The Host Unknown Podcast - Episode 133 - The Last Show of the Year Show

Episode Date: December 16, 2022

This week in InfoSec (09:44)With content liberated from the “today in infosec” twitter account and further afield15th December 1995: AltaVista LaunchesDeveloped by researchers at Digital Equipment Research Laboratories, the AltaVista search engine is launched. It was the first world wide web search service to gain significant popularity. One of the most popular search engines in the early world wide web, Google didn’t overtake AltaVista until 2001. AltaVista was eventually purchased by Yahoo! in 2003.11th December 1989: Joseph Lewis Popp allegedly mailed floppy disks to the UK which were labelled "AIDS Information Introductory Diskette". Surprise! The AIDS trojan on the disks demanded $189 to "renew the licence" by sending payment to a post office box in Panama. Virus Bulletinhttps://twitter.com/todayininfosec/status/1469660348928167943 Rant of the Week (17:02)Internal Note: [You’ll need to read this story first for background if you’re not familiar - Rackspace confirms ransomware attack behind days-long email meltdown]On the 12th day of the Rackspace email disaster, it did not give to me …… a working Exchange inbox treeThere's no end – or restored data – in sight for some Rackspace customers now on day 12 of the company's ransomware-induced hosted Exchange email outage.In the service provider's most recent update, posted at 0844 Eastern Time on Wednesday, Rackspace said it had hired CrowdStrike to investigate the fiasco, and noted it continues "to make all of our internal and external resources available to provide support to the remaining Hosted Exchange customers."Rackspace did not, however, say if or when it expects to recover people's data that was lost or scrambled when ransomware hit its systems – an attack that took down some of Rackspace's hosted Microsoft Exchange services on December 2. Since then, affected customers have been unable to get at their data held in the hosted service."We understand how important data recovery is to our customers," Rackspace wrote. "In ransomware attacks, data recovery efforts do necessarily take significant time, both due to the nature of the attack and need to follow additional security protocols. We will continue to keep you updated on these efforts." Billy Big Balls of the Week (27:19)SEC charges crew of social media influencers with $100m fraudEight braggadocious social media influencers fond of posing next to sportscars are facing charges from the US Securities and Exchange Commission (SEC) and Department of Justice (DoJ), who claim they manipulated their 1.5 million followers in order to help themselves to $100 million in "fraudulent profits."The suspects, all men in their twenties and thirties, were charged with conspiracy to commit securities fraud in connection with a long-running, social media-based "pump and dump" scheme, a recently unsealed Texas federal grand jury indictment [PDF] and an SEC complaint [PDF] revealed.The SEC alleged the suspects used Twitter and Discord to manipulate exchange-traded stocks in a $100 million securities fraud scheme, detailing some pretty amusing excerpts from exchanges it claims took place between individuals in the group.We're robbing f*cking idiots of their money. . .The commission claimed the defendants sometimes discussed their scheme over Discord voice chats that they "believed were private, but which were in fact being recorded."ORHere's something communism is good at: Making smartphones less annoyingThis week the kings of the Middle Kingdom issued directives to address some of the biggest annoyances associated with smartphones applications: copycat apps and bloatware.On Monday the Cyberspace Administration of China (CAC) launched a campaign it said would "rectify chaos" in smartphone apps by cracking down on several behaviors such as publication of "copycat apps" that use logos, pictures or text similar to existing apps to deceive users and potentially collect personal data and app subscription fees.The CAC also also plans to rectify dodgy ranking practices, and apps that lure people in with sexually suggestive or vulgar home pages. Apps distributed by QR code, rather than through app stores, are also in trouble.But wait, there's more! CAC will prevent auto downloads or installations without user consent. Apps that misrepresent their function or content are in the firing line as well.As are apps that tempt users with promises of making money.Excessive pop-ups, functions that serve as an obstacle to removing apps or forced renewals, and fake free trials are all on their way out.In the usual style of the CAC, the regulator did not specify how it would accomplish its goals, instead using phrases like "severely punish," "strictly regulate," and "crack down."Given the Authoritarian nature of the regime, though, these terms should be taken pretty much at face value. Industry News (35:12)North Korean Hackers Impersonate Researchers to Steal IntelHSE Cyber-Attack Costs Ireland $83m So FarSecurity Overlooked in Rush to Hybrid WorkingExperts Warn ChatGPT Could Democratize CybercrimeUber Hit By New Data Breach After Attack on Third-Party VendorTwitter Addresses November Data Leak ClaimsSigned Microsoft Drivers Used in Attacks Against BusinessesLoan Scam Campaign 'MoneyMonger' Exploits Flutter to Hide MalwareSenate Approves Bill Banning TikTok From US Government Devices Tweet of the Week (44:05)https://twitter.com/davenewworld_2/status/1603107286960029696 Come on! Like and bloody well subscribe!

