The Host Unknown Podcast - Episode 124 - Andy... Andy...? ANDY...!

Episode Date: October 14, 2022

This week in InfoSecOctober 12 1988  (a mere 34 years ago) Hailed by Steve Jobs as a computer “five years ahead of its time”, NeXT, Inc. introduces their NeXT Computer. Due to its cube-shaped case, the computer was often referred to as “The Cube” or “The NeXT Cube”, which led to the subsequent model offically being named “NeXTcube“. The new computer introduced several innovations to personal computers, such as including an optical storage disk drive, a built-in digital signal processor for voice recognition, and an object-oriented development environment that was truly years ahead of its time.While not a commercial success, the NeXT Computer and the technology developed for it have a long and storied history. Tim Berners-Lee developed the first world wide web server and web browser on a NeXT computer, crediting the NeXT development tools for allowing him to rapidly develop the now ubiquitous Internet system. After Apple purchased NeXT in 1997, they used the operating system of the NeXT computers to form the base of Mac OS X. Eventually Apple’s iOS, which runs the iPhone and iPad, was itself based upon Mac OS X and hence draws its lineage to NeXT. Finally, the object-oriented development environment that Berners-Lee used to create the World Wide Web is the forerunner of the development environment that today’s programmers use to develop iPhone and iPad Apps. If it wasn’t for the NeXT Computer back in 1988, Thom may not have his iPhone pro max 14 today. RANT of the Weekhttps://www.infosecurity-magazine.com/news/claroty-found-cryptographic-keys/Claroty Found Hardcoded Cryptographic Keys in Siemens PLCs Using RCE Team82, the research arm of New York-based industrial cybersecurity firm Claroty, revealed on October 11, 2022, that they managed to extract heavily guarded, hardcoded cryptographic keys embedded within SIMATIC S7-1200/1500s, a range of Siemens programmable logic computers (PLCs), and TIA Portal, Siemens’ automated engineering software platform.They deployed a new remote code execution (RCE) technique targeting the central processing units (CPUs) of SIMATIC S7-1200 and S7-1500 PLCs, for which they used a vulnerability uncovered in previous research on Siemens PLCs (CVE-2020-15782) that enabled them to bypass native memory protections on the PLC and gain read/write privileges.They were able not only to extract the internal, heavily guarded private key used across the Siemens product lines but also to implement the full protocol stack, encrypt and decrypt protected communications and configurations.“An attacker can use these keys to perform multiple advanced attacks against Siemens SIMATIC devices and the related TIA Portal, while bypassing all four of its access-level protections. [They] could [also] use this secret information to compromise the entire SIMATIC S7-1200/1500 product line in an irreparable way,” Team82 warned in the research paper.CVE-2022-38465 has been assigned to the new vulnerability found by Team82, and given a CVSS v3 score of 9.3.Team82 disclosed all technical information to Siemens, which released new versions of the affected PLCs and engineering workstation that address this vulnerability, urging users to move to current versions.In its advisory, Siemens also provided a series of key protection updates, workarounds and mitigations.This disclosure has led to the introduction of a new TLS management system in TIA Portal v17, ensuring that configuration data and communications between Siemens PLCs and engineering workstations is encrypted and confidential. Billy Big Balls of the Weekhttps://www.bleepingcomputer.com/news/security/police-arrest-teen-for-using-leaked-optus-data-to-extort-victims/Police arrest teen for using leaked Optus data to extort victimsThe Australian Federal Police (AFP) have arrested a 19-year old in Sydney for allegedly using leaked Optus customer data for extortion.More specifically, the suspect used 10,200 records leaked last month by the Optus hackers and contacted victims over SMS to threaten that their data would be sold to other hackers unless they paid AUD 2,000 ($1,300) within two days.The scammer used a Commonwealth Bank of Australia account to receive the ransom money. The AFP identified the account and obtained from the bank information about the holder.According to the AFP, the arrested young man allegedly sent blackmailing messages to 93 individuals whose personal information was exposed Optus data leak. None of them paid the ransom, though.The suspect now faces charges for:Using a telecommunication network with the intent to commit a serious offense (blackmail), contrary to section 474.14 (2) of the Criminal Code Act 1995 (Cth), punishable by up to 10 years of imprisonmentDealing with identification information, contrary to section 192K of the Crime Act 1900 (NSW), punishable by a maximum of 7 years in prisonThe hackers behind the Optus breach have not been identified but AFP's investigation is still underway as part of "Operation Hurricane.""The Hurricane investigation is a high priority for the AFP, and we are aggressively pursuing all lines of inquiry to identify those behind this attack," stated Assistant Commissioner Gough.Announcing the international operation was apparently enough to discourage the threat actors from continuing their extortion, even leading to them declaring that all data stolen from Optus had been deleted.Two days ago, Optus published an update on the results of its ongoing internal investigation, confirming that 9.8 million customers were variably impacted, and 2.1 million of them had their government ID numbers compromised.Many of these people will need new IDs issued now. The Australian government is demanding Optus to cover the costs for this process. Industry NewsLloyd's of London cuts off network after dodgy activity detectedMalicious WhatsApp Mod Spotted Infecting Android DevicesChinese APT WIP19 Targets IT Service Providers and TelcosBudworm Espionage Group Returns, Targets US State LegislatureIP Cameras, VoIP and Video Conferencing Revealed as Riskiest IoT DevicesUK Government Urges Action to Enhance Supply Chain SecuritySingtel's Australian IT Firm Dialog Suffers Data Breach#DTX2022: Cyber Needs to Redress the Defensive-Offensive Balance Following Russia-Ukraine Lloyd's of London says no evidence found of data compromise from cyberattack Tweet of the Weekhttps://twitter.com/SwiftOnSecurity/status/1579575774784688128 Come on! Like and bloody well subscribe!

