Target People With Diabetes - AARP. Wonga.com TV advert - YouTube. Wonga security incident FAQ - Wonga.com. Wonga data breach puts up to 245,000 UK current and former customers at risk - Graham Cluley.

 

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Lisa Vaas.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Don't let an internet-enabled sex toy make your most private moments oh-so-public. Samsung's wannabe-Android-killer is found lacking.  And did you hear about the firm that is micro-chipping its employees? 

All this and more is discussed by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest John Hawes.

Show notes:

Vulnerable Wi-Fi dildo camera endoscope. Yes really - Pen Test Partners Samsung's Android Replacement Is a Hacker's Dream - Motherboard Companies start implanting microchips into workers' bodies - LA Times

This episode of Smashing Security is made possible by the generous support of Recorded Future — the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.

Sign up for free daily threat intelligence updates at recordedfuture.com/intel

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: John Hawes.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

What can you do to better protect your online email accounts?

In this special "splinter" episode (or should it be a "shard"?) regular hosts Graham Cluley and Carole Theriault discuss with Paul Ducklin tips on how to defend your Gmail/Yahoo/Hotmail/Outlook/etc account.

SHOW NOTES:

Passwords - a Smashing Security splinterHow to better protect your Google account with two-step verification and Google Authenticator - Graham CluleyHow to protect your Yahoo account with two-step verification (2SV) - Graham CluleyNIST declares the age of SMS-based 2-factor authentication over - TechCrunchThe lesson we all must learn from the Celebgate nude photo hack - Graham Cluley

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Paul Ducklin.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.
Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Graham is embarrassed by a Twitter security snafu. How an animated GIF could prove deadly. Social engineering threats against your workforce. And will you be able to do any work on your laptop next time you catch an airplane? 

All this and more is discussed by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest Alex Eckelberry.

SHOW NOTES:

Sorry for the Nazi spam from my Twitter account - Graham Cluley Newsweek reporter Kurt Eichenwald on Fox News, 15 December 2016 - YouTube Maryland man arrested for cyberstalking - US Dept of Justice US man held for sending flashing tweet to epileptic writer - BBC News Epilepsy site hacked with seizure images - CBS News How to really pronounce GIF - howtoreallypronouncegif.com Gif's inventor says ignore dictionaries and say 'Jif' - BBC News How to disable animated GIFs in different web browsers - The Windows Club How to disable autoplaying videos on Twitter - Twitter This is the email that hacked Hillary Clinton’s campaign chief - Bitdefender Hot for Security Fry all the things! USB Kill zaps tons of computing devices - Graham Cluley UK flight ban on electronic devices announced - BBC News Electronics banned from cabins on some Middle Eastern and African flights to U.S. - CNN

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Alex Eckelberry.

Sponsored By:

Recorded Future: Recorded Future is the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.Sign up for free daily threat intelligence updates at https://recordedfuture.com/intel

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Androids pre-installed with malware - can the supply chain be trusted? Will WikiLeaks help vendors get zero-days fixed? And what on earth has the Kaspersky marketing department dreamt up this time?

Graham Cluley, Carole Theriault and special guest Nick FitzGerald discuss the latest news from the world of computer security.

SHOW NOTES:

Preinstalled Malware Targeting Mobile Users - CheckPoint Chinese Android smartphone comes with malware pre-installed - Graham Cluley WikiLeaks says it will work with software vendors to fix CIA zero-day exploits... but when? - Graham Cluley Kaspersky launches a range of perfumes to, er, defend your odour - The Register Toilet hackers could snoop on your poop, steal data of a "personal nature" - Graham Cluley Beauty blogger Scarlett London launches Threat de Toilette in bid to stop youngsters oversharing online - The Sun Jackie Chan and Eugene Kaspersky - YouTube Packin' the K music video - YouTube

 

This episode of Smashing Security is made possible by the generous support of Recorded Future — the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats.

Sign up for free daily threat intelligence updates at recordedfuture.com/intel

Thanks to Recorded Future for their support.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Nick FitzGerald.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Has the CIA been using a Weeping Angel to spy on you via your Smart TV? Have WhatsApp, Telegram and Signal been compromised? What is the secret of the SATAN ransomware? And can you avoid having your data searched as you pass through border control?

Computer security veterans Graham Cluley, Carole Theriault and special guest Paul Ducklin discuss.