the line that guy says who do you think you are i am i didn't see that what video was that i just sent it on whatsapp to youtube like in the morning oh you sent it see i don't do tiktok in the mornings i can't do that that's uh oh how very restrained of you and yeah no tiktok doesn't open before uh do you stop at fight is it it between 5.30am and 9pm? It's like Babestation, 9pm till 5am are the working hours. That's where censorship doesn't count. So I can allow myself to relax between 9pm and 5am, but I won't open TikTok out of hours. You're listening to the Host Unknown Podcast Hello, hello, hello, good morning, good afternoon, good evening From wherever you are, join us and welcome to episode 133 of the Host Unknown Podcast

137 of the Host Unknown Podcast Exactly, exactly Well, how are we, gents? Three seven of the Host Unknown podcast. Exactly, exactly. Well, how are we, gents? How's, well, how are you still working? Are we on holiday yet? What's going on? Sadly not, no.

I mean, some of us actually have work, you know, all the way through. It's not. Really? Security doesn't stop for Christmas, Mr. Langford. Bloody does mr c so this is a problem this is that knowledge that c so's have they recognize that security is purely a 9 to 5 30 gig yeah not it doesn't occur on weekends and you get holiday respects all public holidays it does it. But that's what one has staff for. What has staff for? Okay, Charles.

Yeah. Go and give them that motivational speech. That's right. I read it in a leadership book. Yeah. To the sock. Now, guys, I know you're working 24-7 throughout the holiday period, but, you know, that's what you signed up for.

Yeah, just to let you know know I'm just about to go on my two week holiday don't call me that's pure leadership so you literally are working through to the new year Andy I'm actually yeah I'm working all the way through I'm not taking any time off.

Well, I do hope you're taking Christmas Day off. Yes, I shall take a pause for lunch, obviously. Yeah, I mean, you do know that security doesn't stop for lunch. No, I've got a colleague covering for me. We alternate our sort of, you know know eating your courses yeah right i've just finished with starter you go oh dear i just updated my robots.txt file with like please do not pack between nine to outside of nine to five Monday to Friday. Respect my holidays. And then on the internal network, I left a file, which has my Bitcoin wallet address and password on it.

There's a note there that says that if you made it this far, you can clearly deploy ransomware. Let's save each other the hassle. Just take the money and don't deploy it. And so far, that's fine. And it's connected to your Amex card, which automatically links to your expenses. Yes. And, more importantly,

it gives me Avios for my British Airways. Oh, brilliant. What about you, Joe? Are you taking time off? Yeah, I've got a week and a half off from next week. So, yeah, just going to be, I think, hunkering in, trying to save on gas and electricity. So I'm trying to work out,

is it cheaper to get a travel lodge for the family and just stick them in there and say, turn the heating on all you want. I think it'd be cheaper than keeping the house warm. Well, do you know what? It's getting so cold, I'm being forced to close the doors on my advent calendar to keep the heating. Oh, my God.

I saw that one the other day. I thought it was quite funny. Where is it? Granddad jokes or something. It's like... Took all the steam out of our conversation. Oh, please. Please.

Like you expected anything less. How was your week, Tom? Very good. Very busy in the last... My last week before the Christmas break. But I'm off as of now. All I have to do is to submit a couple of time cards and I'm done.

Submit a couple of expenses. That actually made me laugh. Yeah, we saw each other at B-Sides, obviously, at the weekend. Yes. You're like, right, guys, what do you want to drink? I'll get these. And then we go and sit down with our drinks

and you're sitting there taking photos of your receipt uploading it to the expenses portal straight away yeah damn straight hey you know just just because your employers aren't generous if my employer is listening i didn't do any of that this is this is a pre-arranged skit see this is this is what's so amazing like i'm stuck in the middle here on one hand i'm seeing like tom who's like 87 pence i've got to claim that on the other hand i've got my man andy two and a half grand trip to puerto rico or something for work three years later ah i still haven't submitted expense have i ah screw it i'll leave it i know i don't know how you can do how you can afford to pay your employer for your employment

i don't know it's not i just weigh out whether it's worth my time working on that expensive system that is the it's the biggest demotivator what two and a half grand you you think that like 20 minutes is not worth two and a half grand of your time? You really are overconfident. If only it was 20 minutes. Jesus God, if only it was 20 minutes. You've got to know the system. You've got to know the system.