Andy, Andy, what time is Jav joining us this morning? Andy? Andy? You're listening to the Host Unknown Podcast. Hello, hello, hello, good morning, good afternoon, good evening from wherever you are joining us and welcome to episode, I've lost count actually, 124 is it, of the Host Unknown podcast. 135.

Well, it sounds odd when it's not Andy doing it in the background. It really is, it's just not quite right. But, Andy, we are joined by special guest star Javad Malik. How are we, Jav? Hey, hey, hey. This is my podcast. Is that right? It is right.

Unless it's a taxman asking, in which case it's completely yours. Yeah. If a tax inspector knocks on your door at midnight. How are you, Jav, anyway? I'm very good, I'm very good. Glad to be back in the driving seat. Well, not even shotgun. I think in the back seat with the champagne and the girls, right?

Well, one out of two ain't bad, it well yeah that's right so busy week for you oh yes it's been a busy week i was uh out and about a few days so we had um the unsung hero awards this week, which is... Oh, yes. ...the awards that are put on by Eskenzi PR and Marketing every year to sing about the people who are behind the scenes. And before you ask, was Host Unknown nominated? No. No. Why?

Because we are very much sung heroes. We are not unsung heroes. Everybody knows about us. Exactly. We don not unsung heroes. Everybody knows about us. Exactly. Maybe not for the right reasons. Well, there is that. Anyway, it was very, very good to catch up with some old faces and some new ones as well.

So it was a very good night. And then the following day, I was at Excel for dtx europe which is like uh if you ordered infosec europe from wish.com so it was quite small um disappointing didn't fit quite right. Those are all the things she said, yes. But it was, oh dear, this is going downhill rapidly. It is.

I'm not editing it. I haven't got time to edit, by the way, just so you know. We haven't got time to edit. We're just doing this. Oh, okay. So I'll tell you this really quickly. I almost had a Liam Neeson moment. Liam Neeson?

Not Liam Neeson. Leslie Nels Neeson. The spoof. Anyway. I was getting ready for my talk at DTX yesterday. And the guy had put on my Britney Spears style headset and mic

and what have you so I was sitting there and I was talking to one of my colleagues and he started talking about I don't know, oh I love he was talking about eating minstrels because it's his treat when he comes down to London

and so I just started asking oh do you lie in bed and like throw him up in the air and and and catch him in your mouth and he was like no I put him on my belly and then smack my belly and it flies up in the air and I catch it so we were talking about this and then the guy wanted to test my mic yeah and I almost publicly broadcast uh words uh that were not suitable for public broadcast right there and then so it was a very near miss uh almost like i'd love to know what you nearly said yes yes i'll tell you once we're off air tom all right okay okay in the post-credit part yes yes yes. Yeah, perfect. Perfect.