SHOW NOTES:

Nintendo Classic Mini WikiLeaks says it releases files on CIA cyber spying tools The CIA didn't break Signal or WhatsApp, despite what you've heard After NSA hacking exposé, CIA staffers asked where Equation Group went wrong Apple, Samsung Respond To Wikileaks Claims Of CIA Hacking Programs Twitter reactions to the WikiLeaks CIA data dump Is the CIA's Weeping Angel spying on TV viewers? Satan ransomware: old name, new business model 3 (free) things that journalists can do right now to protect their data and their sources at the border The US Gov Can Download the Entire Contents of Your Computer at Border Crossings What Are Your Rights if Border Agents Want to Search Your Phone? Stop Fabricating Travel Security Advice

 This episode of Smashing Security is sponsored by Foursys - check out their free end-user cybersecurity training kit - it's everything you need to roll out infosecurity best practice training (right from your desk).

Grab it now from https://www.foursys.co.uk/toolkit

Thanks to Foursys for sponsoring this episode of Smashing Security.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Paul Ducklin.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

A creepy teddybear leaks two million voicemail messages, Windows 10 pushes you into only installing vetted apps, and Boeing warns 36,000 employees their personal information could have been exposed after a worker sends a spreadsheet to his wife.

All this and more is discussed by computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault.

SHOW NOTES:

Announcing the first SHA1 collision
Tavis Ormandy: Cloudflare Reverse Proxies are Dumping Uninitialized Memory
Incident report on memory leak caused by Cloudflare parser bug
List of Sites possibly affected by Cloudflare's #Cloudbleed HTTPS Traffic Leak
Quantifying the impact of "CloudBleed"
CloudPets commercial
Data from connected CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
Microsoft slaps Apple Gatekeeper-like controls on Windows 10: Install only apps from store
Boeing Notifies 36,000 Employees Following Breach

 

This episode of Smashing Security is sponsored by NetFort - https://www.netfort.com/ 

NetFort LANGuardian is easy-to-use network traffic and security monitoring software that tells you what is really happening on your network - no specialist hardware required!

Check out the demo of LANGuardian and download a free trial from https://www.netfort.com/. Mention "Smashing Security" and you'll save 20% off your order!

Thanks to NetFort for sponsoring this episode of Smashing Security.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

The Lazarus malware attempts to trick you into believing it was written by Russians, second-hand connected cars may be easier to steal, and is your child a malicious hacker?

All this and more is discussed by computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault.

Oh, and Carole makes Graham and Vanja apologise for their past mistakes.

SHOW NOTES:

You Only Live Twice - space capsule scene
Lazarus's false flag malware
Hackers behind bank attack campaign use Russian as decoy
It’s too easy to steal a second-hand connected car
Nissan Figaro
Is your child a hacker? Liverpudlian parents get warning signs checklist
How do I remove a tag from a Facebook photo or post I’m tagged in?
Code Red IIS worm

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Do you run an anti-virus on your Mac?  Should you?

In this special "splinter" episode (or should it be a "shard"?) regular hosts Graham Cluley, Carole Theriault and Vanja Svajcer discuss the malware threat for Apple Macs and MacBooks.

SHOW NOTES:

600,000 Macs infected with Flashback trojan, 274 in Cupertino Flashback to the biggest Mac malware attack of all time - Is it still a threat? Hackers target Iranian activists’ Mac devices with revamped malware Microsoft Office macro malware targets Macs 12 security suites for Mac OS X put to the test

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Handbags at dawn for CrowdStrike and NSS Labs! Donald Trump's insecure Android phone! File-less malware - is that so new? And StalkScan makes it easier to reveal what Facebook users have been carelessly sharing...

 Computer security veterans Graham Cluley, Carole Theriault and Vanja Svajcer discuss.

SHOW NOTES

AEP Public Test Announcement
NSS Labs Report Confirms Testing of CrowdStrike Falcon was Incomplete and Wrong
Some thoughts on the CrowdStrike vs NSS Labs debacle
Which Android phone does Donald Trump use?
Senators raise concerns over Donald Trump's smartphone security
Google claims ‘massive’ Stagefright Android bug had 'sod all effect'
A Scary New Kind of Malware Is Invading Banks All Over the World
Fileless attacks against enterprise networks
StalkScan
This creepy Facebook tool is revealing a LOT about you

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

The tricky problem of public Wi-Fi hotspots.

