Smashing Security

A ransomware negotiator attended a cybersecurity conference, only to be arrested by the FBI in connection with its investigation into the ShinyHunters gang.Meanwhile, hackers get the keys to ASOS's app and the chance to message every single customer. What did they say? And how did the company respond? We have thoughts.All this and more is discussed in episode 488 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.EPISODE LINKS:”123456” password used in massive Danish CPR data breach - The Copenhagen Post.‘You have a meeting’: the calendar phishing scam growing exponentially - The Guardian.Anthropic AI model submitted false tip about unsolved murder, Philadelphia police say - 6abc Philadelphia.FBI Arrests Executive at Ransomware Negotiation Firm - Krebs on Security.ASOS hack: If you could message every customer, what would YOU tell them? - SolCyber.Rooftops, penthouses, and urban living - Mike Tomlin on YouTube.I built ChatGPT with Minecraft redstone! - YouTube.&udm=14 - the disenshittification Konami code - Udm14.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)SPONSORS:Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Hack The Box - Develop, exercise and measure the capabilities of your human operators and AI agents.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!FOLLOW THE SHOW:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.Privacy & Opt-Out: https://redcircle.com/privacy

A store in Auckland vibe-coded itself a new website. Within hours, its inventory had somehow expanded to include a pair of crusty socks, an $850 banana, and all of New Zealand's national parks. What could possibly have gone wrong?Meanwhile, a hacker collective backed a truck into one of the license-plate-reading Flock safety cameras popping up on American street corners, and took a very close look inside.All this and more in episode 486 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Dave Bittner.EPISODE LINKS:Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws - The Hacker News.Odido hackers mock police, threaten another Netherlands hack - Cybernews.North Korea's fake job interviews infected 30,000 devices - The Register.Ridiculous deals as store leaves website open for the public to edit - Stuff.Critical Vulnerability in AI Vibe Coding platform Base44 - Wiz.Beautiful People: The dating site that FAKED getting hacked by a virus called Shrek - Graham Cluley on YouTube.Flock Camera Locations - Live Map of 150,000+ Flock Safety Cameras & ALPRs.Flock cameras are riddled with security vulnerabilities and hard-coded credentials - Micah Flee.Creve Coeur police in 'state of chaos' as former chief investigated for misconduct - WCBU Peoria.La La Land Filming Locations - Seeing Stars.Mrs Mills - Wikipedia.Let's Have a Party - The Piano Genius of Mrs. Mills - YouTube.Introducing the Originals Mrs Mills Piano from Abbey Road Studios & Spitfire Audio - Abbey Road.Smashing Security merchandise (t-shirts, mugs, stickers and stuff) SPONSORS:Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Origin - Endpoint AI observability. Put your AI agent on the record, and request a demo.ThreatLocker - Book a demo today and start securing your organisation.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!FOLLOW THE SHOW:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.Privacy & Opt-Out: https://redcircle.com/privacy

When a chap called Matt noticed his Bluetooth headphones wouldn't switch to his phone, he was surprised to realise the reason was a single AliExpress webpage sitting open in his browser - playing nothing at all, at zero volume. And yet somehow his hardware could hear it. Audio fingerprinting is one of the sneakiest tracking tricks on the web.Meanwhile, the intelligence agencies of the "Five Eyes" (not Five Guys) have got together and published advice on how companies should communicate after a cyber attack. The summary? For the love of God, stop calling every breach "sophisticated."All this and more in episode 484 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.EPISODE LINKS:Hackers demand $2.3M in ransom after breaching Berlin government network - Anadolu.Deux suspects interpellés dans le cadre des enquêtes ouvertes après le piratage du fisc - France Info.Hackers are stealing Claude tokens from subscribers - TechCrunch.AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones - The Register.AliExpress webpage keeping multipoint Bluetooth headphones active with WebAudio fingerprinting - Matt Callaghan’s blog.Audio Fingerprinting: What It Is + How It Works with Web API - Fingerprint.Communicating Under Pressure: Best Practices for Service Providers - CISA.World Stone Skimming Championships.Mind games and a ‘toss master’: world stone skimming contest returns to Scotland after cheating scandal - The Guardian.World Stone Skimming Championships - Every Toss 2025 - YouTube.”The Pirates’ Code: Laws and Life Aboard Ship” by Rebecca Simon - Waterstones.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)SPONSORS:ThreatLocker - Book a demo today and start securing your organisation.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!FOLLOW THE SHOW:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.Privacy & Opt-Out: https://redcircle.com/privacy