How have you been? How's your week been? You seem to have been suspiciously quiet on our internal chats and you seem to be doing a lot of work. Yeah. So I'm quite concerned. I know, right? I know. Well, as you know, last week was a bit of a write-off for me

and literally to the point where last minute I couldn't make the show, which was disappointing, but I am looking forward to listening to it. One of these days. And, yeah, that carried on into this week a bit and then was down in Kent for some leadership off-site, which was good fun. Good to see everybody all in the same room at once. A lot of people who are taller and shorter than you think.

So, yeah, very, very busy. Didn't get back until about past nine last night. So I feel like I've basically spent one night at home in the last nearly 15 days. This is all very vague, Tom. This is all very vague, Tom. This is all very vague. You know, the only thing

that seems to have triggered it recently is like Joe Sullivan, the Uber CISO gets sentenced and all of a sudden you're like running around putting out fires. I'm really busy. I'm going to Kent.

I'm going, you know, all these places where you previously worked for some reason. I don't know. What is it all about? One has to bury bodies a little deeper these days. Is all I can say.

The trick is you bury them vertically. It's harder for the satellites to pick up the location that way. But you've got to dig deeper, though, haven't you? You do. But, you know, whenever I see those headlines about Uber CIO, or sorry, Uber CISO, I'm thinking of like this like massive, amazingly powerful, strong CISO, not the guy who works for Uber. I always get that confused. I always get that confused. Well, moving swiftly on, shall we see what we've got coming up for you today, dear listener?

This week in InfoSec takes us on a trip down InfoSec memory lane. Rant of the week is going to be a cryptographic surprise. Billy Big Balls is going down under. Industry news brings us the latest and greatest security news stories from around the world, and Tweet of the Week tells us a little bit more about what it's like to work in InfoSec. Well, let's move on to our favourite part of the show, the part of the show that we like to call... This Week in InfoSec. Yes, and This Week in InfoSec is content liberated from today's InfoSec Twitter account and further afield. So today's story takes us back to October

12th, 1988, a mere 34 years ago. And this is one of those, I think, true butterfly moments when you, if you map it out, if you change this day, you would have changed where we are today. But that was the day that Steve Jobs held the computer as five years ahead of its time as Next Inc introduces their next computer. Due to its cube-shaped case, the computer was often referred to as the cube or the next cube. And this came with other models being named as the Next Cube and what have you. And although this was not a commercial success and few people other than Tom actually had one, the technology developed for it was really instrumental. Tim Berners-Lee, good friend of the show,

developed the first World Wide Web server and web browser on a Next computer, crediting the Next development tools for allowing him to rapidly develop the new ubiquitous internet system. And then after Apple purchased Next in 1997, they used the operating system of Next computers to form the base of Mac OS X, eventually leading on to iOS, which was also based on Mac OS X, since everything goes back to Next. And also finally, the object-oriented development environment that Berners-Lee used to create the www, World Wide Web, is the forerunner of the development environment that today's programmers use

to develop iPhone and iPad apps. So if it wasn't for the next computer back in 1988, Tom would not be sitting here today on his MacBook Pro with his iPhone Pro Max 14, his Apple Watch and iPad. His life would be extremely different. I'd be a richer man. You would be an immensely richer man. But, you know, interface poor. Absolutely. Absolutely. I remember these next computers. I mean, this is back in a day when, you know,

computers weren't being refreshed every, you know, literally every sort of three or six months as well. You know, a computer would last for a good couple of years before you get any kind of significant upgrade to it. And so I remember being at work in my early days of work and using company, ILM, used the Next listeners, please keep me honest here. I believe the Pixar, which was the system that Industrial Light and Magic used for creating CGI, was originally run on a Next system. Don't correct us. Even if that's wrong, I like to believe that's true.