In this special "splinter" episode (or should it be a "shard"?) regular hosts Graham Cluley, Carole Theriault and Vanja Svajcer discuss, and offer some advice and tips for computer users.

SHOW NOTES:

VPN comparison chart The dangers of public Wi-Fi - and crazy things people do to use it Free open WiFi suspected in Facebook hack of Missouri state representatives Finally! Yahoo Mail to turn on SSL by default in 2014 150 best Wi-Fi names for your router

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Printers start churning out ASCII art after a vigilante hacker hijacks 160,000 devices, a researcher reveals how you can get Donald Trump to tweet an embarrassing spoof video of himself, and has your smart TV been snooping on you?

Computer security veterans Graham Cluley, Carole Theriault and Vanja Svajcer discuss.

SHOW NOTES

Hacker: I made 160,000 printers spew out ASCII art around the world ASCII art collection How I hijacked top celebrities tweets including Katy Perry, Shakira… Donald Trump's hijacked tweet VIZIO Settlement: Smart TVs should not track your shows without your O.K. Vizio settles FTC lawsuit and agrees to get viewer consent before tracking TV habits LG Smart TVs logging USB filenames and viewing info to LG servers

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Email attachment malware is the thorny topic tackled by computer security veterans Graham Cluley, Carole Theriault and Vanja Svajcer in this "splinter" episode from the Smashing Security team. 

Listen to this before you click!

Oh, and Carole would like to apologise to all her fellow Canadians for the terrible faux pas she made in this episode...

SHOW NOTES:

New feature in Office 2016 can block macros and help prevent infection It's time to secure Microsoft Office Memories of the Anna Kournikova worm Memories of the Love Bug Memories of the Melissa virus Alanis Morissette - Ironic (Official video) Avril Lavigne - Complicated

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Passwords - everything you need to know about how to make them safer, and better secure your online accounts.

In this special "splinter" episode (or should it be a "shard"?) regular hosts Graham Cluley, Carole Theriault and Vanja Svajcer discuss the perennial problem of passwords and offer some advice and tips for computer users.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Were hotel guests really trapped in their rooms by ransomware? Does anti-virus increase your attack surface so much that it's not worth running at all? And 11% of people on the internet are running ad blockers, says company which blocks ad blockers.

Oh, and we have a new theme tune...

Computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault chit-chat about the world of online privacy and computer security.

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Links:

Hotel guests locked in their rooms by ransomware? It doesn't make senseDisable Your Antivirus Software (Except Microsoft's)It might be time to stop using antivirusGoogle Chrome engineer says Windows Defender "the only well behaved AV"500 publishers were hacked through anti-ad block tool PageFairNews media move to ban ad blockers from websitesEncryption and Other Tricks Are Making Malvertising Harder to HuntSmashing Security merchandise (t-shirts, mugs, stickers and stuff)
Privacy & Opt-Out: https://redcircle.com/privacy

An alleged hacker finds the downside to car rental, a New York Times Twitter account announces Vladimir Putin is planning to launch a missile attack against the United States, and an "upskirt" website leaks its user data.

Oh, and Vanja forces Graham to share an embarrassing privacy-breaching lavatory anecdote.

Computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault chit-chat about the world of online privacy and computer security.

SHOW NOTES

Spanish Police Arrest Suspect Behind NeverQuest Banking Trojan Vawtrak - International crimeware-as-a-service (PDF) Vawtrak version 2 (PDF) Twitter hack sees New York Times warn of Russian missile strike against USA Badlands National Park deletes tweets on climate change Tweet by journalist Claudia Koerner, quoting Badlands National Park Service 'Upskirt' porn website hit with massive data leak exposing 180,000 voyeurs HaveIBeenPwned

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

The Spora ransomware offers you more than just your encrypted files back, Brian Krebs busts the alleged masterminds behind the Mirai botnet, and be careful that your IT staff aren't the only ones who know your corporate passwords.

Computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault chit-chat about the world of online privacy and computer security.

Recorded live: Thursday 19 January, 2017.

