Smashing Security

Polymarket has built an entire business on predicting the future. So how did it manage to spectacularly fail to predict its own hack? Plus, the Google engineer with a million-dollar secret, and the curious case of the airport hairdryer.Meanwhile, "FortiBleed" sees 75,000 Fortinet firewalls thrown wide open - and the real damage is going to roll on for years.All this and more in episode 474 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Quentyn Taylor.EPISODE LINKS:Danish Police Raided Self-Described Privacy Activist. PM Lives at a Secret Address - State of Surveillance.Hospital probe after 40 staff access crocodile boy's medical records - Cybernews.Third Defendant Sentenced To Prison For Hacking Fantasy Sports And Betting Website - US Dept of Justice.Someone allegedly used a hairdryer to rig Polymarket weather bets - Engadget.Tweet by Polymarket Traders - XCancel.Polymarket says hackers stole users' funds - TechCrunch.Operation Cloud Hopper: China-based Hackers Target Managed Service Providers - SecurityWeek.The Full Story of the Stunning RSA Hack Can Finally Be Told - WIRED.Polymarket points to third-party login tool after users report account breaches - Coindesk.Polymarket Admin Wallet Exploited on Polygon, Says ZachXBT - CryptoPotato.Polymarket reportedly paid creators to post deceptive videos about fake bets - TechCrunch.‘Unbelievable how accurate’: How paid influencers hype Polymarket’s odds - POLITICO.Polymarket's $345 million Iran peace bet is stuck because nobody can agree on what "permanent" means - TNW.Alert: NCSC issues advice following global targeting of Fortinet firewalls and VPN gateways - National Cyber Security Centre.Analysis of Reported Credential Compromise of FortiGate Devices - Fortinet Blog.FortiBleed - Free FortiGate Exposure Checker - SOCRadar.The Boys of Dungeon Lane - Paul McCartney.A closer listen to Paul McCartney's new album 'The Boys of Dungeon Lane' - YouTube.The Summer Portraits - Ludovico Einaudi.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)SPONSORS:Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!FOLLOW THE SHOW:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.Privacy & Opt-Out: https://redcircle.com/privacy

What if your AI coding assistant could be tricked into stealing your own company's secrets - by reading a single booby-trapped bug report? No phishing email. No malware. No password ever stolen. Just an AI doing exactly what it was told.Meanwhile, someone calling themselves Nightmare Eclipse has decided to teach Microsoft a lesson. The result? Three zero-days dropped on the internet, one of which lets a thief with a USB stick walk straight past BitLocker. Microsoft is furious.Plus don't miss our featured interview with Son Nguyen Kim of Proton Pass, who explains why plugging AI agents into your email and calendar without thinking twice is rather like hiring a new employee with the keys to everything - and skipping the background check.All this and more in episode 472 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.EPISODE LINKS:ShinyHunters claims 61M Sysco records - Cybernews.Derbyshire police officer under investigation for using AI to create evidence - Derbyshire Times.Maine forced to take down data breach portal after fake notices filed with authorities - Hot for Security.A Fake Bug Report Hijacks Your AI Coding Agent - and Nothing Catches It. - Tenet Security.Agentjacking: a fake bug report hijacks AI coding agents - TNW.When anti-virus goes rogue - A trifecta of Defender zero-days - SolCyber.BitLocker in crisis? The "YellowKey" zero-day in plain English - SolCyber.Microsoft versus Full Disclosure: The ongoing Nightmare Eclipse saga - SolCyber.BitLocker, Defender, zero-days, and bragging rights: More MS nightmares - SolCyber.Inside the FBI’s Kinetic Cyber Range - FBI.Inside the FBI's Kinetic Cyber Range - YouTube.Computer worm strikes International Space Station - Graham Cluley.Raspberry Pi Zero W - Raspberry Pi.There’s still life in old technology.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)SPONSORS:Proton Pass - The password manager for businesses that can't compromise on security or slow their team down. Start a free trial.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!CoreView - How secure is your Microsoft 365 tenant? Find out with CoreView's free Microsoft 365 Tenant Security Scanner.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!FOLLOW THE SHOW:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.Privacy & Opt-Out: https://redcircle.com/privacy

AI bots are having existential crises, inventing religions, and allegedly plotting against humanity... or so the internet would have you believe.We dig into Moltbook, the “AI-only” social network that sent Twitter into a meltdown, attracted breathless talk of the singularity, and turned out to be far less Terminator and far more humans role-playing as bots.Plus we discuss why "vibe coding" your app might be a catastrophically bad idea, when security researchers can easily peek inside rifle through your private messages, API keys, and databases.Also this week we learn that pro-Russian hackers are circling the Winter Olympics - or is it the Jamaican Bobsleigh team?All this and more is discussed in episode 454 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Iain Thomson.EPISODE LINKS:AI Agents Created Their Own Religion, Crustafarianism, On An Agent-Only Social Network - Forbes.I Infiltrated Moltbook, the AI-Only Social Network Where Humans Aren’t Allowed - Wired.'Moltbook' social media site for AI agents had big security hole, cyber firm Wiz says - Reuters.Italy blames Russia-linked hackers for cyberattacks ahead of Winter Olympics - The Record.Italy says railways hit by 'serious sabotage' as Winter Olympics begin - BBC News.EpsteIN - GitHub.Private Eye.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)SPONSORS:Meter - Network infrastructure for the enterprise. Get a free personalised demo.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!Passwork - a reliable secrets manager and password management solution.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!FOLLOW THE SHOW:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.Privacy & Opt-Out: https://redcircle.com/privacy

In episode 452, a London-based YouTuber wins a landmark court case against Saudi Arabia after his phone was hacked with Pegasus spyware — exposing how a single, seemingly harmless text message can turn a smartphone into a round-the-clock surveillance device.Plus, we go looking for professional hitmen online - only to uncover uncomfortable questions about why some crimes attract customers but very few complaints.All this and more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veteran Graham Cluley, joined this week by special guest Joe Tidy.EPISODE LINKS:Sorry Dave, I’m afraid I can’t do that! PCs refuse to shut down after Microsoft patch - The Register.Russian state hackers likely behind wiper malware attack on Poland’s power grid - The Record.US charges 31 more suspects linked to ATM malware attacks - Bleeping Computer.Dark web arrests in Romania linked to portal which offered services including murder - ROCU.Romanian scammers ran fake hitman-for-hire site, lured desperate perpetrators as 'incompetent assassins' - Fox News.This Fake Hitman Site Is the Most Elaborate, Twisted Dark Web Scam Yet - VICE.Unlikely Assassin, The Murder of Amy Allwine - Rooster.Saudi dissident awarded $4.1 million by UK court for hacking, assault 'by Saudi Arabia' - Reuters.Stalkerware: The software that spies on your partner - BBC News.Using 'stalkerware' to spy on a colleague's phone - YouTube.“Polite Society” trailer - YouTube.Elegoo Saturn 3 3D printer - Elegoo.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)SPONSORS:Passwork - a reliable secrets manager and password management solution.Coreview - Download "Total Tenant Takeover", a white paper about the Microsoft 365 Disaster No One Is Ready For.Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!FOLLOW THE SHOW:Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.THANKS:Theme tune: "Vinyl Memories" by Mikael Manvelyan.Assorted sound effects: AudioBlocks.Privacy & Opt-Out: https://redcircle.com/privacy