Yeah. Because the Pixar, which was the system they used, of course then they spun that off into a separate company and the Pixar system became known as Pixar as a company, which I love. I had no idea George Lucas was involved in Pixar. No idea at all. No, it's a very Hollywood and entertainment

very incestuous yes yes absolutely um insert very poor taste joke here

anyway excellent Jav thank you ah it's bringing back all sorts of memories that is

even Star Wars and stuff like that so uh thank you Jav for this week's this week's... This week in InfoSec. In 2021, you voted us the most entertaining cybersecurity content amongst our peers.

In 2022, you crowned us the best cybersecurity podcast in Europe. You are listening to the double award winning Host Unknown podcast. How do you like them apples? Yeah, but not this week in the Unsung Heroes Awards. I know. We got something last year there, didn't we?

Yeah, I think. Was it the year before? Was that the Blogger Awards? I get confused. I can't remember. All these awards blend into one, don't they, after a while? They do. They do.

We got one where we, didn't we beat the Metropolitan Police's InfoSec Awareness Programme for one of our videos? Oh, yes. That was at the Unsung Heroes. Yes, that was for Lost All The Money, I think. Yeah. In your face, Met Police. Oh, yeah. Everyone, really. face, Met Police. Oh, yeah.

Everyone, really. I think we beat... Yeah, yeah. Yeah, exactly. Right, let's move on, shall we? Let's get on to my favourite part of the show, the part that I have apopectic rage at. Listen up!

Rant of the week. It's time for Mother F***ing Rage. So this is a story and a rant about, for goodness sake, I mean that's the first thing you think of when you read these headlines and even delve a little bit deeper into the story. even delve a little bit deeper into the story. Clarity, a research company, security research company, found hard-coded cryptographic keys in Siemens PLCs using remote code execution. So that isn't just a bunch of made-up words. So this firm, Clarity, they revealed just recently, October 11th,

I mean, this is how up-to-date we are, that they've extracted heavily guarded, hard-coded, hard-coded cryptographic keys embedded within one of Siemens' hardware systems. I was trying to avoid to say the name of it, but I'm going to have to now. The SIMATIC S7-1200-1500, a range of Siemens programmable logic computers. That old chestnut, right? I always preferred the S6 range.

I think they went a bit, jumped the shock with the S7. They did. I think when they added the little Knight rider glowing red light on the front that was probably where yeah where they kind of you're right jump the shark i i preferred the battlestar galactica cylon glowing light that they had in the series 6 indeed indeed so these are... But these are serious things. These are like infrastructure controlling things. And you just said that they have hard-coded cryptographic keys. Okay.

Boom. Exactly. Exactly. This isn't just, you know, a little thing that might control, I don't know, something in your washing machine or something like that. These control... I'm making this stuff up, but, you know, just for the, you know, thing that might control something in your washing machine or something like that. These control, I'm making this stuff up, but, you know, just for the, you know, as in these control things like, you know, valves for coolant systems for nuclear reactors and da, da, da, da, da. And it's great

that they come with sort of security in mind in the sense that they have to have, that there's cryptographic control over the system because you don't want the wrong people switching things on and off or moving pipes around or whatever. But to have hard-coded keys embedded into these things does not seem to be the right thing to do. We talk about this all the time as CISOs and about dumb programmers typing in credentials into their applications because they can't be bothered to use APIs or whatever.

Because these security researchers, they were not only able to extract the internal heavily guarded private keys used across the Siemens product lines, but they were also able to extract the internal heavily guarded private keys used across the Siemens product lines, but they were also able to implement the full protocol stack, encrypt and decrypt protected communications and configurations. Basically, what Siemens did here was they put the skeleton key for all of their cryptographic systems onto all of their control systems and hard-coded it so that they can't change it. Or in order to change it, you have to probably physically remove and replace chips, etc., etc. And they put that such that if you crack one,

replace chips, et cetera, et cetera. And they put that such that if you crack one, you've basically cracked them all. So as they go on and say, an attacker can use these keys to perform multiple advanced attacks against Siemens' SIMATIC devices and their related portals while bypassing all four of its access level protections. They could also use this secret information to compromise the entire SIMATIC S7-1200-1500 product line in an irreparable way.