Check out the video of this podcast at https://www.youtube.com/watch?v=NJsCpadzVGs

SHOW NOTES

Spora Ransomware Works Offline, Has the Most Sophisticated Payment Site as of Yet Spora - the Shortcut Worm that is also a Ransomware Popcorn Time ransomware invites you to get 'nasty' to recover your files Who is Anna-Senpai, the Mirai Worm Author? College fires IT admin, loses access to Google email, successfully sues IT admin for $250,000 Fired IT Employee at Online Indiana College Offered to Help Unlock Google Account for $200K

 

Subscribe and leave us a review on iTunes - it really helps!

https://itunes.apple.com/gb/podcast/smashing-security/id1195001633

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Donald Trump and that secret dossier, MongoDB databases under attack, Microsoft employees suffering from PTSD and Alexa buying doll houses.

Computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault chit-chat about the world of online privacy and security.

Recorded live: Thursday 12 January, 2017

Watch the video version of this podcast at https://www.youtube.com/watch?v=BwpXbrEtgNg.

SHOW NOTES

Donald Trump finally believes Russia hacked the DNC
27,000 MongoDB servers have their data wiped, receive ransom demand for its safe return
Advice on how to secure MongoDB
Microsoft Anti-Porn Workers Sue Over PTSD
TV News anchor says 'Alexa, buy me a dollhouse' with predictable results...

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

Donald Trump talks cybersecurity and explains how to keep your messages top secret, Ukrainian soldiers are being spied upon by Android malware and an artist has devised a novel way of avoiding facial recognition technology.

Computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault chit-chat about the world of online privacy and security.

Recorded live: Thursday 5 January, 2017.

Watch the video version of this podcast at https://www.youtube.com/watch?v=6jfvNSbSpt8

SHOW NOTES

Trump's 'no computer is safe' stance could be disastrous for US and others, cybersecurity experts say
Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units
This camouflage makes you ‘immune’ from facial recognition cameras
"Sophos RAPIL: Wiping the smile off virus writers' faces" (starring a young Vanja Svajcer)

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

We discuss the pains of providing tech support to family and friends, when writing down your passwords is actually a good idea, and muse on cloud backup services. Cool gadgetry, smart basketballs, below-par hotel services and, of course, Christmas being "..in TWO days".

Computer security veterans Graham Cluley, Vanja Svajcer and Carole Theriault chit-chat about the world of online privacy and security.

Recorded live, December 22 2016.  Watch the video version at https://www.youtube.com/watch?v=mDfVI_EJWW0

Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Special Guest: Vanja Švajcer.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

A trailer for the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined each week by special guests.

Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!

Warning: This podcast may contain nuts, adult themes, and rude language.

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Support Smashing Security

Privacy & Opt-Out: https://redcircle.com/privacy

In episode 426 of the "Smashing Security" podcast, Graham reveals how you can hijack a train’s brakes from 150 miles away using kit cheaper than a second-hand PlayStation.

Meanwhile, Carole investigates how Grok went berserk, which didn't stop the Department of Defense signing a contract with Elon’s AI chatbot. So who is responsible when your chatbot becomes a bigot?

Plus: Email headaches, SPF rage, and a glowing review for... Taskmaster SuperMax Plus?

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Schoolboy hacks into city's tram system - The Telegraph.Caboose - Wikipedia.Neil Smith discusses his findings - Twitter thread.End-of-Train and Head-of-Train Remote Linking Protocol - CISA.The Cheap Radio Hack That Disrupted Poland’s Railway System - Wired.Grok, Elon Musk’s AI Chatbot, Shares Antisemitic Posts on X - The New York Times.X ordered its Grok chatbot to ‘tell like it is.’ Then the Nazi tirade began - Washington Post. Hacker uses Elmo's X account to post antisemitic rant and demand release of Epstein files - ABC News.Elon Musk Announces Sensuous Grok AI Companion - Mashable.Grok Rolls Out Pornographic Anime Companion, Lands Department of Defense Contract - The Rolling Stone. Learn DMARC. TASKMASTER SUPERMAX+.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Adaptive Security - request a custom demo featuring a real CEO deepfake simulation today from adaptivesecurity.com.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

In episode 425 of "Smashing Security", Graham reveals how "Call of Duty: WWII" has been weaponised - allowing hackers to hijack your entire PC during online matches, thanks to ancient code and Microsoft’s Game Pass.