Yeah. I'm going to get my admin to do it. Don't have admins anymore to do this. So I believe this is the last show of the year. And you will be on. Yes, absolutely. I will be on. Well, that's very true as well, I have to say.

No question about that. I shall be here next Friday. Don't worry, dear listeners. Really? Next week will be a will you really of course i told you i'm not going anywhere i'm not shutting down for christmas no but you've got a day job so how can you be here i guess you could be here you know six o'clock in the morning again like normal but nonetheless you you want to get up and do this by yourself well yeah actually you

probably do you do a lot of things by yourself don't you so god sure without baggage like you slowing me down next week's show is going to be flying well i do believe our our first show in the new year will be the 6th of january uh whether or not there's a show next week is entirely down to uh uh to to how much sleep andy got the night before indeed but uh i yes uh yeah but don't worry people i will tell you when the first show of new year is next week uh on next week's show so don't worry about that is it will you be telling them on the on the twitter feed uh i don't have the password for that Twitter account. No, it's funny, isn't it? It's funny, yeah. Can't think why. That was, yeah, no. Had I, I guess back when I used to drink a lot,

you guys didn't trust me with those passwords. Or what about the account that we used to publish the podcast with? Yeah, I've got that. Oh, have you? Yeah. How do you think the podcast gets published when you're not here? Do you think Jav does it? Yeah. I've got that. Oh, have you? Yeah. How do you think the podcast gets published when you're not here? Do you think Jav does it? Yeah.

I do, actually, because the account is in his name. Yeah, exactly. You know what he does? WhatsApp, here's the username and password. Isn't that against the host's unknown policies? Okay, Mr. CISO. We got a risk exception. exception yeah we accepted the risk oh dear should we see what we've got coming up for you today let's get this show started oh my god yeah let's get this show finished uh this week in infosec reminds us of Yahoo's history of backing the underdog.

Or Ant of the Week talks about the latest goings-on at Hackspace. Billy Big Balls makes the case for communism. Industry News brings the latest and greatest security news stories from around the world. And Tweet of the Week is interestingly labelled as TBC. Oh yeah, I guess I never went back to that part. Hey, you know, if anybody ever had a question about this being live, this is proof of it. In fact, I was chatting to a friend of the show,

Eleanor Dalloway, yesterday. Hello, Eleanor. And I was telling her that we do very little editing on this and she said uh oh you just put the sounds in and stuff like that said nope do that live as well do all that live you know we haven't got time for anything else oh dear so shall we move on to our favorite part of the show the part of the show that we like to call This Week in InfoSec. It is that part of the show where we take a stroll down InfoSec memory lane

with content liberated from the Today in InfoSec Twitter account and further afield and today our first story takes us back a mere 27 years when AltaVista launched so developed by researchers at digital equipment research laboratories the AltaVista search engine was launched and it was the first worldwide web search service to gain significant popularity and this was you know back in the day this was the default search engine you know like how today people say oh just google it back then it was you know you didn't say just

AltaVista but you went to AltaVista to look for things. So Google didn't actually overtake AltaVista until 2001. So there was a solid sort of six years where AltaVista was like the place you went if you wanted to search for anything. And obviously it was eventually purchased by Yahoo in 2003 to go along with Yahoo's, you know, classic, you know, strength in acquisitions of popular sites such as like GeoCities and Tumblr and things like that, you know. So Yahoo, I think, you know, we'll have to do another skit on whether they're actually just laundering money or actually trying to invest in companies to make it big.

But, yeah, so one of the big – and the reason this – I quite like the story of altavista is that back then like you saw it come out and it was wow it's like a game changer right yeah google sort of came into it and it didn't i don't think it had like google obviously very popular it clearly you know dominant to altavista but i don't remember that sort of buzz about wow google's this much better um it's reminding me of go on i was gonna say you say i remember my my the coo of the company i was at the time calling me in and saying have you checked out this site you know you can put type something

in and then they've even got a i'm feeling lucky button right yeah yeah so yeah so i mean google's biggest thing was they simplified everything right right? It was just one bar. I think that was the biggest thing, wasn't it? Yeah. Yeah, but I'm thinking, you know, this chat GPT app at the moment, the AI, open AI thing, and the buzz around that at the moment, this is like something, this is the start of something huge, right? This is the new, you know, whether you know whether you think to be a new

search engine or the new wikipedia on steroids you know it's still to be determined right how much people modify it and get those results back to you know how much you can poison it um but to say it's like i remember that's what altavista was like at the time this was new the start of a new era um well it opened the door to everything that was on there independently because before that, the internet, you had to... I was a member of the MSN network, for instance, so you had AOL. You were going through someone else's front door, effectively,