Now, Siemens are an old German company. Old German companies being known for quality manufacturing and quality production and all that sort of thing. They've completely screwed up on this. And I wouldn't be surprised if this is a story that does not go away easily for Siemens, because the more you dig, they're probably going to find more and more practices like this across their systems and i i believe wasn't it semen systems were in use in the um uh in the iranian um uh nuclear production facilities the the uh spinny things what are they possibly yeah the centrifuge centrifuges thank you The spinny things.

What are they called? Possibly, yeah. The centrifuge. Centrifuges. Thank you. Actually, I think I use spinny things. It's nicer. But I'm pretty sure it was semen systems that were used in there.

You know, so these are pretty significant. This is a very, very significant failure on semen's part. It is. It is. And, you know, it it's scary i'm agreeing with you that this is i was just going to say you're trying not to agree with me but i know it's but you know you know you always think that i'm deliberately disagreeing with you i'm just trying to get to the truth at all times so i'm just asking the questions here this is so bad honestly but just so uh so traditionally a lot of these types of systems they weren't connected to the internet so i think to your point these practices have been going on

for such a long time because well no one actually ever had the opportunity to get past their heavily guarded. I love how they, in the story they use, these were heavily guarded as if like it pictures like these little silicon chip bouncers, like trying to like stop you from getting in, but you get to the hard coded key anyway. But your name's not on the list, but you're coming in anyway. Yeah. Yeah, exactly. So, so yeah, it's, it's something like your name's not on the list but you're coming in anyway yeah yeah exactly so um so yeah it's uh it's something like you say i agree it's the more people are going to

start digging into these systems the more horrendous practices are going to be uncovered and i just want to cover my eyes and not look yeah and which means we're going to put just blindly korea into the end of this this week's rant of the week rant of the week you're listening to the double award winning host unknown podcast

I think we might be feeling a little bit sensitive recently we're playing a lot of these award winningwinning jingles at the moment, aren't we? Hint, hint. Nudge, nudge. Hint, hint. Exactly. Although I think what I'm also scared of is accidentally playing the Queen one as well. So maybe that's part of it. Oh, yeah, yeah. Oh, did you see that latest clip?

It's been going around on social media a lot where Liz Truss goes to see the king and he goes, oh, you're back again. I haven't seen that. Was that one of those lip reader things? No, no, it's actually Prince Charles. No, as in, was he off mic, but someone zoomed in on his lips? No, you picked up his audio. It was in the palace.

Oh, my God. He should take tips from you. He's brilliant. I think just with that one move, he's endeared himself to a lot of the sensible public. Absolutely. Absolutely, he has. Right.

Talking about the sensible. This is why you need to get on TikTok, Tom. That's where all the latest breaking news is. The latest jiggling breaking news is always on TikTok. Okay, cool. Over to you. Billy Big Balls of the Week. so this week's billy big balls is uh from the land down under and you might remember a week or so ago a couple of weeks ago uh optus was uh breached and uh you know, about 10,000 records were leaked by the hackers to show that they mean business.

And, you know, what happens when stuff gets leaked? Well, you know, you think hard and criminals, they're like, oh, this is good stuff. Let's put this into our database or what have you. stuff let's put this this into our database or what have you but there was an enterprising teen uh who downloaded all the records and then i i'm laughing because this is just brilliant and it's it's sort of like dumb youth at work but also i think well it's quite enterprise enterprising. So this 19-year-old in Sydney downloaded the 10,200 records and started sending text messages to the victims saying that, pay me 2,000 Aussie dollars within two days, or I'm going to sell your data to other hackers. within two days or I'm going to sell your data to other hackers.

No word on whether he actually used his own pay-as-you-go SIM that his parents pay for or whether he said pay it into this bank account and he gave his real bank account. I don't know. Those details aren't there, but it would be funny. those details aren't there but it would be funny um but having said that either way he he got fingered quite quickly and police picked him up what after he got fingered yes anyway the suspect now faces charges for using a telecoms network with intent to commit a criminal offence, blackmail, contrary to section so-and-so of the criminal punishment, up to 10 years of imprisonment. Punishable by up to 10 years of imprisonment. Dealing with stolen information, up to a maximum of seven years in prison.