Meanwhile, Carole digs into a con targeting the recently incarcerated, with scammers impersonating bail bond agents to fleece desperate families.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Call of Duty: WWII trailer - YouTube.Warning: Do NOT Play COD WWII on PC Gamepass - YouTube.2017 Wichita swatting - Wikipedia.Call of Duty: WW2 on PC Game Pass yanked offline amid reports security exploits are leaving players with screens full of smut - Eurogamer.Common Bail Bond Scams and How to Avoid Them - US Attorneys.Can I Check out Another Person's Criminal Record? - Nolo. Belton Bail Bond Testimonials.‘They know everything’: Families of inmates at Sumner County Jail targeted in bail scam - Nashville WKRN.Latest scam targets NJ families of those who were recently arrested, demanding bail - New Jersey 1050.John & Paul: A Love Story in Songs by Ian Leslie review – let it be the new gold standard in Beatles studies - The Guardian.Introducing 'John & Paul: A Love Story In Songs' - Ian Leslie.Charles Paris mysteries - BBC Radio 4.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Adaptive Security - request a custom demo featuring a real CEO deepfake simulation today from adaptivesecurity.com.Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A Mexican drug cartel spies on the FBI using traffic cameras and spyware — because "ubiquitous technical surveillance” is no longer just for dystopian thrillers. Graham digs into a chilling new US Justice Department report that shows how surveillance tech was weaponised to deadly effect.

Meanwhile, Carole checks the rear-view mirror on the driverless car industry. Whatever happened to those million Tesla robotaxis Elon Musk promised by 2020? Spoiler: they’re here — sort of — but they sometimes drive into oncoming traffic.

Plus: Leighton House, heatwave survival gadgets, and an unflushable toilet situation (not what you think).

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Mexican drug cartel hacker spied on FBI official’s phone to track and kill informants, report says - TechCrunch.Audit of the Federal Bureau of Investigation's Efforts to Mitigate the Effects of Ubiquitous Technical Surveillance - US Department of Justice Office of the Inspector General.Tesla driver tells police he was using 'self-drive' system when his car hit a parked police vehicle - AP News.‘Lidar is lame’: why Elon Musk’s vision for a self-driving Tesla taxi faltered - The Guardian.Tesla invited influencers to test its robotaxi. Here's what they had to say - USA Today Europe.Elon Musk Hails 'Successful' Tesla Robotaxis Launch in Austin Amid Reported Glitches - eWEEK.A Fatal Tesla Crash Shows the Limits of Full Self-Driving - Bloomberg.The Arab Hall at Leighton House.Spandau Ballet’s “Gold” - shot at Leighton House!Shark FlexBreeze Fan With InstaCool Mist Attachment- Shark.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

In this episode, Graham unravels Operation Endgame - the surprisingly stylish police crackdown that is seizing botnets, mocking malware authors with anime videos, and taunting cybercriminals via Telegram.

Meanwhile, Carole exposes the AI-generated remote hiring threat. Could your next coworker be a North Korean hacker with a perfect LinkedIn?

And BBC cyber correspondent Joe Tidy joins us to talk about "Ctrl-Alt-Chaos", his new book diving into the murky world of teenage hackers, ransomware gangs, and the strange motivations that lie behind digital mayhem.

Plus: competitive pond husbandry, dead slugs, Hitster the board game, and a shoutout to the AI startup that hijacked Graham's SEO.

All this and more is discussed in episode 423 of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault - it's like a cauldron of life... but for cybersecurity.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Operation Endgame.Ctrl+Alt+Chaos.Lizard Squad Member: Why I Took Down Xbox and PlayStation - YouTube.Reckoning With the Rise of Deepfakes - The Regulatory Review.Deepfake interviews: Navigating the growing AI threat in recruitment and organizational security - Fast Company. Why Your Hiring Process is Now a Cybersecurity Vulnerability - Pindrop.Best Practices for Defeating Deepfake Candidate Fraud - Dice Hiring.Phanpy - A minimalistic opinionated Mastodon web client.How to make a mini pond - Gardener’s World.Hitster board game.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Vanta– Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Flare- Uncover the latest threats across the dark web and Telegram. Start your free trial today.Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A GCHQ intern forgets the golden rule of spy school — don’t take the secrets home with you — and finds himself swapping Cheltenham for a cell. Meanwhile, an Australian hacker flies too close to the sun, hacks his way into a US indictment, and somehow walks free... only to get booted back Down Under.