and it was curated content almost by them. As opposed to this, you could type anything in and it would get you something back. Yeah. I didn't realize it was DEC though. That's quite interesting. Yeah. So the funny thing was, I mean, the people that actually originally wrote it was,

it was supposed to be to make their own public website easier to search. So the engineers that wrote it was uh uh you know they didn't actually envisage it would be something that became a search engine for the world that sounds like everything that deck did which is oh we'll just we'll just make this little thing and not market it and not do anything with it and then yeah something what why are you not selling this what deck deck sales executives will once explain to me as people who would sell sushi and call it cold dead fish

yeah that's pretty true yeah but yeah good times back then so alas our second story as I work out how long ago this was,

takes us back a mere 33 years to before I was born. On the 11th of December 1989, when Joseph Lewis Popp allegedly mailed floppy disks to the UK, which were labelled AIDS Information Introductory Disket. Yes. which were labeled aids information introductory disket yes surprise the aids trojan on the discs demanded 189 to renew the license by sending payment to a post office box in panama um so bear in mind this was 33 years ago back in 1989 there's lots of, I guess, old words in there, like disket, AIDS in big capital letters being sort of scary, Trojans. But he was a ransomware pioneer

decades before ransomware became a thing. But he was an academic as well. He wasn't like a script kiddie or anything like that. He was an academic, wasn't he? I'll be honest, i clicked on the link to look into the like the full history it's about 30 pages and i was like hell no i'm not reading that um this is a quick skit right we don't have time for that uh but he yeah i mean ransomware obviously when we think of it you know we talk about how it's been a popular thing in recent

years um so this guy actually died in 2006 uh Joseph Lewis Pott died in 2006, probably before ransomware became as big as it is today. Yet he started it. He also... Old school, but he started it. He also... He didn't get sent down for it, but he donated all of the money he received to AIDS charities.

Yeah. Okay. So, I mean, there is a link in there. It's on page two of the virus bulletin. Yeah. Okay. So, I mean, there is a link in there. It's on page two of the Virus Bulletin. Yeah. And like I say, there's lots and lots of words on that page to take you through. But you get the gist of it, right?

That's your journalistic interpretation of something. You're right, actually. He was a 1972 biology graduate from Ohio State University. And then he went on to receive a doctorate in anthropology from Harvard in 1979. Yeah. Jesus. And he'd worked with the World Health Organization in Nairobi. Yeah.

Cool. And that's all the words you're going to be reading. Indeed. I'm bored now. Cool. And that's all the words you're going to be reading. Indeed. I'm bored now. Excellent. Do you know what? I think a lot of our audience are thinking the same. Yeah. Actionable information. Yep. Fed up receiving well-researched, factual security content. Yes!

Ask your doctor if the Host Unknown podcast is right for you. Always read the label. Never double dose on episodes. Side effects may include nausea, eye-rolling, and involuntary swearing in anger. All right, let's move on to this week's... Listen up! Rant of the Week.

It's time for Motherf***ing Rage. Right, let's get cracking. Andy's got to start his day job, and, well, Jav doesn't start till midday anyway, so... It's Rant of the Week. So, you may have heard that Rackspace, that once... Wow. Rackspace, that once tier one service provider of cloud services and managed services, etc.,

was hacked not that long ago with ransomware and has led to many, many days of email meltdown. Their exchange servers were hit. This was a couple of weeks ago now, really. And lots and lots of noise from customers who can't get access to even historical data, et cetera, et cetera. Well, it's got even worse. As you can probably gather from the intro we did around Hackspace, it turns out that there is still no end or even restored data in sight for some of these Rackspace customers. On day 12 of the company's ransomware-induced hosted exchange email outage. So their last update, which was sent out two days ago,

almost exactly two days ago, Rackspace said it had finally hired CrowdStrike. Now, two days ago, that's 10 days after the hack, but to investigate the fiasco. And it continues to, inverted commas, make all of our internal external resources available to provide support to the remaining hosted exchange servers. But what it didn't say, however, was when it expects to recover people's data that was lost or scrambled when actually the original ransomware hit its system. It took down Microsoft Exchange servers. It's affected customers who've been unable to get data held

in its Exchange-hosted servers. Here's another mealy-mouthed quote. We understand how important data recovery is to our customers, Rackspace wrote. In ransomware attacks, data recovery efforts do necessarily take significant time, both due to the nature of the attack and need to follow additional security protocols. We'll keep you updated. So basically what Rackspace is saying is hurry up and wait. What Rackspace is saying is hurry up and wait.

We've completely screwed up our backup strategy because there are obviously no immutable copies of the backup in place anywhere. They're effectively just trying to delay as long as possible so they can try and restore a hint of credibility here with its customers because Rackspace is supposed to be, like I say, a tier one company. Now, this might sound like, well, like I'm speaking like Jav because Jav is, as we know, the victim blamer here out of this trio. And I'm trying not to do that, but after nearly two weeks of full outage

and very little information, it does seem to me that Rackspace have just really not got their game together. And then as we were discussing this morning, we came to the conclusion and we sort of nudged some of our collective memories here. And round about, was it 2000? I can't remember.

Was it 2005 or was it later than that? Maybe no more than 10 years ago. So maybe 2012 something. There was another sort of severe hack on Rackspace, which was not made public at the time. And so it does seem that although, you know, 10 years is possibly quite a long time in between. Should we be saying allegedly?

Oh, yeah, alleged. This is all allegedly, by the way. Definitely allegedly. Blimey, have you just put a shirt and a tie on Andy there and a jacket and made yourself into our lawyer here? I just looked at the host's unknown bank all. I'm really quite shocked by this it's also impacting so they obviously host for a lot of sort of small and medium-sized companies yeah and a few large ones as well and uh in the run-up to christmas as well i guess you'd get a lot of e-commerce sites if you know making orders and doing things like that

to really i mean there's never a good time right but particularly you know busy time uh for these people so yeah it's pretty shocking yeah and i you know we should we like i say one we shouldn't victim blame here you know they've probably they've obviously been targeted and they've obviously been completely uh blindsided by this but as you say, the small to medium companies, their recovery strategy or their redundancy strategy is to use a big player like Rackspace. Because you rely on the fact that they know how to do the job of security better than you do.

And if something goes wrong wrong they've got multiple redundant systems that will allow them to maintain your your environments and in very rare cases do you lose something and even then it's only for you know half a day you know to wit the uh aws outages for instance you know you might lose the eastern seaboard for six to 12 hours, but it's back up, you know, very, very shortly because they do have the systems in place. Doesn't seem to be the case here with Rackspace. And it's, you know, and like I say, they're mealy-mouthed responses are not great. You know, Tom, like every week, but this week more than others, you say a lot of words and not much substance comes out. And

very much like the cyber security version of Piers Morgan. It's very early in the morning. What can I say? You know how much I dislike early mornings. I do not want to victim blame, but they got hit by lots of wind. I don't want to victim blame, but

the mealy mouth response was inadequate. He's doing it, but he doesn't want to. I think this is victim blame. I don't want to victim blame, but the mealy mouth response was inadequate. He's doing it, but he doesn't want to. I think this is the problem. They've made him do this, Jav. Yeah, Rackspace, look what a position you've put me in, where once again, well, actually, for the first time in a long time, Jav actually disagrees with me. But, you know.

I don't know. No, I completely disagree. And I'd just like to go on the record that say that the views of Tom Langford do not represent those of Host Unknown. So if Rackspace wants to sue anyone, they would be suing Tom Langford himself. Or if they'd like to come on the show and sponsor us to give their version of events. So I've got to admit, Rackspace, obviously, they're very – that's the thing, they're not cheap either as a provider um they are up there in terms of like people providers

and i remember going there one time uh you know to get some quoting done and like they give you like um like swag bags or like rackspace um yeah sort of like your flask and it was so funny like the facility of the facility yeah exactly all of that and um you can actually look on youtube when new staff join uh because i think they call them rackers or something like that and there's like this big like is so over the top it's very american like you know where everyone sort of lines up and cheers and you run down and sort of high five everyone as you walk into this are you confusing that with the launch of the iphone 4 uh do you know what like it it's just very american but this is you know youtube this stuff it's now i think i'm actually glad they got

hacked like just uh yeah stop being uh so dramatic so So, Tom, in very short summary, what exactly is your rant here? My rant is that 12 days is far too long for a tier one organisation like Rackspace to recover. Must be day 13 today. Yeah. Wow. Wow. If that isn't victim blaming of the highest order Without actually knowing how this attack actually occurred

What if it was an insider? What if rats had chewed through their power cable? What if, you know, it's something so horrendous? If rats have chewed through their power cables Is that the best you can come up with? No, I'm just saying there could be a lot at play Also, your cable should be protected, Geoff Yeah Yeah, I'm just saying there could be a lot at play. Also, your cable should be protected, Geoff.

Yeah. Yeah, I mean, it should be. But we all know what should happen and what does happen, Mr Audit Box, are not always the same things. Oh, dear.

That's an excellent point to end on. And that was this week's Rant of the Week. If you work hard, research stories with diligence and deliver well-edited, award-winning, studio-quality content for high-paying sponsors, then you too can be usurped by three idiots

who know how to think on their feet. You're listening to the award-winning Host Unknown podcast. think on their feet you're listening to the award-winning host unknown podcast okay let's uh let's move swiftly on uh and listen to to jav and find out which criminals he's celebrating this week in this week's You know, it's funny how, like, you know, a victim blamer can stand on his pedestal and accuse me, accuse me of being a celebrator of criminals. J'accuse! Objection, hearsay but this week's story is about some social media influencers and um there's a whole bunch of these guys in their 20s and 30s who have uh well you know

influencers being influencers you know they are not I hate that everyone knows what an influencer is and that is actually a career path for many. It's like you ask kids, he says, what do you want to do when you grow up? And it's like, I want to be an influencer. What does that even mean? I don't know. I make YouTube videos all day and I beg people for money or I or I send emails to establishments saying, if you allow me into your five-star restaurant or hotel, I will do a good review for you. But then there's sort of like the slightly more senior people. And this was a Billy Big Balls move on behalf of these gents who used their fame and fortune, well, their fame, their fame and fortune well their fame to um where they coordinated acquiring shares then promoting the shares to their followers and as soon as that caused a little spike in their

shares they would dump them for substantial profits so um i don't see anything wrong with that i mean just because you're just because you're not a big company doing that, just because it's individuals, suddenly the SEC says that we don't like you doing that and all of your pictures of you posing next to sports cards. And so they're claiming the SEC and the DOJ claim they've manipulated their 1.5 million followers in order to help themselves do 100 million in fraudulent profits. So, yeah, it's it's a Billy Big Balls move. You know, what was really their undoing was move uh you know what was really their undoing was like most criminals who start making a bit of money they became a bit too confident in themselves and so they were having conversation on discord thinking that it was and twitter thinking that it was all private and secure

amateurs should have used whatsapp but um you know some extracts of their their conversations were like get caught we're robbing effing idiots off their money uh you know it's like and someone else saying i can see the timeline i can see it go up and higher and then i sell it and you know it's it's just so so um there's so much contempt towards their followers, as it should be. Stop being sheeple people. And I think it was a good Billy Big Ball's move on their part. And I hope they can defeat the SEC and the DOJ in their, you know, trumped up charges. charges i you couldn't make this up they commit securities fraud but that's okay what what what so so tell me this when the company goes public and they want to try and raise their their their their share price that's what everyone so what do they do they they'll come up with like here are our annual reports and you know look, look how much profit we've made. But then they'll also do things like we've hired this new,

you know, head of design. Johnny Ive is now going to be designing our new products or, you know, here's a new product line and this and the other. All of it is just smoke and mirrors to get people excited and get them to buy. So it boosts the share price up, correct? Do I look like a lawyer? I can't, you know.

Now, just because these eight people decided to do that without being backed by a company, all of a sudden it's illegal. So, you know, I don't see anything wrong with it. It's, you know, SEC fraud, actual profiteering, legitimate business, the line is very, very thin and you need big balls to see where that line is. Well, it's very, very thin and they obviously crossed it.

Allegedly, allegedly. Oh, dear. I mean, yeah, you're right. I do agree with you. It is allegedly, you know, especially when you read, we're robbing fucking idiots of their money. Well, so many business people have said that over the years. It's like, who was that, the gold person in the UK?

I can't remember his name. He had those chain-off shops and he goes... Oh, yeah, Ray of... I want to say Rackham, but no, that's a Tintin book. It's like we sell overpriced crap to the public or something like that. Well, yeah, yeah, he did say that. Yeah, so it's a common thing. I mean, do you not think Alan Sugar was sitting down in the 80s thinking,

people are buying these shitty Amstrad computers? You know, everyone does it. I don't think that's any grounds for SEC. SEC, why? I mean, look at Tom. He sits there laughing, like, look at me and my bonus this year and my two weeks annual leave. Oh, like, my two weeks annual leave. What am I, American?

I get more than that. Well, that I'm taking over there, it's two weeks over Christmas. Oh, OK. OK, yeah, look at me and my work-life balance and caring for my mental health. I like how you turned that around I'm not going to say anything else to that Well played

Billy Big Balls of the week Feeling overloaded. Shit. In 2021, you voted us the most entertaining cybersecurity content amongst our peers. In 2022, you crowned us the best cybersecurity podcast in Europe. You are listening to the double award winning Host Unknown podcast. How do you like them

apples? Do you know, next time I'm going to make sure that my stream deck here has definitely got all our latest jingles loaded up. I don't know what's happened. I think it's because it's on my other computer at the moment. Is this your new year resolution?

New year, new jbrans, new me. Something like that. New year, new decision to give a shit occasionally. Which is probably good. But given there's plenty of time between now and the new year, hopefully I'll

get it done before then. And speaking of time, Andy, what time is it? Andy. Andy's probably winding up his pocket watch to try and see what time it is. But I shall let you know, it is that time of the show where we head over to our news sources over at the InfoSec PA Newswire, who have been very busy bringing us the latest and greatest security news from around the globe. Industry news. North Korean hackers impersonate researchers

to steal Intel. Industry news. HSE cyber attack cost Ireland $83 million so far. Industry news. Security overlooked in rush to hybrid working. Industry news. Experts warn chat GPT could democratise cybercrime. Industry news. Uber hit by new data breach after attack on third-party vendor. Industry News. Twitter addresses November data leak claims. Industry News. Signed Microsoft drivers used in attacks against businesses. Industry News. Loan scam campaign moneymonger exploits Flutter to hide malware. Industry news. Senate approves bill banning TikTok from US government devices. Industry news.

And that was this week's... Industry news. Huge, if true. Huge. Huge. Especially the absence of Andy all of a sudden. Yeah, yeah. Huge, if true Huge, huge Especially the absence of Andy all of a sudden Yeah, yeah, I don't know where he's gone But, you know, mate, we'll carry on with that

And we don't care Yeah No one would even notice No, not at all, not at all It's just going to be some giggling and laughing That I'll just have to insert every now and then Yeah, exactly Or just say, I agree with you, Jav After every sentence I say giggling and laughing that I'll just have to insert every now and then. Yeah, exactly.

Or just say, I agree with you, Jav, after every sentence I say. Oh, dear. What have we got here? What looks interesting? I just love this title. Loan scam campaign. Moneymonger exploits Flutter to hide malware there are words that i see and understand i do not understand what the title actually means i can see the person's lips moving i can see i can

hear words coming out not a clue yeah it looks it looks like they're like nesting techniques and attacks and stuff who knows who knows something knows? Yeah, something like that. Send it to your sock. Yeah. Well, I would do. I'll get one of the staff to send it to them. Yeah. What is it?

Oh, Twitter addresses November data leak claims. Was this the... There was a name for it, wasn't it? Like the Twitter files or something. I don't know. But there's so much going on at Twitter at the moment. So apparently Musk has just permanently banned a whole bunch of legitimate journalists. He's stopped.

You can now no longer link to your Mastodon account in your Twitter bio. And what was the other thing he did? Oh, he's instigated a whole bunch of new rules, which he, within 12 hours, broke himself. You know, the rules are a work in progress the other stuff i think is all understandable it's like it's like complaining that oh uh you know uh my message isn't running on the android phone well no because it's an android why should it so why should he allow mastodon links to go from yeah but i i think though if if he actually came out and said look this is my playground my rules you get off and you know it, it's up to, you know,

if you don't want to play here, that's fine. But what he does is he comes in on a platform of free speech and then just starts chopping people out. You know, free asterisks next to it, terms and conditions apply. You know. Oh, dear. oh dear um security overlooked in rush to hybrid working from uh the bleeding obvious um part of uh part of our journalistic review here and we hear that the giggling idiot is back yeah uh yeah sorry when uh when you said what time is it i i actually it was time for

me to take a call um but you know unlike you tom where actually everyone stopped to service me i figured you guys were professional enough to keep going everyone stopped to service you yeah like when you get a knock on the door it's like okay hold on and then you disappear for five minutes while you uh answer the door and then come back and then uh it goes again and it's like oh okay obviously you edit that part out yeah yeah we're not editing this part out you want to edit it out you edit the show i mean what can i say oh dear so uh what else else Anything else highlight here What did you want to bring in Oh sorry go on

I was going to say did you even talk about Why communism is good for smartphones Under the Billy Big Balls No That's a shame We can talk about that now So this was a backup story For the Billy Big Balls.

And communism is good at making smartphones less annoying. This week's King of the Middle Kingdom issued directives to address some of the biggest annoyances associated with smartphone applications. Were you about to say fart phone, Nick? Copycat apps and bloatware. So on Monday, the Cyberspace administration of china or cac for sure launched a campaign it said would rectify chaos in smartphone apps by cracking down on

several behaviors such as publication of copycat apps that use logos pictures or text similar to existing apps to deceive and potentially collect personal data and app subscription fees. So it sounds an awful lot like now the Chinese are thinking, oh, maybe like this copyright infringement cuts both ways. It sounds more like a Jack and Ori show where Jav just reads directly off the show notes. Well, no, so they're doing a lot of things

not just uh you know to get rid of that sort of app subscription things like you know when you download something don't realize it's got all these in-app purchases that you have to pay for um they're getting rid of what they call dodgy ranking practices that use sort of sexually suggestive you know home pages um any apps distributed by qr codes rather than through app stores they're getting rid of um no auto downloads to installations without user consent you're not allowed to have pop-ups that sort of block the screen or you know they hide the the close button uh or any sort of apps that have to be forced or any sort of freight trials and um as with anything in china they didn't specify how they're going to do this,

but they did say they will severely punish anyone that violates these terms, which I think in China you have to accept as true to their word. And I actually think this is a good thing, to be honest. I know they're often perceived as a uh you know authoritarian authoritarian state um you know not just perceived they are um but it's not all bad and i think this

is one of the uh one of the good things that can come out of it can't feed your family oppressed by your government fear death if you speak out but don't worry your smartphone does exactly what it says it should according to the hey i'm just saying this is one of the good things that they are driving in fact take out the cherry picking what i'm saying i'm cherry picking yes yes in fact take out the comment about smartphone and everything applies equally to the last decade of Tory governments. Oh, now we're getting into it. Oh, OK. Oh, that's below the belt, man.

Now we're getting into it. Blimey. That is disgraceful. Holy crap, man. I mean, I don't disagree, in fairness, if I completely agree with you. All right. You know what? I think we're done with this news. I think we completely der with you. All right. You know what?

I think we're done with this news. I think we completely derailed it. But what the hell. That was this week's... Industry News. Merry Christmas to all our friends, family, listeners, and, yes, even one of the new ones. Hey.

There you go. Right. Let's move on to our last part of the show. It's time for... Tweet of the Week. We always play that one twice. Tweet of the Week. I shall take us home with a tweet from 50 Shades of Whey,

as in whey protein, W-H-E-Y. I love that name and also his handle is like Dave New World. Dave. I love the punny. Anyway, he says, instead of banning TikTok, why don't we just pass bills that protect our digital privacy on all platforms? It is classic corruption for politicians to take bribes from tech companies who stand to gain the most from a TikTok ban

and then coincidentally legislating in their favour. That's not funny. No, it's not funny. He actually hit exactly. It's true. Yeah, it is. It's depressingly true. Well, that's a great one to end our year of podcast.

We want something funny. To end your year, not... Yes, yes. Oh, yeah, Jav, because you're going to be on the show next week as well. Of course I am. Of course I am. Don't be a hater. You know Jav doesn't celebrate Christmas, right, Dom?

No, but he celebrates having a holiday. No, no. You know, holidays are for the weak. I'm not a pussy. Yeah. Monday, Tuesday, Wednesday, Thursday, Friday, the working week. Honestly, you're such a pussy, aren't you, Tom? Yep.

When it comes to my mental health, yes. Again, with the mental health card. Like, look at me. It's like my... You cannot kink-shape me now because I spoke the mental health card, like, look at me. It's like my, you cannot kink shake me now because I spoke about mental health. You are despicable. Hang on, I think you're mixing a few things up there,

but nonetheless, all valid. Well, a little bit of a mixed bag there this week. We may be here next week. I don't know. Well, I probably won't, in fairness. And if these two idiots manage to get a show together, it'll be late anyway. We'll see. We will

see. So you think we're going to record it on Thursday? Yeah. A year of little faith. Yeah, you think I'm going to change the passwords on these accounts. Okay, I'll just increment the number to a two then. No, a four. One, three, four next week.

God damn me. You're going to have to change it to 2023 at the end soon anyway. Yeah, exactly. Yeah, might as well. Do it a month early oh anyway uh jav thank you very much uh for today much obliged oh you're welcome i suppose this is painful and uh andy thank you stay, my friends. Stay secure. You've been listening to The Host Unknown Podcast. If you enjoyed what you heard, comment and subscribe.

If you hated it, please leave your best insults on our Reddit channel. The worst episode ever. R slash smashing security. Anyway, I can't come nextiday because i've got a spa day so if you want a um a funny tweet um i've got one from meg west it says working in cyber security means having 40 gigabytes of old messages on your phone going years back so when someone tries to gaslight you you can easily go back to your old messages screenshot them and prove your point are you sure that's not you andy well i relate to this i relate to meg on this one data retention is important folks you remember tom that time we were at b

sites london a few years back and we were like a couple of the people from Christmas out were there and I said something. I knew it was wrong but I knew it was... and Andy spent like an hour scrolling through his phone. We just had a really nice conversation. Scrolling, scrolling. He went quiet for like an hour, yeah. And then at the end I was

like, yeah, I think you might be right, Andy. Keep receipts, folks.