So he's looking at... I think the other thing that needs to go on his charge sheet is being a bit of a knob. Yes, yes. So quite a bit of a... Well, you know, a bit of a knob, a bit of a Billy Big Balls. So 17 years potentially, although I reckon six months probation,

get him a job in a consultancy. What, a consultancy that sends SMS messages? Yeah, maybe marketing. He could work in marketing, yes. Yeah, telemarketing. Buy my product or I'll leak your data. Yeah. I know, I know. yes buy my product or i'll leak your data yeah i know i know it's uh but i think this is just the norm now isn't it it's become so easy so accessible and he could he might have just been

bored he might have thought it's a prank bro or whatever not that i'm making too many i shouldn't make too many excuses for him because he's 19. 19 is a grown-ass adult. Technically, I suppose. Not when you're our age, Tom, and you look back at someone at 19 and say, yeah, just a snotty-nosed kid. Yeah, absolutely. Get off my lawn.

I think a lot of these things happen. People make mistakes. And then it's like, are they going to want to make an example out of him or are they going to give him the benefit of the doubt you know this is where where it all all balances uh in the scales of justice but uh i do i do think we probably need to move away from the celebration of criminals in their criminal enterprises in the Billy Big Ball section though.

Is that what I do? Is that a trend? I don't even realise. Is that what I end up doing? Celebrating criminals? Here's somebody who did something really illegal and big and is male. Therefore,

we should put them into a Billy Big Balls. We want to find somebody who's doing a Billy Big Balls move for the greater good. Well, there isn't anyone, is there? And therein is the problem, I think. Actually, you're right.

First, you call me a right-wing Fox News-style presenter. I did not. I was just asking the questions. Then you say that I celebrate criminals. What next? What next? You're going to ask me to take down my poster off the Ayatollah of Iran or something. I mean, where does it send?

No, no, I think it's the climate change denying part that really riles me. It's not... I don't deny climate change. Whoa, it was just a joke, bro. I just deny the shape of the earth okay oh man let's end this now before someone gets hurt billy big balls of the week the week attention this is a message for all other infosec podcasts busted we caught you listening again this is the host unknown podcast indeed indeed so jav Jav, you're playing the role of Andy this week pretty much,

aren't you, at the moment? Well, yeah. I mean, I've got a bag of half-eaten Haribo's on my desk and I'm holding my teeth saying, oh, my root canal needs doing. So, yes, I am. And telling somebody to fix that font in their PowerPoint presentation. Exactly, exactly.

I mean, that's literally all you can do. So, listeners, Andy is one of the people you never want to work for unless you have extreme OCD when it comes to formatting your slides. Let's just leave it at that. Yeah, you will never have less time on your hands when producing a PowerPoint presentation than you will when working for Andy. And talking of time, see what I did there?

What have we got coming up now, Jav? Well, it's that time of the show where we head over to our news sources over at the InfoSec PA Newswire, who have been very busy bringing us the latest and greatest security news from around the globe. Industry News. Lloyds of London cuts off network after dodgy activity detected.

Industry news. Malicious WhatsApp mods spotted infecting Android devices. Industry news. Chinese APT WIP19 targets IT services providers and telcos. Industry news. Budworm espionage group returns targets the US state legislature. Industry news. IP cameras, VoIP and video conferencing revealed as riskiest IoT devices. Industry news. UK government urges action to enhance supply chain security.

Industry News Singtel's Australian IT firm Dialog suffers data breach. Industry News Hashtag DTX 2022. Cyber needs to redress the defensive-offensive balance following Russia-Ukraine. Industry News. Lloyds of London says no evidence found of data compromise from attack. Industry News. And that was this week's...

Industry News. Huge, if true. Huge, huge. Especially these Lloyd stories. There's two of them. What do you think about that? I will not be answering questions. That was a bit abrupt.

No, but Lloyd's Atlanta cuts off network after dodgy activity detected. Yeah. What about those Chinese, eh chinese eh apt whip 19 what have you Lloyd okay so so this story and you don't have to say anything but Lloyd's of London said the UK government urging action to enhance supply chain security Lloyd's of London says no evidence found of data compromise from cyber attack which as TinkerSec on Twitter said this is like a burglar came in and stole everything but the

place had no security cameras so an article is written that says no security tapes were discovered showing any evidence of a burglary which i think is just so so good it's so such a good analogy to use for i wonder what a budworm espionage group is do you think lloyds where they've returned insurance to to cover their and ip camerasIP, video... Who would have guessed? Yeah. And if it was a nation-state attacker, then would lawyers have cancelled their own coverage saying it's state-sponsored? DTX 2022. Who would have thought from such a lacklustre event,

according to people who attended, that there'd actually be a news story in there? But, you know, that's a good story. And, you know, you can take it to the bank, all your insurers. Yeah, I'm going to cut in here. Lloyds of London is not a bank. Yeah, I know. But, you know, the phrase is you can take it to the bank.

And that's why I added on all your insurer. Come on, Andy. Come on, Tom. Get with the program. No, you're Andy today, remember? Yes, yesurer. Come on, Andy. Come on, Tom, get with the program. No, you're Andy today, remember? Yes, yes, yes, yes, yes. So it's not a bank, it's an insurance company, yes? Yes. Well, not even a company. I mean, it's an insurance market. It's a marketplace. It's a marketplace. So were all the brokers that rely on Lloyd's guidance and systems, were they impacted when their network went offline?

And when they say dodgy activity detected, was that the fact that someone actually paid out a claim without making you jump through like 5 million hoops? That's probably true, that part. It's like in The Incredibles where Mr Incredible, he helps people make their claims so that it's successful. That's right, yeah. This is dodgy activity.

Let's cut him off the network. Someone's actually paying money out. That's not what we're in the business of. This Singtel story is the one that's that's uh that's singing to me at the moment i've run out of other stories to try and divert your attention no i really think this is the elephant in the room right here so um you know no no he anyway that was this week's industry news this is the host unknown podcast the couch potato of InfoSec Broadcasting.

All right, let's take this home, move swiftly on from some of those awkward silences and exchanges and take us into this week's... Tweet of the Week. And we always play that one twice. Tweet of the Week. Right, who's doing this one? Well, you said moving swiftly on, which is very apt, so I'll let you take that. Okay, okay. Actually, yes, it is, isn't it?

Because this week's tweet of the week is from our friend of the show, Swift on Security. And for once, I actually found a story that contributed to the show, and that's this tweet. And the tweet goes, I'm sorry to report that working in security is less bleeding-edge malware research and more project manager for people who don't report to you. Which is scarily true. Is that also like...

Yeah, you work in marketing rather than security, don't you? Can we extend that analogy to say it's also like instant response for organisations that you don't actually control? I... That was this week's... Tweet of the Week. troll? I now was this week's tweet of the week. Well, we're

barreling out of this one in record time, I would suggest. Jav, I think, do you reckon I got away with that? Oh, I think so. I don't think anyone's going to notice that you were avoiding any topics and therefore we had less to talk about. Yeah, and I don't think anyone's going to notice that you were avoiding any topics and therefore we had less to talk about. Yeah. And I don't think anybody from from my workplace is going to listen anyway.

So we'll be all right. Well, you'd hope so. But, you know, if this is played in your, you know, your your your tribunal at work, my HR meeting. Yeah, I can honestly say I said nothing up as a character witness i i'll be happy to show up oh christ no i want to stay working there not get fired right jav thank you very much as always for playing the uh the dual heavyweight roles of jav and andy this week. Very much appreciated. Well, you're welcome. Thank you.

And thank you for showing up half hour late or 15 minutes late and then not having the show notes ready, not having it. Whatever. I'm not one to hold a grudge. Show notes is not my job. Show notes is Andy's job. And since you're playing the role of Andy this week, it's your job. Such a see-saw. Such a see-saw, isn't it? It's just like, this isn't my job. This isn't my job. This is Andy's job. And since you're playing the role of Andy this week, it's your job. Such a CISO, such a CISO.

This isn't my job. This isn't my job. This is outside my scope. I accepted the risk. All right. Stay secure. You've been listening to the Host Unknown podcast. If you enjoyed what you heard, comment and subscribe.

If you hated it, please leave your best insults on our Reddit channel. I prefer doing podcasts with Andy. Why? You know, he's more fun. There's no topics that he doesn't talk about, including wrestling. He gets all the references. Big Daddy, Giant Haystacks, what more do you want?

Okay.