Plus: flow states, Bob Mortimer, and the joys of pretending to carry an owl around on a cushion.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

The Cheltenham Doughnut - Wikipedia.Summer placements - GCHQ.Spy school dropout: GCHQ intern jailed for swiping classified data - The Register.Former GCHQ intern jailed for taking top secret files home - Crown Prosecution Service.United States government says it will deport Australian hacker David Kee Crees  - ABC News.Australian national known as “DR32” sentenced in U.S. federal court – DataBreaches.ICE takes steps to deport the Australian hacker known as “DR32” – DataBreaches.Aussie Travel Cover has hundreds of thousands of records stolen in hacking, policy holders not informed - ABC News.Australian cybercriminal to be deported from US- Information Age.Government sites hit by Aussie Travel Cover hacker - ZDNET.Abdilo, Australia-based computer hacker, live streams attack on US education sites - ABC News.Bob Mortimer's Pet Owl - YouTube.And Away… by Bob Mortimer - Simon & Schuster.Flow by Mihaly Csikszentmihaly -  HarperCollins.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Flare - Uncover the latest threats across the dark web and Telegram. Start your free trial today.Trelica by 1Password - Access Governance for every SaaS app. Discover, manage, and optimize access for any of your SaaS apps - whether managed or unmanaged.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

What do a sleazy nightclub carpet, Google’s gaping privacy hole, and an international student conned by fake ICE agents have in common? This week’s episode of the "Smashing Security" podcast obviously.

Graham explains how a Singaporean bug-hunter cracked Google’s defences and could brute-force your full phone number. Meanwhile, Carole dives into a chilling scam where ICE impersonators used fear, spoofed numbers, and... Apple gift cards to extort terrified migrants.

Plus: Nazis, door safety, and the age-old struggle of telling Ralph Fiennes from Liam Neeson.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Bruteforcing the phone number of any Google user - Brutecat.Leaking the phone number of any Google user- YouTube.Researcher Found Flaw to Discover Phone Numbers Linked to Any Google Account - The Hacker News.Google fixes flaw that could unmask YouTube users' email addresses - Bleeping Computer.ICE Scammers Are On The Rise: What To Do  - Newsweek.Student visa holder tricked by fake ICE agent scam, loses thousands  - Newsweek.Conspiracy - IMDB.Schindler’s List - IMDB.Dutch Reach car door opening method - The AA.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

Drata - The world’s most advanced Trust Management platform – making risk and compliance management accessible, continuous, and 10x more automated than ever before.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Flare - Uncover the latest threats across the dark web and Telegram. Start your free trial today.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy

A bizarre case of political impersonation, where Trump’s top aide Susie Wiles is cloned (digitally, not biologically — we think), and high-ranking Republicans start getting invitations to link up with "her" on Telegram to share their Trump pardon wishlists. Was it a deepfake? Or just someone with a halfway decent impression and access to a shady data broker?

Meanwhile, we take a worryingly familiar journey into the mental health crisis in the UK — and how TikTok is stepping in with advice like “eat an orange in the shower” to cure your anxiety. Spoiler: it won’t. But it might make your bathroom smell nice.

Plus: a nostalgic tech support tale involving a CRT monitor, a wooden door, and an unexpected shade of brown.

All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Warning: This podcast may contain nuts, adult themes, and rude language.

Episode links:

Federal Authorities Probe Effort to Impersonate White House Chief of Staff - Wall Street Journal.FBI probes effort to impersonate White House chief of staff Susie Wiles, sources say - CBS News.The Trump Administration Accidentally Texted Me Its War Plans - The Atlantic.The Trump campaign is still being hacked - Popular Information.The Big Mental Health Report - Mind.Mental Health Pressures - British Medical Association. More than half of top 100 mental health TikToks contain misinformation, study finds  - The Guardian.‘They thought they were doing good but it made people worse’: why mental health apps are under scrutiny - The Guardian.How to find therapy or counselling - Mind.Carole in the shower with an orange? - Twitter.Matter - modern read-later app for iPhone, iPad, and web.Techie fixed a ‘brown monitor’ by closing a door - The Register.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

Sponsored by:

MetaCompliance - MetaCompliance's Security Awareness Planner is your free 12-month roadmap to reduce risk and build a culture of cyber awareness.Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Harmonic - Let your teams adopt AI tools safely by protecting sensitive data in real time with minimal effort. Harmonic Security gives you full control and stops leaks so your teams can innovate confidently.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter via Patreon or Apple Podcasts for ad-free episodes and our early-release feed!

FOLLOW US:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy